Function at 0x4067f0
Capabilities:
Check if file exists
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b190
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x429008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
call fcn.004051f0
test eax, eax
jle 0x40684c
push eax
push 0
push 0x42b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40684c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xa
call edi
sub esi, 1
jne 0x406828
push 0x32
call edi
cmp byte [ebp + 8], 0
je 0x406971
push 0x23
push str.360ChromeX.exe___no_startup_window
mov ecx, 0x429910
call fcn.00404f30
cmp dword [0x429924], 0x10
xorps xmm0, xmm0
mov eax, 0x429910
movlpd qword [ebp - 0xcc], xmm0
cmovae eax, dword [0x429910]
mov esi, 0x4298f8
cmp dword [0x42990c], 0x10
push 0x40
cmovae esi, dword [0x4298f8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xcc]
push 0
push eax
movlpd qword [ebp - 0xc4], xmm0
movlpd qword [ebp - 0xbc], xmm0
movlpd qword [ebp - 0xb4], xmm0
movlpd qword [ebp - 0xac], xmm0
movlpd qword [ebp - 0xa4], xmm0
movlpd qword [ebp - 0x9c], xmm0
movlpd qword [ebp - 0x94], xmm0
call fcn.00408e60
add esp, 0xc
mov dword [ebp - 0xd0], 0x44
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406930
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3a98
call edi
mov esi, 0xa
call fcn.004051f0
test eax, eax
jle 0x406968
push eax
push 0
push 0x42b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x406968
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x64
call edi
sub esi, 1
jne 0x406944
push 0x64
call edi
cmp dword [0x42990c], 0x10
mov edx, 0x4298f8
mov eax, dword [0x429908]
cmovae edx, dword [0x4298f8]
cmp eax, 1
jb 0x406fd9
dec eax
or esi, 0xffffffff
cmp eax, esi
mov ecx, esi
cmovb ecx, eax
add ecx, edx
cmp byte [ecx], 0x5c
jne 0x4069bc
movzx eax, byte [ecx]
cmp al, 0x5c
jne 0x4069b3
xor eax, eax
jmp 0x4069b8
sbb eax, eax
or eax, 1
test eax, eax
je 0x4069c7
cmp ecx, edx
je 0x406fd9
dec ecx
jmp 0x4069a3
sub ecx, edx
cmp ecx, 0xffffffff
je 0x406fd9
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 4], 0
mov eax, 0x4298f8
cmp dword [0x429908], ecx
mov dword [ebp - 0x5c], 0
cmovb ecx, dword [0x429908]
cmp dword [0x42990c], 0x10
push ecx
cmovae eax, dword [0x4298f8]
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
call fcn.00404f30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
cmp dword [ebp - 0x48], 0x10
mov eax, dword [ebp - 0x4c]
cmovae ecx, dword [ebp - 0x5c]
cmp eax, 1
jb 0x406a79
dec eax
cmp eax, 0xffffffff
cmovb esi, eax
add esi, ecx
cmp byte [esi], 0x5c
jne 0x406a6e
movzx eax, byte [esi]
cmp al, 0x5c
jne 0x406a65
xor eax, eax
jmp 0x406a6a
sbb eax, eax
or eax, 1
test eax, eax
je 0x406a75
cmp esi, ecx
je 0x406a79
dec esi
jmp 0x406a55
sub esi, ecx
jmp 0x406a7c
or esi, 0xffffffff
lea ecx, [esi + 1]
mov dword [ebp - 0x2c], 0
cmp dword [0x429908], ecx
mov eax, 0x4298f8
mov dword [ebp - 0x1c], 0
cmovb ecx, dword [0x429908]
cmp dword [0x42990c], 0x10
push ecx
cmovae eax, dword [0x4298f8]
lea ecx, [ebp - 0x2c]
push eax
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.00404f30
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x74]
call fcn.004071e0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
push 0x12
push str.User_DataDefault_
cmp eax, 0x12
jb 0x406b0d
cmp edx, 0x10
lea esi, [ebp - 0x2c]
lea eax, [ecx + 0x12]
cmovae esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call fcn.0040a2f0
add esp, 0xc
mov byte [esi + 0x12], 0
jmp 0x406b1e
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x14]
push 0x12
call fcn.00407430
mov edx, dword [ebp - 0x60]
mov eax, edx
mov ecx, dword [ebp - 0x64]
sub eax, ecx
push 0x1b
push str.User_Data_safemon_shdov.dat
cmp eax, 0x1b
jb 0x406b55
cmp edx, 0x10
lea esi, [ebp - 0x74]
lea eax, [ecx + 0x1b]
cmovae esi, dword [ebp - 0x74]
add esi, ecx
mov dword [ebp - 0x64], eax
push esi
call fcn.0040a2f0
add esp, 0xc
mov byte [esi + 0x1b], 0
jmp 0x406b66
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x74]
push dword [ebp - 0x14]
push 0x1b
call fcn.00407430
cmp dword [ebp - 0x60], 0x10
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
call fcn.0040afa5
mov ecx, dword [ebp - 0x1c]
mov esi, 0x7fffffff
mov eax, esi
add esp, 4
sub eax, ecx
cmp eax, 0xb
jb 0x406ff6
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0xb
cmovae eax, dword [ebp - 0x2c]
push str.Preferences
push ecx
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe8]
call fcn.00407620
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x406be6
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406bdc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ffb
push edx
push ecx
call fcn.00407d02
add esp, 8
movups xmm1, xmmword [ebp - 0xe8]
cmp dword [ebp - 0xd4], 0x10
lea ecx, [ebp - 0x44]
movq xmm0, qword [ebp - 0xd8]
movd eax, xmm1
push 0
movups xmmword [ebp - 0x44], xmm1
cmovae ecx, eax
movq qword [ebp - 0x34], xmm0
push ecx
call fcn.0040cc20
add esp, 8
cmp eax, 0xffffffff
jne 0x406ca0
mov ecx, dword [ebp - 0x4c]
sub esi, ecx
cmp esi, 0x1e
jb 0x406ff6
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push 0x1e
cmovae eax, dword [ebp - 0x5c]
push str.User_DataDefaultPreferences
push ecx
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe8]
call fcn.00407620
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x406c88
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406c7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ffb
push edx
push ecx
call fcn.00407d02
add esp, 8
movups xmm0, xmmword [ebp - 0xe8]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [ebp - 0xd8]
movq qword [ebp - 0x34], xmm0
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
cmovae edx, dword [ebp - 0x44]
sub esp, 0x18
mov esi, esp
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x14], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406cd0
sub ecx, dword [ebp - 0x14]
push ecx
push edx
mov ecx, esi
call fcn.00404f30
lea ecx, [ebp - 0x8c]
call fcn.00405990
mov byte [ebp - 4], 4
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.0040afa5
add esp, 0x1c
push 0x64
call edi
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004071e0
cmp dword [ebp - 0xd4], 0x10
lea eax, [ebp - 0xe8]
push 0
cmovae eax, dword [ebp - 0xe8]
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406f29
push str.CreateFile_error_n
call fcn.004051c0
mov edx, dword [ebp - 0xd4]
add esp, 4
cmp edx, 0x10
jb 0x406d98
mov ecx, dword [ebp - 0xe8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406d8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407000
push edx
push ecx
call fcn.00407d02
add esp, 8
push str.clear_reg_n
call fcn.004051c0
sub esp, 0x14
mov ecx, esp
push 0x429928
call fcn.004071e0
mov ecx, str.SOFTWARE360ChromeXHomepage
call fcn.004052c0
mov ecx, esp
push 0x429928
call fcn.004071e0
mov ecx, str.SOFTWARE360ChromeHomepage
call fcn.004052c0
mov edx, dword [ebp - 0x78]
add esp, 0x18
cmp edx, 0x10
jb 0x406e0b
mov ecx, dword [ebp - 0x8c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406e01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ffb
push edx
push ecx
call fcn.00407d02
add esp, 8
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
cmp edx, 0x10
jb 0x406e54
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406e4a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ffb
push edx
push ecx
call fcn.00407d02
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
cmp edx, 0x10
jb 0x406e9a
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406e90
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ffb
push edx
push ecx
call fcn.00407d02
add esp, 8
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x406ee0
mov ecx, dword [ebp - 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406ed6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ffb
push edx
push ecx
call fcn.00407d02
add esp, 8
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
cmp edx, 0x10
jb 0x406fd9
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406fcf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ffb
jmp 0x406fcf
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x406f45
push str.SetFilePointer_error_n
jmp 0x406d56
cmp dword [ebp - 0x78], 0x10
lea ecx, [ebp - 0x14]
push 0
push ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x8c]
cmovae eax, dword [ebp - 0x8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x406f75
push str.WriteFile_error_n
jmp 0x406d56
push dword [ebp - 0x14]
push str.write__d._n
call fcn.004051c0
push str.done._n
call fcn.004051c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xd4]
cmp edx, 0x10
jb 0x406d98
mov ecx, dword [ebp - 0xe8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406d8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407000
jmp 0x406d8e
push edx
push ecx
call fcn.00407d02
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407876
mov esp, ebp
pop ebp
ret 4
call fcn.00404c10
call fcn.0040abee
call fcn.0040abee
int3