Function at 0x42a775
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x4a0
mov eax, dword [0x52efc0]
lea ecx, [esp + 0x7c]
xor eax, ebp
mov dword [esp + 0x498], eax
call fcn.0042cb10
lea edi, [esp + 0x290]
push 0x208
push 0
push edi
call fcn.004b81d0
add esp, 0xc
call fcn.0042ca80
mov ecx, eax
push str.chromeshell
call fcn.0042ce80
test al, al
je 0x42a835
push 0x4e6c22
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42ac0a
mov esi, eax
xor edi, edi
lea ebx, [esp + 0x88]
push 0x208
push edi
push ebx
call fcn.004b81d0
add esp, 0xc
push 0x103
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x7ffffff0
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
jae 0x42b0cc
mov ebx, eax
cmp eax, 5
jae 0x42a890
lea edi, [esp + 0x20]
test ebx, ebx
mov esi, edi
mov byte [edi + 0xb], bl
jne 0x42a8be
jmp 0x42a8d4
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [esp + 0x290], 0
je 0x42a860
xor eax, eax
cmp word [esp + eax*2 + 0x292], 0
lea eax, [eax + 1]
jne 0x42a850
jmp 0x42a862
xor eax, eax
lea esi, [esp + 0x88]
mov ecx, esi
push eax
push edi
call fcn.0042cb30
lea ecx, [esp + 0x7c]
push esi
call fcn.00431280
mov ecx, esi
call fcn.0042cba0
mov dword [esp + 8], 0
jmp 0x42aa74
lea edi, [ebx + 8]
and edi, 0xfffffff8
js 0x42b0d5
lea eax, [edi + edi]
push eax
call fcn.004aea96
add esp, 4
mov esi, eax
lea ecx, [esp + 0x20]
or edi, 0x80000000
mov dword [ecx], esi
mov dword [ecx + 8], edi
mov edi, ecx
mov dword [ecx + 4], ebx
mov eax, ebx
add eax, ebx
push eax
lea eax, [esp + 0x8c]
push eax
push esi
call fcn.004b76d0
add esp, 0xc
mov word [esi + ebx*2], 0
lea esi, [esp + 0x20]
mov ecx, esi
push 0xffffffffffffffff
push 0x5c
call fcn.00428fae
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x70]
push edx
push eax
push 0
push esi
call fcn.004282dc
cmp byte [edi + 0xb], 0
js 0x42a90e
mov word [esp + 0x20], 0
mov byte [edi + 0xb], 0
jmp 0x42a939
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [edi + 0xb], 0
jns 0x42a939
push dword [esp + 0x20]
call fcn.004aeac6
add esp, 4
mov dword [esp + 0x28], 0
lea ebx, [esp + 0x70]
mov ecx, esi
mov eax, dword [ebx + 8]
movsd xmm0, qword [ebx]
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm0
push 0xffffffffffffffff
push 0x5c
call fcn.00428fae
lea edx, [esp + 0x2c]
mov ecx, ebx
push edx
push eax
push 0
push esi
call fcn.004282dc
cmp byte [edi + 0xb], 0
js 0x42a97c
mov word [esp + 0x20], 0
mov byte [edi + 0xb], 0
jmp 0x42a9a7
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [edi + 0xb], 0
jns 0x42a9a7
push dword [esp + 0x20]
call fcn.004aeac6
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x78]
movsd xmm0, qword [esp + 0x70]
xor ebx, ebx
mov dword [esp + 8], edi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42a9dd
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x70]
mov ecx, edi
push eax
push esi
call fcn.0042cb30
lea esi, [esp + 0x64]
mov ecx, edi
push 0xd
push str.360secore.exe
push esi
call fcn.00431e80
push esi
call fcn.00432370
add esp, 4
mov edi, dword [esp + 8]
test al, al
lea ecx, [esp + 0x290]
je 0x42aa42
cmp byte [esp + 0x6f], 0
mov eax, esi
jns 0x42aa22
mov eax, dword [esp + 0x64]
push eax
push 0x4e35de
push 0x103
push ecx
call fcn.00429210
add esp, 0x10
lea ecx, [esp + 0x7c]
push esi
call fcn.00430e10
mov bl, 1
