Function at 0x40d91e
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x2ac], edi
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2a8], ebx
call fcn.004380f1
push str.rename_360se_exe
lea esi, [ebp - 0x24c]
call fcn.0040204f
lea eax, [ebp - 0x230]
push eax
mov eax, esi
call fcn.0044e4da
pop ecx
push eax
mov esi, edi
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x2a2], al
call fcn.0040582f
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
cmp byte [ebp - 0x2a2], bl
je 0x40d9b7
mov eax, dword [ebp - 0x2b0]
mov dword [eax], 0xa
mov al, 1
jmp 0x40e422
push str.remove_chrome_registration
lea esi, [ebp - 0x24c]
call fcn.0040204f
lea eax, [ebp - 0x230]
push eax
mov eax, esi
call fcn.0044e4da
mov esi, dword [ebp - 0x2ac]
pop ecx
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x2a2], al
call fcn.0040582f
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
cmp byte [ebp - 0x2a2], bl
je 0x40dba3
lea ecx, [ebp - 0x2a8]
call fcn.0041268d
cmp byte [ebp - 0x2a6], bl
je 0x40da29
call fcn.00412890
lea eax, [ebp - 0x2a8]
push eax
call fcn.00412cc0
push 0x1e
xor eax, eax
mov edi, str.register_chrome_browser_suffix
push edi
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x254], 7
mov dword [ebp - 0x258], ebx
mov word [ebp - 0x268], ax
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00405913
mov esi, dword [ebp - 0x2ac]
lea eax, [ebp - 0x230]
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x2a2], al
call fcn.0040582f
cmp byte [ebp - 0x2a2], bl
je 0x40db06
push 0x1e
push edi
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00405913
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x24c]
push eax
push esi
call fcn.0044d024
push eax
lea eax, [ebp - 0x268]
call fcn.00402a57
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.0040582f
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x268]
push eax
push 0x80000002
mov dword [ebp - 0x2ac], 9
call fcn.0042d087
lea eax, [ebp - 0x2ac]
add esp, 0xc
push eax
call fcn.0042cee1
lea esi, [ebp - 0x24c]
mov dword [esp], str..crx
call fcn.0040204f
mov eax, esi
push eax
call fcn.0040e52c
push eax
lea ecx, [ebp - 0x230]
call fcn.0040e552
push eax
call fcn.004137d8
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.004021a4
push 1
lea esi, [ebp - 0x24c]
call fcn.004021a4
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x2b0]
mov dword [ecx], eax
lea esi, [ebp - 0x268]
xor edi, edi
push 1
call fcn.004021a4
jmp 0x40d9b0
push str.dissociate_crx_file
lea esi, [ebp - 0x230]
call fcn.0040204f
lea eax, [ebp - 0x284]
push eax
mov eax, esi
mov dword [ebp - 0x2a8], 3
call fcn.0044e4da
mov esi, dword [ebp - 0x2ac]
pop ecx
push eax
call fcn.0044cf63
mov byte [ebp - 0x2a1], al
cmp al, bl
jne 0x40dc21
push str.dissociate_mht_file
lea esi, [ebp - 0x24c]
call fcn.0040204f
lea eax, [ebp - 0x268]
push eax
mov eax, esi
mov dword [ebp - 0x2a8], 0xf
call fcn.0044e4da
mov esi, dword [ebp - 0x2ac]
pop ecx
push eax
call fcn.0044cf63
mov byte [ebp - 0x2a2], bl
test al, al
je 0x40dc28
mov byte [ebp - 0x2a2], 1
test byte [ebp - 0x2a8], 8
je 0x40dc46
and dword [ebp - 0x2a8], 0xfffffff7
push ebx
push 1
lea ecx, [ebp - 0x268]
call fcn.0040582f
test byte [ebp - 0x2a8], 4
je 0x40dc65
and dword [ebp - 0x2a8], 0xfffffffb
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
test byte [ebp - 0x2a8], 2
je 0x40dc83
and dword [ebp - 0x2a8], 0xfffffffd
push ebx
push 1
lea ecx, [ebp - 0x284]
call fcn.0040582f
test byte [ebp - 0x2a8], 1
je 0x40dca2
and dword [ebp - 0x2a8], 0xfffffffe
push 1
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.004021a4
