Function at 0x41fc70
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x468a08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x484064]
push 0x27be
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
call fcn.00418460
mov ecx, dword [0x484064]
mov dword [esp + 0x2c], ecx
push 0x27bf
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0
call fcn.00418460
mov edx, dword [0x484064]
push 0x27c0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 1
mov dword [esp + 0x2c], edx
call fcn.00418460
mov eax, dword [0x484064]
push 0x27c1
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 2
mov dword [esp + 0x28], eax
call fcn.00418460
mov ecx, dword [0x484064]
mov dword [esp + 0x20], ecx
push 0x27c3
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.00418460
mov edx, dword [0x484064]
push 0x27c2
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
mov dword [esp + 0x20], edx
call fcn.00418460
mov eax, dword [0x484064]
push 0x2760
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 5
mov dword [esp + 0x1c], eax
call fcn.00418460
mov ecx, dword [0x484064]
mov dword [esp + 0x14], ecx
push 0x2761
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 6
call fcn.00418460
mov edx, dword [0x484064]
push 0x2762
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], 7
mov dword [esp + 0x38], edx
call fcn.00418460
mov edi, dword [esp + 0x48]
push edi
lea ecx, [esi + 8]
mov byte [esp + 0x44], 8
call fcn.00417fb0
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esi + 0x20]
call fcn.00417fb0
push 0
push str.MFC42.dll
push edi
call fcn.0041cce0
push 0
push str.ws2_32.dll
push edi
call fcn.0041cce0
push 0
push str.msimg32.dll
push edi
call fcn.0041cce0
push 0
push 0x46fbdc
push edi
call fcn.0041cce0
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 0x30
push str.SOFTWAREMicrosoftWindowsCurrentVersion3B158F69_0988_48bf_A3CD_93E0A4B0339F
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionE2A91EC5_8DF7_4d9c_9723_509CBC1015CB
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWARE360Safe_safemonRepairSucceeded
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 2
push 0x477680
push 1
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.0041ece0
push str.360122FF_13C3_3f30_A177_3B9CA9BF7B33
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
je 0x41fe6d
mov ecx, dword [esi + 4]
push 1
call fcn.00433300
mov ecx, esi
call fcn.0041c7d0
push edi
mov ecx, esi
call fcn.0041edd0
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ebp
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041f000
push str.Software360safemenuext360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.Software360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
push ecx
push edi
mov ecx, esi
call fcn.0041cf80
push str.SYSTEMCurrentControlSetServices360webpro
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov esi, dword [esi + 0x1c]
push 0
push str.360_Arp
push edi
call fcn.0041cce0
push 0
push 0x46fdec
push esi
call fcn.0041cce0
add esp, 0x18
push str.360Antiarp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360_Arp
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [ebp - 0xc]
cmp edx, dword [0x484060]
je 0x41ff49
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x41ff49
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41ff6b
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41ff6b
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41ff8d
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41ff8d
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41ffaf
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41ffaf
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x20]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41ffd1
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41ffd1
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41fff3
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41fff3
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x420015
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420015
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x420037
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420037
push esi
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x30]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x420059
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420059
push esi
call fcn.0044ee34
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8