lea ecx, [esp + 0x64]
call fcn.0042cba0
lea ecx, [esp + 0x70]
call fcn.0042cba0
cmp byte [edi + 0xb], 0
jns 0x42aa66
push dword [esp + 0x20]
call fcn.004aeac6
add esp, 4
mov al, 1
test bl, bl
mov dword [esp + 8], eax
je 0x42ac0a
lea edi, [esp + 0x7c]
lea esi, [esp + 0x70]
mov ecx, edi
push esi
call fcn.00431a10
lea ebx, [esp + 0x64]
mov ecx, ebx
push 0x20019
push str.Software360360se6UpdateClients02E720BD_2B50_4404_947C_65DBE64F6970
push 0x80000001
call fcn.00456dc0
xor eax, eax
cmp dword [ebx], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], eax
je 0x42ab0e
lea ebx, [esp + 0x58]
lea ecx, [esp + 0x64]
push ebx
push 0x4e6f0a
call fcn.004572f0
test eax, eax
jne 0x42ab0e
movzx ecx, byte [esp + 0x63]
test cl, cl
mov eax, ecx
jns 0x42aad6
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x42ab0e
test cl, cl
jns 0x42aae2
mov ebx, dword [esp + 0x58]
lea edx, [esp + 0x88]
mov ecx, esi
push eax
push ebx
mov ebx, edx
push edx
call fcn.00431b50
mov ecx, esi
push ebx
call fcn.00431280
mov ecx, ebx
call fcn.0042cba0
push esi
push edi
call fcn.00460bf0
add esp, 8
lea ecx, [esp + 0x4c]
push 0x4e6f10
call fcn.00402d2c
lea edi, [esp + 0x40]
mov ecx, edi
push esi
call fcn.00430e00
mov ecx, edi
lea esi, [esp + 0x88]
push 0xa
push str.sesafe.dll
push esi
call fcn.00431b50
mov ecx, edi
push esi
call fcn.00431280
mov ecx, esi
call fcn.0042cba0
xor ecx, ecx
cmp byte [edi + 0xb], 0
mov dword [esp + 0x3c], ecx
jns 0x42ab5d
mov edi, dword [esp + 0x40]
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x42ab78
cmp dword [esp + 0x3c], 0
jne 0x42ab81
call fcn.0042b0da
test al, al
jne 0x42ab8f
lea ecx, [esp + 0x4c]
push str.___flag1
call fcn.00428a50
xor esi, esi
test bl, 0x10
mov eax, 0
lea edi, [esp + 0x290]
je 0x42aba7
call fcn.0042a6ee
test bl, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esi
je 0x42ad28
cmp byte [esp + 8], 0
mov eax, 0x4e2bbe
mov esi, str.__secore_update
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
push dword [esp + 0x14]
push edi
push str.__ls____typeseupdate__360seautoupdate___v3Wnd_d___v3seProcId_d__ls__prefetch:8
lea esi, [esp + 0x9c]
push esi
call fcn.00447630
add esp, 0x18
xor eax, eax
cmp byte [esp + 0x3b], al
js 0x42ac11
mov word [esp + 0x30], 0
mov byte [esp + 0x3b], 0
jmp 0x42ac3d
xor ebx, ebx
jmp 0x42b0ab
mov eax, dword [esp + 0x30]
mov word [eax], 0
mov dword [esp + 0x34], 0
cmp byte [esp + 0x3b], 0
jns 0x42ac3d
push dword [esp + 0x30]
call fcn.004aeac6
add esp, 4
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x90]
lea edi, [esp + 0x30]
movsd xmm0, qword [esp + 0x88]
lea ecx, [esp + 0x4c]
mov edx, ecx
mov ecx, edi
mov dword [edi + 8], eax
movzx eax, byte [esp + 0x57]
movsd qword [edi], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
test al, al
cmovs eax, dword [esp + 0x50]
cmovs edx, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0x88], 0x44
push eax
push edx
call fcn.00428714
cmp byte [edi + 0xb], bl
jns 0x42ad06
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x290]
test bl, 0x10
lea esi, [esp + 0x88]
je 0x42aed0
lea ebx, [esp + 0x14]
mov ecx, ebx
call fcn.0042cb10
push ebx
push 0x3ea
call fcn.0043fe00
add esp, 8
cmp byte [esp + 8], 0
mov eax, 0x4e2bbe
mov esi, str.__secore_update
cmove esi, eax
xor eax, eax
cmp byte [ebx + 0xb], al
