Function at 0x406264
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x278
mov ebx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x270], eax
cmp word [str.dissociate_crx_file], 0
je 0x4062a2
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x6494b4], 0
mov ecx, eax
jne 0x406290
jmp 0x4062a4
xor eax, eax
lea esi, [esp + 0x68]
push eax
push str.dissociate_crx_file
push esi
call fcn.0047d020
add esp, 0xc
movzx eax, byte [esi + 0xb]
test al, al
mov ecx, dword [esi]
cmovns ecx, esi
lea edi, [esp + 4]
mov dword [edi], ecx
cmovs eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, ebx
push edi
call fcn.0046bd60
mov byte [esp + 3], al
cmp byte [esi + 0xb], 0
jns 0x4062ed
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
cmp word [str.dissociate_mht_file], 0
je 0x40630b
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x6494dc], 0
mov ecx, eax
jne 0x4062f9
jmp 0x40630d
xor eax, eax
push eax
push str.dissociate_mht_file
push esi
call fcn.0047d020
add esp, 0xc
movzx eax, byte [esp + 0x73]
test al, al
mov ecx, dword [esp + 0x68]
cmovns ecx, esi
mov dword [esp + 4], ecx
cmovs eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov ecx, ebx
push edi
call fcn.0046bd60
mov bh, al
cmp byte [esp + 0x73], 0
jns 0x406354
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
cmp word [str.rename_360Chrome_exe], 0
je 0x406372
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x6493b2], 0
mov ecx, eax
jne 0x406360
jmp 0x406374
xor eax, eax
push eax
push str.rename_360Chrome_exe
push esi
call fcn.0047d020
add esp, 0xc
movzx eax, byte [esp + 0x73]
test al, al
mov ecx, dword [esp + 0x68]
cmovns ecx, esi
mov dword [esp + 4], ecx
cmovs eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov ecx, dword [ebp + 8]
push edi
call fcn.0046bd60
mov bl, al
cmp byte [esp + 0x73], 0
jns 0x4063bc
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
mov eax, dword [ebp + 0x10]
test bl, bl
je 0x4063ce
mov dword [eax], 0x18
jmp 0x406679
cmp word [str.remove_chrome_registration], 0
je 0x4063ec
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x6493dc], 0
mov ecx, eax
jne 0x4063da
jmp 0x4063ee
xor eax, eax
push eax
push str.remove_chrome_registration
push esi
call fcn.0047d020
add esp, 0xc
movzx eax, byte [esp + 0x73]
test al, al
mov ecx, dword [esp + 0x68]
cmovns ecx, esi
mov dword [esp + 4], ecx
cmovs eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov ecx, dword [ebp + 8]
push edi
call fcn.0046bd60
mov bl, al
cmp byte [esp + 0x73], 0
jns 0x406436
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
test bl, bl
je 0x4064b8
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.0040a6ec
mov ecx, ebx
call fcn.0040a7ee
mov ecx, ebx
call fcn.0040afd4
xor eax, eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x70], eax
mov ebx, dword [ebp + 8]
mov ecx, ebx
push str.register_chrome_browser_suffix
call fcn.0046bdb0
test al, al
je 0x406599
mov eax, str.register_chrome_browser_suffix
lea edi, [esp + 0x40]
mov dword [edi], eax
push eax
call fcn.0061fdf0
add esp, 4
mov dword [edi + 4], eax
lea eax, [esp + 4]
mov ecx, ebx
push edi
push eax
call fcn.0046bf10
cmp byte [esp + 0x73], 0
js 0x406559
mov word [esp + 0x68], 0
mov byte [esp + 0x73], 0
jmp 0x406585
mov al, byte [esp + 3]
or bh, al
cmp bh, 1
jne 0x40651a
mov bl, 1
test al, al
je 0x40667b
mov ecx, esi
push 0x639d54
call fcn.00401a6c
call fcn.004175be
lea edi, [esp + 4]
mov ecx, eax
push edi
call fcn.0041760e
push esi
push edi
call fcn.0040b3ba
add esp, 8
cmp byte [edi + 0xb], 0
jns 0x406506
push dword [esp + 4]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x73], 0
jns 0x40667b
push dword [esp + 0x68]
jmp 0x406a62
mov ecx, dword [ebp + 8]
push str.inactive_user_toast
call fcn.0046bdb0
mov bl, 1
test al, al
jne 0x40667b
cmp word [str.system_level_toast], 0
