Function at 0x42f8d0
Capabilities:
Delete registry key
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f0
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi + 4], eax
cmp byte [sym.360bdoctor.exe_get_addr], 0x21
jne 0x42f988
cmp byte [0x54e9e9], 0x40
jne 0x42f988
push edi
call fcn.004300c0
lea edi, [ebp - 0x440]
call fcn.0044b500
mov eax, edi
call fcn.0044b610
call fcn.0044baf0
mov eax, str.EndDate
call fcn.0040a3f0
test al, al
jne 0x42f93d
mov ecx, str.https:__dd.browser.360.cn_static_a_469.4848.gif
call fcn.0040a490
push str._b:3
call fcn.004517e0
add esp, 4
push 1
mov ecx, str.https:__dd.browser.360.cn_static_a_1070.3608.gif
call fcn.00409fe0
add esp, 4
push 0
mov ecx, str._typeex
call fcn.00430b10
lea eax, [ebp - 0x440]
call fcn.0044b5c0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str.asadformem
push eax
call ebx
test eax, eax
jne 0x42f9f0
mov dword [ebp - 0x8e4], eax
mov dword [ebp - 0x8e0], eax
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0x8d4], eax
mov dword [ebp - 0x8d0], eax
mov dword [ebp - method.CSE6ResVMem.virtual_0], vtable.CSE6ResVMem.0
call fcn.00467730
lea esi, [ebp - 0x8dc]
call fcn.0040bef0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 4]
push str.asADforPic
push eax
call ebx
test eax, eax
jne 0x42fa56
push eax
mov dword [ebp - 0x8e4], eax
mov dword [ebp - 0x8e0], eax
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0x8d4], eax
mov dword [ebp - 0x8d0], eax
mov dword [ebp - method.CPictureRepair.virtual_0], vtable.CPictureRepair.0
call fcn.00465750
lea esi, [ebp - 0x8dc]
call fcn.0040bef0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x212]
push edx
mov word [ebp - 0x214], cx
call fcn.004c5470
add esp, 0xc
lea esi, [ebp - 0x214]
mov edx, str.SE6_Isolation_FixItem
mov ecx, edi
call fcn.0042f7d0
test eax, eax
je 0x42fb70
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x41a]
push ecx
mov word [ebp - 0x41c], ax
call fcn.004c5470
add esp, 0xc
lea esi, [ebp - 0x41c]
mov edx, 0x5202ec
mov ecx, edi
call fcn.0042f7d0
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov esi, eax
call fcn.00425800
mov dword [eax + 0x24], esi
call fcn.00425800
add eax, 4
push eax
lea eax, [ebp - 0x8d8]
call fcn.0042ee70
mov edi, dword [ebp - 0x8d4]
mov ebx, dword [ebp - 0x8d8]
xor esi, esi
test edi, edi
jle 0x42fb1f
test esi, esi
jl 0x42fb5f
cmp esi, edi
jge 0x42fb5f
mov ecx, dword [ebx + esi*4]
mov edx, dword [ecx]
lea eax, [ebp - 0x214]
push eax
mov eax, dword [edx]
call eax
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x42fb41
inc esi
cmp esi, edi
jl 0x42faf7
test ebx, ebx
je 0x42fb2c
push ebx
call fcn.004c2160
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + esi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
test eax, eax
je 0x42fb57
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [edi + 4]
push str.win10delreg
push ecx
call ebx
test eax, eax
jne 0x42fbd5
mov dword [ebp - 0x8e4], eax
mov dword [ebp - 0x8e0], eax
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0x8d4], eax
mov dword [ebp - 0x8d0], eax
mov dword [ebp - method.C360ChromeDelReg.virtual_0], vtable.C360ChromeDelReg.0
call fcn.0042f680
lea esi, [ebp - 0x8dc]
call fcn.0040bef0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
lea esi, [ebp - 0x214]
mov edx, str.SE6_Frame
mov ecx, edi
call fcn.0042f7d0
test eax, eax
je 0x42fb2c
push str.Start
mov edx, esi
push edx
call ebx
test eax, eax
jne 0x42fe02
push str._b:2
call fcn.004517e0
add esp, 4
call fcn.00442430
mov eax, str.Software360360se6ChromeExtensions
lea ecx, [ebp - 0x438]
call fcn.00401520
lea eax, [ebp - 0x438]
push eax
mov edx, 0x5193a4
call fcn.0040aa90
lea ecx, [ebp - 0x438]
push ecx
mov edx, str.ncijhjkieekclbgagclmhceooncnadhp
call fcn.0040aa90
cmp dword [ebp - 0x420], 8
mov eax, dword [ebp - 0x434]
jae 0x42fc5a
lea eax, [ebp - 0x434]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 1
push 0x20
call fcn.00409c60
add esp, 8
call fcn.00411040
call fcn.0044b140
call fcn.00465d10
lea edi, [ebp - 0x574]
call fcn.00453900
call fcn.00453960
xor eax, eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], eax