jns 0x42ad6e
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push ebx
push eax
push dword [esp + 0x18]
push edi
push str.__ls____typeseupdate__360seautoupdate___v3Wnd_d___v3seProcId_d___v3manual___user_data__ls___ls__prefetch:8
lea esi, [esp + 0xa0]
push esi
call fcn.00447630
add esp, 0x1c
xor eax, eax
cmp byte [esp + 0x3b], al
js 0x42ada7
mov word [esp + 0x30], 0
mov byte [esp + 0x3b], 0
jmp 0x42add3
mov eax, dword [esp + 0x30]
mov word [eax], 0
mov dword [esp + 0x34], 0
cmp byte [esp + 0x3b], 0
jns 0x42add3
push dword [esp + 0x30]
call fcn.004aeac6
add esp, 4
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x90]
movsd xmm0, qword [esp + 0x88]
mov dword [esp + 0x38], eax
movsd qword [esp + 0x30], xmm0
cmp byte [esp + 0x3b], 0
jns 0x42adfa
mov eax, dword [esp + 0x30]
jmp 0x42adfe
lea eax, [esp + 0x30]
xor ebx, ebx
lea ecx, [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0x88], 0x44
movaps xmmword [ecx], xmm0
push ecx
push esi
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42aeb6
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
mov dword [esp + 0x10], 0
inc ebx
jmp 0x42aebc
mov al, 1
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x14]
call fcn.0042cba0
cmp byte [esp + 0x10], 0
je 0x42b057
mov ecx, dword [ebp + 8]
cmp byte [esp + 8], 0
mov edx, ecx
setne al
test dl, 1
sete cl
and edx, 0xc
cmp edx, 4
je 0x42aef3
or cl, al
jne 0x42b02f
cmp byte [esp + 8], 0
mov eax, str.__secore_update
mov esi, 0x4e2bbe
cmovne esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
lea esi, [esp + 0x8c]
push eax
push dword [esp + 0x14]
push edi
push str.__ls____typeseupdate__360se_safe_browsing_autoupdate___v3Wnd_d___v3seProcId_d__ls__prefetch:8
push esi
call fcn.00447630
add esp, 0x18
xor eax, eax
cmp byte [esp + 0x3b], al
js 0x42af3d
mov word [esp + 0x30], 0
mov byte [esp + 0x3b], 0
jmp 0x42af69
mov eax, dword [esp + 0x30]
mov word [eax], 0
mov dword [esp + 0x34], 0
cmp byte [esp + 0x3b], 0
jns 0x42af69
push dword [esp + 0x30]
call fcn.004aeac6
add esp, 4
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x90]
movsd xmm0, qword [esp + 0x88]
mov dword [esp + 0x38], eax
movsd qword [esp + 0x30], xmm0
cmp byte [esp + 0x3b], 0
jns 0x42af90
mov eax, dword [esp + 0x30]
jmp 0x42af94
lea eax, [esp + 0x30]
xor ecx, ecx
lea edx, [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x90], ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x98], ecx
mov dword [esp + 0x94], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0x88], 0x44
movaps xmmword [edx], xmm0
push edx
push esi
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x42b049
jmp 0x42b057
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x42b03b
cmp byte [esp + 0x3b], 0
jns 0x42b06a
push dword [esp + 0x30]
call fcn.004aeac6
add esp, 4
lea ecx, [esp + 0x40]
call fcn.0042cba0
cmp byte [esp + 0x57], 0
jns 0x42b086
push dword [esp + 0x4c]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x63], 0
jns 0x42b099
push dword [esp + 0x58]
call fcn.004aeac6
add esp, 4
lea ecx, [esp + 0x64]
call fcn.00456e80
lea ecx, [esp + 0x70]
call fcn.0042cba0
lea ecx, [esp + 0x7c]
call fcn.0042cba0
mov ecx, dword [esp + 0x498]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x20]
call fcn.0042752c
call fcn.004c8e4e