Function at 0x415b6d
Capabilities:
Create process on windows
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423eb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x740
push edi
mov dword [ebp - 0x74c], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x744], 0
mov al, byte [0x439a60]
mov byte [ebp - 0x63c], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x63b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439a64]
mov byte [ebp - 0x534], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x533]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x439a68]
mov byte [ebp - 0x220], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x21f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x439a6c]
mov byte [ebp - 0x428], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x427]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439a70]
mov byte [ebp - 0x740], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x73f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x439a74]
mov byte [ebp - 0x114], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x439a78]
mov byte [ebp - 0x324], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x323]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x11c]
call fcn.0041d630
mov dword [ebp - 4], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x538], 0
push 0x104
lea ecx, [ebp - 0x63c]
push ecx
call fcn.0040ea68
add esp, 8
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415cd9
push 0
push str.UpdateService_GetCurAppPath___Fail
call fcn.00410257
add esp, 8
jmp 0x4161a1
push 0x104
push 0
lea edx, [ebp - 0x220]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x434a48
lea eax, [ebp - 0x63c]
push eax
push 0x434a54
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push str.KANUpdate2::UpdateService_service_update
call fcn.00410257
add esp, 8
mov ecx, dword [ebp - 0x74c]
call fcn.004164be
test eax, eax
je 0x415e0b
push str.KAVSVC
call fcn.004220c5
add esp, 4
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415d5d
push 0
push str.UpdateService_KMGDeleteServiceEx_KAN_OLD_SERVICE_SVC_NAME__Fail_
call fcn.00410257
add esp, 8
cmp dword [ebp - 0x42c], 0
jne 0x415dca
push 0x434ad4
call fcn.004220c5
add esp, 4
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415d91
push 0
push str.UpdateService_KMGDeleteServiceEx_KAN_OLD_SERVICE_NET_COMM_NAME_1ST__Fail_
call fcn.00410257
add esp, 8
cmp dword [ebp - 0x42c], 0
jne 0x415dca
push str.KANNetCommService
call fcn.004220c5
add esp, 4
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415dca
push 0
push str.UpdateService_KMGDeleteServiceEx_KAN_OLD_SERVICE_NET_COMM_NAME_2ND__Fail_
call fcn.00410257
add esp, 8
jmp 0x4161a1
lea edx, [ebp - 0x220]
push edx
push str.Kingsoft_Antivirus_Net_Communication
push str.KANetCommService
call fcn.00422298
add esp, 0xc
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415e06
push 0
push str.UpdateService_KMGCreateServiceEx_KAN_NEW_SERVICE_NAME__Fail_
call fcn.00410257
add esp, 8
jmp 0x4161a1
jmp 0x415ee4
push 0x434c10
push 0x80000002
lea ecx, [ebp - 0x11c]
call fcn.0041d66d
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415e43
push 0
push str.KANUpdate2::UpdateService_RegKey.Open_Error
call fcn.00410257
add esp, 8
jmp 0x4161a1
push 0x434c74
lea ecx, [ebp - 0x11c]
call fcn.0041d9b9
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415e71
push 0
push str.KANUpdate2::UpdateService_RegKey.DeleteValue_KAN_REGISTER_SERVICE_KEY_Error
call fcn.00410257
add esp, 8
push str.KAVSvc
lea ecx, [ebp - 0x11c]
call fcn.0041d9b9
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415e9f
push 0
push str.KANUpdate2::UpdateService_RegKey.DeleteValue_KAN_REGISTER_OLD_SERVICE_KEY_Error
call fcn.00410257
add esp, 8
lea eax, [ebp - 0x220]
push eax
push 0x434d20
lea ecx, [ebp - 0x11c]
call fcn.0041d752
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415ed9
push 0
push str.KANUpdate2::UpdateService_RegKey.Write_KAN_REGISTER_SERVICE_KEY_Error
call fcn.00410257
add esp, 8
jmp 0x4161a1
lea ecx, [ebp - 0x11c]
call fcn.0041d6c6
push 0
push str.KANUpdate2::UpdateService_start_key_update
call fcn.00410257
add esp, 8
push 0x434d9c
push 0x80000002
lea ecx, [ebp - 0x11c]
call fcn.0041d66d
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415f2b
push 0
push str.KANUpdate2::UpdateService_RegKey.Open_KAN_REGISTER_AUTORUN_PATH_fail
call fcn.00410257
add esp, 8
jmp 0x4161a1
push str.KANMain
lea ecx, [ebp - 0x11c]
call fcn.0041d9b9
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415f59
push 0
push str.KANUpdate2::UpdateService_RegKey.DeleteValue_KAN_REGISTER_AUTORUN_KANMAIN_KEY_fail
call fcn.00410257
add esp, 8
push str.KANSMain
lea ecx, [ebp - 0x11c]
call fcn.0041d9b9
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415f87
push 0
push str.KANUpdate2::UpdateService_RegKey.DeleteValue_KAN_REGISTER_AUTORUN_KANSMAIN_KEY_fail
call fcn.00410257
add esp, 8
push 0x434ed0
lea ecx, [ebp - 0x11c]
call fcn.0041d9b9
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415fb5
push 0
push str.KANUpdate2::UpdateService_RegKey.DeleteValue_KAN_REGISTER_AUTORUN_KANSA_KEY_fail
call fcn.00410257
add esp, 8
push str.KANScanLeak
lea ecx, [ebp - 0x11c]
call fcn.0041d9b9
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x415fe3
push 0
push str.KANUpdate2::UpdateService_RegKey.DeleteValue_KAN_REGISTER_AUTORUN_OLD_KANSA_KEY_fail
call fcn.00410257
add esp, 8
push 0x104
push 0
lea ecx, [ebp - 0x220]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x434f90
lea edx, [ebp - 0x63c]
push edx
push 0x434f9c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x220]
push ecx
push 0x434fa8
lea ecx, [ebp - 0x11c]
call fcn.0041d752
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x416054
push 0
push str.KANUpdate2::UpdateService_RegKey.Write_KAN_REGISTER_AUTORUN_KANGUI_KEY_fail
call fcn.00410257
add esp, 8
jmp 0x4161a1
lea ecx, [ebp - 0x11c]
call fcn.0041d6c6
push 0
push str.KANUpdate2::UpdateService_register_dll_File
call fcn.00410257
add esp, 8
push 0x104
push 0
lea edx, [ebp - 0x534]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x534]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x534]
push ecx
push str._s_regsvr32.exe
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [ebp - 0x538], 0
jmp 0x4160cd
mov eax, dword [ebp - 0x538]
add eax, 1
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0xe
jge 0x416197
push 0x104
push 0
lea ecx, [ebp - 0x220]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x538]
imul edx, edx, 0x104
add edx, str.CKSCEStream.DLL
push edx
lea eax, [ebp - 0x63c]
push eax
push 0x43503c
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x104
push 0
lea edx, [ebp - 0x740]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0x435044
lea ecx, [ebp - 0x740]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x220]
push edx
push str._s__s
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x324]
push ecx
lea edx, [ebp - 0x740]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x430], eax
jmp 0x4160be
mov dword [ebp - 0x744], 1
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x748], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.0041d651
mov eax, dword [ebp - 0x748]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret