Function at 0x4039e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x180
mov esi, esp
mov dword [esi + 0x160], ebp
lea eax, [esi + 0x16c]
mov dword [eax - 8], esp
mov dword [eax + 0xc], 0xffffffff
mov dword [eax + 8], 0x52c5e8
mov dword [eax + 4], 0x4b6cc8
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push str.chrome_elf.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x403a84
lea edi, [esi + 0x78]
mov ecx, edi
push str.chrome_elf.dll
call fcn.0040394a
mov dword [esi + 0x178], 0
mov ecx, edi
call fcn.0040391e
mov edi, eax
cmp byte [esi + 0x83], 0
jns 0x403a76
mov eax, dword [esi + 0x78]
mov dword [esi + 0x178], 0xffffffff
push eax
call fcn.004af3c6
add esp, 4
mov dword [esi + 0x178], 0xffffffff
test edi, edi
je 0x403ab8
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartAntiLsp
push edi
call ebx
mov ecx, ebx
mov ebx, eax
push str.StopAntiLsp
push edi
call ecx
mov dword [esi + 0x20], eax
test ebx, ebx
je 0x403abf
push 1
push str.software360Chromechrome
push 0x80000001
call ebx
add esp, 0xc
jmp 0x403abf
mov dword [esi + 0x20], 0
lea ebx, [esi + 0x10]
push ebx
call fcn.0043b250
add esp, 4
mov eax, dword [ebx]
mov dword [esi + 4], eax
mov ebx, dword [ebx + 4]
lea edi, [esi + 0x78]
mov ecx, edi
push str.AntiLsp
call fcn.004043d8
mov dword [edi + 0x14], ebx
mov dword [esi + 0xc], edi
mov eax, dword [esi + 4]
mov dword [edi + 0x10], eax
mov eax, dword [0x532154]
mov ecx, dword [0x532158]
cmp eax, ecx
jae 0x403b37
mov ecx, dword [esi + 0x80]
mov dword [eax + 8], ecx
movsd xmm0, qword [esi + 0x78]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x80], ecx
movsd xmm0, qword [esi + 0x88]
movsd qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x532154], eax
jmp 0x403be6
mov edi, dword [0x532150]
sub eax, edi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea edx, [eax + 1]
cmp edx, 0xaaaaaab
jae 0x4042d2
sub ecx, edi
sar ecx, 3
imul ecx, ecx, 0xaaaaaaab
lea edi, [ecx + ecx]
cmp edi, edx
cmovb edi, edx
cmp ecx, 0x5555555
mov edx, 0xaaaaaaa
cmovb edx, edi
lea edi, [esi + 0x124]
mov ecx, edi
push 0x53215c
push eax
push edx
call fcn.0040b420
mov eax, dword [edi + 8]
mov ecx, dword [esi + 0x80]
mov dword [eax + 8], ecx
movsd xmm0, qword [esi + 0x78]
movsd qword [eax], xmm0
xor ecx, ecx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], ecx
movsd xmm0, qword [esi + 0x88]
movsd qword [eax + 0x10], xmm0
add dword [edi + 8], 0x18
mov ecx, 0x532150
push edi
call fcn.0040c740
mov ecx, edi
call fcn.0040c7ca
cmp byte [esi + 0x83], 0
jns 0x403be6
push dword [esi + 0x78]
call fcn.004af3c6
add esp, 4
lea eax, [esi + 0x70]
push eax
call fcn.0043b250
add esp, 4
call fcn.0042d530
mov ebx, eax
mov eax, 0x4e43a6
mov dword [esi + 0x78], eax
push eax
call fcn.004cfa30
add esp, 4
mov dword [esi + 0x7c], eax
lea edi, [esi + 0x58]
mov dword [esi + 8], ebx
mov ecx, ebx
lea eax, [esi + 0x78]
push eax
push edi
call fcn.0042da50
movzx eax, byte [edi + 0xb]
test al, al
jns 0x403c2a
mov eax, dword [esi + 0x5c]
test eax, eax
jne 0x403d3b
mov dword [esi + 0x178], 1
mov ecx, dword [esi + 8]
push str.waitfor_proc_exit
call fcn.0042d9e0
test al, al
je 0x403d3b
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x178], 1
mov ecx, dword [esi + 8]
push 0x4e3ad8
lea eax, [esi + 0x78]
push eax
call fcn.0042da50
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x124], 0
movzx eax, byte [esi + 0x83]
test al, al
jns 0x403c9e
mov eax, dword [esi + 0x78]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x178], 6
lea ecx, [esi + 0x124]
push ecx
push eax
push dword [esi + 0xc]
call fcn.00436c40
add esp, 0xc
mov ecx, dword [esi + 0x124]
test ecx, ecx
sete dl
xor al, 1
or al, dl
jne 0x403d1d
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x403d1d
push 0xbb8
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 4]
test eax, eax
je 0x403d12
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi + 4]
test eax, eax
jne 0x403d1d
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x403d1d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esi + 0x178], 0xffffffff
cmp byte [esi + 0x83], 0
jns 0x403d3b
push dword [esi + 0x78]
call fcn.004af3c6
add esp, 4
mov dword [esi + 0x178], 0xffffffff
push 0x28
push str..._.._chrome_app_chrome_exe_main_win.cc
call fcn.004324f0
add esp, 8
test eax, eax
jle 0x403db2
mov dword [esi + 0x178], 1
lea ecx, [esi + 0x78]
push 0xffffffffffffffff
push 0x201
push str..._.._chrome_app_chrome_exe_main_win.cc
call fcn.00432550
lea eax, [esi + 0x80]
mov dword [esi + 0x178], 0xffffffff
push 0x17
push str.About_to_load_main_DLL.
push eax
call fcn.0040c434
add esp, 0xc
mov dword [esi + 0x178], 1
lea ecx, [esi + 0x78]
call fcn.004328f0
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x178], 1
call fcn.0040d68e
mov ecx, dword [esi + 0x70]
mov dword [esi + 0xc], ecx
mov ebx, dword [esi + 0x74]
mov edi, dword [0x532150]
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 4], eax
mov ecx, edi
push str.exe_entry_point
call fcn.0042927e
mov dword [edi + 0x14], ebx
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
mov dword [esi + 0x178], 1
mov ecx, dword [esi + 4]
push 0x532150
push dword [ebp + 8]
call fcn.0040cd60
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 4]
call fcn.0040d682
test al, al
je 0x4040ea
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x178], 1
lea ecx, [esi + 0x124]
push dword [esi + 8]
call fcn.0042d0a0
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x178], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esi + 0x4c]
push eax
push ecx
call fcn.004368d0
add esp, 8
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x178], 3
lea ecx, [esi + 0x78]
push str.waitfor_proc_exit
call fcn.004043d8
mov dword [esi + 0x178], 4
lea ecx, [esi + 0x124]
lea eax, [esi + 0x4c]
push eax
lea eax, [esi + 0x78]
push eax
call fcn.0042e380
cmp byte [esi + 0x83], 0
jns 0x403ec5
mov eax, dword [esi + 0x78]
mov dword [esi + 0x178], 0xffffffff
push eax
call fcn.004af3c6
add esp, 4
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x178], 3
mov ecx, dword [esi + 8]
push str.waitfor_proc_exit
call fcn.0042d9e0
test al, al
jne 0x404098
mov dword [esi + 0x178], 0xffffffff
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.004303a0
push edi
push 7
call fcn.00435ad0
add esp, 8
push edi
call fcn.0043ece0
add esp, 4
test al, al
je 0x404090
lea edi, [esi + 0x24]
lea ecx, [esi + 0x10]
push edi
call fcn.00430cf0
mov ebx, 0x4eb21a
push ebx
call fcn.004cfa30
add esp, 4
mov ecx, edi
push eax
push ebx
lea eax, [esi + 0x78]
push eax
call fcn.00431340
movzx eax, word [0x4e4336]
test ax, ax
je 0x403f65
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x4e4338], 0
mov ecx, eax
jne 0x403f53
jmp 0x403f67
xor eax, eax
mov dword [esi + 0x178], 0xffffffff
lea ebx, [esi + 0x64]
lea edi, [esi + 0x78]
mov ecx, edi
push eax
push 0x4e4336
push ebx
call fcn.00430ee0
mov ecx, edi
call fcn.004304c0
lea ecx, [esi + 0x24]
call fcn.004304c0
push ebx
call fcn.0043ece0
add esp, 4
test al, al
jne 0x404088
lea ecx, [esi + 0x10]
push edi
call fcn.00430cf0
cmp word [str.new_360chrome.exe], 0
je 0x403fcf
xor ecx, ecx
lea ebx, [esi + 0x24]
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x4e434e], 0
mov ecx, eax
jne 0x403fbd
jmp 0x403fd4
xor eax, eax
lea ebx, [esi + 0x24]
mov dword [esi + 0x178], 0xffffffff
lea edi, [esi + 0x78]
mov ecx, edi
push eax
push str.new_360chrome.exe
push ebx
call fcn.00430ee0
mov ecx, edi
call fcn.004304c0
push ebx
call fcn.0043ece0
add esp, 4
test al, al
je 0x404080
mov eax, ebx
lea ebx, [esi + 0x30]
push eax
push ebx
call fcn.0043e210
add esp, 8
mov ecx, dword [ebx]
test ecx, ecx
je 0x404080
mov eax, dword [ecx]
lea ebx, [esi + 0x40]
push ebx
call dword [eax + 0x28]
movzx eax, byte [ebx + 0xb]
mov ecx, eax
test al, al
jns 0x40402e
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x40414e
lea eax, [esi + 0x34]
lea ecx, [esi + 0x24]
push eax
call fcn.00430cf0
movzx eax, byte [esi + 0x4b]
test al, al
jns 0x404050
mov ebx, dword [esi + 0x40]
mov eax, dword [esi + 0x44]
lea ecx, [esi + 0x34]
push eax
push ebx
push edi
call fcn.00430ee0
cmp word [0x4e4336], 0
je 0x404155
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x4e4338], 0
mov ecx, eax
jne 0x40406b
jmp 0x404157
lea ecx, [esi + 0x24]
call fcn.004304c0
lea ecx, [esi + 0x64]
call fcn.004304c0
lea ecx, [esi + 0x10]
call fcn.004304c0
mov dword [esi + 0x178], 3
xor eax, eax
push eax
push 1
push eax
call fcn.00443c80
add esp, 0xc
cmp byte [esi + 0x57], 0
mov dword [esi + 0x178], 0xffffffff
jns 0x4040cb
push dword [esi + 0x4c]
call fcn.004af3c6
add esp, 4
mov dword [esi + 0x178], 1
lea ecx, [esi + 0x124]
call fcn.0042d1f0
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x178], 1
mov ecx, dword [esi + 4]
call fcn.0040d2e6
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x404109
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x20], 0
je 0x40411c
mov dword [esi + 0x178], 5
call dword [esi + 0x20]
cmp byte [esi + 0x63], 0
mov dword [esi + 0x178], 0xffffffff
jns 0x404137
push dword [esi + 0x58]
call fcn.004af3c6
add esp, 4
mov eax, dword [esi + 0x16c]
mov dword fs:[0], eax
mov eax, dword [esi + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x40428a
xor eax, eax
mov dword [esi + 0x178], 0xffffffff
lea edi, [esi + 0x148]
lea ebx, [esi + 0x78]
mov ecx, ebx
push eax
push 0x4e4336
push edi
call fcn.00430ee0
mov ecx, ebx
call fcn.004304c0
lea ecx, [esi + 0x34]
mov dword [esi + 8], ecx
call fcn.004304c0
xor ebx, ebx
push edi
call fcn.0043ece0
add esp, 4
test al, al
je 0x40427c
lea ecx, [esi + 0x10]
lea eax, [esi + 0x78]
push eax
call fcn.00430cf0
cmp word [str.old_360chrome.exe], 0
je 0x4041c5
xor eax, eax
lea ebx, [eax + 1]
cmp word [eax + eax + 0x4e4372], 0
mov eax, ebx
jne 0x4041b5
mov dword [esi + 0x178], 0xffffffff
lea edi, [esi + 0x78]
mov ecx, edi
push ebx
push str.old_360chrome.exe
lea eax, [esi + 0x34]
push eax
call fcn.00430ee0
mov ecx, edi
call fcn.004304c0
cmp byte [esi + 0x3f], 0
jns 0x4041f6
mov eax, dword [esi + 0x34]
mov dword [esi + 8], eax
cmp byte [esi + 0x2f], 0
lea eax, [esi + 0x24]
lea ecx, [esi + 0x10]
jns 0x404205
mov eax, dword [esi + 0x24]
cmp byte [esi + 0x1b], 0
jns 0x40420e
mov ecx, dword [esi + 0x10]
xor ebx, ebx
push ebx
push ebx
push 2
push dword [esi + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
je 0x404274
mov ecx, edi
call fcn.00436400
mov ebx, edi
lea edi, [esi + 0x154]
lea ecx, [esi + 0x10]
push edi
call fcn.00430cf0
lea ecx, [esi + 0x7c]
push edi
call fcn.00430500
mov ecx, edi
call fcn.004304c0
push ebx
lea eax, [esi + 0x124]
push eax
push edi
call fcn.0043f5e0
add esp, 0xc
mov ecx, edi
call fcn.0043fdb0
mov ebx, eax
mov ecx, edi
call fcn.0043fd50
lea ecx, [esi + 0x78]
call fcn.00436460
lea ecx, [esi + 0x34]
call fcn.004304c0
lea ecx, [esi + 0x148]
call fcn.004304c0
mov al, byte [esi + 0x4b]
test al, al
jns 0x404299
push dword [esi + 0x40]
call fcn.004af3c6
add esp, 4
mov ecx, dword [esi + 0x30]
mov dword [esi + 0x30], 0
test ecx, ecx
je 0x4042ad
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esi + 0x24]
call fcn.004304c0
lea ecx, [esi + 0x64]
call fcn.004304c0
lea ecx, [esi + 0x10]
call fcn.004304c0
test bl, bl
je 0x404098
jmp 0x4040b0
mov ecx, 0x532150
call fcn.0042ab0c
mov esp, dword [ebp - 0x18]
lea esi, [ebp - 0x17c]
mov ebp, dword [esi + 0x160]
jmp 0x40411c