Function at 0x402e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x168
mov esi, esp
mov dword [esi + 0x148], ebp
lea eax, [esi + 0x154]
mov dword [eax - 8], esp
mov dword [eax + 0xc], 0xffffffff
mov dword [eax + 8], 0x529b0c
mov dword [eax + 4], 0x4b6368
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push str.chrome_elf.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x402f2f
push 0x20
call fcn.004aea96
add esp, 4
mov edx, dword [0x4e2082]
movsd xmm0, qword [0x4e207a]
movsd xmm2, qword [0x4e2072]
movsd xmm1, qword [str.chrome_elf.dll]
lea ecx, [esi + 0x90]
mov dword [esi + 0x160], 0
mov dword [ecx], eax
mov dword [ecx + 8], 0x80000010
mov dword [ecx + 4], 0xe
mov dword [eax + 0x18], edx
movsd qword [eax + 0x10], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
mov word [eax + 0x1c], 0
call fcn.00402cff
cmp byte [esi + 0x9b], 0
mov edi, eax
jns 0x402f21
mov eax, dword [esi + 0x90]
mov dword [esi + 0x160], 0xffffffff
push eax
call fcn.004aeac6
add esp, 4
test edi, edi
mov dword [esi + 0x160], 0xffffffff
je 0x402f63
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartAntiLsp
push edi
call ebx
mov ecx, ebx
mov ebx, eax
push str.StopAntiLsp
push edi
call ecx
test ebx, ebx
mov dword [esi + 0x14], eax
je 0x402f6a
push 1
push str.software360360se6
push 0x80000001
call ebx
add esp, 0xc
jmp 0x402f6a
mov dword [esi + 0x14], 0
lea eax, [esi + 0x68]
push eax
call fcn.0044ae80
add esp, 4
call fcn.0042ca80
mov ebx, eax
mov eax, 0x4e3743
lea edi, [esi + 0x90]
mov dword [edi], eax
push eax
call fcn.004ceea0
add esp, 4
mov dword [edi + 4], eax
lea eax, [esi + 0x50]
mov dword [esi + 4], ebx
mov ecx, ebx
mov dword [esi], edi
push edi
push eax
mov edi, eax
call fcn.0042cef0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x402fb4
mov eax, dword [esi + 0x54]
test eax, eax
jne 0x4030c3
mov ecx, dword [esi + 4]
mov dword [esi + 0x160], 1
push str.waitfor_proc_exit
call fcn.0042ce80
test al, al
je 0x4030c3
mov ecx, dword [esi + 4]
mov dword [esi + 0x160], 0xffffffff
mov dword [esi + 0x160], 1
push 0x4e2ad0
lea eax, [esi + 0x90]
push eax
call fcn.0042cef0
movzx eax, byte [esi + 0x9b]
mov dword [esi + 0x160], 0xffffffff
mov dword [esi + 0x70], 0
test al, al
jns 0x40302d
mov eax, dword [esi + 0x90]
mov dword [esi], eax
mov eax, dword [esi + 0x94]
lea ecx, [esi + 0x70]
mov dword [esi + 0x160], 6
push ecx
push eax
push dword [esi]
call fcn.00443cd0
add esp, 0xc
mov ecx, dword [esi + 0x70]
test ecx, ecx
sete dl
xor al, 1
or al, dl
jne 0x4030a2
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4030a2
push 0xbb8
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi]
test eax, eax
je 0x403097
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi]
test eax, eax
jne 0x4030a2
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4030a2
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x9b], 0
mov dword [esi + 0x160], 0xffffffff
jns 0x4030c3
push dword [esi + 0x90]
call fcn.004aeac6
add esp, 4
mov dword [esi + 0x160], 0xffffffff
push 0x28
push str..._.._chrome_app_chrome_exe_main_win.cc
call fcn.00435a20
add esp, 8
test eax, eax
jle 0x403140
mov dword [esi + 0x160], 1
lea ecx, [esi + 0x90]
push 0xffffffffffffffff
push 0x1e9
push str..._.._chrome_app_chrome_exe_main_win.cc
call fcn.00435a80
lea eax, [esi + 0x94]
mov dword [esi + 0x160], 0xffffffff
push 0x17
push str.About_to_load_main_DLL.
