Function at 0x48ba27
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x66c]
sub esp, 0x6ec
mov eax, dword [0x4ffeb0]
xor eax, ebp
mov dword [ebp + 0x668], eax
mov eax, dword [ebp + 0x67c]
push ebx
push esi
push edi
push 0x50739c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x44], eax
call fcn.0041af40
xor eax, eax
push 0x206
mov word [ebp + 0x460], ax
xor edi, edi
lea eax, [ebp + 0x462]
push edi
push eax
call fcn.004a0bd0
add esp, 0xc
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x460]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x505c38
test eax, eax
je 0x48c027
push edi
call fcn.004a28e5
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
mov edi, eax
mov dword [ebp - 0x24], edx
call ebx
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x2c]
push edi
push 0x4d8c4c
push eax
call fcn.00404ba0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x14
push dword [ebp - 0x2c]
lea eax, [ebp + 0x460]
push eax
call edi
lea eax, [ebp + 0x460]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004045f0
lea eax, [ebp + 0x460]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.360base.dll
lea eax, [ebp + 0x460]
push eax
call edi
lea eax, [ebp + 0x460]
push eax
push 0x1f8
push str.FILE
call fcn.0048cccb
add esp, 0xc
test al, al
jne 0x48bc1b
lea ecx, [ebp - 0x2c]
call fcn.00404c40
push 0x208
lea eax, [ebp + 0x460]
push 0
push eax
call fcn.004a0bd0
add esp, 0xc
push 1
push 0x23
lea eax, [ebp + 0x460]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x48bb89
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00404d60
push 0x67
pop eax
mov ecx, dword [ebp + 0x668]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a0e91
add ebp, 0x66c
leave
ret 0x10
push 0
call fcn.004a28e5
pop ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
call ebx
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x2c]
push dword [ebp - 0x28]
push 0x4d8c4c
push eax
call fcn.00404ba0
add esp, 0x14
push dword [ebp - 0x2c]
lea eax, [ebp + 0x460]
push eax
call edi
lea eax, [ebp + 0x460]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004045f0
lea eax, [ebp + 0x460]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.360base.dll
lea eax, [ebp + 0x460]
push eax
call edi
lea eax, [ebp + 0x460]
push eax
push 0x1f8
push str.FILE
call fcn.0048cccb
add esp, 0xc
test al, al
jne 0x48bc24
push 0x67
pop esi
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00404d60
mov eax, esi
jmp 0x48bb6f
push dword [ebp - 0x2c]
call fcn.00488ace
pop ecx
lea eax, [ebp + 0x460]
push eax
call fcn.00474ddb
pop ecx
mov ecx, 0x505d18
call fcn.0047f3bc
mov ecx, esi
call fcn.0048b196
test al, al
jne 0x48bc4a
push 0x65
jmp 0x48bc08
call fcn.00488342
lea ecx, [ebp - 0x6c]
call fcn.00438a40
push 0x3a
push dword [ebp - 0x44]
lea ecx, [ebp - 0x6c]
call fcn.00489502
cmp al, 1
jne 0x48c014
cmp dword [ebp - 0x50], 0
je 0x48c014
mov ebx, 0x50739c
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0041af40
lea eax, [ebp - 0x1c]
push eax
push 0x4d8c48
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bd44
mov byte [0x505cd1], al
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], 0
je 0x48bd44
cmp byte [0x505cd0], 0
jne 0x48bd44
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call edi
mov ebx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x1c]
call fcn.00477d71
cmp ax, 0x5c
jne 0x48bcf6
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax - 0xc]
push 1
dec eax
push eax
lea ecx, [ebp - 0x1c]
call fcn.004296f0
push dword [ebp - 0x1c]
call edi
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Total_Security
push ebx
call edi
test eax, eax
je 0x48bd2d
push str.Total
push ebx
call edi
test eax, eax
je 0x48bd2d
push str.PSafeAV
push ebx
call edi
test eax, eax
je 0x48bd2d
push 0x4d8bec
lea ecx, [ebp - 0x1c]
call fcn.004053a0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404970
push eax
mov ecx, esi
call fcn.00487bcf
mov ebx, 0x50739c
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041af40
lea eax, [ebp - 0x38]
push eax
push 0x4d8be8
lea ecx, [ebp - 0x6c]
call fcn.004882d3
mov edi, dword [ebp - 0x38]
cmp al, 1
jne 0x48bd76
cmp dword [edi - 0xc], 0
je 0x48bd76
push edi
mov ecx, 0x505cbc
call fcn.004045f0
push ebx
lea ecx, [ebp - 0x4c]
call fcn.0041af40
lea eax, [ebp - 0x4c]
push eax
push 0x4d8be0
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bd9f
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.00487bec
push ebx
lea ecx, [ebp - 0x40]
call fcn.0041af40