je 0x406629
xor ecx, ecx
mov ebx, dword [ebp + 8]
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x64948e], 0
mov ecx, eax
jne 0x406544
jmp 0x40662e
mov eax, dword [esp + 0x68]
mov word [eax], 0
mov dword [esp + 0x6c], 0
cmp byte [esp + 0x73], 0
jns 0x406585
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x70], 0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x70], eax
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x68], xmm0
lea edi, [esp + 0x5c]
mov dword [edi], 0x16
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043e654
add esp, 0xc
push edi
call fcn.0043e4ff
add esp, 4
lea esi, [esp + 4]
mov ecx, esi
push 0x639d54
call fcn.00401a6c
call fcn.004175be
lea edi, [esp + 0x40]
mov ecx, eax
push edi
call fcn.0041760e
push esi
push edi
call fcn.0040b3ba
add esp, 8
cmp byte [edi + 0xb], 0
jns 0x4065f8
push dword [esp + 0x40]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xf], 0
jns 0x40660b
push dword [esp + 4]
call fcn.00517bd6
add esp, 4
mov eax, dword [esp + 0x5c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp byte [esp + 0x73], 0
jns 0x406679
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
jmp 0x406679
xor eax, eax
mov ebx, dword [ebp + 8]
push eax
push str.system_level_toast
push esi
call fcn.0047d020
add esp, 0xc
movzx eax, byte [esp + 0x73]
test al, al
mov ecx, dword [esp + 0x68]
cmovns ecx, esi
mov dword [esp + 4], ecx
cmovs eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov ecx, ebx
push edi
call fcn.0046bd60
mov ebx, eax
cmp byte [esp + 0x73], 0
jns 0x406675
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
test bl, bl
je 0x406693
mov bl, 1
mov ecx, dword [esp + 0x270]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.del_setup_exe
call fcn.0046bdb0
test al, al
mov bl, 1
je 0x40675c
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0x639d6c
push edi
call fcn.0046bf10
lea eax, [esp + 0x40]
mov ecx, ebx
push 0x639d8c
push eax
call fcn.0046bf10
movzx eax, byte [esp + 0xf]
test al, al
jns 0x4066dc
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, esi
push eax
push edi
call fcn.0046ed80
push esi
call fcn.00482720
add esp, 4
mov ebx, eax
mov ecx, esi
call fcn.0046ee40
test bl, bl
mov bl, 1
je 0x406a40
cmp byte [esp + 0x4b], 0
lea eax, [esp + 0x40]
jns 0x406710
mov eax, dword [esp + 0x40]
push eax
call fcn.0061d786
add esp, 4
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x406829
mov edi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x406a39
movzx eax, byte [esp + 0xf]
test al, al
jns 0x4069c6
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
jmp 0x4069ca
mov ecx, dword [ebp + 8]
push str.do_shortcut
call fcn.0046bdb0
test al, al
je 0x4067d7
lea ecx, [esp + 4]
push dword [ebp + 8]
call fcn.0046b3b0
lea edi, [esp + 0x5c]
mov ecx, edi
call fcn.0046ed20
mov bl, 1
push edi
push 2
call fcn.00476650
add esp, 8
test al, al
je 0x40693c
lea ebx, [esp + 0x50]
lea edi, [esp + 0x5c]
mov ecx, edi
push ebx
call fcn.0046f6e0
lea eax, [esp + 0x40]
mov ecx, ebx
push eax
call fcn.0046f6e0
cmp word [str.360chrome.exe], 0
je 0x406843
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x649620], 0
mov ecx, eax
jne 0x4067c5
jmp 0x406845
mov ecx, dword [ebp + 8]
push str.uninstall_old_se
call fcn.0046bdb0
test al, al
jne 0x40667b
mov ecx, dword [ebp + 8]
push str.associate_crx_file_only
call fcn.0046bdb0
test al, al
jne 0x40667b
cmp word [str.uninstall], 0
je 0x406a6f
xor ecx, ecx
mov ebx, dword [ebp + 8]
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x649446], 0
mov ecx, eax
jne 0x406814
jmp 0x406a74
movzx eax, byte [esp + 0xf]
test al, al
jns 0x406953
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
jmp 0x406957
xor eax, eax
lea ebx, [esp + 0x40]
mov ecx, ebx
push eax
push str.360chrome.exe
push esi
