Function at 0x41e220
Capabilities:
Create process on windows
Create thread
Delete registry value
Query or enumerate registry value
Resolve function by parsing pe exports
Self delete
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4732d3
mov eax, dword fs:[0]
push eax
mov eax, 0x1ab0
call fcn.00440680
mov eax, dword [0x48dd78]
xor eax, esp
mov dword [esp + 0x1aac], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48dd78]
xor eax, esp
push eax
lea eax, [esp + 0x1ac4]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1ad4]
push esi
push str.Cmd_Line___s
mov dword [esp + 0x40], esi
call fcn.00402380
add esp, 8
lea ecx, [esp + 0xd8]
call fcn.0040c440
xor ebp, ebp
push 0x498
lea eax, [esp + 0x524]
push ebp
push eax
mov dword [esp + 0x1ad8], ebp
call fcn.0043e9f0
mov eax, dword [0x48d130]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
push 0x206
lea edx, [esp + 0x18ca]
xor ecx, ecx
push ebp
push edx
mov byte [esp + 0x1ae4], 2
mov word [esp + 0x18d0], cx
call fcn.0043e9f0
add esp, 0x18
push 0x104
lea eax, [esp + 0x18bc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4778e4
push esi
call fcn.0043f1c4
add esp, 8
test eax, eax
jne 0x41e312
push 0x4778dc
push esi
call fcn.0043f1c4
add esp, 8
mov byte [esp + 0x17], 0
test eax, eax
je 0x41e317
mov byte [esp + 0x17], 1
movzx ecx, byte [esp + 0x17]
push ecx
push str.Check_param__s_and__Silent___d
call fcn.00402380
add esp, 8
call fcn.00416260
test al, al
je 0x41e345
push 0x477858
call fcn.00402380
add esp, 4
mov byte [esp + 0x17], 1
push 0xc6
lea eax, [esp + 0x9be]
xor edx, edx
push ebp
push eax
mov word [esp + 0x9c4], dx
call fcn.0043e9f0
push 0x206
lea edx, [esp + 0xa92]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0xa98], cx
call fcn.0043e9f0
push 0x206
lea ecx, [esp + 0x14c6]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x14cc], ax
call fcn.0043e9f0
push 0x206
lea eax, [esp + 0x10c2]
xor edx, edx
push ebp
push eax
mov dword [esp + 0x4c], ebp
mov word [esp + 0x10c8], dx
call fcn.0043e9f0
push 0x206
lea edx, [esp + 0xcbe]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0xcc4], cx
call fcn.0043e9f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x3c
lea eax, [esp + 0x1c]
push eax
push 3
push ebp
push str.SOFTWARE360SD
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 4
test eax, eax
jne 0x41e4fc
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.itype]
mov word [esp + eax + 0xc88], cx
add eax, 2
cmp cx, bp
jne 0x41e410
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x109c]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x3c]
push eax
push ebp
lea ecx, [esp + 0xc98]
push ecx
push edx
mov dword [esp + 0x4c], 1
mov dword [esp + 0x48], 0x208
call edi
cmp eax, ebp
jne 0x41e4ed
cmp byte [esp + 0x17], 0
je 0x41e4ed
mov ecx, 0x477854
lea eax, [esp + 0x1098]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41e49c
cmp dx, bp
je 0x41e498
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41e49c
add eax, ebx
add ecx, ebx
cmp dx, bp
jne 0x41e478
xor eax, eax
jmp 0x41e4a1
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x41e4ed
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.silent_mode_and_itype2__exit_at_once
call fcn.00402380
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00403820
lea ecx, [esp + 0x20]
call fcn.00403820
lea ecx, [esp + 0xd8]
mov dword [esp + 0x1acc], 0xffffffff
call fcn.0040c5d0
xor eax, eax
jmp 0x41ed00
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], ebp
lea edx, [esp + 0x1c]
push edx
push 1
push ebp
push str.SOFTWARE360SD
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebp
jne 0x41e561
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebp
push 0x476fac
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ebp
call edi
cmp eax, ebp
jne 0x41e552
push str.Find_SetupKillde_symbol__turn_to_silent_mode
call fcn.00402380
add esp, 4
mov byte [esp + 0x17], 1
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], ebp
push ebp
lea ecx, [esp + 0xdc]
call fcn.0040ded0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0xdc]
mov byte [esp + 0x2b], al
call fcn.0041ce30
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1acc], 3
call fcn.004076b0
test al, al
jne 0x41e6be