lea eax, [ebp - 0x40]
push eax
push str.pmode
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48be61
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], 0
je 0x48be61
lea ecx, [ebp - 0x40]
call fcn.00404970
push eax
call fcn.004a2fdd
pop ecx
push ebx
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0041af40
cmp edi, 0xfe
jne 0x48be3c
lea eax, [ebp - 0x34]
push eax
push 0x4d8940
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48be4c
mov edi, dword [ebp - 0x34]
cmp dword [edi - 0xc], 0
je 0x48be4c
push edi
push 0x1f7
push str.FILE
call fcn.00499041
add esp, 0xc
test al, al
je 0x48be4c
push edi
mov ecx, 0x505cc8
call fcn.004045f0
mov dword [0x505cd4], 0xfe
jmp 0x48be53
lea eax, [edi - 1]
cmp eax, 1
ja 0x48be4c
mov dword [0x505cd4], edi
jmp 0x48be53
mov ecx, esi
call fcn.00481137
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00404d60
mov edi, dword [ebp - 0x38]
push ebx
lea ecx, [ebp - 0x24]
call fcn.0041af40
lea eax, [ebp - 0x24]
push eax
push str.show
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48be84
mov byte [0x505cd2], al
push ebx
lea ecx, [ebp - 0x48]
call fcn.0041af40
lea eax, [ebp - 0x48]
push eax
push str.post
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bec4
push str.wait
lea ecx, [ebp - 0x48]
mov byte [0x505cf1], al
call fcn.0040b6b0
test eax, eax
jne 0x48bec4
call fcn.0042c030
mov byte [0x505cf2], 1
push ebx
lea ecx, [ebp - 0x30]
call fcn.0041af40
lea eax, [ebp - 0x30]
push eax
push 0x4d8bb4
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bee7
mov byte [0x505cf3], al
push ebx
lea ecx, [ebp - 0x3c]
call fcn.0041af40
lea eax, [ebp - 0x3c]
push eax
push str.autodeploy
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bf0a
mov byte [0x505cf4], al
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041af40
lea eax, [ebp - 0x38]
push eax
push str.campaign
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bf36
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x505ccc
call fcn.004044f0
push ebx
lea ecx, [ebp - 0x34]
call fcn.0041af40
lea eax, [ebp - 0x34]
push eax
push str.syncid0_0
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bf60
mov dword [0x505d08], 1
jmp 0x48bfa9
lea eax, [ebp - 0x34]
push eax
push str.syncid0_1
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bf81
mov dword [0x505d08], 2
jmp 0x48bfa9
lea eax, [ebp - 0x34]
push eax
push str.syncid0_2
lea ecx, [ebp - 0x6c]
call fcn.004882d3
cmp al, 1
jne 0x48bfa2
mov dword [0x505d08], 3
jmp 0x48bfa9
and dword [0x505d08], 0
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00404d60
lea ecx, [edi - 0x10]
call fcn.00404d60
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00404d60
lea ecx, [ebp - 0x6c]
call fcn.00439910
push dword [ebp - 0x6c]
call fcn.0049c830
pop ecx
xor edi, edi
push 0x4d8b34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x48c088
cmp byte [0x505cd1], al
jne 0x48c081
push 0x4d395c
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.0047a44d
mov ebx, dword [eax]
push str.ERROR_CNNOGDIPLUS
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.0047a44d
push edi
push ebx
push dword [eax]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00404d60
push 0x66
jmp 0x48bc08
call fcn.004881a6
call fcn.004880e0
push str.LocalQ360SafeI18NInstaller
call fcn.00474bb0
pop ecx
mov dword [ebp - 0x30], eax
cmp eax, edi
jne 0x48c0cc
cmp byte [0x505cd1], 0
jne 0x48c0c5
push edi
push 0x4d7cd8
call fcn.00495cc8
pop ecx
pop ecx
cmp eax, edi
je 0x48c0c5
push eax
call fcn.00474943
pop ecx
push 0x69
jmp 0x48bc08
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
xor bl, bl
call fcn.0047f88b
cmp al, 1
jne 0x48c0ed
cmp dword [ebp - 0x20], 1
jne 0x48c0ed
mov bl, al
call fcn.00474370
test al, al
je 0x48c185
test bl, bl
jne 0x48c185
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x505cd1], bl
jne 0x48c17e
push str.UAC_ELEVATION_FAILED_MESSAGE
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.0047a44d
push eax
push str.UAC_MESSAGE
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.0047a44d
push eax
push str.UAC_TITLE
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0047a44d
push eax
call fcn.00474596
mov ecx, dword [ebp - 0x20]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00404d60
push 1
push dword [ebp - 0x44]
push 0xffffffffffffffff
call fcn.0047461f
add esp, 0xc
push 0x6a
jmp 0x48bc08
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.0047f934
pop ecx
push edi
push dword [ebp + 0x674]
mov ecx, 0x5064a8
push edi
