Function at 0x41fce0
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x468858
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x484064]
push 0x27be
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
call fcn.00418410
mov ecx, dword [0x484064]
mov dword [esp + 0x2c], ecx
push 0x27bf
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0
call fcn.00418410
mov edx, dword [0x484064]
push 0x27c0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 1
mov dword [esp + 0x2c], edx
call fcn.00418410
mov eax, dword [0x484064]
push 0x27c1
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 2
mov dword [esp + 0x28], eax
call fcn.00418410
mov ecx, dword [0x484064]
mov dword [esp + 0x20], ecx
push 0x27c3
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.00418410
mov edx, dword [0x484064]
push 0x27c2
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
mov dword [esp + 0x20], edx
call fcn.00418410
mov eax, dword [0x484064]
push 0x2760
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 5
mov dword [esp + 0x1c], eax
call fcn.00418410
mov ecx, dword [0x484064]
mov dword [esp + 0x14], ecx
push 0x2761
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 6
call fcn.00418410
mov edx, dword [0x484064]
push 0x2762
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], 7
mov dword [esp + 0x38], edx
call fcn.00418410
mov edi, dword [esp + 0x48]
push edi
lea ecx, [esi + 8]
mov byte [esp + 0x44], 8
call fcn.00417f60
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esi + 0x20]
call fcn.00417f60
push 0
push str.MFC42.dll
push edi
call fcn.0041cd10
push 0
push str.ws2_32.dll
push edi
call fcn.0041cd10
push 0
push str.msimg32.dll
push edi
call fcn.0041cd10
push 0
push 0x46fbdc
push edi
call fcn.0041cd10
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 0x30
push str.SOFTWAREMicrosoftWindowsCurrentVersion3B158F69_0988_48bf_A3CD_93E0A4B0339F
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionE2A91EC5_8DF7_4d9c_9723_509CBC1015CB
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWARE360Safe_safemonRepairSucceeded
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 2
push 0x477630
push 1
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.0041ed10
push str.360122FF_13C3_3f30_A177_3B9CA9BF7B33
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
je 0x41fedd
mov ecx, dword [esi + 4]
push 1
call fcn.004338b0
mov ecx, esi
call fcn.0041c800
push edi
mov ecx, esi
call fcn.0041ee00
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ebp
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041f030
push str.Software360safemenuext360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.Software360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
push ecx
push edi
mov ecx, esi
call fcn.0041cfc0
push str.SYSTEMCurrentControlSetServices360webpro
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov esi, dword [esi + 0x1c]
push 0
push str.360_Arp
push edi
call fcn.0041cd10
push 0
push 0x46fdec
push esi
call fcn.0041cd10
add esp, 0x18
push str.360Antiarp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360_Arp
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [ebp - 0xc]
cmp edx, dword [0x484060]
je 0x41ffb9
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x41ffb9
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41ffdb
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41ffdb
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41fffd
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41fffd
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x42001f
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x42001f
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x20]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x420041
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420041
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x420063
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420063
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x420085
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420085
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x4200a7
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x4200a7
push esi
call fcn.0044ec74
add esp, 4
mov eax, dword [esp + 0x30]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x4200c9
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x4200c9
push esi
call fcn.0044ec74
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8