Function at 0x40101e
Capabilities:
Check if file exists
Create thread
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x4e8
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [esp + 0x4e0], eax
lea esi, [esp + 0x298]
push esi
call fcn.0043b250
add esp, 4
mov edi, dword [esi]
mov esi, dword [esi + 4]
lea ebx, [esp + 0x88]
mov ecx, ebx
push str.exe_entry_point:placeholder
call fcn.004043d8
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x10], edi
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x4010c1
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
jmp 0x401185
mov edi, dword [0x532150]
sub eax, edi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, edi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea esi, [ecx + ecx]
cmp esi, edx
cmovb esi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, esi
lea edi, [esp + 0x2c8]
mov ecx, edi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [edi + 8], 0x18
mov ecx, 0x532150
push edi
call fcn.0040c740
mov ecx, edi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
jns 0x401185
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
call fcn.00403850
xor esi, esi
test eax, eax
jne 0x401b0b
mov ebx, 0x208
xor edi, edi
push ebx
push edi
lea eax, [esp + 0x90]
push eax
call fcn.004b8bc0
add esp, 0xc
lea esi, [esp + 0x2c8]
push ebx
push edi
push esi
call fcn.004b8bc0
add esp, 0xc
push 0x104
mov dword [esp + 0x10], esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4011ee
cmp word [esp + eax*2 + 0x2c6], 0x5c
je 0x4011e4
dec eax
jne 0x4011d4
jmp 0x4011ee
mov word [esp + eax*2 + 0x2c8], 0
mov esi, 0x4eb21a
push esi
call fcn.004cfa30
add esp, 4
push eax
push esi
lea esi, [esp + 0x2a0]
push esi
call fcn.0043a340
add esp, 0xc
cmp byte [esp + 0x2a3], 0
jns 0x40121f
mov esi, dword [esp + 0x298]
push esi
lea eax, [esp + 0x2cc]
push eax
push str._s_schrome_elf.dll
push 0x104
lea esi, [esp + 0x98]
push esi
call fcn.004038c2
add esp, 0x14
cmp byte [esp + 0x2a3], 0
jns 0x40125b
push dword [esp + 0x298]
call fcn.004af3c6
add esp, 4
push 0
push esi
call fcn.004cc4c7
add esp, 8
cmp eax, 0xffffffff
jne 0x401286
lea eax, [esp + 0x2c8]
push eax
push str._schrome_elf.dll
push 0x104
push esi
call fcn.004038c2
add esp, 0x10
push esi
call fcn.00443630
add esp, 4
test eax, eax
je 0x4037cd
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4012b9
push 0x4e307c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4012b4
call eax
call fcn.004103e4
lea esi, [esp + 0x298]
push esi
call fcn.0043b250
add esp, 4
mov ebx, dword [esi]
mov edi, dword [esi + 4]
lea esi, [esp + 0x88]
mov ecx, esi
push str.load_elf
call fcn.004043d8
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x40133f
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
jmp 0x40140b
mov ebx, dword [0x532150]
sub eax, ebx
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, ebx
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea edi, [ecx + ecx]
cmp edi, edx
cmovb edi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, edi
lea edi, [esp + 0x2c8]
mov ecx, edi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esp + 0x2d0], 0x18
mov ecx, 0x532150
push edi
call fcn.0040c740
mov ecx, edi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
jns 0x40140b
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
call fcn.0043fbc0
xor esi, esi
push esi
push esi
call fcn.0042d250
add esp, 8
call fcn.0042d530
mov edi, eax
push eax
call fcn.0040d6b0
add esp, 4
test al, al
jne 0x401b0b
mov eax, 0x4e43a6
mov dword [esp + 0x88], eax
push eax
call fcn.004cfa30
add esp, 4
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x34]
mov ecx, edi
lea edx, [esp + 0x88]
push edx
push eax
call fcn.0042da50
push str.chrome_elf.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test eax, eax
jne 0x4014aa
lea ebx, [esp + 0x88]
mov ecx, ebx
push str.chrome_elf.dll
call fcn.0040394a
mov ecx, ebx
call fcn.0040391e
mov esi, eax
cmp byte [ebx + 0xb], 0
jns 0x4014a6
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
test esi, esi
je 0x4014bc
push str.SignalChromeElf
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4014bc
call eax
mov dword [esp + 8], edi
lea eax, [esp + 0x298]
push eax
call fcn.0043b250
add esp, 4
mov edi, dword [esp + 0x298]
mov ebx, dword [esp + 0x29c]
lea esi, [esp + 0x88]
mov ecx, esi
push str.chksig:elf
call fcn.004043d8
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x40154f
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
jmp 0x40161b
mov edi, dword [0x532150]
sub eax, edi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, edi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea edi, [ecx + ecx]
cmp edi, edx
cmovb edi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, edi
lea edi, [esp + 0x2c8]
mov ecx, edi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esp + 0x2d0], 0x18
mov ecx, 0x532150
push edi
call fcn.0040c740
mov ecx, edi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
jns 0x40161b
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x298]
call fcn.0042c570
call fcn.00441a60
cmp eax, 2
mov edi, dword [esp + 8]
jg 0x401654
cmp dword [0x533464], 5
jl 0x401654
mov dword [0x533464], 2
mov dword [0x530f90], 4
jmp 0x4016ab