call fcn.0047fef1
call fcn.004890a6
call fcn.00444360
call fcn.004444d0
mov eax, dword [0x506344]
cmp dword [eax - 0xc], edi
jne 0x48c209
push 0x505cbc
lea ecx, [ebp - 0x24]
call fcn.00404d20
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x506344
call fcn.004044f0
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d60
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.004886cf
push eax
mov ecx, 0x506348
call fcn.004044f0
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00404d60
call fcn.00488045
cmp byte [0x505cd1], 0
mov dword [0x5064a4], eax
jne 0x48c367
call fcn.00408020
test al, al
jne 0x48c276
cmp byte [0x505cd0], al
jne 0x48c276
mov eax, dword [0x505d08]
cmp eax, edi
jne 0x48c241
call fcn.0048a5db
jmp 0x48c276
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x48c250
mov dword [0x505cf8], edi
jmp 0x48c26f
cmp eax, 2
jne 0x48c264
mov dword [0x505cf8], ecx
mov byte [0x505d04], 1
jmp 0x48c276
cmp eax, 3
jne 0x48c276
mov dword [0x505cf8], ecx
mov byte [0x505d04], 0
lea ecx, [ebp - 0x80]
call fcn.0047fb28
call fcn.00408020
test al, al
jne 0x48c28f
push 1
call fcn.0040b030
pop ecx
push str.font
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
mov byte [0x505cd2], 1
call fcn.0047a44d
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.004885f1
push dword [eax]
mov ecx, 0x505960
call fcn.004779d3
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d60
push str.IDCANCEL
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.0047a44d
mov edi, dword [eax]
push 0x4d8a50
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.0047a44d
mov ebx, dword [eax]
push 0x4d395c
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0047a44d
mov ecx, 0x4e0c80
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push edi
push ebx
push dword [eax]
call fcn.0048964c
mov ecx, dword [ebp - 0x20]
add esp, 0x24
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00404d60
call fcn.00489218
push dword [ebp + 0x680]
push dword [ebp - 0x44]
call fcn.0048b985
pop ecx
pop ecx
push dword [ebp - 0x70]
mov dword [ebp - 0x1c], eax
call sub.gdiplus.dll_GdiplusShutdown
xor edi, edi
jmp 0x48c46d
mov ebx, 0x505cb8
push ebx
lea ecx, [ebp - 0x24]
call fcn.00404d20
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], edi
jne 0x48c39c
lea eax, [ebp - 0x20]
push eax
call fcn.00479bca
pop ecx
push edi
push dword [eax]
mov ecx, esi
call fcn.00487bcf
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00404d60
cmp byte [0x505cd0], 0
je 0x48c3ef
call fcn.00408020
test al, al
jne 0x48c3bf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0047f9c5
pop ecx
test eax, eax
jne 0x48c3ef
push ebx
lea ecx, [ebp - 0x20]
call fcn.00404d20
mov esi, dword [ebp - 0x20]
push esi
call fcn.0042b630
mov bl, al
neg bl
pop ecx
sbb bl, bl
lea ecx, [esi - 0x10]
inc bl
call fcn.00404d60
test bl, bl
je 0x48c3ef
mov dword [ebp - 0x1c], 0x72
jmp 0x48c462
lea ecx, [ebp - 0x18]
call fcn.0048f95f
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x48c42d
lea eax, [ebp - 0x18]
push eax
call fcn.004993b7
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x48c42d
lea ecx, [ebp - 0x18]
call fcn.00491e28
cmp al, 1
jne 0x48c427
push edi
call fcn.0049438f
pop ecx
jmp 0x48c42d
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 0x1c], eax
call fcn.00489b8c
cmp dword [ebp - 0x1c], edi
je 0x48c440
push dword [ebp - 0x1c]
call fcn.00493436
pop ecx
cmp dword [ebp - 0x14], edi
je 0x48c452
push edi
push edi
push 0x12
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x18]
call fcn.0048cddc
lea ecx, [ebp - 0x18]
call fcn.0048f239
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404d60
cmp dword [ebp - 0x1c], edi
jne 0x48c4b1
lea eax, [ebp - 0x20]
push eax
call fcn.00489c16
mov ebx, dword [ebp - 0x20]
pop ecx
cmp dword [ebx - 0xc], edi
je 0x48c4a9
push 1
push edi
push edi
push ebx
mov esi, str.open
push esi
push edi
call fcn.00474ea1
add esp, 0x18
test al, al
jne 0x48c4a9
push 1
push edi
push edi
push ebx
push esi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebx - 0x10]
call fcn.00404d60
call fcn.004444f0
call fcn.00444480
call fcn.0047fe3e
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x505cd1], 0
jne 0x48c4ec
push 0xffffffffffffffff
call fcn.00489218
mov ecx, eax
call fcn.0047fce1
call fcn.00489218
mov ecx, eax
call fcn.0048cddc
cmp dword [0x506498], 1
jne 0x48c4fa
call fcn.00491edc
mov ecx, 0x5064a8
call fcn.0048268f
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [ebp - 0x1c]
jmp 0x48bc09