Function at 0x424be0
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x471af8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x490d68]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x48f014]
push 0x27be
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], eax
call fcn.0041c9b0
mov ecx, dword [0x48f014]
mov dword [esp + 0x30], ecx
push 0x27bf
lea ecx, [esp + 0x34]
mov dword [esp + 0x44], 0
call fcn.0041c9b0
mov edx, dword [0x48f014]
push 0x27c0
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], 1
mov dword [esp + 0x30], edx
call fcn.0041c9b0
mov eax, dword [0x48f014]
push 0x27c1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 2
mov dword [esp + 0x2c], eax
call fcn.0041c9b0
mov ecx, dword [0x48f014]
mov dword [esp + 0x24], ecx
push 0x27c3
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 3
call fcn.0041c9b0
mov edx, dword [0x48f014]
push 0x27c2
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 4
mov dword [esp + 0x24], edx
call fcn.0041c9b0
mov eax, dword [0x48f014]
push 0x2760
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 5
mov dword [esp + 0x20], eax
call fcn.0041c9b0
mov ecx, dword [0x48f014]
mov dword [esp + 0x18], ecx
push 0x2761
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 6
call fcn.0041c9b0
mov edx, dword [0x48f014]
push 0x2762
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 7
mov dword [esp + 0x18], edx
call fcn.0041c9b0
mov edi, dword [esp + 0x48]
push edi
lea ecx, [esi + 8]
mov byte [esp + 0x44], 8
call fcn.0041c500
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esi + 0x20]
call fcn.0041c500
push edi
mov ecx, esi
call fcn.004226e0
push 0
push str.MFC42.dll
push edi
call fcn.004219e0
push 0
push str.ws2_32.dll
push edi
call fcn.004219e0
push 0
push str.msimg32.dll
push edi
call fcn.004219e0
push 0
push 0x478cbc
push edi
call fcn.004219e0
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 0x30
push str.SOFTWAREMicrosoftWindowsCurrentVersion3B158F69_0988_48bf_A3CD_93E0A4B0339F
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionE2A91EC5_8DF7_4d9c_9723_509CBC1015CB
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWARE360Safe_safemonRepairSucceeded
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 2
push 0x481090
push 1
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.00423c50
push str.360122FF_13C3_3f30_A177_3B9CA9BF7B33
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
je 0x424de5
mov ecx, dword [esi + 4]
push 1
call fcn.0043c7a0
mov ecx, esi
call fcn.004214d0
push edi
mov ecx, esi
call fcn.00423d40
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x4c]
push ecx
push edx
push eax
mov ecx, esi
call fcn.00423f70
push str.Software360safemenuext360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.Software360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x10]
push ecx
push edx
push edi
mov ecx, esi
call fcn.00421c80
push str.SYSTEMCurrentControlSetServices360webpro
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov ebp, dword [esi + 0x1c]
push 0
push str.360_Arp
push edi
call fcn.004219e0
push 0
push 0x478ecc
push ebp
call fcn.004219e0
add esp, 0x18
push str.360Antiarp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360_Arp
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test edi, edi
je 0x424ec8
push str.safemon360TrayLogin.tpi
push edi
mov ecx, esi
call fcn.00422770
push str.safemonMicroExamin.tpi
push edi
mov ecx, esi
call fcn.00422770
push str.360MicroExamin.exe
push edi
mov ecx, esi
call fcn.00422770
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x48f010]
je 0x424ef0
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424ef0
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x48f010]
je 0x424f12
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424f12
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x48f010]
je 0x424f34
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424f34
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x20]
lea edx, [eax - 0xc]
cmp edx, dword [0x48f010]
je 0x424f56
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424f56
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x48f010]
je 0x424f78
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424f78
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, dword [0x48f010]
je 0x424f9a
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424f9a
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x48f010]
je 0x424fbc
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424fbc
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x30]
lea edx, [eax - 0xc]
cmp edx, dword [0x48f010]
je 0x424fde
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x424fde
push esi
call fcn.00457d84
add esp, 4
mov eax, dword [esp + 0x34]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x48f010]
je 0x425000
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x425000
push esi
call fcn.00457d84
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8