cmp eax, 4
jl 0x4016ab
movzx ebx, byte [esp + 0x3f]
test bl, bl
jns 0x401666
mov ebx, dword [esp + 0x38]
test ebx, ebx
je 0x4016a6
push 0x4e4394
call fcn.004cfa30
add esp, 4
cmp eax, ebx
jne 0x401692
lea ecx, [esp + 0x34]
push ebx
push 0x4e4394
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
je 0x4016a6
mov ecx, edi
push str.in_chromeie
call fcn.0042d9e0
test al, al
je 0x401bd1
call fcn.00440d80
cmp dword [edi + 0x1c], 1
ja 0x401773
mov edi, dword [esp + 8]
mov ebx, dword [edi + 0x14]
add edi, 0x18
cmp edi, ebx
je 0x401726
push str.profile_directory
call fcn.004cfa30
add esp, 4
movzx ecx, byte [ebx + 0x1b]
test cl, cl
jns 0x4016db
mov ecx, dword [ebx + 0x14]
cmp eax, ecx
jne 0x401773
lea ecx, [ebx + 0x10]
push eax
push str.profile_directory
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
jne 0x401773
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x40170a
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x401700
jmp 0x401720
mov eax, dword [ebx + 8]
cmp dword [eax], ebx
je 0x401720
add ebx, 8
mov ecx, dword [ebx]
lea ebx, [ecx + 8]
mov eax, dword [ecx + 8]
cmp dword [eax], ecx
jne 0x401714
mov ebx, eax
cmp edi, eax
jne 0x4016c3
mov ecx, esi
call fcn.004303a0
push esi
call fcn.0044a8ae
add esp, 4
test al, al
je 0x401767
push esi
call fcn.0044a274
add esp, 4
test eax, eax
je 0x401767
push eax
call fcn.0044a27d
add esp, 4
mov esi, eax
lea ecx, [esp + 0x88]
call fcn.004304c0
test esi, esi
jne 0x401773
jmp 0x401ae0
lea ecx, [esp + 0x88]
call fcn.004304c0
lea ebx, [esp + 0x78]
push ebx
call fcn.0043b250
add esp, 4
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov esi, dword [ebx + 4]
lea edi, [esp + 0x88]
mov ecx, edi
push str.1101
call fcn.004043d8
mov dword [edi + 0x14], esi
mov eax, dword [esp + 4]
mov dword [edi + 0x10], eax
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x401800
mov esi, edi
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
jmp 0x4018d3
mov edi, dword [0x532150]
sub eax, edi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, edi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea esi, [ecx + ecx]
cmp esi, edx
cmovb esi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, esi
lea esi, [esp + 0x2c8]
mov ecx, esi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esp + 0x2d0], 0x18
mov ecx, 0x532150
push esi
call fcn.0040c740
mov ecx, esi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
lea esi, [esp + 0x88]
jns 0x4018d3
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
mov edi, dword [esp + 8]
cmp dword [edi + 0x1c], 0
jne 0x40195a
xor esi, esi
push 0x20a
push esi
lea eax, [esp + 0x90]
push eax
call fcn.004b8bc0
add esp, 0xc
push esi
push 0x1a
lea eax, [esp + 0x90]
push eax
push esi
lea esi, [esp + 0x98]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40194d
push esi
call fcn.004cc779
add esp, 4
push esi
call fcn.004d03ae
add esp, 4
cmp eax, 4
jb 0x40194d
push str.system32config_systemprofile
push esi
call fcn.004b935c
add esp, 8
test eax, eax
jne 0x40194d
push 0x4e311e
push esi
call fcn.004b935c
add esp, 8
test eax, eax
je 0x40195a
call fcn.0040f528
test al, al
jne 0x401ae0
mov eax, str.windows10_f12
mov dword [esp + 0x88], eax
push eax
call fcn.004cfa30
add esp, 4
mov dword [esp + 0x8c], eax
mov ecx, edi
push esi
push ebx
call fcn.0042da50
mov al, byte [esp + 0x83]
test al, al
js 0x40199a
je 0x401ad7
movzx ecx, al
add ecx, esp
add ecx, 0x78
jmp 0x4019ac
mov ebx, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x401ace
add ecx, ebx
cmp ebx, ecx
je 0x4019d1
dec ecx
cmp ecx, ebx
jbe 0x4019d1
inc ebx
mov al, byte [ebx - 1]
mov dl, byte [ecx]
mov byte [ebx - 1], dl
mov byte [ecx], al
dec ecx
lea eax, [ebx + 1]
cmp ebx, ecx
mov ebx, eax
jb 0x4019b6
mov al, byte [esp + 0x83]
lea esi, [esp + 0x68]
mov dword [esi], 0
test al, al
lea ecx, [esp + 0x78]
mov edx, dword [ecx]
cmovns edx, ecx
movzx eax, al
cmovs eax, dword [ecx + 4]
push esi
push eax
push edx
call fcn.00436c40
add esp, 0xc
mov edi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401ab6
call fcn.00441a60
cmp eax, 7
jl 0x401ab6
xor esi, esi
lea ebx, [esp + 0x58]
mov dword [ebx], esi
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, 0x104
push eax
push esi
lea edi, [esp + 0x2d0]
push edi
call fcn.004b8bc0
add esp, 0xc
push dword [esp + 0x68]
push dword [ebx]
push str._d__X
push edi
call fcn.0040445c
add esp, 0x10
push 0x208
push esi
lea esi, [esp + 0x90]
push esi
call fcn.004b8bc0
add esp, 0xc
mov eax, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.F12F12AppFrame.dll
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401ab6
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x401ab6
push str.AttachTools
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401ab6
xor ecx, ecx
push ecx
lea edx, [esp + 0x2cc]
push edx
push ecx
push ecx
call eax
cmp byte [esp + 0x83], 0
jns 0x401ae0
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
jmp 0x401ae0
push ebx
call fcn.004af3c6
add esp, 4
call fcn.0040eca8
test al, al
je 0x401b25
mov dword [esp + 4], 0
lea ecx, [esp + 0x298]
call fcn.0042c5a0
cmp byte [esp + 0x3f], 0
jns 0x401b07
push dword [esp + 0x34]
call fcn.004af3c6
add esp, 4
mov esi, dword [esp + 4]
mov ecx, dword [esp + 0x4e0]
xor ecx, ebp
call fcn.004af401
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x3f]
test al, al
jns 0x401b3a
mov eax, dword [esp + 0x38]
test eax, eax
je 0x401f50
lea edi, [esp + 0x78]
push edi
call fcn.0043b250
add esp, 4
mov esi, dword [edi]
mov dword [esp + 0x10], edi
mov edi, dword [edi + 4]
lea ebx, [esp + 0x88]
mov ecx, ebx
push str.1144
call fcn.004043d8
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], esi
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x401c13
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
mov edi, dword [esp + 8]
jmp 0x401ce3
push 0x4e43c8
call fcn.004cfa30
add esp, 4
movzx ecx, byte [esp + 0x3f]
test cl, cl
jns 0x401beb
mov ecx, dword [esp + 0x38]
cmp eax, ecx
jne 0x4016ab
lea ecx, [esp + 0x34]
push eax
push 0x4e43c8
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
jne 0x4016ab
jmp 0x4016a6
mov esi, dword [0x532150]
sub eax, esi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, esi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea esi, [ecx + ecx]
cmp esi, edx
cmovb esi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, esi
lea esi, [esp + 0x2c8]
mov ecx, esi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esp + 0x2d0], 0x18
mov ecx, 0x532150
push esi
call fcn.0040c740
mov ecx, esi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
mov edi, dword [esp + 8]
jns 0x401ce3
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
call fcn.0042d530
mov esi, eax
mov eax, 0x4e43a6
mov dword [esp + 0x88], eax
push eax
call fcn.004cfa30
add esp, 4
mov dword [esp + 0x8c], eax
mov ecx, esi
push ebx
lea eax, [esp + 0x2cc]
push eax
call fcn.0042da50
movzx eax, byte [esp + 0x2d3]
test al, al
jns 0x401d29
mov eax, dword [esp + 0x2cc]
test eax, eax
je 0x401f7c
mov ecx, esi
push str.360chromeautoupdate
call fcn.0042d9e0
test al, al
je 0x401d5b
lea ecx, [esp + 0x88]
push esi
call fcn.0042d0a0
lea edi, [esp + 0x78]
mov ecx, edi
push str.v3autoupdate
jmp 0x401d87
mov ecx, esi
push str.360chrome_safe_browsing_autoupdate
call fcn.0042d9e0
test al, al
je 0x40233b
lea ecx, [esp + 0x88]
push esi
call fcn.0042d0a0
lea edi, [esp + 0x78]
mov ecx, edi
push str.v3safe_browsing_autoupdate
call fcn.004043d8
lea esi, [esp + 0x68]
mov ecx, esi
push 0x4e371a
call fcn.004043d8
lea ecx, [esp + 0x88]
push esi
push edi
call fcn.0042e380
cmp byte [esi + 0xb], 0
jns 0x401dbc
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x88]
push esi
call fcn.0042ebf0
push esi
push dword [ebp + 8]
call fcn.0040f0c2
add esp, 8
cmp byte [esp + 0x73], 0
jns 0x401de8
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
mov esi, ebx
cmp byte [esp + 0x83], 0
mov edi, dword [esp + 8]
jns 0x401e04
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x88]
call fcn.0042d1f0
mov bl, 1
cmp byte [esp + 0x2d3], 0
jns 0x401e2b
push dword [esp + 0x2c8]
call fcn.004af3c6
add esp, 4
test bl, bl
jne 0x401ae8
movzx eax, byte [esp + 0x3f]
test al, al
jns 0x401e40
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x401ea1
mov ecx, edi
push str.360chromeautoupdate
call fcn.0042d9e0
test al, al
jne 0x401ea1
mov ecx, edi
push str.360chrome_safe_browsing_autoupdate
call fcn.0042d9e0
test al, al
jne 0x401ea1
mov ecx, edi
push str.360chrome_safe_browsing_white
call fcn.0042d9e0
test al, al
jne 0x401ea1
mov ecx, edi
push 0x4e31b4
call fcn.0042d9e0
test al, al
jne 0x401ea1
mov ecx, edi
push 0x4e31cd
call fcn.0042d9e0
test al, al
jne 0x401ea1
call fcn.00443d20
test al, al
je 0x402afc
mov dword [esp + 4], 0
mov ecx, edi
push str.in_chromeie
call fcn.0042d9e0
test al, al
je 0x401ebe
call fcn.00410290
lea eax, [esp + 0x78]
push eax
call fcn.0043b250
add esp, 4
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x7c]
lea ebx, [esp + 0x88]
mov ecx, ebx
push str.handle_cmdline
call fcn.004043d8
mov dword [ebx + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [ebx + 0x10], esi
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x402189
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
mov edi, dword [esp + 8]
jmp 0x402259
mov byte [esp + 0x88], 1
push esi
call fcn.0040edd0
add esp, 4
cmp byte [esp + 0x88], 0
je 0x401b42
test al, al
jne 0x401ae8
jmp 0x401b42
call fcn.0040ee48
test eax, eax
je 0x401d31
mov ecx, esi
push str.uninstall_cud_disabledlg
call fcn.0042d9e0
test al, al
jne 0x401d31
lea ecx, [esp + 0x88]
push esi
call fcn.0042d0a0
lea ecx, [esp + 0x78]
mov ebx, ecx
push str.v3pendupdate
call fcn.004043d8
lea ecx, [esp + 0x68]
push str.v3reboot
call fcn.004043d8
lea ecx, [esp + 0x58]
push str.v3highprivilidge
call fcn.004043d8
lea ecx, [esp + 0x4c]
push str.v3seProcId
call fcn.004043d8
lea edi, [esp + 0x40]
mov ecx, edi
push 0x4e371a
call fcn.004043d8
lea ecx, [esp + 0x88]
push edi
push ebx
call fcn.0042e380
cmp byte [edi + 0xb], 0
jns 0x402014
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
mov ecx, edi
push 0x4e371a
call fcn.004043d8
lea ecx, [esp + 0x88]
push edi
lea eax, [esp + 0x6c]
push eax
call fcn.0042e380
cmp byte [esp + 0x4b], 0
jns 0x402045
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
xor eax, eax
lea edi, [esp + 0x4d0]
mov dword [edi + 4], eax
mov dword [edi], eax
mov word [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4e371c
