Function at 0x4301e0
Capabilities:
Check os version
Create thread
Persist via windows service
Query or enumerate registry value
Resume thread
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x49f7eb
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebp
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor eax, eax
lea esi, [ebx + 0x4b8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 4
call fcn.00439950
test eax, eax
jne 0x430240
call fcn.00439b50
call fcn.0042fe10
call fcn.00454df0
call fcn.0042fb90
call fcn.004273f0
push eax
call fcn.004275f0
push 0x10
lea edi, [ebx + 0xcc]
push edi
push 0x425d20
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x430281
add edi, 0x348
push 1
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, ebx
call fcn.004317f0
call fcn.004218c0
call fcn.0046d8c0
call fcn.004364f0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
movzx eax, al
cmp eax, 6
sbb eax, eax
inc eax
cmp byte [0x4c943c], 0
mov dword [0x4c940c], eax
je 0x4302ce
mov eax, dword [0x4c2be0]
mov byte [0x4c93e3], 0
cmp eax, 0xffffffff
je 0x4302ce
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esi + 0x28]
push eax
push 0
push esi
push 0x439d90
push 0
push 0
call edi
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0x42faa0
push 0
push 0
mov dword [esi + 0x2c], eax
call edi
test eax, eax
je 0x430308
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004287a0
test eax, eax
je 0x430329
call fcn.004287a0
mov esi, eax
cmp byte [esi + 0x38], 1
je 0x430329
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esi + 0x38], 1
call fcn.0043d730
call fcn.00424c60
cmp eax, 1
jne 0x430476
push 0x42d150
push 0x4a
call fcn.00424ec0
push 0x42d150
push 0x77a
call fcn.00424ec0
push 0x42d150
push 0x77b
call fcn.00424ec0
push 0x42d150
push 0x401
call fcn.00424ec0
push 0x42d150
push 0x507
call fcn.00424ec0
push 0x42d150
push 0x4f0
call fcn.00424ec0
push 0x42d150
push 0x11
call fcn.00424ec0
push 0x42d150
push 0x16
call fcn.00424ec0
add esp, 0x40
push 0x42d150
push 0x41c
call fcn.00424ec0
push 0x42d150
push 0x4ff
call fcn.00424ec0
push 0x42d150
push 0xbd2
call fcn.00424ec0
push 0x42d150
push 0x406
call fcn.00424ec0
push 0x42d2a0
push 0x402
call fcn.00424ec0
push 0x43ed90
push 0xbd3
call fcn.00424ec0
push 0x43ed90
push 0x531
call fcn.00424ec0
push 0x43ed90
push 0x532
call fcn.00424ec0
add esp, 0x40
push 0x43ed90
push 0x533
call fcn.00424ec0
push 0x42d260
push 0x403
call fcn.00424ec0
push 0x42d260
push 0x404
call fcn.00424ec0
add esp, 0x18
cmp byte [0x4c8f6a], 0
je 0x430476
mov eax, dword [0x4c3394]
mov byte [0x4c8f69], 0
cmp eax, 0xffffffff
je 0x430476
push eax
call ebp
lea eax, [esp + 0x20]
call fcn.0042fad0
xor edx, edx
mov dword [0x4c93f0], eax
cmp eax, edx
je 0x4304a4
mov dword [esp + 0x20], edx
cmp ebx, edx
je 0x430495
lea edx, [ebx + 0x2c]
mov esi, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push edx
mov edx, dword [esi + 8]
mov ecx, eax
call edx
call fcn.004589d0
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
jne 0x43052b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x430502
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
mov edi, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
jmp 0x430530
cmp dword [esp + 0x14], 1
je 0x43052b
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
call ebp
mov edi, 1
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x430572
push 4
lea edx, [esp + 0x18]
push edx
push 4
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.DrvFWAccess2
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4305b4
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.DrvFWAccess2
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push str.NetMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4305f6
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push str.NetMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x430638
push 4
lea edx, [esp + 0x18]
push edx
push 4
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x43067a
