Function at 0x44f460
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x14c
mov eax, dword [0x61ac94]
xor eax, esp
mov dword [esp + 0x148], eax
mov eax, dword [0x61e940]
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], esi
cmp eax, esi
jne 0x44f49d
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], esi
je 0x44f4ea
mov ecx, eax
call fcn.0044eda0
mov eax, dword [0x61e940]
cmp eax, esi
jne 0x44f4bf
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], esi
je 0x44f4ea
mov eax, dword [eax + 0xcc]
cmp eax, esi
je 0x44f4ea
lea ecx, [esp + 8]
push ecx
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetServices
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x44f505
lea edx, [esp + 8]
push edx
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x44f9d9
mov eax, dword [str.360AvFlt]
mov ecx, dword [0x5c6558]
mov dl, byte [0x5c655c]
push 0xfb
mov dword [esp + 0x50], eax
lea eax, [esp + 0x59]
push esi
push eax
mov dword [esp + 0x5c], ecx
mov byte [esp + 0x60], dl
call fcn.004e5fc0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.0044f180
mov eax, dword [esp + 0x1c]
add esp, 0x14
push eax
call fcn.0044f120
mov ecx, edi
call fcn.0044e390
test eax, eax
jne 0x44f831
lea ecx, [esp + 8]
push ecx
push str.SYSTEMCurrentControlSetServices360AvFlt
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0044ef30
test eax, eax
jne 0x44f9d9
mov eax, 1
push ebx
xor edx, edx
push ebp
mov dword [esp + 0x44], str.DependOnService
mov dword [esp + 0x48], str.DisplayName
mov dword [esp + 0x4c], str.Group
mov dword [esp + 0x50], str.ImagePath
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 2
mov dword [esp + 0x24], str.FltMgr
mov dword [esp + 0x28], str.360AvFlt_mini_filter_driver
mov dword [esp + 0x2c], str.FSFilter_Activity_Monitor
mov dword [esp + 0x30], str.system32DRIVERS360AvFlt.sys
mov dword [esp + 0x18], edx
jmp 0x44f5f4
mov edx, dword [esp + 0x18]
mov eax, dword [esp + edx + 0x24]
lea esi, [eax + 1]
jmp 0x44f600
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44f600
mov edi, dword [esp + edx + 0x34]
mov ebp, dword [esp + edx + 0x44]
mov ebx, dword [esp + 0x10]
sub eax, esi
mov esi, eax
mov eax, dword [0x61e940]
test eax, eax
jne 0x44f62e
call fcn.0044ed30
mov edx, dword [esp + 0x18]
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f67b
mov ecx, eax
call fcn.0044eda0
mov eax, dword [0x61e940]
test eax, eax
jne 0x44f651
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f677
mov eax, dword [eax + 0x114]
test eax, eax
je 0x44f677
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + edx + 0x24]
push esi
push ecx
push edi
push 0
push ebp
push ebx
call eax
jmp 0x44f68c
mov edx, dword [esp + 0x18]
mov edx, dword [esp + edx + 0x24]
push esi
push edx
push edi
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x10
mov dword [esp + 0x18], eax
jl 0x44f5f0
mov eax, dword [0x61e940]
mov esi, dword [esp + 0x10]
pop ebp
mov dword [esp + 0x10], 3
pop ebx
test eax, eax
jne 0x44f6c1
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f712
mov ecx, eax
call fcn.0044eda0
mov eax, dword [0x61e940]
test eax, eax
jne 0x44f6e4
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f712
mov eax, dword [eax + 0x114]
test eax, eax
je 0x44f712
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.Start
push esi
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x44f72b
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.Start
push esi
call edi
mov eax, dword [0x61e940]
mov esi, dword [esp + 8]
mov dword [esp + 0xc], 2
test eax, eax
jne 0x44f74a
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f795
mov ecx, eax
call fcn.0044eda0
mov eax, dword [0x61e940]
test eax, eax
jne 0x44f76d
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f795
mov eax, dword [eax + 0x114]
test eax, eax
je 0x44f795
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.Type
push esi
call eax
jmp 0x44f7a8
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.Type
push esi
call edi
mov eax, dword [0x61e940]
mov esi, dword [esp + 8]
mov dword [esp + 0xc], 0
test eax, eax
jne 0x44f7c7
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f812
mov ecx, eax
call fcn.0044eda0
mov eax, dword [0x61e940]
test eax, eax
jne 0x44f7ea
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], 0
je 0x44f812
mov eax, dword [eax + 0x114]
test eax, eax
je 0x44f812
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.ErrorControl
push esi
call eax
jmp 0x44f825
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.ErrorControl
push esi
call edi
mov eax, dword [esp + 8]
push eax
call fcn.0044f120
xor esi, esi
mov eax, dword [0x61e940]
cmp eax, esi
jne 0x44f844
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], esi
je 0x44f891
mov ecx, eax
call fcn.0044eda0
mov eax, dword [0x61e940]
cmp eax, esi
jne 0x44f866
call fcn.0044ed30
mov dword [0x61e940], eax
cmp dword [eax + 0x124], esi
je 0x44f891
mov eax, dword [eax + 0xcc]
cmp eax, esi
je 0x44f891
lea ecx, [esp + 8]
push ecx
push 0x20006
push esi
push str.SYSTEMCurrentControlSetServices360AvFlt
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x44f8ac
lea edx, [esp + 8]
push edx
push 0x20006
push esi
push str.SYSTEMCurrentControlSetServices360AvFlt
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x44f9d9
push 0x103
lea eax, [esp + 0x51]
push esi
push eax
mov byte [esp + 0x58], 0
call fcn.004e5fc0
mov edx, dword [esp + 0x14]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push str.Instances
push edx
call fcn.0044ef30
cmp dword [esp + 0x14], esi
je 0x44f9b3
push 0x103
lea eax, [esp + 0x50]
push str.360SDInstance
push eax
call fcn.004e9d80
lea eax, [esp + 0x58]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44f908
sub eax, edx
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x50]
push ecx
push 1
push esi
push str.DefaultInstance
push edx
call fcn.0044f000
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push str.360SDInstance
push ecx
call fcn.0044ef30
cmp dword [esp + 0x18], esi
je 0x44f9a9
push 0x103
lea edx, [esp + 0x50]
push str.327400
push edx
call fcn.004e9d80
lea eax, [esp + 0x58]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44f961
mov ecx, dword [esp + 0x18]
sub eax, edx
push eax
lea eax, [esp + 0x50]
push eax
push 1
push esi
push str.Altitude
push ecx
call fcn.0044f000
mov eax, dword [esp + 0x18]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push esi
push str.Flags
push eax
mov dword [esp + 0x24], esi
call fcn.0044f000
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0044f120
mov edx, dword [esp + 0x14]
push edx
call fcn.0044f120
mov eax, dword [esp + 8]
push eax
call fcn.0044f120
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.004e5fb0
add esp, 0x14c
ret
mov ecx, dword [esp + 0x150]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004e5fb0
add esp, 0x14c
ret