push edi
call fcn.0040445c
add esp, 0xc
lea ebx, [esp + 0x40]
mov ecx, ebx
push edi
call fcn.004043d8
lea ecx, [esp + 0x88]
push ebx
lea eax, [esp + 0x50]
push eax
call fcn.0042e380
cmp byte [esp + 0x4b], 0
jns 0x40209f
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
call fcn.0040f4cd
test eax, eax
lea ebx, [esp + 0x88]
je 0x4020e4
lea edi, [esp + 0x40]
mov ecx, edi
push 0x4e371a
call fcn.004043d8
lea ecx, [esp + 0x88]
push edi
lea eax, [esp + 0x5c]
push eax
call fcn.0042e380
cmp byte [esp + 0x4b], 0
jns 0x4020e4
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x88]
lea edi, [esp + 0x40]
push edi
call fcn.0042ebf0
push edi
push dword [ebp + 8]
call fcn.0040f0c2
add esp, 8
mov dword [esp + 0x18], eax
cmp byte [esp + 0x4b], 0
jns 0x402118
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x57], 0
jns 0x40212b
push dword [esp + 0x4c]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x63], 0
mov edi, dword [esp + 8]
jns 0x402142
push dword [esp + 0x58]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x73], 0
jns 0x402155
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x83], 0
jns 0x40216b
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x88]
call fcn.0042d1f0
cmp dword [esp + 0x18], 0
jne 0x401d31
mov esi, ebx
jmp 0x401e10
mov esi, dword [0x532150]
sub eax, esi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, esi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea esi, [ecx + ecx]
cmp esi, edx
cmovb esi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, esi
lea esi, [esp + 0x2c8]
mov ecx, esi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esp + 0x2d0], 0x18
mov ecx, 0x532150
push esi
call fcn.0040c740
mov ecx, esi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
mov edi, dword [esp + 8]
jns 0x402259
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
movzx eax, byte [esp + 0x3f]
test al, al
jns 0x402266
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40227e
mov ecx, edi
push str.in_chromeie
call fcn.0042d9e0
test al, al
je 0x40263d
call fcn.0040d68e
mov esi, eax
xor eax, eax
lea edx, [esp + 0x78]
mov dword [edx + 4], eax
mov dword [edx], eax
mov dword [edx + 8], eax
lea edi, [esp + 0x68]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
push edx
call fcn.0040ca08
test esi, esi
je 0x4022b4
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
lea esi, [esp + 0x58]
push esi
call fcn.0043b250
add esp, 4
mov ebx, dword [esi]
mov edi, dword [esi + 4]
lea esi, [esp + 0x88]
mov ecx, esi
push str.main_dll_loader:get_dll_info
call fcn.004043d8
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x4023df
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
jmp 0x4024a3
mov ecx, esi
push str.360chrome_safe_browsing_white
call fcn.0042d9e0
test al, al
je 0x40279a
lea ecx, [esp + 0x88]
push esi
call fcn.0042d0a0
lea ecx, [esp + 0x78]
push str.v3safe_browsing_white
call fcn.004043d8
lea esi, [esp + 0x68]
mov ecx, esi
push 0x4e371a
call fcn.004043d8
lea ecx, [esp + 0x88]
push esi
lea eax, [esp + 0x7c]
push eax
call fcn.0042e380
cmp byte [esi + 0xb], 0
jns 0x40239e
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x88]
push esi
call fcn.0042ebf0
push esi
push dword [ebp + 8]
call fcn.0040f0c2
add esp, 8
cmp byte [esp + 0x73], 0
jns 0x4023ca
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
mov esi, ebx
cmp byte [esp + 0x83], 0
jns 0x401e04
jmp 0x401df8
mov esi, dword [0x532150]
sub eax, esi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, esi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea esi, [ecx + ecx]
cmp esi, edx
cmovb esi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, esi
lea esi, [esp + 0x2c8]
mov ecx, esi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esi + 8], 0x18
mov ecx, 0x532150
push esi
call fcn.0040c740
mov ecx, esi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
jns 0x4024a3
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x68]
push str.360base.dll
call fcn.00429ed8
cmp byte [eax + 0xb], 0
jns 0x4024b9
mov eax, dword [eax]
push eax
call fcn.00442f30
add esp, 4
lea eax, [esp + 0x58]
push eax
call fcn.0043b250
add esp, 4
mov edi, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
lea esi, [esp + 0x88]
mov ecx, esi
push str.chksig:360base
call fcn.004043d8
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x40254c
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
mov edi, dword [esp + 8]
jmp 0x402614
mov esi, dword [0x532150]
sub eax, esi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
mov edi, dword [esp + 8]
jae 0x4037c3
sub ecx, esi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea esi, [ecx + ecx]
cmp esi, edx
cmovb esi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, esi
lea esi, [esp + 0x2c8]
mov ecx, esi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esi + 8], 0x18
mov ecx, 0x532150
push esi
call fcn.0040c740
mov ecx, esi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
jns 0x402614
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x73], 0
jns 0x402627
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x83], 0
jns 0x40263d
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
movzx eax, byte [esp + 0x3f]
test al, al