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4306bc
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
push 4
lea edx, [esp + 0x18]
push edx
push 4
push str.enable
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
call ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.upref
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x430720
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.upref
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call ebp
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x43078e
mov edx, dword [0x4a699c]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x40], edx
mov edx, dword [0x4a69a4]
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x50], eax
mov eax, dword [0x4a69a0]
mov dword [esp + 0x48], edx
push edi
lea edx, [esp + 0x38]
mov dword [esp + 0x48], eax
mov eax, dword [0x4a69a8]
push edx
push ecx
mov dword [esp + 0x40], 0x20
mov dword [esp + 0x44], 5
mov dword [esp + 0x58], eax
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov dword [ebx + 0xe78], eax
lea esi, [ebx + 0x2c]
push esi
lea ecx, [ebx + 0x44]
mov dword [0x4c9e24], edi
call fcn.004099d0
mov dword [0x4c9e24], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push 0x4c9fac
push str.CLSID_IPCS_DDMANAGE.1
mov ecx, esi
call edx
push ebx
call fcn.00434330
push 0
push ebx
call fcn.00433bc0
push 0
push ebx
call fcn.00434700
push 0
push ebx
call fcn.00434ae0
push 0
push ebx
call fcn.00434f80
cmp dword [0x4c8f8c], edi
jne 0x4307f9
cmp dword [0x4c8f9c], 0
je 0x4307f9
call fcn.00462230
call fcn.0042fb30
push esi
lea edi, [ebx + 0xe48]
mov dword [0x4c3384], eax
call fcn.00438310
lea edi, [ebx + 0x500]
mov ecx, esi
mov esi, edi
call fcn.00403d80
test al, al
je 0x43083d
lea esi, [edi + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0xc], 0x4088c0
mov dword [edi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ipcipcservice.dll
push 0x4c9900
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea esi, [ebx + 0xe64]
lea ecx, [esp + 0x54]
push esi
push ecx
call fcn.0040e010
mov esi, dword [esi]
xor edi, edi
add esp, 8
cmp esi, edi
je 0x430877
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
push edi
push esi
call eax
call fcn.0042fea0
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push str.Silent
push str.SOFTWARE360TotalSecurityAuditGameMode
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], edi
call ebp
call fcn.004559f0
lea esi, [ebx + 0xe7c]
mov dword [esi], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00430120
test al, al
jne 0x4309af
mov edx, dword [0x4c9428]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x268], edi
lea edi, [esp + 0x28]
call fcn.004551a0
test al, al
je 0x4308eb
mov dword [esp + 0x30], reloc.OLEAUT32.dll_SysReAllocString
call fcn.004558e0
push esi
call fcn.00455f00
call fcn.00452720
test al, al
je 0x4308ff
call fcn.00456410
cmp dword [ebx + 0xe80], 0
lea esi, [ebx + 0xe80]
jne 0x430930
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x430930
test eax, eax
je 0x430930
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
je 0x430930
test eax, eax
je 0x430930
mov dword [esi], reloc.OLEAUT32.dll_SysReAllocString
mov byte [esi + 4], 0
cmp dword [ebx + 0xe98], 0
lea edi, [ebx + 0xe98]
jne 0x430961
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
je 0x430961
test eax, eax
je 0x430961
mov eax, dword [edi + 0x14]
cmp eax, 0xffffffff
je 0x430961
test eax, eax
je 0x430961
mov dword [edi], reloc.OLEAUT32.dll_SysReAllocString
mov byte [edi + 4], 1
lea eax, [esp + 0x24]
push eax
push str.LockSearch
mov ecx, str.SOFTWARE360Safe_safemon
mov dword [esp + 0x2c], 0
call fcn.0042c6f0
add esp, 8
test al, al
je 0x43099c
cmp dword [esp + 0x24], 0
setne al
test al, al
je 0x43099c
call fcn.00456a50
mov esi, edi
call fcn.00456a50
mov eax, dword [esp + 0x28]
cmp dword [0x4c9428], eax
je 0x4309af
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00476dfd
add esp, 0x25c
ret