Function at 0x4819f0
Capabilities:
Create process on windows
Create thread
Hide graphical window

Disassembly:
push 0x680
mov eax, 0x5ec651
call fcn.0059bbd7
mov bh, dl
and dword [ebp - 0x68c], 0
push 7
sub esp, 0x18
mov ecx, esp
push 0x6335fc
call fcn.0040b0d5
lea ecx, [ebp - 0x688]
call fcn.004a5c42
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push str.main
call fcn.0040b0d5
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0049029e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0040b67e
push str.operate
lea ecx, [ebp - 0x28]
call fcn.004045aa
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x68c], 1
call fcn.00539200
mov ecx, eax
call fcn.005396b0
test al, al
je 0x481a8a
call fcn.004e2753
test al, al
je 0x481a8a
mov bl, 1
jmp 0x481a8c
xor bl, bl
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404812
test bl, bl
je 0x481aaa
push 0
push dword [ebp - 0x680]
call dword [sym.imp.USER32.dll_ShowWindow]
test bh, bh
je 0x481ab9
lea ecx, [ebp - 0x688]
call fcn.004a5fc0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x688]
call fcn.004a5fc8
call fcn.004cc6a4
test eax, eax
jne 0x481af5
test bl, bl
jne 0x481af5
xor ecx, ecx
lea eax, [ebp - 0x68c]
push eax
push ecx
push ecx
push 0x4803c1
push ecx
push ecx
mov dword [ebp - 0x68c], ecx
call fcn.005c30ff
add esp, 0x18
sub esp, 0x18
lea eax, [ebp - 0x688]
mov ecx, esp
mov dword [0x6e56ac], eax
mov esi, str.chrome.dll
push esi
call fcn.0040b0d5
lea ecx, [ebp - 0x58]
call fcn.004ca141
add esp, 0x18
mov byte [ebp - 4], 3
call fcn.004d6a98
mov edi, str.ShowWallPaperMainWnd
test al, al
je 0x481bb1
xor cl, cl
call fcn.004d5cdb
test al, al
je 0x481b45
call fcn.004d6a98
test al, al
je 0x481bb1
call fcn.0042709e
cmp eax, 5
je 0x481b74
push 0x2f4
push edi
push str.__s__d___start_DownLoad360seImplComm
call fcn.0040a649
add esp, 0xc
call fcn.004d60aa
test al, al
je 0x481b74
call fcn.004d6a98
test al, al
je 0x481bb1
call fcn.0049684b
push 1
push 0x6406e8
push 0x6534fc
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x481d01
push 5
push ebx
push ebx
push str.https:__bbs.360.cn_forum.php_modforumdisplayfid7627
push 0x63afc8
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x481d01
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0040b0d5
lea ecx, [ebp - 0x40]
call fcn.004ca141
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x481bcf
mov eax, dword [eax]
push eax
call fcn.004352fd
pop ecx
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.0040b67e
test esi, esi
je 0x481d01
push 8
push 0
sub esp, 0x18
mov ecx, esp
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x40]
call fcn.004ca141
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x481c0e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.0040b67e
sub esp, 0x18
mov ecx, esp
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
call fcn.004ca141
add esp, 0x18
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x481c45
mov eax, dword [eax]
push eax
push 0x306
push edi
push str.__s__d___chrome.dll__s
call fcn.0040a649
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.0040b67e
test esi, esi
je 0x481cee
push str.ChromeShell
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x481ca4
push 0x30b
push edi
push str.__s__d___chrome_main__null
call fcn.0040a649
add esp, 0xc
push esi
push esi
push 0x10
push dword [ebp - 0x680]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x481d01
test bl, bl
je 0x481cc2
push 0x6535a0
lea ecx, [ebp - 0x28]
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
call fcn.004ceb02
lea ecx, [ebp - 0x28]
jmp 0x481cda
push str._hb:1
lea ecx, [ebp - 0x40]
call fcn.0040b0d5
lea ecx, [ebp - 0x40]
call fcn.004ceb02
lea ecx, [ebp - 0x40]
call fcn.0040b67e
push 0x6e4e88
push dword [0x6deab4]
call esi
pop ecx
pop ecx
push 0x315
push edi
push str.__s__d___exit
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.0040b67e
lea ecx, [ebp - 0x688]
call fcn.004a5e4d
call fcn.0059bb81
ret