jns 0x40264a
mov eax, dword [esp + 0x38]
cmp eax, 8
je 0x402711
test eax, eax
jne 0x402755
call fcn.0042d530
mov edi, eax
lea esi, [esp + 0x88]
mov ecx, esi
call fcn.004303a0
push esi
call fcn.0044a8ae
add esp, 4
test al, al
je 0x4027a3
lea eax, [esp + 0x88]
push eax
call fcn.0044a274
add esp, 4
test eax, eax
je 0x4027a3
mov dword [esp + 8], edi
xor ebx, ebx
lea edi, [esp + 0x68]
mov dword [edi], ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea esi, [esp + 0x2c8]
push ebx
push dword [edi]
push esi
call fcn.00442320
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edi, [esp + 0x78]
push ebx
push eax
push edi
call fcn.00442320
add esp, 0xc
movzx eax, byte [esi + 0xb]
mov edx, eax
test al, al
jns 0x4026e6
mov edx, dword [esp + 0x2cc]
movzx ecx, byte [esp + 0x83]
test edx, edx
je 0x4028ee
test cl, cl
js 0x4029b4
cmp edx, ecx
je 0x4029be
xor ebx, ebx
mov edi, dword [esp + 8]
jmp 0x402a07
lea ecx, [esp + 0x34]
push 8
push 0x4e323e
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
jne 0x402755
mov ecx, edi
push str.360se_crash_renderer
call fcn.0042d9e0
test al, al
je 0x402755
mov ecx, edi
push str.no_sandbox
call fcn.0042d9e0
mov dword [esp + 4], 0x360
test al, al
je 0x401ae8
call fcn.0040d68e
mov esi, eax
lea edi, [esp + 0x28]
push edi
call fcn.0043b250
add esp, 4
mov ecx, esi
push dword [edi + 4]
push dword [edi]
push dword [ebp + 8]
call fcn.0040cbd8
mov edi, eax
mov ecx, esi
call fcn.0040d2e6
test esi, esi
mov dword [esp + 4], edi
je 0x402a59
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
jmp 0x402a59
mov esi, ebx
xor ebx, ebx
jmp 0x401e12
lea ecx, [esp + 0x88]
call fcn.004304c0
mov ecx, edi
push 0x4e31b4
call fcn.0042d9e0
test al, al
jne 0x402a2e
xor esi, esi
dec esi
cmp esi, 3
je 0x4027e7
mov ecx, edi
push dword [esi*4 + 0x4e3768]
call fcn.0042d9e0
inc esi
test al, al
je 0x4027c6
cmp esi, 4
jb 0x402a2e
mov ecx, edi
push 0x4e37a8
lea eax, [esp + 0x8c]
push eax
call fcn.0042db40
mov al, byte [esp + 0x93]
test al, al
js 0x40280c
cmp al, 5
je 0x402821
jmp 0x40282d
cmp dword [esp + 0x8c], 5
jne 0x40282d
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x18], ecx
mov bl, 1
mov ecx, dword [esp + 0x18]
cmp word [ecx], 0x33
je 0x40282f
xor ebx, ebx
test al, al
jns 0x402842
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
test bl, bl
jne 0x402a2e
lea esi, [esp + 0x88]
mov ecx, esi
push 0x2001f
push 0x4e37b0
push 0x80000001
call fcn.004405b0
mov dword [esp + 0x78], 0
mov ecx, esi
lea eax, [esp + 0x78]
push eax
push str.clean_snap_shot
call fcn.00440b30
cmp dword [esp + 0x78], 1
jne 0x4028f7
lea esi, [esp + 0x88]
mov ecx, esi
push str.clean_snap_shot
call fcn.00440b10
mov ecx, esi
push 0x4e3804
call fcn.00440b10
mov ecx, esi
push 0x4e380a
call fcn.00440b10
lea edi, [esp + 0x2c8]
mov ecx, edi
push 0x2001f
push 0x4e3810
push 0x80000001
call fcn.004405b0
mov ecx, edi
push str.ui_persist_value
call fcn.00440790
mov ecx, edi
call fcn.00440720
mov ecx, esi
call fcn.00440720
jmp 0x402a2e
mov dword [esp + 0x1c], ecx
jmp 0x4029e1
lea esi, [esp + 0x88]
mov ecx, esi
call fcn.00440720
mov ecx, edi
push str.programid
call fcn.0042d9e0
test al, al
jne 0x402a2e
mov ecx, edi
push esi
call fcn.0042e400
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
sub ecx, eax
cmp ecx, 0xc
mov dword [esp + 8], edi
jne 0x402ae9
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x40294b
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea esi, [esp + 0x2c8]
mov ecx, esi
push edx
push eax
call fcn.00430400
lea edi, [esp + 0x78]
mov ecx, esi
push edi
call fcn.004316b0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x402977
mov edi, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
lea esi, [esp + 0x58]
push 3
push eax
push edi
push esi
call fcn.00438a20
add esp, 0x10
lea ebx, [esp + 0x68]
mov ecx, esi
push ebx
call fcn.004044be
cmp byte [esp + 0x83], 0
js 0x402b56
xor eax, eax
mov byte [esp + 0x78], al
mov byte [esp + 0x83], al
jmp 0x402b86
cmp edx, dword [esp + 0x7c]
jne 0x4029ee
mov edi, dword [esp + 0x78]
mov dword [esp + 0x1c], ecx
test al, al
jns 0x4029cd
mov esi, dword [esp + 0x2c8]
xor ecx, ecx
movzx ebx, word [esi + ecx*2]
cmp bx, word [edi + ecx*2]
sete bl
jne 0x4029e1
inc ecx
cmp edx, ecx
jne 0x4029cf
cmp byte [esp + 0x1c], 0
mov edi, dword [esp + 8]
jns 0x402a07
jmp 0x4029f4
xor ebx, ebx
mov edi, dword [esp + 8]
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
mov al, byte [esp + 0x2d3]
test al, al
jns 0x402a1a
push dword [esp + 0x2c8]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x88]
call fcn.004304c0
test bl, bl
je 0x4027af
push dword [ebp + 8]
call fcn.004039e0
add esp, 4
mov esi, eax
cmp byte [esp + 4], 0
je 0x402a47
call fcn.0042bf3f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x4e43ab
call fcn.004cfa30
add esp, 4
mov bl, byte [esp + 0x3f]
test bl, bl
mov esi, dword [esp + 0x38]
movzx edi, bl
mov ecx, edi
cmovs ecx, esi
cmp eax, ecx
jne 0x402a9e
lea ecx, [esp + 0x34]
push eax
push 0x4e43ab
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
je 0x402ad3
mov bl, byte [esp + 0x3f]
mov esi, dword [esp + 0x38]
movzx edi, bl
push 0x4e43a0
call fcn.004cfa30
add esp, 4
test bl, bl
cmovs edi, esi
cmp eax, edi
jne 0x401ae8
lea ecx, [esp + 0x34]
