Function at 0x4317f0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x49e6bc
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
mov eax, dword [0x4c77a4]
mov edx, dword [eax + 0xc]
mov ebx, ecx
xor edi, edi
mov ecx, 0x4c77a4
mov dword [esp + 0x24], edi
mov dword [esp + 0x3c], edi
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x258], edi
mov eax, dword [0x4c77a4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4c77a4
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
lea esi, [esp + 0x1c]
mov byte [esp + 0x258], 1
call fcn.00406c30
mov dword [esp + 0x34], eax
call fcn.00406c30
lea esi, [esp + 0x20]
mov dword [esp + 0x2c], eax
call fcn.00406c30
mov ebp, eax
lea eax, [esp + 0x18]
push eax
mov ecx, 0x4a7458
call fcn.004038d0
lea ecx, [esp + 0x28]
push ecx
push 1
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x26c], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431b68
push 0x208
lea edx, [esp + 0x48]
push edi
push edx
mov dword [esp + 0x4c], 0x104
call fcn.0047c020
add esp, 0xc
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x40]
push edx
push edi
push str.Path
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x431b3f
mov eax, dword [esp + 0x38]
sub eax, 1
jne 0x43195f
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x48]
call fcn.004038d0
lea edi, [esp + 0x18]
mov byte [esp + 0x258], 3
call fcn.00403160
mov byte [esp + 0x258], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43195d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor edi, edi
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
push str.deepscanqutmload.dll
push edx
push ebp
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea esi, [ebx + 0xe68]
mov eax, ebp
call fcn.0040f270
test eax, eax
je 0x4319b8
mov esi, dword [esi + 8]
cmp esi, edi
je 0x431995
call esi
call fcn.0040f2c0
push edi
push edi
push edi
push 0x42ca60
push edi
push edi
mov dword [ebx + 0xe74], edi
call fcn.00477643
add esp, 0x18
mov dword [ebx + 0xe74], eax
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
push str.safemon360procmon.dll
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.00402550
test eax, eax
je 0x431b68
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, edi
push ecx
call esi
mov ebx, eax
test ebx, ebx
je 0x431a8e
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ReloadSelfProtectRule
push ebx
call ebp
test eax, eax
je 0x431a8e
call eax
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x34]
push str.safemonSelfProtectAPI2.dll
push edx
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.00402550
test eax, eax
jne 0x431a45
lea ecx, [esp + 0x18]
call fcn.00455380
lea ecx, [esp + 0x1c]
call fcn.00455380
lea ecx, [esp + 0x20]
call fcn.00455380
jmp 0x431be3
push edi
call esi
mov esi, eax
test esi, esi
je 0x431a92
push str.APICreateObjectSelfProc
push esi
call ebp
test eax, eax
je 0x431a92
lea ecx, [esp + 0x24]
push ecx
push 5
call eax
add esp, 8
test eax, eax
je 0x431a92
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jne 0x431a92
push str.OffSelfProtectEx
push ebx
call ebp
test eax, eax
je 0x431a92
push 0
call eax
add esp, 4
jmp 0x431a92
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x431aa9
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov dword [esp + 0x24], 0
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x431ab6
push esi
call edi
test ebx, ebx
je 0x431abd
push ebx
call edi
mov byte [esp + 0x258], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431ae5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x258], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431b0d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x258], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431b38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x431be5
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x258], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x431b84
mov byte [esp + 0x258], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431b90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x258], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431bb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x258], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431be3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00476dfd
add esp, 0x248
ret