Function at 0x417ac6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x451220]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x444], ebx
call fcn.00429ac0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....deepscancloudsec3.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
call fcn.004114e9
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x424], eax
cmp eax, ebx
jne 0x417b6c
call fcn.00413ab4
mov dword [ebp - 0x41c], ebx
jmp 0x417f45
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsSupportFeature
push eax
call ebx
test eax, eax
jne 0x417b97
call fcn.00413ab4
and dword [ebp - 0x41c], 0
push dword [ebp - 0x424]
call esi
jmp 0x417f45
push str.xdquery2
call eax
test eax, eax
je 0x417b7e
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00429ac0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....utils360Safechecker.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
call fcn.004114e9
mov dword [ebp - 0x438], eax
test eax, eax
je 0x417b7e
push str.NotifyInvokeSuperKiller
push eax
mov dword [ebp - 0x444], eax
call ebx
xor ecx, ecx
test eax, eax
setne cl
push str.CreateNotifyDlg
push dword [ebp - 0x438]
mov dword [edi + 0x7c], eax
mov dword [edi + 0x8b4], ecx
call ebx
xor ecx, ecx
mov dword [edi + 0x74], eax
cmp eax, ecx
je 0x417b7e
lea edx, [ebp - 0x434]
push edx
push ecx
push ecx
push 2
mov dword [ebp - 0x434], ecx
call eax
add esp, 0x10
test eax, eax
jl 0x417b7e
xor eax, eax
inc eax
cmp dword [ebp - 0x434], eax
jne 0x417c5e
mov dword [edi + 0x8ac], eax
push str.CreateTrustZoneNotifyDlg
push dword [ebp - 0x438]
call ebx
mov dword [edi + 0x78], eax
test eax, eax
je 0x417c92
lea ecx, [ebp - 0x434]
push ecx
push 0
push 0
push 2
call eax
add esp, 0x10
test eax, eax
jl 0x417c92
mov dword [edi + 0x8dc], 1
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00429ac0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....deepscandeepscan.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
call fcn.004114e9
mov dword [ebp - 0x430], eax
test eax, eax
je 0x417b7e
push str.IsSupportFeature
push eax
call ebx
test eax, eax
jne 0x417d10
call fcn.00413ab4
push dword [ebp - 0x430]
and dword [ebp - 0x41c], 0
call esi
jmp 0x417b8a
push str.xdquery
call eax
test eax, eax
je 0x417cf7
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00429ac0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....deepscancloudcom2.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
call fcn.004114e9
mov dword [ebp - 0x428], eax
test eax, eax
je 0x417cfc
push str.XDOpen
push eax
mov dword [ebp - 0x44c], eax
call ebx
push str.XDClose
push dword [ebp - 0x428]
mov dword [edi + 0x5c], eax
call ebx
push str.XDDeleteRecords
push dword [ebp - 0x428]
mov dword [edi + 0x60], eax
call ebx
push str.XDGetCounts
push dword [ebp - 0x428]
mov dword [edi + 0x64], eax
call ebx
push str.XDGetFirst
push dword [ebp - 0x428]
mov dword [edi + 0x68], eax
call ebx
push str.XDGetNext
push dword [ebp - 0x428]
mov dword [edi + 0x6c], eax
call ebx
xor ebx, ebx
mov dword [edi + 0x70], eax
cmp dword [edi + 0x5c], ebx
je 0x417f15
cmp dword [edi + 0x60], ebx
je 0x417f15
cmp dword [edi + 0x64], ebx
je 0x417f15
cmp dword [edi + 0x68], ebx
je 0x417f15
cmp dword [edi + 0x6c], ebx
je 0x417f15
cmp eax, ebx
je 0x417f15
xor eax, eax
push 0x206
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.00429ac0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x418]
push eax
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....deepscan_speedmem2.hg
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x418]
push eax
push str.newspy_killer
push str.360safe
call dword [edi + 0x5c]
xor ecx, ecx
add esp, 0xc
cmp eax, ebx
setne cl
mov dword [edi + 0x58], eax
mov dword [ebp - 0x43c], ecx
cmp eax, ebx
je 0x417f15
lea eax, [edi + 0x80]
push eax
call fcn.0040e363
test eax, eax
je 0x417f15
mov eax, edi
call fcn.0041a16a
lea esi, [edi + 0x8c8]
call fcn.00417243
push dword [ebp - 0x430]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi + 0x8d8], eax
call esi
push dword [ebp - 0x424]
call esi
mov eax, dword [ebp - 0x428]
mov dword [edi + 0x50], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x444], ebx
mov dword [edi + 0x54], eax
cmp dword [ebp - 0x444], 0
je 0x417ef0
push dword [ebp - 0x444]
call esi
cmp dword [ebp - 0x44c], 0
je 0x417f01
push dword [ebp - 0x44c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
pop esi
xor ecx, ebp
pop ebx
call fcn.00427527
leave
ret
push dword [ebp - 0x430]
mov dword [ebp - 0x41c], ebx
call esi
push dword [ebp - 0x424]
call esi
cmp dword [ebp - 0x43c], ebx
je 0x417f45
mov ecx, dword [edi + 0x60]
test ecx, ecx
je 0x417f45
mov eax, dword [edi + 0x58]
test eax, eax
je 0x417f45
push eax
call ecx
pop ecx
mov eax, edi
call fcn.00417a61
jmp 0x417edf