push eax
call fcn.0040372d
add esp, 0xc
lea ecx, [esi + 0x90]
mov dword [esi + 0x160], 1
call fcn.00435e20
mov dword [esi + 0x160], 0xffffffff
mov dword [esi + 0x160], 1
call fcn.0040c4ac
mov dword [esi], eax
mov ecx, dword [esi]
push dword [esi + 0x6c]
push dword [esi + 0x68]
push dword [ebp + 8]
call fcn.0040bdb8
mov dword [esi + 0x40], eax
mov ecx, dword [esi]
call fcn.0040c4a0
test al, al
je 0x403441
mov dword [esi + 0x160], 0xffffffff
mov dword [esi + 0x160], 1
lea ecx, [esi + 0x70]
push dword [esi + 4]
call fcn.0042c650
mov dword [esi + 0x160], 0xffffffff
mov dword [esi + 0x160], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esi + 0x44]
push eax
push ecx
call fcn.004439a0
add esp, 8
mov dword [esi + 0x160], 0xffffffff
mov dword [esi + 0x160], 3
lea ecx, [esi + 0x90]
push str.waitfor_proc_exit
call fcn.00402d5a
lea eax, [esi + 0x44]
mov dword [esi + 0x160], 4
lea ecx, [esi + 0x70]
push eax
lea eax, [esi + 0x90]
push eax
call fcn.0042d9f0
cmp byte [esi + 0x9b], 0
jns 0x40321c
mov eax, dword [esi + 0x90]
mov dword [esi + 0x160], 0xffffffff
push eax
call fcn.004aeac6
add esp, 4
mov ecx, dword [esi + 4]
mov dword [esi + 0x160], 0xffffffff
mov dword [esi + 0x160], 3
push str.waitfor_proc_exit
call fcn.0042ce80
test al, al
jne 0x4033f2
lea edi, [esi + 8]
mov dword [esi + 0x160], 0xffffffff
mov ecx, edi
call fcn.0042cb10
push edi
push 7
call fcn.0043fe00
add esp, 8
push edi
call fcn.00432370
add esp, 4
test al, al
je 0x4033ea
lea edi, [esi + 0x18]
lea ecx, [esi + 8]
push edi
call fcn.00431a10
mov ebx, 0x4eea3d
push ebx
call fcn.004ceea0
add esp, 4
mov ecx, edi
push eax
push ebx
lea eax, [esi + 0x90]
push eax
call fcn.00431e80
movzx eax, word [str.chrome.dll]
test ax, ax
je 0x4032bd
xor eax, eax
cmp word [eax + eax + 0x4ee972], 0
lea eax, [eax + 1]
jne 0x4032ad
jmp 0x4032bf
xor eax, eax
lea edi, [esi + 0x90]
mov dword [esi + 0x160], 0xffffffff
lea ebx, [esi + 0x5c]
mov ecx, edi
push eax
push str.chrome.dll
push ebx
call fcn.00431b50
mov ecx, edi
call fcn.0042cba0
lea ecx, [esi + 0x18]
call fcn.0042cba0
push ebx
call fcn.00432370
add esp, 4
test al, al
jne 0x4033e2
lea ecx, [esi + 8]
push edi
call fcn.00431a10
cmp word [str.new_360se.exe], 0
je 0x403328
xor eax, eax
lea ebx, [esi + 0x18]
cmp word [eax + eax + 0x4ee9aa], 0
lea eax, [eax + 1]
jne 0x403318
jmp 0x40332d
xor eax, eax
lea ebx, [esi + 0x18]
lea edi, [esi + 0x90]
mov dword [esi + 0x160], 0xffffffff
mov ecx, edi
push eax
push str.new_360se.exe
push ebx
call fcn.00431b50
mov ecx, edi
call fcn.0042cba0
push ebx
call fcn.00432370
add esp, 4
test al, al
je 0x4033da
mov eax, ebx
lea ebx, [esi + 0x24]
push eax
push ebx
call fcn.00430390
add esp, 8
mov ecx, dword [ebx]
test ecx, ecx
je 0x4033da
mov eax, dword [ecx]
lea ebx, [esi + 0x34]
push ebx
call dword [eax + 0x28]
movzx eax, byte [ebx + 0xb]
test al, al
mov ecx, eax
jns 0x40338a
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x4034a3
lea eax, [esi + 0x28]
lea ecx, [esi + 0x18]
push eax
call fcn.00431a10
movzx eax, byte [esi + 0x3f]
test al, al
jns 0x4033ac
mov ebx, dword [esi + 0x34]
mov eax, dword [esi + 0x38]
