Function at 0x404b10
Capabilities:
Delete registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
push 2
call dword [0x419018]
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0xc]
push eax
call fcn.00404df0
mov esi, eax
mov eax, dword [esi]
xor edi, edi
cmp dword [eax - 0xc], edi
jge 0x404b41
or eax, 0xffffffff
jmp 0x404b5c
push str.WritebackReg
push eax
call fcn.0040d39a
add esp, 8
cmp eax, edi
jne 0x404b58
or eax, 0xffffffff
jmp 0x404b5c
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404b82
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x404c05
mov esi, dword [0x419198]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun360Disabled
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun360Disabled
push 0x80000001
call esi
call fcn.00404460
call fcn.00404530
call fcn.0040a2a0
call fcn.0040a600
lea esi, [esp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.00409880
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x404be7
call eax
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x404d29
push eax
call dword [0x419038]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00404df0
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
jge 0x404c20
or eax, 0xffffffff
jmp 0x404c3b
push str.Installdriver
push eax
call fcn.0040d39a
add esp, 8
cmp eax, edi
jne 0x404c37
or eax, 0xffffffff
jmp 0x404c3b
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404c61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x404c75
call fcn.0040a940
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00404df0
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
jge 0x404c90
or eax, 0xffffffff
jmp 0x404cab
push str.DeleteDisabled
push eax
call fcn.0040d39a
add esp, 8
cmp eax, edi
jne 0x404ca7
or eax, 0xffffffff
jmp 0x404cab
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404cd1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x404cee
call fcn.0040a400
test eax, eax
je 0x404d29
call fcn.0040a3d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
call fcn.004046f0
mov dword [0x420044], eax
cmp eax, edi
jne 0x404d09
mov dword [0x420044], 1
push edi
call dword [0x4191a8]
call fcn.004049b0
call dword [0x4191a4]
push edi
call dword [0x419014]
push eax
call dword [0x419010]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10