push eax
push 0x4e43a0
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
jne 0x401ae8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x401ae8
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
jmp 0x402cb8
call fcn.0042beae
test al, al
je 0x402b0e
call fcn.0042c055
test al, al
je 0x402b46
mov dword [esp + 0x88], 0
push esi
call fcn.0042b205
add esp, 4
mov eax, dword [esp + 0x88]
or eax, 4
mov dword [esp + 0x88], eax
push eax
call fcn.0042b85b
add esp, 4
call fcn.0042c049
call fcn.0042c0e4
call fcn.0042bfc3
mov al, 1
mov dword [esp + 4], eax
jmp 0x401ea9
mov eax, dword [esp + 0x78]
mov byte [eax], 0
mov dword [esp + 0x7c], 0
cmp byte [esp + 0x83], 0
jns 0x402b86
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x80], eax
movsd xmm0, qword [esp + 0x68]
movsd qword [esp + 0x78], xmm0
mov ecx, ebx
push str.https:__
call fcn.004043d8
movzx eax, byte [esp + 0x73]
test al, al
jns 0x402bba
mov ebx, dword [esp + 0x68]
mov eax, dword [esp + 0x6c]
movzx ecx, byte [esp + 0x83]
test cl, cl
jns 0x402bd0
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
jmp 0x402bd4
lea edx, [esp + 0x78]
push 1
push eax
push ebx
push ecx
push edx
call fcn.00439050
add esp, 0x14
test al, al
je 0x402bea
xor ebx, ebx
jmp 0x402c47
mov ecx, esi
push str.http:__
call fcn.004043d8
movzx eax, byte [esp + 0x63]
test al, al
jns 0x402c07
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
movzx ecx, byte [esp + 0x83]
test cl, cl
jns 0x402c1d
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
jmp 0x402c21
lea edx, [esp + 0x78]
push 1
push eax
push esi
push ecx
push edx
call fcn.00439050
add esp, 0x14
mov ebx, eax
cmp byte [esp + 0x63], 0
jns 0x402c44
push dword [esp + 0x58]
call fcn.004af3c6
add esp, 4
xor bl, 1
cmp byte [esp + 0x73], 0
jns 0x402c5a
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
test bl, bl
je 0x402c84
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
cmp byte [esp + 0x83], 0
jns 0x402cac
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
jmp 0x402cac
mov eax, dword [esp + 0x80]
mov dword [esp + 0x48], eax
movsd xmm0, qword [esp + 0x78]
movsd qword [esp + 0x40], xmm0
xor eax, eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x80], eax
lea ecx, [esp + 0x2c8]
call fcn.004304c0
lea ecx, [esp + 0x88]
call fcn.00404542
movzx ecx, byte [esp + 0x4b]
mov eax, ecx
test cl, cl
jns 0x402cd3
mov eax, dword [esp + 0x44]
test eax, eax
je 0x402cee
test cl, cl
jns 0x402ce1
mov ebx, dword [esp + 0x40]
jmp 0x402ce5
lea ebx, [esp + 0x40]
cmp eax, 3
jge 0x402e3c
xor ebx, ebx
cmp byte [esp + 0x4b], 0
jns 0x402d03
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
test bl, bl
mov esi, dword [esp + 8]
jne 0x402a2e
mov ecx, esi
push str.disable_presetui
call fcn.0042d9e0
test al, al
jne 0x402a2e
mov ecx, esi
push str.incognito
call fcn.0042d9e0
test al, al
jne 0x402a2e
mov ecx, esi
push str.no_startup_window
call fcn.0042d9e0
test al, al
jne 0x402a2e
mov eax, dword [ebp + 8]
mov dword [0x532168], eax
xor edi, edi
call fcn.00443d20
mov esi, 0
test al, al
jne 0x402d79
sub esp, 0x10
movaps xmm0, xmmword [section..rdata]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [esp + 0x88], edi
lea eax, [esp + 0x88]
push eax
push edi
push esi
push 0x40c200
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x402db5
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x78]
push esi
call fcn.0043b250
add esp, 4
mov edi, dword [esi]
mov ebx, dword [esi + 4]
lea esi, [esp + 0x88]
mov ecx, esi
push str.presetui
call fcn.004043d8
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x402f30
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
jmp 0x402a2e
lea edi, [ebx + eax]
mov esi, ebx
add eax, 0xfffffffe
je 0x402cee
push eax
push 0x3a
push esi
call fcn.004b7060
add esp, 0xc
test eax, eax
je 0x402cee
mov esi, eax
movzx eax, word [eax]
xor eax, 0x2f3a
movzx ecx, byte [esi + 2]
xor ecx, 0x2f
or cx, ax
je 0x402e83
inc esi
mov eax, edi
sub eax, esi
cmp eax, 3
jge 0x402e41
jmp 0x402cee
cmp esi, edi
je 0x402cee
sub esi, ebx
cmp esi, 0xffffffff
je 0x402cee
lea edx, [esp + 0x4c]
lea eax, [esp + 0x40]
lea ebx, [esp + 0x88]
mov ecx, ebx
push edx
push esi
push 0
mov dword [esp + 0x24], eax
push eax
call fcn.00428bb4
mov al, byte [ebx + 0xb]
test al, al
mov ecx, dword [ebx + 4]
movzx edx, al
mov edi, edx
cmovs edi, ecx
cmp edi, 4
jne 0x402efa
lea ecx, [esp + 0x88]
push 4
push str.http
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
je 0x402ffd
mov al, byte [esp + 0x93]
mov ecx, dword [esp + 0x8c]
movzx edx, al
test al, al
cmovs edx, ecx
cmp edx, 5
jne 0x402f23
lea ecx, [esp + 0x88]
push 5
push str.https
push 0xffffffffffffffff
push 0
call fcn.004297ba
test eax, eax
je 0x402ffd
mov dword [esp + 0xc], 0
jmp 0x4031d9
mov esi, dword [0x532150]
sub eax, esi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4037c3
sub ecx, esi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea esi, [ecx + ecx]
cmp esi, edx
cmovb esi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, esi
lea esi, [esp + 0x2c8]
mov ecx, esi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x90]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x88]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