cmp byte [ebp - 0x2a2], bl
je 0x40dcfc
cmp byte [ebp - 0x2a1], bl
je 0x40d9b0
push str..crx
lea esi, [ebp - 0x24c]
call fcn.0040204f
mov eax, esi
push eax
call fcn.0040e52c
push eax
lea ecx, [ebp - 0x284]
call fcn.0040e552
push eax
call fcn.004137d8
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x284]
call fcn.004021a4
lea esi, [ebp - 0x24c]
jmp 0x40db95
push 0x13
push str.inactive_user_toast
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00405913
mov esi, dword [ebp - 0x2ac]
lea eax, [ebp - 0x230]
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
cmp byte [ebp - 0x2a1], bl
je 0x40dd6f
test byte [ebp - 0x2a8], 0x10
je 0x40d9b0
lea esi, [ebp - 0x3e4]
call fcn.0044dd6a
jmp 0x40d9b0
push str.system_level_toast
lea esi, [ebp - 0x24c]
call fcn.0040204f
lea eax, [ebp - 0x284]
push eax
mov eax, esi
call fcn.0044e4da
mov esi, dword [ebp - 0x2ac]
pop ecx
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x284]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
cmp byte [ebp - 0x2a1], bl
je 0x40ddce
test byte [ebp - 0x2a8], 0x20
jmp 0x40dd59
push 0xf
pop edi
push 0xd
push str.del_setup_exe
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00405913
mov esi, dword [ebp - 0x2ac]
lea eax, [ebp - 0x230]
push eax
call fcn.0044cf63
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
lea ecx, [ebp - 0x230]
cmp byte [ebp - 0x2a1], bl
je 0x40e00c
push 0xd
push str.del_setup_exe
call fcn.00405913
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x2ac]
call fcn.0044d024
push ebx
push esi
lea ecx, [ebp - 0x230]
call fcn.0040582f
push 0x17
push str.origin_setup_exe_handle
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00405913
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x2ac]
call fcn.0044d024
push ebx
push esi
lea ecx, [ebp - 0x230]
call fcn.0040582f
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x284]
call fcn.0044a559
call fcn.00449a3d
push esi
xor edi, edi
lea esi, [ebp - 0x284]
mov byte [ebp - 0x2a1], al
call fcn.004021a4
cmp byte [ebp - 0x2a1], bl
je 0x40dff8
cmp dword [ebp - 0x238], 8
mov eax, dword [ebp - 0x24c]
jae 0x40df09
lea eax, [ebp - 0x24c]
push eax
call fcn.004ffa28
pop ecx
push eax
push ebx
push 0x100000
call dword [0x52b144]
mov dword [ebp - 0x2b0], eax
cmp eax, ebx
je 0x40dff8
push 0xffffffffffffffff
push eax
call dword [0x52b138]
test eax, eax
jne 0x40dfec
push 1
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x284]
call fcn.0044a559
mov ecx, eax
call fcn.004498a9
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x284]
call fcn.004021a4
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.00506540
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [0x52b258]
lea eax, [ebp - 0x214]
push eax
lea esi, [ebp - 0x230]
call fcn.0040204f
mov eax, esi
push eax
lea eax, [ebp - 0x284]
call fcn.0044a559
cmp dword [eax + 0x10], edi
jae 0x40dfd0
cmp dword [eax + 0x14], 8
jb 0x40dfc6
mov eax, dword [eax]
push 5
push ebx
push eax
call dword [0x52b120]
push 1
xor edi, edi
lea esi, [ebp - 0x284]
call fcn.004021a4
push 1
lea esi, [ebp - 0x230]
call fcn.004021a4
push dword [ebp - 0x2b0]
call dword [0x52b17c]
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
jmp 0x40db8f
push 0xb
push str.do_shortcut
call fcn.00405913
mov esi, dword [ebp - 0x2ac]
lea eax, [ebp - 0x230]
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
cmp byte [ebp - 0x2a1], bl
je 0x40e1f6
push esi
lea edi, [ebp - 0x2d4]
call fcn.0040e431
xor eax, eax
push 2
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00454a03
pop ecx
test al, al
je 0x40e1f2
push 0x543538
lea esi, [ebp - 0x24c]
