Function at 0x41c770
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x463a28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x47d064]
push 0x27be
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
call fcn.004173a0
mov ecx, dword [0x47d064]
mov dword [esp + 0x2c], ecx
push 0x27bf
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0
call fcn.004173a0
mov edx, dword [0x47d064]
push 0x27c0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 1
mov dword [esp + 0x2c], edx
call fcn.004173a0
mov eax, dword [0x47d064]
push 0x27c1
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 2
mov dword [esp + 0x28], eax
call fcn.004173a0
mov ecx, dword [0x47d064]
mov dword [esp + 0x20], ecx
push 0x27c3
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.004173a0
mov edx, dword [0x47d064]
push 0x27c2
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
mov dword [esp + 0x20], edx
call fcn.004173a0
mov eax, dword [0x47d064]
push 0x2760
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 5
mov dword [esp + 0x1c], eax
call fcn.004173a0
mov ecx, dword [0x47d064]
mov dword [esp + 0x14], ecx
push 0x2761
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 6
call fcn.004173a0
mov edx, dword [0x47d064]
push 0x2762
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], 7
mov dword [esp + 0x38], edx
call fcn.004173a0
mov edi, dword [esp + 0x48]
push edi
lea ecx, [esi + 8]
mov byte [esp + 0x44], 8
call fcn.00416ef0
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esi + 0x20]
call fcn.00416ef0
push 0
push str.MFC42.dll
push edi
call fcn.00419720
push 0
push str.ws2_32.dll
push edi
call fcn.00419720
push 0
push str.msimg32.dll
push edi
call fcn.00419720
push 0
push 0x4699a4
push edi
call fcn.00419720
mov ebx, dword [0x4683a8]
add esp, 0x30
push str.SOFTWAREMicrosoftWindowsCurrentVersion3B158F69_0988_48bf_A3CD_93E0A4B0339F
push 0x80000002
call ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionE2A91EC5_8DF7_4d9c_9723_509CBC1015CB
push 0x80000002
call ebx
push str.SOFTWARE360Safe_safemonRepairSucceeded
push 0x80000002
call ebx
push 2
push 0x470a60
push 1
push str.__cr
push str.Software360Safe
push 0x80000002
call dword [0x468368]
push str.__cr
push str.Software360Safe
push 0x80000002
call dword [0x468370]
mov ecx, esi
call fcn.0041b780
push str.360122FF_13C3_3f30_A177_3B9CA9BF7B33
call dword [0x468160]
test ax, ax
je 0x41c96d
mov ecx, dword [esi + 4]
push 1
call fcn.0042f730
mov ecx, esi
call fcn.00419370
push edi
mov ecx, esi
call fcn.0041b870
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ebp
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041baa0
push str.Software360safemenuext360down
push 0x80000002
call ebx
push str.Software360down
push 0x80000002
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
push ecx
push edi
mov ecx, esi
call fcn.004199c0
push str.SYSTEMCurrentControlSetServices360webpro
push 0x80000002
call ebx
push edi
mov ecx, esi
call fcn.00419a40
mov esi, dword [esi + 0x1c]
push 0
push str.360_Arp
push edi
call fcn.00419720
push 0
push 0x469bb4
push esi
call fcn.00419720
add esp, 0x18
push str.360Antiarp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [0x468370]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360_Arp
push 0x80000002
call ebx
mov edi, dword [0x468284]
lea edx, [ebp - 0xc]
cmp edx, dword [0x47d060]
je 0x41ca51
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x41ca51
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41ca73
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41ca73
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x41ca95
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41ca95
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41cab7
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41cab7
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x20]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x41cad9
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41cad9
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41cafb
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41cafb
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x41cb1d
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41cb1d
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41cb3f
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41cb3f
push esi
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x30]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x41cb61
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41cb61
push esi
call fcn.00449df5
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8