Function at 0x484757
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x664]
sub esp, 0x6e4
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp + 0x660], eax
mov eax, dword [ebp + 0x674]
push ebx
push esi
push edi
push 0x4fc0d8
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x48], eax
call fcn.00418850
xor eax, eax
push 0x206
mov word [ebp + 0x458], ax
xor edi, edi
lea eax, [ebp + 0x45a]
push edi
push eax
call fcn.00497680
add esp, 0xc
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x458]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x4fa998
test eax, eax
je 0x484ce5
push edi
call fcn.00499395
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
mov edi, eax
mov dword [ebp - 0x28], edx
call ebx
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x30]
push edi
push 0x4cead8
push eax
call fcn.004048a0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x14
push dword [ebp - 0x30]
lea eax, [ebp + 0x458]
push eax
call edi
lea eax, [ebp + 0x458]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404670
lea eax, [ebp + 0x458]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.360base.dll
lea eax, [ebp + 0x458]
push eax
call edi
lea eax, [ebp + 0x458]
push eax
push 0x1f8
push str.FILE
call fcn.004858f1
add esp, 0xc
test al, al
jne 0x48494b
lea ecx, [ebp - 0x30]
call fcn.00404d50
push 0x208
lea eax, [ebp + 0x458]
push 0
push eax
call fcn.00497680
add esp, 0xc
push 1
push 0x23
lea eax, [ebp + 0x458]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4848b9
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00404d30
push 0x67
pop eax
mov ecx, dword [ebp + 0x660]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497941
add ebp, 0x664
leave
ret 0x10
push 0
call fcn.00499395
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
call ebx
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x30]
push dword [ebp - 0x2c]
push 0x4cead8
push eax
call fcn.004048a0
add esp, 0x14
push dword [ebp - 0x30]
lea eax, [ebp + 0x458]
push eax
call edi
lea eax, [ebp + 0x458]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404670
lea eax, [ebp + 0x458]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.360base.dll
lea eax, [ebp + 0x458]
push eax
call edi
lea eax, [ebp + 0x458]
push eax
push 0x1f8
push str.FILE
call fcn.004858f1
add esp, 0xc
test al, al
jne 0x484954
push 0x67
pop esi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00404d30
mov eax, esi
jmp 0x48489f
push dword [ebp - 0x30]
call fcn.00481cdb
pop ecx
lea eax, [ebp + 0x458]
push eax
call fcn.0046e32e
pop ecx
mov ecx, 0x4faa60
call fcn.004786e5
mov ecx, esi
call fcn.00483ef4
test al, al
jne 0x48497a
push 0x65
jmp 0x484938
call fcn.00481665
lea ecx, [ebp - 0x6c]
call fcn.004270e0
push 0x3a
push dword [ebp - 0x48]
lea ecx, [ebp - 0x6c]
call fcn.00482710
cmp al, 1
jne 0x484cd2
cmp dword [ebp - 0x50], 0
je 0x484cd2
mov edi, 0x4fc0d8
push edi
lea ecx, [ebp - 0x20]
call fcn.00418850
lea eax, [ebp - 0x20]
push eax
push 0x4cead4
lea ecx, [ebp - 0x6c]
call fcn.004815f6
mov ebx, dword [ebp - 0x20]
cmp al, 1
jne 0x484a79
mov byte [0x4faa31], al
cmp dword [ebx - 0xc], 0
je 0x484a79
cmp byte [0x4faa30], 0
jne 0x484a79
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push ebx
call edi
mov dword [ebp - 0x34], eax
mov eax, dword [ebx - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x20]
call fcn.00470e73
cmp ax, 0x5c
jne 0x484a22
mov eax, dword [ebx - 0xc]
push 1
dec eax
push eax
lea ecx, [ebp - 0x20]
call fcn.00418710
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x34], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Total_Security
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x484a5f
push str.Total
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x484a5f
push str.PSafeAV
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x484a5f
push 0x4cea78
lea ecx, [ebp - 0x20]
call fcn.00405c60
push 1
lea ecx, [ebp - 0x20]
call fcn.00404370
push eax
mov ecx, esi
call fcn.00480f70
mov ebx, dword [ebp - 0x20]
mov edi, 0x4fc0d8
push edi
lea ecx, [ebp - 0x20]
call fcn.00418850
lea eax, [ebp - 0x20]
push eax
push 0x4cea74
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484aab
