Function at 0x41f290
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x468a38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485b90]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x484064]
push 0x27be
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
call fcn.00417e50
mov ecx, dword [0x484064]
mov dword [esp + 0x2c], ecx
push 0x27bf
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0
call fcn.00417e50
mov edx, dword [0x484064]
push 0x27c0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 1
mov dword [esp + 0x2c], edx
call fcn.00417e50
mov eax, dword [0x484064]
push 0x27c1
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 2
mov dword [esp + 0x28], eax
call fcn.00417e50
mov ecx, dword [0x484064]
mov dword [esp + 0x20], ecx
push 0x27c3
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.00417e50
mov edx, dword [0x484064]
push 0x27c2
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
mov dword [esp + 0x20], edx
call fcn.00417e50
mov eax, dword [0x484064]
push 0x2760
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 5
mov dword [esp + 0x1c], eax
call fcn.00417e50
mov ecx, dword [0x484064]
mov dword [esp + 0x14], ecx
push 0x2761
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 6
call fcn.00417e50
mov edx, dword [0x484064]
push 0x2762
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], 7
mov dword [esp + 0x38], edx
call fcn.00417e50
mov edi, dword [esp + 0x48]
push edi
lea ecx, [esi + 8]
mov byte [esp + 0x44], 8
call fcn.004179a0
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esi + 0x20]
call fcn.004179a0
push 0
push str.MFC42.dll
push edi
call fcn.0041c280
push 0
push str.ws2_32.dll
push edi
call fcn.0041c280
push 0
push str.msimg32.dll
push edi
call fcn.0041c280
push 0
push 0x46fafc
push edi
call fcn.0041c280
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 0x30
push str.SOFTWAREMicrosoftWindowsCurrentVersion3B158F69_0988_48bf_A3CD_93E0A4B0339F
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionE2A91EC5_8DF7_4d9c_9723_509CBC1015CB
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWARE360Safe_safemonRepairSucceeded
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 2
push 0x477478
push 1
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.0041e2c0
push str.360122FF_13C3_3f30_A177_3B9CA9BF7B33
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
je 0x41f48d
mov ecx, dword [esi + 4]
push 1
call fcn.004323f0
mov ecx, esi
call fcn.0041bdf0
push edi
mov ecx, esi
call fcn.0041e3b0
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ebp
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041e5e0
push str.Software360safemenuext360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.Software360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
push ecx
push edi
mov ecx, esi
call fcn.0041c520
push str.SYSTEMCurrentControlSetServices360webpro
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push edi
mov ecx, esi
call fcn.0041c5a0
mov esi, dword [esi + 0x1c]
push 0
push str.360_Arp
push edi
call fcn.0041c280
push 0
push 0x46fd0c
push esi
call fcn.0041c280
add esp, 0x18
push str.360Antiarp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360_Arp
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [ebp - 0xc]
cmp edx, dword [0x484060]
je 0x41f571
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x41f571
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41f593
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f593
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41f5b5
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f5b5
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41f5d7
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f5d7
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x20]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41f5f9
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f5f9
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41f61b
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f61b
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41f63d
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f63d
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41f65f
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f65f
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x30]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41f681
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41f681
push esi
call fcn.0044eec4
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8