Function at 0x4872bf
Capabilities:
Delete registry value
Persist via app paths registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
lea ebx, [ecx + 0x5c]
push edi
push ebx
mov dword [ebp - 0x18], ecx
call fcn.00486fb5
mov dword [esp], str.QHSafeMain.exe
push ebx
call fcn.0048704d
push str.safemonQHSafeTray.exe
push ebx
call fcn.0048704d
push 0x4cf2ac
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004067a0
mov eax, dword [eax]
add esp, 0x1c
push 0
push eax
push 0
push ecx
mov ecx, esp
push 0x4d67f4
call fcn.00404050
push ecx
mov ecx, esp
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push edi
call fcn.00404050
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b9b0
push eax
call fcn.0040bfc0
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.0040c410
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404d30
mov ebx, dword [ebx]
push 0
push ebx
push 0
push ecx
mov ecx, esp
push str.Path
call fcn.00404050
push ecx
mov ecx, esp
push edi
call fcn.00404050
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b9b0
push eax
call fcn.0040bfc0
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.0040c410
call fcn.0041aa30
xor edi, edi
push 4
inc edi
pop ebx
test al, al
jne 0x4873cf
push 0
push ecx
mov ecx, esp
push 0x4cf2a0
mov dword [ebp - 0x10], edi
call fcn.00404050
push ecx
mov ecx, esp
push str.SYSTEMCurrentControlSet_services360SelfProtection
call fcn.00404050
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b9b0
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
call fcn.0040bf40
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.0040c410
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push str.software360TotalSecurity
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4873f4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0xc], 0
push 0x4fc0d8
lea ecx, [ebp - 8]
call fcn.00418850
push str.UserProfile
push str.software360TotalSecurity
lea eax, [ebp - 8]
push 0x4cee58
push eax
call fcn.00476549
and dword [ebp - 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.MaskFlags
push dword [ebp - 8]
mov dword [ebp - 4], edi
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x48744a
cmp dword [ebp - 0x10], ebx
je 0x487462
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.MaskFlags
push dword [ebp - 8]
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00404d30
cmp byte [0x4faa31], 0
je 0x4874fe
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.ShowTipsValue
call fcn.00404050
push ecx
mov ecx, esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.00404050
push SysReAllocStringLen
lea ecx, [ebp - 0x28]
call fcn.0040b9b0
push eax
call fcn.0040beb0
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.0040c410
or dword [ebp - 8], 0x80
push dword [ebp - 8]
push 0
push ecx
mov ecx, esp
push str.ShowTipsValue
call fcn.00404050
push ecx
mov ecx, esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.00404050
push SysReAllocStringLen
lea ecx, [ebp - 0x28]
call fcn.0040b9b0
push eax
call fcn.0046e249
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.0040c410
cmp byte [0x4faa30], 0
jne 0x48769d
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
mov edi, str.software360TotalSecurityUserProfile
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x487531
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0xc], 0
push 0x4fc0d8
lea ecx, [ebp - 8]
call fcn.00418850
push 0
call fcn.00499395
push edx
push eax
lea eax, [ebp - 8]
push str._I64d
push eax
call fcn.004048a0
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0xc]
add esp, 0x14
add ecx, ecx
push ecx
push eax
push 1
push str.InstallDate
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.ReInstall
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00404d30
mov eax, dword [0x4faa34]
and dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov edi, str.SOFTWARE360TotalSecurityActiveProtection
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4875b7
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push str.mode
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x48761d
test eax, eax
je 0x48761d
cmp eax, 0xfe
jne 0x4875f0
push dword [0x4faa28]
mov ecx, dword [ebp - 0x18]
call fcn.00485706
jmp 0x487843
cmp eax, 2
jne 0x487843
cmp byte [0x4faa55], 0
je 0x487843
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
mov dword [ebp - 0x18], 0x200000
push str.ExtFlags
jmp 0x4877b1
lea eax, [ebp - 8]
push eax
mov edi, str.SOFTWARE360Safe_filemon
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x48763f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.AVEnable
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 0xc], 1
jne 0x487843
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.AVReadProtectEnable
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.AVWriteProtectEnable
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 4], 1
push str.Level
jmp 0x4877b1
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push str.ReInstall
push str.software360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [0x4fb1e8], edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov edi, str.SOFTWARE360TotalSecurityActiveProtection
jne 0x4877be
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.ExtFlags
push edi
push esi
mov dword [ebp - 4], 0x200000
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push str.mode
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x487843
cmp dword [ebp - 8], ebx
jne 0x487843
cmp dword [ebp - 4], 2
jne 0x487843
and dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push str.Flags
push edi
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x487767
cmp dword [ebp - 8], ebx
jne 0x487767
mov eax, 0x200000
test dword [ebp - 4], eax
jne 0x487767
or dword [ebp - 4], eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.Flags
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push str.AVEngine
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x487843
cmp dword [ebp - 8], ebx
jne 0x487843
test dword [ebp - 4], 2
jne 0x487843
or dword [ebp - 4], 2
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.AVEngine
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x487843
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.mode
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x487843
cmp dword [ebp - 0xc], ebx
jne 0x487843
cmp dword [ebp - 4], 2
jne 0x487843
and dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.ExtFlags
push edi
push esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x487843
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.Flags
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push esi
mov dword [ebp - 4], 0x30013f0f
call edi
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push str.AVEngine
push str.SOFTWARE360Safe_filemon
push esi
call edi
pop edi
pop esi
mov al, 1
pop ebx
leave
ret