call fcn.0040204f
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2a0]
call fcn.0044a8ff
push eax
lea eax, [ebp - 0x268]
call fcn.0044a8ff
push eax
mov ecx, esi
call fcn.0044abc8
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0044a59f
push 1
xor edi, edi
lea esi, [ebp - 0x284]
call fcn.004021a4
push 1
lea esi, [ebp - 0x268]
call fcn.004021a4
push 1
lea esi, [ebp - 0x2a0]
call fcn.004021a4
push 1
lea esi, [ebp - 0x24c]
call fcn.004021a4
lea eax, [ebp - 0x230]
call fcn.00449a3d
test al, al
je 0x40e1f2
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x230]
call fcn.0044e735
pop ecx
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.0044ccfe
push 0x40
lea eax, [ebp - 0x330]
push ebx
push eax
call fcn.00506540
add esp, 0xc
push 5
pop eax
inc edi
cmp dword [ebp - 0x238], 8
mov word [ebp - 0x304], ax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x334], 0x44
mov dword [ebp - 0x308], edi
jae 0x40e17f
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x334]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [0x52b11c]
test eax, eax
jne 0x40e1ce
push edi
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
push 1
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.004021a4
lea eax, [ebp - 0x2d4]
call fcn.0044cba8
mov al, bl
jmp 0x40e422
push dword [ebp - 0x258]
mov esi, dword [0x52b17c]
call esi
push dword [ebp - 0x25c]
call esi
push edi
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
mov bl, 1
jmp 0x40e1ad
push 0x10
push str.uninstall_old_se
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 0x24c], bl
call fcn.00405913
lea eax, [ebp - 0x24c]
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x24c]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
cmp byte [ebp - 0x2a1], bl
jne 0x40d9b0
push 0x17
push str.associate_crx_file_only
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 0x24c], bl
call fcn.00405913
lea eax, [ebp - 0x24c]
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x24c]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
cmp byte [ebp - 0x2a1], bl
jne 0x40d9b0
push 0x543314
lea esi, [ebp - 0x24c]
call fcn.0040204f
lea eax, [ebp - 0x2a0]
push eax
mov eax, esi
call fcn.0044e4da
mov esi, dword [ebp - 0x2ac]
pop ecx
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
cmp byte [ebp - 0x2a1], bl
je 0x40e3c2
call fcn.00408df5
test al, al
je 0x40e321
push str.360DirectUICls_SwitchBar
push str.360DirectUICls
call dword [0x52b4d4]
cmp eax, ebx
je 0x40e321
push 1
push ebx
push 0x2278
push eax
call dword [0x52b4c8]
jmp 0x40d9b0
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.00506540
add esp, 0xc
push 0x103
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [0x52b258]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40e420
push 0x38
lea eax, [ebp - 0x2e8]
push ebx
push eax
call fcn.00506540
lea eax, [ebp - 0x214]
mov dword [ebp - 0x2dc], eax
add esp, 0xc
lea eax, [ebp - 0x2ec]
push eax
mov dword [ebp - 0x2ec], 0x3c
mov dword [ebp - 0x2e8], 0x40
mov dword [ebp - 0x2e0], str.runas
mov dword [ebp - 0x2d8], str.__uninstall
mov dword [ebp - 0x2d0], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x40d9b0
push 0xf
pop eax
push eax
push str.UnPackExtPacket
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 0x24c], bl
call fcn.00405913
mov esi, dword [ebp - 0x2ac]
lea eax, [ebp - 0x24c]
push eax
call fcn.0044cf63
push ebx
push 1
lea ecx, [ebp - 0x24c]
mov byte [ebp - 0x2a1], al
call fcn.0040582f
cmp byte [ebp - 0x2a1], bl
je 0x40e420
call fcn.00422895
jmp 0x40d9b0
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret