Function at 0x41a9c0
Capabilities:
Create thread
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x5cc
mov eax, 0x43e4bd
call fcn.00429c87
cmp dword [0x4534d4], 0
jne 0x41ad23
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x3ac], ax
xor esi, esi
lea eax, [ebp - 0x3aa]
inc esi
push eax
mov dword [0x4534d4], esi
call fcn.004253c0
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x5bc]
push eax
mov dword [ebp - 0x5bc], esi
push str.Partner
mov esi, str.Software360safeCoop
push esi
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
mov dword [ebp - 0x5b8], 0x208
call edi
test eax, eax
je 0x41ad23
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x5bc]
push eax
push str.PrePartner
push esi
push ebx
call edi
test eax, eax
jne 0x41ad23
push str.360ver
lea eax, [ebp - 0x5c0]
push eax
call fcn.00409ada
and dword [ebp - 4], 0
push str.0.0.0.0
lea eax, [ebp - 0x5c4]
push eax
call fcn.00409ada
lea eax, [ebp - 0x5c4]
push eax
lea esi, [ebp - 0x5c0]
mov byte [ebp - 4], 1
call fcn.0040abec
pop ecx
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0xda]
push eax
call fcn.004253c0
add esp, 0xc
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x5bc]
push eax
push 0x445810
push str.Software360safeCoop
push ebx
mov dword [ebp - 0x5b8], 0xc8
mov dword [ebp - 0x5bc], 1
call edi
and dword [ebp - 0x5cc], 0
push 4
pop eax
mov dword [ebp - 0x5c8], eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x5c8]
push eax
push str.UserID
push str.Software360safe
push SysReAllocString
call edi
push 0x44278c
push str.Software360safeLiveup
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
mov esi, 0x800
push esi
push eax
mov edi, 0x4534d8
push edi
mov word [0x453330], ax
call fcn.004253c0
add esp, 0xc
call fcn.00405833
push eax
push dword [ebp - 0x5cc]
lea eax, [ebp - 0xdc]
push eax
push dword [ebp - 0x5c4]
lea eax, [ebp - 0x3ac]
push eax
push str.http:__inst.360safe.com_reg_safe_ins.htm_partner_sver_sbid_suid_dm_s
mov eax, esi
call fcn.00409ded
add esp, 0x18
cmp dword [0x45530c], 0
je 0x41abb0
push str.typeupdate
mov eax, esi
mov ecx, edi
call fcn.00414e5b
call fcn.00419d9f
mov dword [ebp - 0x5d4], eax
test eax, eax
mov eax, str.nb1
jne 0x41abc9
mov eax, str.nb0
push eax
mov eax, esi
mov ecx, edi
call fcn.00414e5b
push 0xc8
lea eax, [ebp - 0x1a4]
push 0
push eax
call fcn.004253c0
xor eax, eax
add esp, 0xc
cmp dword [ebp - 0x5d4], eax
setne al
add eax, 0x30
mov word [ebp - 0x1a4], ax
lea eax, [ebp - 0x1a4]
push eax
call fcn.00425946
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x1a4]
push eax
push 1
push str.IsNetBar
push str.SOFTWARE360Safe_safemon
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x5b4], ax
lea eax, [ebp - 0x5b2]
push eax
call fcn.004253c0
add esp, 0xc
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x5b4]
push eax
lea eax, [ebp - 0x5c8]
push eax
push 0x4454d0
push str.Software360safeCoop
push ebx
mov dword [ebp - 0x5c8], 1
mov dword [ebp - 0x5b8], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41aca2
push str.iPartner
mov eax, esi
mov ecx, edi
call fcn.00414e5b
lea eax, [ebp - 0x5b4]
push eax
mov eax, esi
mov ecx, edi
call fcn.00414e5b
push str.versrc
mov eax, esi
mov ecx, edi
call fcn.00414e5b
push dword [ebp - 0x5c0]
mov eax, esi
mov ecx, edi
call fcn.00414e5b
push str.m2
mov eax, esi
mov ecx, edi
call fcn.00414e5b
call fcn.0041db9a
push eax
mov eax, esi
mov ecx, edi
call fcn.00414e5b
xor esi, esi
lea eax, [ebp - 0x5d8]
push eax
push esi
push edi
push 0x41a8c0
push esi
push esi
mov dword [ebp - 0x5d8], esi
call fcn.00425a61
add esp, 0x18
cmp eax, esi
je 0x41ad07
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c4]
add eax, 0xfffffff0
call fcn.004054cf
mov eax, dword [ebp - 0x5c0]
add eax, 0xfffffff0
call fcn.004054cf
call fcn.00429d0a
ret