Function at 0x4af769
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
mov dword [ebp - 0x324], ebx
call fcn.00402394
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x214]
push eax
lea esi, [ebp - 0x230]
call fcn.0040beca
mov eax, esi
push eax
lea eax, [ebp - 0x2f4]
call fcn.0040c917
push 1
xor edi, edi
call fcn.0040bad4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2bc]
call fcn.004226bf
lea esi, [ebp - 0x31c]
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x318], ebx
call fcn.004107f6
mov eax, esi
push eax
push 0x20019
push ebx
push str.Software360360se6UpdateClients02E720BD_2B50_4404_947C_65DBE64F6970
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
mov dword [ebp - 0x270], 7
mov dword [ebp - 0x274], ebx
mov word [ebp - 0x284], ax
cmp dword [ebp - 0x31c], ebx
je 0x4af8aa
lea eax, [ebp - 0x284]
push eax
mov eax, esi
push eax
mov ecx, 0x664b0c
call fcn.004b668a
test eax, eax
jne 0x4af8aa
cmp dword [ebp - 0x274], ebx
je 0x4af8aa
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x284]
call fcn.004108b7
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.00422755
push 1
lea esi, [ebp - 0x230]
call fcn.0040bad4
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x2bc]
call fcn.004b0931
pop ecx
push str.___flag0
lea esi, [ebp - 0x2d8]
call fcn.0040beca
lea eax, [ebp - 0x2bc]
push eax
lea esi, [ebp - 0x268]
call fcn.0040c759
push str.sesafe.dll
lea esi, [ebp - 0x230]
call fcn.0040beca
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x268]
push eax
mov ecx, esi
call fcn.004108b7
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00422755
push 1
xor edi, edi
lea esi, [ebp - 0x2a0]
call fcn.0040bad4
push 1
lea esi, [ebp - 0x230]
call fcn.0040bad4
cmp dword [ebp - 0x254], 8
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x320], ebx
jae 0x4af935
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x320]
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x4af950
cmp dword [ebp - 0x320], ebx
jne 0x4af959
call fcn.00414ae5
test al, al
jne 0x4af96a
push str.___flag1
lea eax, [ebp - 0x2d8]
push eax
call fcn.0040beee
mov eax, dword [ebp + 8]
and eax, 0x10
mov dword [ebp - 0x328], eax
je 0x4af985
call fcn.004af6b7
mov dword [ebp - 0x314], eax
jmp 0x4af98b
mov dword [ebp - 0x314], ebx
xor eax, eax
mov word [ebp - 0x24c], ax
mov eax, dword [ebp + 8]
and eax, 4
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x324], eax
je 0x4afa66
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x314]
lea eax, [ebp - 0x214]
push eax
push str.__ls____typeseupdate__360seautoupdate___v3Wnd_d___v3seProcId_d
lea esi, [ebp - 0x230]
call fcn.004b77c6
add esp, 0x10
push eax
lea eax, [ebp - 0x24c]
call fcn.0040ba78
push 1
xor edi, edi
call fcn.0040bad4
push 0x40
lea eax, [ebp - 0x398]
push ebx
push eax
mov dword [ebp - 0x39c], 0x44
call fcn.00402394
xor eax, eax
mov dword [ebp - 0x338], ebx
lea edi, [ebp - 0x334]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x2d8]
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x24c]
call fcn.0040d7c5
cmp dword [ebp - 0x238], 8
mov eax, dword [ebp - 0x24c]
jae 0x4afa46
mov eax, esi
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x39c]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x328], ebx
je 0x4afb67
xor eax, eax
push 0x3ea
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.004b869f
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
pop ecx
jae 0x4afab1
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x314]
lea eax, [ebp - 0x214]
push eax
push str.__ls____typeseupdate__360seautoupdate___v3Wnd_d___v3seProcId_d___v3manual___user_data__ls_
lea esi, [ebp - 0x2a0]
call fcn.004b77c6
add esp, 0x14
push eax
lea eax, [ebp - 0x24c]
call fcn.0040ba78
push 1
xor edi, edi
call fcn.0040bad4
push 0x40
lea eax, [ebp - 0x398]
push ebx
push eax
mov dword [ebp - 0x39c], 0x44
call fcn.00402394
xor eax, eax
mov dword [ebp - 0x338], ebx
lea edi, [ebp - 0x334]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp - 0x238], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x24c]
jae 0x4afb30
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x39c]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4afc34
push 1
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.0040bad4
test byte [ebp + 8], 1
jne 0x4afb83
cmp dword [ebp - 0x324], ebx
je 0x4afc21
test byte [ebp + 8], 8
jne 0x4afc21
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x314]
lea eax, [ebp - 0x214]
push eax
push str.__ls____typeseupdate__360se_safe_browsing_autoupdate___v3Wnd_d___v3seProcId_d
lea esi, [ebp - 0x310]
call fcn.004b77c6
add esp, 0x10
push eax
lea eax, [ebp - 0x24c]
call fcn.0040ba78
push 1
xor edi, edi
call fcn.0040bad4
push 0x40
lea eax, [ebp - 0x3e0]
push ebx
push eax
mov dword [ebp - 0x3e4], 0x44
call fcn.00402394
xor eax, eax
mov dword [ebp - 0x294], ebx
lea edi, [ebp - 0x290]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp - 0x238], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x24c]
jae 0x4afc01
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x294]
push ecx
lea ecx, [ebp - 0x3e4]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x314], ebx
je 0x4afc53
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4afcd9
push 0xffffffffffffffff
push dword [ebp - 0x338]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.0040bad4
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.0040bad4
push 1
lea esi, [ebp - 0x268]
call fcn.0040bad4
push 1
lea esi, [ebp - 0x2d8]
call fcn.0040bad4
push 1
lea esi, [ebp - 0x284]
call fcn.0040bad4
lea esi, [ebp - 0x31c]
call fcn.004107f6
push 1
lea esi, [ebp - 0x2bc]
call fcn.0040bad4
push 1
lea esi, [ebp - 0x2f4]
call fcn.0040bad4
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push dword [ebp - 0x314]
lea eax, [ebp - 0x354]
push eax
call esi
test eax, eax
jne 0x4afcbf
jmp 0x4afc53