mov dword [ebp - method.CSE6ResVMem.virtual_0], vtable.CSE6ResVMem.0
call fcn.00467720
lea edi, [ebp - 0x51c]
call fcn.00448560
mov ecx, edi
call fcn.00448620
lea edi, [ebp - 0x634]
call fcn.00468900
mov ebx, edi
call fcn.00468a70
call fcn.0046d710
lea edi, [ebp - 0x4c4]
call fcn.00444740
call fcn.00444810
cmp dword [ebp - 0x470], 0
je 0x42fd26
lea edi, [ebp - 0x69c]
call fcn.00444740
mov edx, dword [ebp - 0x46c]
mov ecx, edi
mov dword [ebp - 0x644], edx
call fcn.004447e0
call fcn.00450e90
call fcn.00452310
lea esi, [ebp - 0x8e4]
call fcn.00412240
call fcn.00432af0
mov ecx, esi
call fcn.004333f0
call fcn.00451360
call fcn.00451fa0
mov eax, str.StartDate
call fcn.0040a3f0
test al, al
jne 0x42fd69
mov ecx, str.https:__dd.browser.360.cn_static_a_469.4355.gif
call fcn.0040a490
push 1
mov ecx, str.https:__dd.browser.360.cn_static_a_1070.3608.gif
call fcn.00409fe0
add esp, 4
push 1
mov ecx, str._typest
call fcn.00430b10
lea edi, [ebp - 0x5d4]
call fcn.00437af0
mov eax, edi
call fcn.00437bb0
mov ecx, edi
call fcn.00437b80
lea esi, [ebp - 0x8e4]
call fcn.00432ae0
lea ecx, [ebp - 0x4c4]
call fcn.004447e0
lea ecx, [ebp - 0x634]
call fcn.00468a30
lea ecx, [ebp - 0x51c]
call fcn.004485f0
lea esi, [ebp - 0x450]
call fcn.0040bef0
lea eax, [ebp - 0x574]
call fcn.004689a0
lea esi, [ebp - 0x438]
call fcn.0040f420
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
push str.StatusBar_Click
lea eax, [ebp - 0x214]
push eax
call ebx
test eax, eax
jne 0x42fe20
push 0x1e
call fcn.00409e20
jmp 0x42fb29
push 0x5204fc
lea ecx, [ebp - 0x214]
push ecx
call ebx
test eax, eax
jne 0x42fe82
push 0x1f
call fcn.00409e20
add esp, 4
push str.disable_hotkey
push 0x51c3d4
push SysReAllocStringLen
lea ecx, [ebp - 0x8ec]
mov dword [ebp - 0x8ec], 0
call fcn.004086f0
xor eax, eax
add esp, 0xc
cmp dword [ebp - 0x8ec], 1
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
push str.StatusBar_RightClick
lea edx, [ebp - 0x214]
push edx
call ebx
test eax, eax
je 0x42f970
push str.Menu
lea eax, [ebp - 0x214]
push eax
call ebx
test eax, eax
jne 0x42feb5
mov dword [edi], 2
jmp 0x42fb2c
push str.UnInstall
lea ecx, [ebp - 0x214]
push ecx
call ebx
test eax, eax
jne 0x43008f
push 0x51c3d4
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Software360
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x42ff8e
push 0x228
lea edx, [ebp - 0x8c8]
push 0
push edx
call fcn.004c5470
add esp, 0xc
lea eax, [ebp - 0x8cc]
push eax
push esi
mov dword [ebp - 0x8cc], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42ff87
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x42ff40
push 0x52056c
lea ecx, [ebp - 0x8a8]
push ecx
call ebx
test eax, eax
jne 0x42ff76
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x8c4]
cmp ecx, eax
je 0x42ff76
push ecx
push 0
push 1
call edi
test eax, eax
je 0x42ff76
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edx, [ebp - 0x8cc]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ff40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x41a]
push ecx
mov word [ebp - 0x41c], ax
call fcn.004c5470
add esp, 0xc
push 0x104
lea edx, [ebp - 0x41c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.......360BDoctor
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x430019
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x45c]
call fcn.00401520
push 0
lea ecx, [ebp - 0x45c]
push ecx
mov edx, str.360se6360BDoctor
call fcn.0040aaf0
cmp eax, 0xffffffff
je 0x43000e
lea edx, [ebp - 0x41c]
push edx
call fcn.00407a60
add esp, 4
lea esi, [ebp - 0x45c]
call fcn.0040f420
mov eax, str.Software360360se6ChromeExtensions
lea ecx, [ebp - 0x438]
call fcn.00401520
lea eax, [ebp - 0x438]
push eax
mov edx, 0x5193a4
call fcn.0040aa90
lea ecx, [ebp - 0x438]
push ecx
mov edx, str.ncijhjkieekclbgagclmhceooncnadhp
call fcn.0040aa90
cmp dword [ebp - 0x420], 8
mov eax, dword [ebp - 0x434]
jae 0x430060
lea eax, [ebp - 0x434]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea esi, [ebp - 0x438]
call fcn.0040f420
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
push str.Install
lea edx, [ebp - 0x214]
push edx
call ebx
test eax, eax
jne 0x42fb2c
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4