movsd xmm0, qword [esp + 0x98]
movsd qword [eax + 0x10], xmm0
add dword [esi + 8], 0x18
mov ecx, 0x532150
push esi
call fcn.0040c740
mov ecx, esi
call fcn.0040c7ca
cmp byte [esp + 0x93], 0
jns 0x402a2e
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
jmp 0x402a2e
add esi, 3
lea edi, [esp + 0x2c8]
mov ecx, edi
lea eax, [esp + 0x4c]
push eax
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x4c]
push eax
call fcn.00428bb4
mov cl, byte [esp + 0x2d3]
test cl, cl
mov eax, dword [esp + 0x2c8]
mov edx, dword [esp + 0x2cc]
mov dword [esp + 0x1c], eax
cmovs edi, eax
mov byte [esp + 0x17], cl
movzx eax, cl
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
cmovs eax, edx
test eax, eax
jle 0x4030ce
lea ebx, [edi + eax]
mov esi, edi
push eax
push 0x2f
push esi
call fcn.004b7060
add esp, 0xc
test eax, eax
je 0x4030ce
mov esi, eax
cmp byte [eax], 0x2f
je 0x403076
inc esi
mov eax, ebx
sub eax, esi
test eax, eax
jg 0x403054
jmp 0x4030ce
cmp esi, ebx
je 0x4030ce
sub esi, edi
xor eax, eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x80], eax
cmp esi, 0xffffffff
je 0x4030df
lea edi, [esp + 0x2d4]
lea ecx, [esp + 0x68]
push edi
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x2d4]
push eax
call fcn.00428bb4
cmp byte [esp + 0x83], 0
js 0x403449
xor eax, eax
mov byte [esp + 0x78], al
mov byte [esp + 0x83], al
jmp 0x403479
xor eax, eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x80], eax
cmp byte [esp + 0x17], 0
lea eax, [esp + 0x2c8]
mov ecx, dword [esp + 0x1c]
cmovns ecx, eax
mov eax, dword [esp + 0x24]
cmovs eax, dword [esp + 0x20]
push 1
push 8
push str.e.so.com
push eax
push ecx
call fcn.00439180
add esp, 0x14
test al, al
jne 0x403188
movzx eax, byte [esp + 0x2d3]
test al, al
jns 0x403130
mov eax, dword [esp + 0x2c8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2cc]
push 1
push 0xb
push str..mediav.com
push eax
push dword [esp + 0x1c]
call fcn.00439180
add esp, 0x14
test al, al
jne 0x403188
movzx eax, byte [esp + 0x2d3]
test al, al
jns 0x403166
mov ecx, dword [esp + 0x2c8]
mov eax, dword [esp + 0x2cc]
jmp 0x40316d
lea ecx, [esp + 0x2c8]
push 1
push 9
push str.tf.360.cn
push eax
push ecx
call fcn.00439180
add esp, 0x14
test al, al
je 0x40324a
movzx ecx, byte [esp + 0x4b]
test cl, cl
jns 0x40319d
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x44]
cmp ecx, 7
jge 0x403204
mov dword [esp + 0xc], 0
cmp byte [esp + 0x83], 0
jns 0x4031c0
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x2d3], 0
jns 0x4031d9
push dword [esp + 0x2c8]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x93], 0
jns 0x4031f2
push dword [esp + 0x88]
call fcn.004af3c6
add esp, 4
mov bl, 1
cmp byte [esp + 0xc], 0
je 0x402cee
jmp 0x402cf0
mov eax, dword [esp + 0x18]
lea esi, [eax + ecx]
mov edi, 0x4d515f5f
mov ebx, 0x5f5f4d4d
add ecx, 0xfffffffa
je 0x4031a2
push ecx
push 0x5f
push eax
call fcn.004b7060
add esp, 0xc
test eax, eax
je 0x4031a2
mov ecx, dword [eax]
xor ecx, edi
mov edx, dword [eax + 3]
xor edx, ebx
or edx, ecx
je 0x403266
inc eax
mov ecx, esi
sub ecx, eax
cmp ecx, 7
jge 0x403215
jmp 0x4031a2
movzx eax, byte [esp + 0x2d3]
test al, al
jns 0x403286
mov ecx, dword [esp + 0x2c8]
mov eax, dword [esp + 0x2cc]
jmp 0x40328d
cmp eax, esi
je 0x4031a2
sub eax, dword [esp + 0x18]
mov cl, 1
mov dword [esp + 0xc], ecx
cmp eax, 0xffffffff
jne 0x4031aa
jmp 0x4031a2
lea ecx, [esp + 0x2c8]
push 0xc
push str.so.mp.360.cn
push eax
push ecx
call fcn.00438710
add esp, 0x10
test al, al
je 0x4032fc
movzx eax, byte [esp + 0x83]
mov ebx, dword [esp + 0x10]
test al, al
jns 0x4032ba
mov ebx, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
test eax, eax
jle 0x4031a2
lea edi, [ebx + eax]
mov esi, ebx
push eax
push 0x3f
push esi
call fcn.004b7060
add esp, 0xc
test eax, eax
je 0x4031a2
mov esi, eax
cmp byte [eax], 0x3f
je 0x40353e
inc esi
mov eax, edi
sub eax, esi
mov dword [esp + 0xc], 0
test eax, eax
jg 0x4032c7
jmp 0x4031aa
lea esi, [esp + 0x58]
mov ecx, esi
push str.360APP084DFF939E0341E6AD76B20424999C4E
call fcn.004043d8
lea ecx, [esp + 0x68]
lea edx, [esp + 0x40]
push esi
call fcn.00404593
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x40332f
push dword [esp + 0x58]
call fcn.004af3c6
add esp, 4
movzx eax, byte [esp + 0x73]
mov ecx, eax
test al, al
jns 0x40333e
mov ecx, dword [esp + 0x6c]
cmp ecx, 0x15
jb 0x4035e0
mov ecx, esi
push 0x4e38e8
call fcn.004043d8
lea ebx, [esp + 0x4c]
mov ecx, ebx
push 0x4e38ea
call fcn.004043d8
lea ecx, [esp + 0x68]
mov edx, ebx
push esi
call fcn.00404953
add esp, 4
cmp byte [ebx + 0xb], 0
jns 0x403384
push dword [esp + 0x4c]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x63], 0
jns 0x403397
push dword [esp + 0x58]
call fcn.004af3c6
add esp, 4
mov ecx, esi
push 0x4e38ee
call fcn.004043d8
lea edi, [esp + 0x4c]
mov ecx, edi
push 0x4e38f0
call fcn.004043d8
lea ecx, [esp + 0x68]
mov edx, edi
push esi
call fcn.00404953
add esp, 4
cmp byte [edi + 0xb], 0
jns 0x4033d4
push dword [esp + 0x4c]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x63], 0
jns 0x4033e7
push dword [esp + 0x58]
call fcn.004af3c6
add esp, 4
mov ecx, edi
push str.appid
call fcn.004043d8
lea ecx, [esp + 0x58]
lea edx, [esp + 0x68]
push edi
call fcn.00404593
add esp, 4