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], 0
je 0x484aab
push eax
mov ecx, 0x4faa1c
call fcn.00404670
push edi
lea ecx, [ebp - 0x4c]
call fcn.00418850
lea eax, [ebp - 0x4c]
push eax
push 0x4cea6c
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484ad4
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.00480f8d
push edi
lea ecx, [ebp - 0x34]
call fcn.00418850
lea eax, [ebp - 0x34]
push eax
push str.pmode
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484b9d
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
je 0x484b9d
lea ecx, [ebp - 0x34]
call fcn.00404370
push eax
call fcn.004997dd
lea ecx, [ebp - 0x3c]
mov edi, eax
mov dword [esp], 0x4fc0d8
call fcn.00418850
cmp edi, 0xfe
jne 0x484b76
lea eax, [ebp - 0x3c]
push eax
push 0x4ce804
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484b86
mov edi, dword [ebp - 0x3c]
cmp dword [edi - 0xc], 0
je 0x484b86
push edi
push 0x1f7
push str.FILE
call fcn.00491a3c
add esp, 0xc
test al, al
je 0x484b86
push edi
mov ecx, 0x4faa28
call fcn.00404670
mov dword [0x4faa34], 0xfe
jmp 0x484b8d
lea eax, [edi - 1]
cmp eax, 1
ja 0x484b86
mov dword [0x4faa34], edi
jmp 0x484b8d
mov ecx, esi
call fcn.0047a5b1
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00404d30
mov edi, 0x4fc0d8
push edi
lea ecx, [ebp - 0x28]
call fcn.00418850
lea eax, [ebp - 0x28]
push eax
push str.show
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484bc0
mov byte [0x4faa32], al
push edi
lea ecx, [ebp - 0x44]
call fcn.00418850
lea eax, [ebp - 0x44]
push eax
push str.post
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484c00
push str.wait
lea ecx, [ebp - 0x44]
mov byte [0x4faa51], al
call fcn.00409370
test eax, eax
jne 0x484c00
call fcn.0041afd0
mov byte [0x4faa52], 1
push edi
lea ecx, [ebp - 0x38]
call fcn.00418850
lea eax, [ebp - 0x38]
push eax
push 0x4cea40
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484c23
mov byte [0x4faa53], al
push edi
lea ecx, [ebp - 0x40]
call fcn.00418850
lea eax, [ebp - 0x40]
push eax
push str.autodeploy
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484c46
mov byte [0x4faa54], al
push edi
lea ecx, [ebp - 0x3c]
call fcn.00418850
lea eax, [ebp - 0x3c]
push eax
push str.campaign
lea ecx, [ebp - 0x6c]
call fcn.004815f6
cmp al, 1
jne 0x484c72
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4faa2c
call fcn.00404570
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00404d30
lea ecx, [ebx - 0x10]
call fcn.00404d30
lea ecx, [ebp - 0x6c]
call fcn.00427c50
push dword [ebp - 0x6c]
call fcn.00493cb0
pop ecx
xor edi, edi
push 0x4ce9fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x484d46
cmp byte [0x4faa31], al
jne 0x484d3f
push 0x4c997c
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.00473572
mov ebx, dword [eax]
push str.ERROR_CNNOGDIPLUS
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00473572
push edi
push ebx
push dword [eax]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00404d30
push 0x66
jmp 0x484938
call fcn.004814c9
call fcn.00481403
push str.LocalQ360SafeI18NInstaller
call fcn.0046e04d
pop ecx
mov dword [ebp - 0x38], eax
cmp eax, edi
jne 0x484d8a
cmp byte [0x4faa31], 0
jne 0x484d83
push edi
push 0x4cdc70
call fcn.0048e551
pop ecx
pop ecx
cmp eax, edi
je 0x484d83
push eax
call fcn.0046dde0
pop ecx
push 0x69
jmp 0x484938
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
xor bl, bl
call fcn.00478bb4
cmp al, 1
jne 0x484dab
cmp dword [ebp - 0x24], 1
jne 0x484dab
mov bl, al
call fcn.0046d77f
test al, al
je 0x484e43
test bl, bl
jne 0x484e43
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x4faa31], bl
jne 0x484e3c
push str.UAC_ELEVATION_FAILED_MESSAGE
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.00473572
push eax
push str.UAC_MESSAGE
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00473572
push eax
push str.UAC_TITLE
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00473572
push eax
call fcn.0046da33
mov ecx, dword [ebp - 0x24]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00404d30
push 1
push dword [ebp - 0x48]
push 0xffffffffffffffff
call fcn.0046dabc
add esp, 0xc
push 0x6a
jmp 0x484938