lea ecx, [esi + 0x28]
push eax
push ebx
push edi
call fcn.00431b50
cmp word [str.chrome.dll], 0
je 0x4034aa
xor eax, eax
cmp word [eax + eax + 0x4ee972], 0
lea eax, [eax + 1]
jne 0x4033c7
jmp 0x4034ac
lea ecx, [esi + 0x18]
call fcn.0042cba0
lea ecx, [esi + 0x5c]
call fcn.0042cba0
lea ecx, [esi + 8]
call fcn.0042cba0
xor eax, eax
mov dword [esi + 0x160], 3
push eax
push 1
push eax
call fcn.0042c010
add esp, 0xc
cmp byte [esi + 0x4f], 0
mov dword [esi + 0x160], 0xffffffff
jns 0x403425
push dword [esi + 0x44]
call fcn.004aeac6
add esp, 4
lea ecx, [esi + 0x70]
mov dword [esi + 0x160], 1
call fcn.0042c790
mov dword [esi + 0x160], 0xffffffff
mov ecx, dword [esi]
mov dword [esi + 0x160], 1
call fcn.0040bef8
mov ecx, dword [esi]
test ecx, ecx
je 0x40345e
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x14], 0
je 0x403471
mov dword [esi + 0x160], 5
call dword [esi + 0x14]
cmp byte [esi + 0x5b], 0
mov dword [esi + 0x160], 0xffffffff
jns 0x40348c
push dword [esi + 0x50]
call fcn.004aeac6
add esp, 4
mov eax, dword [esi + 0x154]
mov dword fs:[0], eax
mov eax, dword [esi + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x4035e6
xor eax, eax
lea ebx, [esi + 0x90]
mov dword [esi + 0x160], 0xffffffff
lea edi, [esi + 0x130]
mov ecx, ebx
push eax
push str.chrome.dll
push edi
call fcn.00431b50
mov ecx, ebx
call fcn.0042cba0
lea ecx, [esi + 0x28]
mov dword [esi + 4], ecx
call fcn.0042cba0
xor ebx, ebx
push edi
call fcn.00432370
add esp, 4
test al, al
je 0x4035d8
lea eax, [esi + 0x90]
lea ecx, [esi + 8]
push eax
call fcn.00431a10
cmp word [str.old_360se.exe], 0
je 0x40351e
xor ebx, ebx
cmp word [ebx + ebx + 0x4ee9c6], 0
lea ebx, [ebx + 1]
jne 0x403510
lea edi, [esi + 0x90]
mov dword [esi + 0x160], 0xffffffff
mov ecx, edi
push ebx
push str.old_360se.exe
lea eax, [esi + 0x28]
push eax
call fcn.00431b50
mov ecx, edi
call fcn.0042cba0
xor ebx, ebx
cmp byte [esi + 0x33], bl
jns 0x403553
mov eax, dword [esi + 0x28]
mov dword [esi + 4], eax
cmp byte [esi + 0x23], bl
lea eax, [esi + 0x18]
lea ecx, [esi + 8]
jns 0x403561
mov eax, dword [esi + 0x18]
cmp byte [esi + 0x13], bl
jns 0x403569
mov ecx, dword [esi + 8]
push ebx
push ebx
push 2
push dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
je 0x4035d0
mov ecx, edi
call fcn.00440780
mov ebx, edi
lea edi, [esi + 0x13c]
lea ecx, [esi + 8]
push edi
call fcn.00431a10
lea ecx, [esi + 0x94]
push edi
call fcn.00431280
mov ecx, edi
call fcn.0042cba0
push ebx
lea eax, [esi + 0x70]
push eax
push edi
call fcn.00440830
add esp, 0xc
mov ecx, edi
call fcn.00440600
mov ecx, edi
mov ebx, eax
call fcn.0040e9a0
lea ecx, [esi + 0x90]
call fcn.00440800
lea ecx, [esi + 0x28]
call fcn.0042cba0
lea ecx, [esi + 0x130]
call fcn.0042cba0
mov al, byte [esi + 0x3f]
test al, al
jns 0x4035f5
push dword [esi + 0x34]
call fcn.004aeac6
add esp, 4
mov ecx, dword [esi + 0x24]
xor eax, eax
mov dword [esi + 0x24], eax
test ecx, ecx
je 0x403607
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esi + 0x18]
call fcn.0042cba0
lea ecx, [esi + 0x5c]
call fcn.0042cba0
lea ecx, [esi + 8]
call fcn.0042cba0
test bl, bl
je 0x4033f2
jmp 0x40340a