cmp byte [esp + 0x17], al
jne 0x41e5d5
mov ecx, dword [0x48f834]
push 0x104
lea eax, [esp + 0xa84]
push eax
push 0xed
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push ebp
push ebp
lea edx, [esp + 0xa88]
push edx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x206
lea ecx, [esp + 0x16b6]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x16bc], ax
call fcn.0043e9f0
mov edi, dword [esp + 0x34]
push 1
push edi
lea edx, [esp + 0x16c4]
push str.http:__stat.sd.360.cn_setupfail.htm_pid_scase_d
push edx
call fcn.004010c0
add esp, 0x1c
push ebp
push ebp
lea eax, [esp + 0x16b8]
push eax
push 0x4188f0
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41e642
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [edi - 0xc]
cmp ecx, dword [0x48d12c]
je 0x41e666
lea esi, [edi - 0xc]
push esi
call ebx
test eax, eax
jg 0x41e666
push esi
call fcn.0043f1b9
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x48d12c]
je 0x41e68f
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x41e68f
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.0043f1b9
add esp, 4
mov esi, dword [esp + 0x20]
lea eax, [esi - 0xc]
cmp eax, dword [0x48d12c]
je 0x41e4cf
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x41e4cf
push esi
call fcn.0043f1b9
add esp, 4
jmp 0x41e4cf
mov esi, dword [esp + 0xfc]
xor bl, bl
call fcn.004075a0
mov edi, eax
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, 0x20
add ecx, 0x20
push ecx
push esi
push str.Require_run_on__dbit_OS__and_now_run_on__dbit_OS
call fcn.00402380
add esp, 0xc
cmp esi, 0x20
jne 0x41e6f9
cmp edi, ebp
je 0x41e70e
lea edi, [esi + 0x20]
mov bl, 1
jmp 0x41e716
cmp esi, 0x40
jne 0x41e70e
call fcn.004075a0
test eax, eax
jne 0x41e70e
lea edi, [esi - 0x20]
mov bl, 1
jmp 0x41e716
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x38]
push 0x206
lea eax, [esp + 0xe96]
xor edx, edx
push ebp
push eax
mov word [esp + 0xe9c], dx
call fcn.0043e9f0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xe94]
push ecx
lea ecx, [esp + 0xe0]
call fcn.00408f40
push 0x206
lea eax, [esp + 0x12a6]
xor edx, edx
push ebp
push eax
mov word [esp + 0x12ac], dx
call fcn.0043e9f0
add esp, 0xc
test bl, bl
je 0x41e850
cmp byte [esp + 0x17], 0
jne 0x41e7e1
mov edx, dword [0x48f834]
push 0x104
lea ecx, [esp + 0x14ac]
push ecx
push 0xef
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
push esi
lea eax, [esp + 0x14b0]
push eax
lea ecx, [esp + 0xa8c]
push ecx
call fcn.004010c0
add esp, 0x10
push 0x40
push ebp
lea edx, [esp + 0xa88]
push edx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
push ebp
push ebp
lea eax, [esp + 0xe9c]
push eax
push 0x477380
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x48d12c]
je 0x41e809
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41e809
push esi
call fcn.0043f1b9
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x48d12c]
je 0x41e832
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x41e832
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.0043f1b9
add esp, 4
mov esi, dword [esp + 0x20]
lea eax, [esi - 0xc]
cmp eax, dword [0x48d12c]
je 0x41e4cf
add esi, 0xfffffff4
push esi
call edi
jmp 0x41e6a8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00415f70
add esp, 4
test al, al
jne 0x41e8bc
push str.Not_admin_User
call fcn.00402380
mov bl, byte [esp + 0x1b]
add esp, 4
test bl, bl
jne 0x41e8ae
mov edx, dword [0x48f834]
push 0x104
lea ecx, [esp + 0xa84]
push ecx
push 0xe4
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x24
push ebp
lea eax, [esp + 0xa88]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x41e8c0
lea ecx, [esp + 0x28]
call fcn.00403820
jmp 0x41e4bd
mov bl, byte [esp + 0x17]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebp
push str.SYSTEMCurrentControlSetServices360AvFlt
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x41e96a
xor eax, eax
jmp 0x41e8f0
movzx ecx, word [eax + str.DeleteFlag]
mov word [esp + eax + 0xc88], cx
add eax, 2
cmp cx, bp
jne 0x41e8f0
mov eax, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x3c]
push ecx
push ebp
lea edx, [esp + 0xc98]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x41e95b
push str.Delte_DeleteFlag
call fcn.00402380
mov edx, dword [esp + 0x20]
