Function at 0x49dd30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa9c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa9c], ecx
cmp dword [ebp + 8], 0
je 0x49dd55
cmp dword [ebp + 0xc], 0
jne 0x49dd5a
jmp 0x49e049
cmp dword [ebp + 0xc], 0
jne 0x49dd67
mov dword [ebp + 0xc], 0x50e0b8
push 0x800
push 0
lea eax, [ebp - 0xa28]
push eax
call fcn.004ebd80
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x517b40
push 0x400
lea eax, [ebp - 0xa28]
push eax
call fcn.004ed64c
add esp, 0x14
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push 0x50d6bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x49ddeb
push str.MessageBoxTimeoutW
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x49de1d
push 0x7530
push 0
push 0x10
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xa28]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
jmp 0x49de3d
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xa28]
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
je 0x49de4b
jmp 0x49e049
xor eax, eax
mov word [ebp - 0x218], ax
push 0x208
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp - 0xa9c]
call fcn.0049e150
test eax, eax
je 0x49e032
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0xa9c]
call fcn.0049e300
test eax, eax
setne cl
mov byte [ebp - 0xa31], cl
push str.modules360Inst.exe
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ecx, ecx
mov word [ebp - 0xa30], cx
xor edx, edx
mov dword [ebp - 0xa2e], edx
mov word [ebp - 0xa2a], dx
lea eax, [ebp - 0xa2a]
push eax
lea ecx, [ebp - 0xa2c]
push ecx
lea edx, [ebp - 0xa2e]
push edx
lea eax, [ebp - 0xa30]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.00445130
add esp, 0x14
push 0x431
push 0
push 5
push 2
movzx edx, word [ebp - 0xa2a]
push edx
movzx eax, word [ebp - 0xa2c]
push eax
movzx ecx, word [ebp - 0xa2e]
push ecx
movzx edx, word [ebp - 0xa30]
push edx
call fcn.0043fa70
add esp, 0x20
test eax, eax
jl 0x49e032
mov dword [ebp - 0xa98], 0
push 0x40
push 0
lea eax, [ebp - 0xa94]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0xa48], 0
xor ecx, ecx
mov dword [ebp - 0xa44], ecx
mov dword [ebp - 0xa40], ecx
mov dword [ebp - 0xa3c], ecx
mov dword [ebp - 0xa98], 0x44
mov dword [ebp - 0xa6c], 1
mov edx, 5
mov word [ebp - 0xa68], dx
mov dword [ebp - 0xa38], str._FORCECOVER__URL:http:__pinst.360.cn_360safebeta_safebeta_home.cab
movzx eax, byte [ebp - 0xa31]
test eax, eax
je 0x49dfb7
mov dword [ebp - 0xa38], str._FORCECOVER__URL:http:__pinst.360.cn_360safebeta_safebeta_home_jisu.cab
mov ecx, dword [ebp - 0xa38]
push ecx
lea edx, [ebp - 0x218]
push edx
push str.__s___s
push 0x400
lea eax, [ebp - 0xa28]
push eax
call fcn.004ed64c
add esp, 0x14
lea ecx, [ebp - 0xa48]
push ecx
lea edx, [ebp - 0xa98]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xa28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0
je 0x49e032
mov ecx, dword [ebp - 0xa44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xa48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49e049
push 5
push 0
push 0
push str.http:__www.360.cn_weishi_index.html_sourcefileerr
push str.open
push 0
call fcn.00417910
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 8