Function at 0x4ab9d9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
mov dword [ebp - 0x324], ebx
call fcn.00402394
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x214]
push eax
lea esi, [ebp - 0x230]
call fcn.0040bead
mov eax, esi
push eax
lea eax, [ebp - 0x2f4]
call fcn.0040c8fa
push 1
xor edi, edi
call fcn.0040bab7
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2bc]
call fcn.004234a8
lea esi, [ebp - 0x31c]
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x318], ebx
call fcn.00410999
mov eax, esi
push eax
push 0x20019
push ebx
push str.Software360360se6UpdateClients02E720BD_2B50_4404_947C_65DBE64F6970
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
mov dword [ebp - 0x270], 7
mov dword [ebp - 0x274], ebx
mov word [ebp - 0x284], ax
cmp dword [ebp - 0x31c], ebx
je 0x4abb1a
lea eax, [ebp - 0x284]
push eax
mov eax, esi
push eax
mov ecx, 0x651e34
call fcn.004b2897
test eax, eax
jne 0x4abb1a
cmp dword [ebp - 0x274], ebx
je 0x4abb1a
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x284]
call fcn.0041072b
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.0042353e
push 1
lea esi, [ebp - 0x230]
call fcn.0040bab7
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x2bc]
call fcn.004acbe4
pop ecx
push str.___flag0
lea esi, [ebp - 0x2d8]
call fcn.0040bead
lea eax, [ebp - 0x2bc]
push eax
lea esi, [ebp - 0x268]
call fcn.0040c73c
push str.sesafe.dll
lea esi, [ebp - 0x230]
call fcn.0040bead
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x268]
push eax
mov ecx, esi
call fcn.0041072b
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.0042353e
push 1
xor edi, edi
lea esi, [ebp - 0x2a0]
call fcn.0040bab7
push 1
lea esi, [ebp - 0x230]
call fcn.0040bab7
cmp dword [ebp - 0x254], 8
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x320], ebx
jae 0x4abba5
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x320]
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x4abbc0
cmp dword [ebp - 0x320], ebx
jne 0x4abbc9
call fcn.00415740
test al, al
jne 0x4abbda
push str.___flag1
lea eax, [ebp - 0x2d8]
push eax
call fcn.0040bed1
mov eax, dword [ebp + 8]
and eax, 0x10
mov dword [ebp - 0x328], eax
je 0x4abbf5
call fcn.004ab927
mov dword [ebp - 0x314], eax
jmp 0x4abbfb
mov dword [ebp - 0x314], ebx
xor eax, eax
mov word [ebp - 0x24c], ax
mov eax, dword [ebp + 8]
and eax, 4
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x324], eax
je 0x4abcd6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x314]
lea eax, [ebp - 0x214]
push eax
push str.__ls____typeseupdate__360seautoupdate___v3Wnd_d___v3seProcId_d
lea esi, [ebp - 0x230]
call fcn.004b2fc8
add esp, 0x10
push eax
lea eax, [ebp - 0x24c]
call fcn.0040ba5b
push 1
xor edi, edi
call fcn.0040bab7
push 0x40
lea eax, [ebp - 0x398]
push ebx
push eax
mov dword [ebp - 0x39c], 0x44
call fcn.00402394
xor eax, eax
mov dword [ebp - 0x338], ebx
lea edi, [ebp - 0x334]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x2d8]
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x24c]
call fcn.0040d7a8
cmp dword [ebp - 0x238], 8
mov eax, dword [ebp - 0x24c]
jae 0x4abcb6
mov eax, esi
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x39c]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x328], ebx
je 0x4abdd7
xor eax, eax
push 0x3ea
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.004b4e9a
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
pop ecx
jae 0x4abd21
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x314]
lea eax, [ebp - 0x214]
push eax
push str.__ls____typeseupdate__360seautoupdate___v3Wnd_d___v3seProcId_d___v3manual___user_data__ls_
lea esi, [ebp - 0x2a0]
call fcn.004b2fc8
add esp, 0x14
push eax
lea eax, [ebp - 0x24c]
call fcn.0040ba5b
push 1
xor edi, edi
call fcn.0040bab7
push 0x40
lea eax, [ebp - 0x398]
push ebx
push eax
mov dword [ebp - 0x39c], 0x44
call fcn.00402394
xor eax, eax
mov dword [ebp - 0x338], ebx
lea edi, [ebp - 0x334]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp - 0x238], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x24c]
jae 0x4abda0
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x39c]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4abea4
push 1
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.0040bab7
test byte [ebp + 8], 1
jne 0x4abdf3
cmp dword [ebp - 0x324], ebx
je 0x4abe91
test byte [ebp + 8], 8
jne 0x4abe91
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x314]
lea eax, [ebp - 0x214]
push eax
push str.__ls____typeseupdate__360se_safe_browsing_autoupdate___v3Wnd_d___v3seProcId_d
lea esi, [ebp - 0x310]
call fcn.004b2fc8
add esp, 0x10
push eax
lea eax, [ebp - 0x24c]
call fcn.0040ba5b
push 1
xor edi, edi
call fcn.0040bab7
push 0x40
lea eax, [ebp - 0x3e0]
push ebx
push eax
mov dword [ebp - 0x3e4], 0x44
call fcn.00402394
xor eax, eax
mov dword [ebp - 0x294], ebx
lea edi, [ebp - 0x290]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp - 0x238], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x24c]
jae 0x4abe71
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x294]
push ecx
lea ecx, [ebp - 0x3e4]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x314], ebx
je 0x4abec3
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4abf49
push 0xffffffffffffffff
push dword [ebp - 0x338]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.0040bab7
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.0040bab7
push 1
lea esi, [ebp - 0x268]
call fcn.0040bab7
push 1
lea esi, [ebp - 0x2d8]
call fcn.0040bab7
push 1
lea esi, [ebp - 0x284]
call fcn.0040bab7
lea esi, [ebp - 0x31c]
call fcn.00410999
push 1
lea esi, [ebp - 0x2bc]
call fcn.0040bab7
push 1
lea esi, [ebp - 0x2f4]
call fcn.0040bab7
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push dword [ebp - 0x314]
lea eax, [ebp - 0x354]
push eax
call esi
test eax, eax
jne 0x4abf2f
jmp 0x4abec3