call fcn.0046fbd0
mov ecx, edi
push esi
call fcn.0046ee80
mov ecx, esi
call fcn.0046ee40
mov ecx, ebx
call fcn.0046ee40
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.0046ee40
push edi
call fcn.00482720
add esp, 4
test al, al
je 0x40693a
lea ecx, [esp + 4]
push edi
call fcn.0046b130
lea ecx, [esp + 4]
push ebx
call fcn.0046cdd0
xorps xmm0, xmm0
movups xmmword [esp + 0x8c], xmm0
movups xmmword [esp + 0x9c], xmm0
movups xmmword [esp + 0x7c], xmm0
movups xmmword [esp + 0x6c], xmm0
mov dword [esp + 0x68], 0x44
mov dword [esp + 0x94], 1
mov word [esp + 0x98], 5
cmp byte [esp + 0x5b], 0
jns 0x4068e2
mov ebx, dword [esp + 0x50]
sub esp, 0x28
lea eax, [esp + 0x68]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], esi
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406b0d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x44]
call esi
push dword [esp + 0x40]
call esi
cmp byte [esp + 0x5b], 0
jns 0x40693a
push dword [esp + 0x50]
call fcn.00517bd6
add esp, 4
mov bl, 1
lea ecx, [esp + 0x5c]
call fcn.0046ee40
lea ecx, [esp + 4]
call fcn.0046b550
jmp 0x40667b
lea edx, [esp + 4]
mov ecx, esi
push eax
push edx
call fcn.0046ed80
push esi
call fcn.00482020
add esp, 4
mov ecx, esi
call fcn.0046ee40
xor ebx, ebx
push 0x208
push ebx
push esi
call fcn.006030b0
add esp, 0xc
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [esp + 0x68], 0
je 0x4069a5
xor eax, eax
lea ebx, [eax + 1]
cmp word [esp + eax*2 + 0x6a], 0
mov eax, ebx
jne 0x406998
lea edi, [esp + 0x5c]
mov ecx, edi
push ebx
push esi
call fcn.0046ed80
push edi
call fcn.00482040
add esp, 4
mov ecx, edi
call fcn.0046ee40
mov bl, 1
jmp 0x406a40
lea edx, [esp + 4]
mov ecx, esi
push eax
push edx
call fcn.0046ed80
push esi
call fcn.00482020
add esp, 4
mov ecx, esi
call fcn.0046ee40
xor ebx, ebx
push 0x208
push ebx
push esi
call fcn.006030b0
add esp, 0xc
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [esp + 0x68], 0
je 0x406a18
xor eax, eax
lea ebx, [eax + 1]
cmp word [esp + eax*2 + 0x6a], 0
mov eax, ebx
jne 0x406a0b
lea ecx, [esp + 0x5c]
push ebx
push esi
call fcn.0046ed80
lea esi, [esp + 0x5c]
push esi
call fcn.00482040
add esp, 4
mov ecx, esi
call fcn.0046ee40
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x4b], 0
jns 0x406a53
push dword [esp + 0x40]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xf], 0
jns 0x40667b
push dword [esp + 4]
call fcn.00517bd6
add esp, 4
jmp 0x40667b
xor eax, eax
mov ebx, dword [ebp + 8]
push eax
push str.uninstall
push esi
call fcn.0047d020
add esp, 0xc
movzx eax, byte [esp + 0x73]
test al, al
mov ecx, dword [esp + 0x68]
cmovns ecx, esi
mov dword [esp + 4], ecx
cmovs eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov ecx, ebx
push edi
call fcn.0046bd60
mov ebx, eax
cmp byte [esp + 0x73], 0
jns 0x406abb
push dword [esp + 0x68]
call fcn.00517bd6
add esp, 4
test bl, bl
je 0x406aee
xor ebx, ebx
push 0x208
push ebx
push esi
call fcn.006030b0
add esp, 0xc
push 0x103
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x406b51
xor ebx, ebx
jmp 0x40667b
mov esi, dword [ebp + 8]
mov ecx, esi
push str.UnPackExtPacket
call fcn.0046bdb0
test al, al
mov bl, 1
je 0x406b27
call fcn.00412994
jmp 0x40667b
cmp byte [esp + 0x5b], 0
jns 0x406b20
push dword [esp + 0x50]
call fcn.00517bd6
add esp, 4
xor ebx, ebx
jmp 0x40693c
mov ecx, esi
push str.allow_mini_thunderplatform_to_firewall
call fcn.0046bdb0
test al, al
jne 0x40667b
mov ecx, esi
push str.disallow_mini_thunderplatform_to_firewall
call fcn.0046bdb0
test al, al
jne 0x40667b
jmp 0x406ae7
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], 0
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x40
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], str.__uninstall
mov dword [esp + 0x20], 5
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x406679