cmp byte [esp + 0x57], 0
jns 0x403417
push dword [esp + 0x4c]
call fcn.004af3c6
add esp, 4
mov al, byte [esp + 0x63]
test al, al
js 0x4035c3
cmp al, 0x12
jne 0x4035dc
cmp byte [esp + 0x73], 0
jns 0x40343e
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
mov al, 1
mov dword [esp + 0xc], eax
jmp 0x4031aa
mov eax, dword [esp + 0x78]
mov byte [eax], 0
mov dword [esp + 0x7c], 0
cmp byte [esp + 0x83], 0
jns 0x403479
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0x80], 0
lea ecx, [esp + 0x68]
mov eax, dword [ecx + 8]
mov dword [esp + 0x80], eax
movsd xmm0, qword [ecx]
movsd qword [esp + 0x78], xmm0
push edi
push esi
push 0
lea eax, [esp + 0x2d4]
push eax
call fcn.00428bb4
cmp byte [esp + 0x2d3], 0
js 0x4034be
xor eax, eax
mov byte [esp + 0x2c8], al
mov byte [esp + 0x2d3], al
jmp 0x4034f7
mov eax, dword [esp + 0x2c8]
mov byte [eax], 0
mov dword [esp + 0x2cc], 0
cmp byte [esp + 0x2d3], 0
jns 0x4034f7
push dword [esp + 0x2c8]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0x2d0], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x2d0], eax
movsd xmm0, qword [esp + 0x68]
movsd qword [esp + 0x2c8], xmm0
mov cl, byte [esp + 0x2d3]
mov eax, dword [esp + 0x2c8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2cc]
mov dword [esp + 0x20], eax
mov byte [esp + 0x17], cl
movzx eax, cl
mov dword [esp + 0x24], eax
jmp 0x4030df
mov dword [esp + 0xc], 0
cmp esi, edi
je 0x4031aa
sub esi, ebx
cmp esi, 0xffffffff
je 0x4031aa
xor edi, edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x70], edi
lea edx, [esp + 0x84]
lea eax, [esp + 0x78]
lea ebx, [esp + 0x58]
mov ecx, ebx
push edx
push 0xffffffffffffffff
push esi
push eax
call fcn.00428bb4
movsd xmm0, qword [ebx]
movsd qword [esp + 0x68], xmm0
mov eax, dword [ebx + 8]
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x58]
lea eax, [esp + 0x84]
push eax
push esi
push edi
lea esi, [esp + 0x84]
push esi
call fcn.00428bb4
cmp byte [esi + 0xb], 0
js 0x4035f9
xor eax, eax
mov byte [esp + 0x78], al
mov byte [esp + 0x83], al
jmp 0x403629
mov esi, dword [esp + 0x5c]
push dword [esp + 0x58]
call fcn.004af3c6
add esp, 4
cmp esi, 0x12
je 0x40342b
mov al, byte [esp + 0x73]
test al, al
jns 0x4031a2
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
jmp 0x4031a2
mov eax, dword [esp + 0x78]
mov byte [eax], 0
mov dword [esp + 0x7c], 0
cmp byte [esp + 0x83], 0
jns 0x403629
push dword [esp + 0x78]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0x58]
movsd qword [esi], xmm0
cmp byte [esp + 0x83], 0
jns 0x403654
mov esi, dword [esp + 0x78]
test esi, esi
je 0x403729
push esi
call fcn.004cfa30
add esp, 4
push 8
push str._mp.html
push eax
push esi
call fcn.00438710
add esp, 0x10
test al, al
jne 0x4036b0
cmp byte [esp + 0x83], 0
jns 0x40368c
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4037b4
push dword [esp + 0x10]
call fcn.004cfa30
add esp, 4
push 7
push str._mp.htm
push eax
push dword [esp + 0x1c]
call fcn.00438710
add esp, 0x10
test al, al
je 0x40371f
movzx ebx, byte [esp + 0x73]
mov eax, ebx
mov byte [esp + 0xc], bl
test bl, bl
jns 0x4036cd
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x6c]
jmp 0x4036d5
lea eax, [esp + 0x68]
mov dword [esp + 0x10], eax
cmp ebx, 7
jl 0x40378c
mov eax, dword [esp + 0x10]
lea esi, [eax + ebx]
mov edi, 0x3d646970
mov ecx, ebx
add ecx, 0xfffffffa
je 0x40373f
push ecx
push 0x3f
push eax
call fcn.004b7060
add esp, 0xc
test eax, eax
je 0x40373f
mov ecx, dword [eax]
mov edx, 0x7070613f
xor ecx, edx
mov edx, dword [eax + 3]
xor edx, edi
or edx, ecx
je 0x403732
inc eax
mov ecx, esi
sub ecx, eax
cmp ecx, 7
jge 0x4036ec
jmp 0x40373f
mov al, byte [esp + 0x73]
mov byte [esp + 0xc], al
jmp 0x40378c
xor esi, esi
xor eax, eax
jmp 0x40365d
cmp eax, esi
je 0x40373f
sub eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x403788
mov edi, 0x3d646970
mov eax, dword [esp + 0x10]
add ebx, 0xfffffffa
je 0x40378c
push ebx
push 0x26
push eax
call fcn.004b7060
add esp, 0xc
test eax, eax
je 0x40378c
mov ecx, dword [eax]
mov edx, 0x70706126
xor ecx, edx
mov edx, dword [eax + 3]
xor edx, edi
or edx, ecx
je 0x40377b
inc eax
mov ebx, esi
sub ebx, eax
cmp ebx, 7
jge 0x403748
jmp 0x40378c
cmp eax, esi
je 0x40378c
sub eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x40378c
xor ebx, ebx
jmp 0x40378e
mov bl, 1
cmp byte [esp + 0xc], 0
jns 0x4037a1
push dword [esp + 0x68]
call fcn.004af3c6
add esp, 4
mov al, 1
mov dword [esp + 0xc], eax
test bl, bl
jne 0x4031a2
jmp 0x4031aa
mov dword [esp + 0x10], 0
xor eax, eax
jmp 0x403698
mov ecx, 0x532150
call fcn.0042ab0c
call fcn.00443990
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor ecx, ecx
test esi, esi
mov edx, 0x4e32ec
mov edi, 0x4e3252
cmove edi, edx
mov edx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan.
mov ebx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan._Download_the_latest_version_
cmove ebx, edx
movzx eax, ax
setne cl
cmp eax, 0x804
cmove ebx, edi
mov eax, 0x4e3248
mov edx, str.Tips
cmove edx, eax
lea eax, [ecx*4 + 0x40]
push eax
push edx
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test esi, esi
je 0x40383b
cmp eax, 6
jne 0x40383b
push str.http:__............._
call fcn.00443ab0
add esp, 4
push 0
call fcn.004c4b13
int3