Function at 0x41bd56
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x78c
mov eax, 0x449658
call fcn.00433037
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x41c367
cmp dword [esi + 8], 0
je 0x41c367
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
test eax, eax
jne 0x41c367
push 0x20
push eax
lea eax, [ebp - 0x78c]
push eax
call fcn.0042dec0
mov eax, dword [esi + 8]
mov ecx, dword [eax]
add esp, 0xc
push 7
push eax
call dword [ecx + 0x9c]
mov dword [ebp - 0x78c], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x9c]
mov dword [ebp - 0x788], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 6
push eax
call dword [ecx + 0x9c]
mov dword [ebp - 0x784], eax
push str.NoNotiLeak
xor eax, eax
call fcn.0041c36d
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x770], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 4
push eax
call dword [ecx + 0x9c]
mov dword [ebp - 0x780], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x9c]
mov dword [ebp - 0x77c], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 8
push eax
call dword [ecx + 0x9c]
xor edi, edi
mov dword [ebp - 0x778], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
inc edi
push edi
push eax
call dword [ecx + 0x9c]
mov dword [ebp - 0x774], eax
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x340], ax
lea eax, [ebp - 0x33e]
push eax
call fcn.0042dec0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x340]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x136]
push eax
call fcn.0042dec0
add esp, 0xc
lea eax, [ebp - 0x754]
push eax
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0x340]
push eax
call fcn.0040d649
add esp, 0xc
test eax, eax
je 0x41bee8
mov eax, dword [ebp - 0x754]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x758]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._d._d._d._d
push 0x40
pop ecx
lea edi, [ebp - 0x138]
call fcn.00410c60
xor edi, edi
add esp, 0x14
inc edi
xor eax, eax
push ebx
mov word [ebp - 0x548], ax
xor ebx, ebx
lea eax, [ebp - 0x546]
push ebx
push eax
call fcn.0042dec0
add esp, 0xc
lea eax, [ebp - 0x798]
push eax
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x794]
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x798], 0x208
mov dword [ebp - 0x794], edi
mov dword [ebp - 0x76c], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41bf64
push str._start
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x41bf64
mov dword [ebp - 0x76c], edi
mov eax, dword [0x45dc04]
mov ecx, 0x45dc04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x760], eax
mov dword [ebp - 4], ebx
call fcn.0041b6f1
cmp eax, ebx
je 0x41bf8f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
jmp 0x41bf91
xor eax, eax
cmp eax, ebx
je 0x41c0ed
push 0x15
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41bfbd
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x94]
mov dword [ebp - 0x790], eax
or ebx, 0xffffffff
jmp 0x41bfc6
or ebx, 0xffffffff
mov dword [ebp - 0x790], ebx
push 8
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41bfe1
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x768], eax
jmp 0x41bfe7
mov dword [ebp - 0x768], ebx
push edi
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c001
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x764], eax
jmp 0x41c007
mov dword [ebp - 0x764], ebx
push 2
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c022
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x75c], eax
jmp 0x41c028
mov dword [ebp - 0x75c], ebx
push 3
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c043
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x758], eax
jmp 0x41c049
mov dword [ebp - 0x758], ebx
push 4
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c064
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x754], eax
jmp 0x41c06a
mov dword [ebp - 0x754], ebx
push 6
mov eax, esi
call fcn.0041bd22
mov edi, dword [ebp - 0x784]
test eax, eax
jne 0x41c07f
mov edi, ebx
push 5
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c092