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00478d20
pop ecx
push edi
push dword [ebp + 0x66c]
mov ecx, 0x4fb1ec
push edi
call fcn.004793ba
call fcn.004822b4
call fcn.0043d4b0
call fcn.0043d620
mov eax, dword [0x4fb08c]
cmp dword [eax - 0xc], edi
jne 0x484ec7
push 0x4faa1c
lea ecx, [ebp - 0x28]
call fcn.00404530
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4fb08c
call fcn.00404570
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404d30
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.004819a8
push eax
mov ecx, 0x4fb090
call fcn.00404570
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d30
call fcn.00481368
cmp byte [0x4faa31], 0
mov dword [0x4fb1e8], eax
jne 0x484fcf
lea ecx, [ebp - 0x80]
call fcn.00478e4d
call fcn.00407540
test al, al
jne 0x484ef7
push 1
call fcn.00409260
pop ecx
push str.font
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [0x4faa32], 1
call fcn.00473572
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.004818ca
push dword [eax]
mov ecx, 0x4fa6c0
call fcn.00470aa3
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404d30
push str.IDCANCEL
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.00473572
mov edi, dword [eax]
push 0x4ce918
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00473572
mov ebx, dword [eax]
push 0x4c997c
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00473572
mov ecx, 0x4d67f4
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push edi
push ebx
push dword [eax]
call fcn.0048285a
mov ecx, dword [ebp - 0x24]
add esp, 0x24
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00404d30
call fcn.00482426
push dword [ebp + 0x678]
push dword [ebp - 0x48]
call fcn.004846b5
pop ecx
pop ecx
push dword [ebp - 0x70]
mov dword [ebp - 0x20], eax
call sub.gdiplus.dll_GdiplusShutdown
xor edi, edi
jmp 0x4850d5
mov ebx, 0x4faa18
push ebx
lea ecx, [ebp - 0x28]
call fcn.00404530
mov eax, dword [ebp - 0x28]
cmp dword [eax - 0xc], edi
jne 0x485004
lea eax, [ebp - 0x24]
push eax
call fcn.00472cd1
pop ecx
push edi
push dword [eax]
mov ecx, esi
call fcn.00480f70
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d30
cmp byte [0x4faa30], 0
je 0x485057
call fcn.00407540
test al, al
jne 0x485027
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00478c8b
pop ecx
test eax, eax
jne 0x485057
push ebx
lea ecx, [ebp - 0x24]
call fcn.00404530
mov esi, dword [ebp - 0x24]
push esi
call fcn.0041a5e0
mov bl, al
neg bl
pop ecx
sbb bl, bl
lea ecx, [esi - 0x10]
inc bl
call fcn.00404d30
test bl, bl
je 0x485057
mov dword [ebp - 0x20], 0x72
jmp 0x4850ca
lea ecx, [ebp - 0x1c]
call fcn.00488441
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x485095
lea eax, [ebp - 0x1c]
push eax
call fcn.00491db2
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x485095
lea ecx, [ebp - 0x1c]
call fcn.0048a791
cmp al, 1
jne 0x48508f
push edi
call fcn.0048cc31
pop ecx
jmp 0x485095
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x20], eax
call fcn.00482d9a
cmp dword [ebp - 0x20], edi
je 0x4850a8
push dword [ebp - 0x20]
call fcn.0048bcb0
pop ecx
cmp dword [ebp - 0x18], edi
je 0x4850ba
push edi
push edi
push 0x12
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x1c]
call fcn.00485a02
lea ecx, [ebp - 0x1c]
call fcn.00487d1b
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404d30
cmp dword [ebp - 0x20], edi
jne 0x485119
lea eax, [ebp - 0x24]
push eax
call fcn.00482e24
mov ebx, dword [ebp - 0x24]
pop ecx
cmp dword [ebx - 0xc], edi
je 0x485111
push 1
push edi
push edi
push ebx
mov esi, str.open
push esi
push edi
call fcn.0046e3f4
add esp, 0x18
test al, al
jne 0x485111
push 1
push edi
push edi
push ebx
push esi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebx - 0x10]
call fcn.00404d30
call fcn.0043d640
call fcn.0043d5d0
call fcn.004792e6
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x4faa31], 0
jne 0x485154
push 0xffffffffffffffff
call fcn.00482426
mov ecx, eax
call fcn.00479006
call fcn.00482426
mov ecx, eax
call fcn.00485a02
cmp dword [0x4fb1dc], 1
jne 0x485162
call fcn.0048a845
mov ecx, 0x4fb1ec
call fcn.0047bbfd
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [ebp - 0x20]
jmp 0x484939