Function at 0x44b380
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Resume thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf1eb
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x4e9688]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
lea esi, [ebx + 0x4ac]
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x450], 4
call fcn.004444a0
lea esi, [ebx + 0x548]
call fcn.00455520
test eax, eax
jne 0x44b3e8
call fcn.00455710
call fcn.0044af20
call fcn.0040fb60
call fcn.0044acb0
call fcn.00442640
push eax
call fcn.00442840
push 0x10
lea esi, [ebx + 0x110]
push esi
push 0x42f620
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x44b429
lea eax, [esi + 0x398]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [ebx + 0x30], edi
je 0x44b433
call fcn.0044b2d0
mov ecx, str.ipc360hvm.dll
lea eax, [ebp - 0x424]
call fcn.0042c480
test eax, eax
je 0x44b489
lea eax, [ebp - 0x424]
call fcn.00424110
test eax, eax
je 0x44b489
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x44b489
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetDriverState
push esi
call edi
push str.DoesBiosFeatureTouched
push esi
mov dword [0x4f165c], eax
call edi
mov dword [0x4f1660], eax
push ebx
call fcn.0044c940
call fcn.0043eae0
call fcn.0048dbb0
call fcn.00452db0
mov ecx, 0x47
mov esi, 0x4f2388
lea edi, [ebp - 0x134]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x130], 6
sbb ecx, ecx
inc ecx
cmp byte [0x4f162b], 0
mov dword [0x4f1654], ecx
je 0x44b4e1
mov eax, dword [0x4eae44]
mov byte [0x4f162a], 0
cmp eax, 0xffffffff
je 0x44b4e1
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea esi, [ebx + 0x548]
lea edx, [esi + 0x28]
push edx
push 0
push esi
push 0x455990
push 0
push 0
call edi
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x454]
push eax
push 0
push 0
push 0x44abc0
push 0
push 0
call edi
test eax, eax
je 0x44b523
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00443960
test eax, eax
je 0x44b544
call fcn.00443960
mov esi, eax
cmp byte [esi + 0x38], 1
je 0x44b544
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esi + 0x38], 1
call fcn.00462da0
call fcn.00441d00
cmp eax, 1
jne 0x44b6b3
push 0x447b80
push 0x4a
call fcn.00441f70
push 0x447b80
push 0x77a
call fcn.00441f70
push 0x447b80
push 0x77b
call fcn.00441f70
push 0x447b80
push 0x401
call fcn.00441f70
push 0x447b80
push 0x507
call fcn.00441f70
push 0x447b80
push 0x4f0
call fcn.00441f70
push 0x447b80
push 0x11
call fcn.00441f70
push 0x447b80
push 0x16
call fcn.00441f70
add esp, 0x40
push 0x447b80
push 0x41c
call fcn.00441f70
push 0x447b80
push 0x417
call fcn.00441f70
push 0x447b80
push 0x4ff
call fcn.00441f70
push 0x447b80
push 0xbd2
call fcn.00441f70
push 0x447b80
push 0xc34
call fcn.00441f70
push 0x447b80
push 0x406
call fcn.00441f70
push 0x447d10
push 0x402
call fcn.00441f70
push 0x467e20
push 0xbd3
call fcn.00441f70
add esp, 0x40
push 0x467e20
push 0x531
call fcn.00441f70
push 0x467e20
push 0x532
call fcn.00441f70
push 0x467e20
push 0x533
call fcn.00441f70
push 0x447cc0
push 0x403
call fcn.00441f70
push 0x447cc0
push 0x404
call fcn.00441f70
add esp, 0x28
cmp byte [0x4f11fd], 0
je 0x44b6b3
mov eax, dword [0x4eb338]
mov byte [0x4f11fc], 0
cmp eax, 0xffffffff
je 0x44b6b3
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x454]
call fcn.0044abf0
mov dword [0x4f1638], eax
test eax, eax
je 0x44b6e5
mov edx, dword [eax]
lea esi, [ebp - 0x458]
lea ecx, [ebx + 0x2c]
push esi
push ecx
mov ecx, eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x458], 0
call eax
call fcn.00401020
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
jne 0x44b768
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x44c]
push eax
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b739
push 4
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x448], 1
push ecx
jmp 0x44b755
mov eax, 1
cmp dword [ebp - 0x448], eax
je 0x44b768
push 4
lea edx, [ebp - 0x448]
mov dword [ebp - 0x448], eax
push edx
push 4
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp - 0x44c]
push edx
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b7b8
push 4
lea eax, [ebp - 0x448]
push eax
push 4
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 1
call esi
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x44c]
push eax
push str.DrvFWAccess2
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b808
push 4
lea ecx, [ebp - 0x448]
push ecx
push 4
push str.DrvFWAccess2
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 1
call esi
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x44c]
push ecx
push str.NetMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b858
push 4
lea edx, [ebp - 0x448]
push edx
push 4
push str.NetMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 1
call esi
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp - 0x44c]
push edx
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b8a8
push 4
lea eax, [ebp - 0x448]
