Function at 0x4201d0
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4697b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x485064]
push 0x27be
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
call fcn.00418760
mov ecx, dword [0x485064]
mov dword [esp + 0x2c], ecx
push 0x27bf
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0
call fcn.00418760
mov edx, dword [0x485064]
push 0x27c0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 1
mov dword [esp + 0x2c], edx
call fcn.00418760
mov eax, dword [0x485064]
push 0x27c1
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 2
mov dword [esp + 0x28], eax
call fcn.00418760
mov ecx, dword [0x485064]
mov dword [esp + 0x20], ecx
push 0x27c3
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.00418760
mov edx, dword [0x485064]
push 0x27c2
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
mov dword [esp + 0x20], edx
call fcn.00418760
mov eax, dword [0x485064]
push 0x2760
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 5
mov dword [esp + 0x1c], eax
call fcn.00418760
mov ecx, dword [0x485064]
mov dword [esp + 0x14], ecx
push 0x2761
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 6
call fcn.00418760
mov edx, dword [0x485064]
push 0x2762
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], 7
mov dword [esp + 0x38], edx
call fcn.00418760
mov edi, dword [esp + 0x48]
push edi
lea ecx, [esi + 8]
mov byte [esp + 0x44], 8
call fcn.004182b0
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esi + 0x20]
call fcn.004182b0
push 0
push str.MFC42.dll
push edi
call fcn.0041d1a0
push 0
push str.ws2_32.dll
push edi
call fcn.0041d1a0
push 0
push str.msimg32.dll
push edi
call fcn.0041d1a0
push 0
push 0x470d44
push edi
call fcn.0041d1a0
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 0x30
push str.SOFTWAREMicrosoftWindowsCurrentVersion3B158F69_0988_48bf_A3CD_93E0A4B0339F
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionE2A91EC5_8DF7_4d9c_9723_509CBC1015CB
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWARE360Safe_safemonRepairSucceeded
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 2
push 0x4788e0
push 1
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.__cr
push str.Software360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.0041f240
push str.360122FF_13C3_3f30_A177_3B9CA9BF7B33
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
je 0x4203cd
mov ecx, dword [esi + 4]
push 1
call fcn.00434740
mov ecx, esi
call fcn.0041cc90
push edi
mov ecx, esi
call fcn.0041f330
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ebp
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041f560
push str.Software360safemenuext360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.Software360down
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
push ecx
push edi
mov ecx, esi
call fcn.0041d440
push str.SYSTEMCurrentControlSetServices360webpro
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov esi, dword [esi + 0x1c]
push 0
push str.360_Arp
push edi
call fcn.0041d1a0
push 0
push 0x470f54
push esi
call fcn.0041d1a0
add esp, 0x18
push str.360Antiarp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360_Arp
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [ebp - 0xc]
cmp edx, dword [0x485060]
je 0x4204a9
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x4204a9
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x485060]
je 0x4204cb
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x4204cb
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp edx, dword [0x485060]
je 0x4204ed
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x4204ed
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x485060]
je 0x42050f
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x42050f
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x20]
lea edx, [eax - 0xc]
cmp edx, dword [0x485060]
je 0x420531
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420531
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x485060]
je 0x420553
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420553
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, dword [0x485060]
je 0x420575
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420575
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x485060]
je 0x420597
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x420597
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x30]
lea edx, [eax - 0xc]
cmp edx, dword [0x485060]
je 0x4205b9
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x4205b9
push esi
call fcn.0044fbd4
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8