add esp, 4
lea ecx, [esp + 0xc88]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], ebp
mov cl, byte [esp + 0x27]
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x525], cl
push str._360safe.exe_
lea ecx, [esp + 0xe0]
mov dword [esp + 0x52c], ebp
mov byte [esp + 0x528], bl
call fcn.0040acf0
test al, al
je 0x41e9c8
mov eax, dword [esp + 0x18]
push eax
push str.Find_360safe:___s_
call fcn.00402380
mov ecx, dword [esp + 0x20]
push 0x104
push ecx
lea edx, [esp + 0x7c0]
push edx
call fcn.0043fecb
add esp, 0x14
jmp 0x41e9df
push str.Not_find_360safe
call fcn.00402380
add esp, 4
xor eax, eax
mov word [esp + 0x7b0], ax
mov ecx, dword [esp + 0x28]
push 0x40
push ecx
lea edx, [esp + 0x530]
push edx
call fcn.0043fecb
add esp, 0xc
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x7c]
call fcn.00412520
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1ad0], 4
call fcn.0040a710
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1ad0], 5
call fcn.00404fd0
mov eax, dword [esp + 0x2c]
lea edx, [eax - 0xc]
mov byte [esp + 0x1acc], 4
cmp edx, dword [0x48d12c]
je 0x41ea67
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41ea67
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff4
push eax
call fcn.0043f1b9
add esp, 4
mov esi, dword [esp + 0x20]
push 0x104
lea eax, [esp + 0x5ac]
push esi
push eax
call fcn.0043fecb
lea ecx, [esp + 0x52c]
mov dword [esp + 0xa8], ecx
add esp, 0xc
lea ecx, [esp + 0x78]
call fcn.00411780
test al, al
jne 0x41eac8
push str.Extract_7z.Cab_failed__exit_at_once
call fcn.00402380
add esp, 4
lea ecx, [esp + 0x78]
mov byte [esp + 0x1acc], 3
call fcn.00412620
lea ecx, [esp + 0x28]
call fcn.00403820
jmp 0x41e4bd
test bl, bl
jne 0x41eb31
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0xdc]
call fcn.00405750
mov eax, dword [esp + 0x2c]
push 0x104
push eax
lea ecx, [esp + 0x12a8]
push ecx
mov byte [esp + 0x1ad8], 6
call fcn.0043fecb
lea edx, [esp + 0xe9c]
push edx
lea eax, [esp + 0x12b0]
push eax
call fcn.0041de10
add esp, 0x14
lea ecx, [esp + 0x2c]
cmp eax, 1
jne 0x41eb24
call fcn.00403820
jmp 0x41eaa9
mov byte [esp + 0x1acc], 4
call fcn.00403820
lea ecx, [esp + 0x78]
call fcn.004120a0
cmp eax, 1
jne 0x41eb49
push str.Run_OnInit_functions_and_return_STOP_symbol__exit_at_once
jmp 0x41eaa1
call fcn.00416130
movzx ecx, al
push ecx
push str.SetupKilled___d
mov byte [0x48f698], al
call fcn.00402380
mov eax, dword [esp + 0x40]
push 0x64
lea edx, [esp + 0x9c4]
push edx
push str._partner
push eax
call fcn.004161e0
add esp, 0x18
cmp eax, ebp
jle 0x41eb95
lea ecx, [esp + 0x9b8]
push ecx
lea ecx, [esp + 0xfc]
call fcn.00405030
test bl, bl
je 0x41ebaf
lea edx, [esp + 0x520]
push edx
lea ecx, [esp + 0x7c]
call fcn.004157f0
jmp 0x41eaa9
mov dword [esp + 0x40], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x40]
mov bl, 8
push eax
mov ecx, 0x48f69c
mov byte [esp + 0x1ad0], bl
call fcn.0041a160
lea ecx, [esp + 0x1b8]
call fcn.0041ce80
push esi
lea ecx, [esp + 0x4f4]
mov byte [esp + 0x1ad0], 9
call fcn.00405030
cmp byte [esp + 0x27], 0
lea ecx, [esp + 0x1b8]
je 0x41ec1a
push 2
jmp 0x41ec1c
push 1
call fcn.004014a0
lea ecx, [esp + 0x78]
push ebp
mov dword [esp + 0x504], ecx
lea edx, [esp + 0x524]
push ebp
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x510], edx
call fcn.0041a420
test eax, eax
jne 0x41ec6d
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x1acc], bl
call fcn.0041a750
lea ecx, [esp + 0x40]
call fcn.004173f0
jmp 0x41eaa9
mov eax, dword [esp + 0x1bc]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
lea ecx, [esp + 0x1c0]
call fcn.00401f70
lea ecx, [esp + 0x40]
call fcn.00416e60
mov ecx, 0x48f69c
mov esi, eax
call fcn.0041a680
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x1acc], bl
call fcn.0041a750
lea ecx, [esp + 0x40]
call fcn.004173f0
lea ecx, [esp + 0x78]
mov byte [esp + 0x1acc], 3
call fcn.00412620
lea ecx, [esp + 0x28]
call fcn.00403820
lea ecx, [esp + 0x18]
call fcn.00403820
lea ecx, [esp + 0x20]
call fcn.00403820
lea ecx, [esp + 0xd8]
mov dword [esp + 0x1acc], 0xffffffff
call fcn.0040c5d0
mov eax, esi
mov ecx, dword [esp + 0x1ac4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1aac]
xor ecx, esp
call fcn.0043e9e1
add esp, 0x1abc
ret