mov ebx, dword [ebp - 0x788]
push 7
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c0a7
mov eax, dword [ebp - 0x78c]
jmp 0x41c0aa
or eax, 0xffffffff
push dword [ebp - 0x790]
push dword [ebp - 0x76c]
push dword [ebp - 0x768]
push dword [ebp - 0x764]
push dword [ebp - 0x75c]
push dword [ebp - 0x758]
push dword [ebp - 0x754]
push edi
push ebx
push eax
push str.tray_exit
lea eax, [ebp - 0x138]
push eax
push str._pipc__c360tray__v_s__actionmon_status__tp_s__Reg_d__App_d__File_d__Drv_d__UDisk_d__Leak_d__Web_d__Arp_d__RunKey_d__ND_d_
jmp 0x41c24b
xor eax, eax
push 0x5e
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push ebx
push eax
call fcn.0042dec0
add esp, 0xc
push dword [0x460438]
lea edi, [ebp - 0x70]
push dword [0x460434]
push dword [0x460430]
push str._d._d._d
push 0x30
pop eax
call fcn.0040cbc5
add esp, 0x10
push 8
mov eax, esi
call fcn.0041bd22
or edi, 0xffffffff
test eax, eax
je 0x41c145
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x754], eax
jmp 0x41c14b
mov dword [ebp - 0x754], edi
push 1
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c166
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x758], eax
jmp 0x41c16c
mov dword [ebp - 0x758], edi
push 2
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c187
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x75c], eax
jmp 0x41c18d
mov dword [ebp - 0x75c], edi
push 3
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c1a8
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x764], eax
jmp 0x41c1ae
mov dword [ebp - 0x764], edi
push 4
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c1c9
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x768], eax
jmp 0x41c1cf
mov dword [ebp - 0x768], edi
push 6
mov eax, esi
call fcn.0041bd22
mov ebx, dword [ebp - 0x784]
test eax, eax
jne 0x41c1e4
mov ebx, edi
push 5
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c1f7
mov edi, dword [ebp - 0x788]
push 7
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c20c
mov eax, dword [ebp - 0x78c]
jmp 0x41c20f
or eax, 0xffffffff
lea ecx, [ebp - 0x70]
push ecx
push dword [ebp - 0x76c]
push dword [ebp - 0x754]
push dword [ebp - 0x758]
push dword [ebp - 0x75c]
push dword [ebp - 0x764]
push dword [ebp - 0x768]
push ebx
push edi
push eax
push str.TrayExit
lea eax, [ebp - 0x138]
push eax
push str._pipc__c360tray__v_s__actionmon_status___s__Reg_d__App_d__File_d__Drv_d__UDisk_d__Leak_d__Web_d__Arp_d__RunKey_d__os_s_
lea eax, [ebp - 0x760]
call fcn.0040816c
add esp, 0x34
mov eax, str.safemon360realpro.exe
lea ecx, [ebp - 0x750]
call fcn.0040d605
lea eax, [ebp - 0x754]
push eax
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0x750]
push eax
call fcn.0040d649
add esp, 0xc
test eax, eax
je 0x41c318
cmp dword [esi + 8], 0
je 0x41c2b3
push 0x16
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c2b3
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 0x16
push eax
call dword [ecx + 0x9c]
mov ebx, eax
jmp 0x41c2b6
or ebx, 0xffffffff
cmp dword [esi + 8], 0
je 0x41c2db
push 0x18
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c2db
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 0x18
push eax
call dword [ecx + 0x9c]
mov edi, eax
jmp 0x41c2de
or edi, 0xffffffff
cmp dword [esi + 8], 0
je 0x41c2ff
push 0x15
mov eax, esi
call fcn.0041bd22
test eax, eax
je 0x41c2ff
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x94]
jmp 0x41c302
or eax, 0xffffffff
push ebx
push edi
push eax
push str._nd_d__camera_d__keylogger_d_
lea ecx, [ebp - 0x760]
call fcn.0040bd33
add esp, 0x10
lea eax, [ebp - 0x754]
push eax
push esi
call fcn.0041c3aa
mov byte [ebp - 4], 1
push dword [eax]
lea ecx, [ebp - 0x760]
push 0x451824
call fcn.0040bd33
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x754]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00406004
mov esi, dword [esi + 4]
mov edi, dword [ebp - 0x760]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x14]
lea eax, [edi - 0x10]
call fcn.00406004
call fcn.004330ba
ret