push eax
push 4
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 1
call esi
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x44c]
push eax
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b8f8
push 4
lea ecx, [ebp - 0x448]
push ecx
push 4
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 1
call esi
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x44c]
push ecx
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b948
push 4
lea edx, [ebp - 0x448]
push edx
push 4
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 1
call esi
push 4
lea eax, [ebp - 0x448]
push eax
push 4
push str.enable
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 0
call esi
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x44c]
push eax
push str.upref
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44b9be
push 4
lea ecx, [ebp - 0x448]
push ecx
push 4
push str.upref
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 1
call esi
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x44ba4d
mov edx, dword [0x4c587c]
xor eax, eax
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x438], edx
mov edx, dword [0x4c5884]
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x428], eax
mov eax, dword [0x4c5880]
mov dword [ebp - 0x430], edx
push 1
lea edx, [ebp - 0x444]
mov dword [ebp - 0x434], eax
mov eax, dword [0x4c5888]
push edx
push ecx
mov dword [ebp - 0x444], 0x20
mov dword [ebp - 0x440], 5
mov dword [ebp - 0x42c], eax
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov dword [ebx + 0xf0c], eax
lea edi, [ebx + 0x2c]
push edi
lea eax, [ebx + 0x40]
push eax
mov dword [0x4f24a4], 1
call fcn.004284e0
mov dword [0x4f24a4], 0
mov edx, dword [edi]
mov eax, dword [edx + 0x30]
push 0x4f2678
push str.CLSID_IPCS_DDMANAGE.1
mov ecx, edi
call eax
push 0x6f
push ebx
call fcn.0044fdb0
push 0
push ebx
call fcn.0044f630
push 0
push ebx
call fcn.00450860
push 0
push ebx
call fcn.00450cb0
push 0
push ebx
call fcn.004511c0
mov eax, dword [0x4f165c]
test eax, eax
je 0x44bae5
lea ecx, [ebp - 0x458]
push ecx
mov dword [ebp - 0x458], 0
call eax
add esp, 4
test eax, eax
je 0x44bae5
cmp dword [ebp - 0x458], 0
je 0x44bae5
mov eax, dword [0x4f1660]
test eax, eax
je 0x44bae5
push 0xffffffffffffffff
call eax
add esp, 4
cmp dword [0x4f11e8], 1
jne 0x44bafc
cmp dword [0x4f11f8], 0
je 0x44bafc
call fcn.004823d0
call fcn.0044ac50
push edi
lea edx, [ebx + 0xedc]
push edx
mov dword [0x4eb328], eax
call fcn.00454100
lea edx, [ebx + 0x594]
mov ecx, edi
call fcn.00464560
test al, al
je 0x44bb51
lea edi, [ebx + 0x594]
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 0x454], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x454]
push eax
mov dword [edi + 0xc], 0x467b20
mov dword [edi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ipcipcservice.dll
push 0x4f1f78
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edi, [ebx + 0xef8]
lea edx, [ebp - 0x21c]
push edi
push edx
call fcn.00432070
mov eax, dword [edi]
xor edi, edi
add esp, 8
cmp eax, edi
je 0x44bb8f
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push eax
call edx
call fcn.0044af90
push 4
lea eax, [ebp - 0x458]
push eax
push 4
push str.Silent
push str.SOFTWARE360TotalSecurityAuditGameMode
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x458], edi
call esi
call fcn.00401d00
lea esi, [ebx + 0xf10]
mov dword [esi], reloc.OLEAUT32.dll_SysReAllocString
call fcn.0044b210
test al, al
jne 0x44bcd9
mov ecx, dword [0x4f11cc]
mov dword [ebp - 0x464], ecx
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x45c], edi
mov dword [ebp - 4], edi
lea edi, [ebp - 0x464]
call fcn.0040d030
test al, al
je 0x44bc0d
mov dword [ebp - 0x45c], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401bf0
push esi
call fcn.004021f0
call fcn.00406200
test al, al
je 0x44bc21
call fcn.004027c0
cmp dword [ebx + 0xf14], 0
lea esi, [ebx + 0xf14]
jne 0x44bc52
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x44bc52
test eax, eax
je 0x44bc52
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
je 0x44bc52
test eax, eax
je 0x44bc52
mov dword [esi], reloc.OLEAUT32.dll_SysReAllocString
mov byte [esi + 4], 0
cmp dword [ebx + 0xf2c], 0
lea edi, [ebx + 0xf2c]
jne 0x44bc83
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
je 0x44bc83
test eax, eax
je 0x44bc83
mov eax, dword [edi + 0x14]
cmp eax, 0xffffffff
je 0x44bc83
test eax, eax
je 0x44bc83
mov dword [edi], reloc.OLEAUT32.dll_SysReAllocString
mov byte [edi + 4], 1
lea edx, [ebp - 0x454]
push edx
push str.LockSearch
mov ecx, str.SOFTWARE360Safe_safemon
mov dword [ebp - 0x454], 0
call fcn.004019c0
add esp, 8
test al, al
je 0x44bcc4
cmp dword [ebp - 0x454], 0
setne al
test al, al
je 0x44bcc4
call fcn.00402df0
mov esi, edi
call fcn.00402df0
mov eax, dword [ebp - 0x464]
cmp dword [0x4f11cc], eax
je 0x44bcd9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00491281
mov esp, ebp
pop ebp
ret 4