Function at 0x54cde0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x61c
push 0xfffffffffffffffe
push 0x674b48
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x618], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x624]
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp + 0x208], bl
push 0x207
push ebx
lea ecx, [ebp + 0x209]
push ecx
call fcn.005dfd60
push ebx
push str.WinDefend
call fcn.0050d920
add esp, 0x14
mov esi, eax
mov dword [ebp - 0x34], esi
lea edi, [ebx + 1]
cmp esi, ebx
je 0x54ce70
push edi
push ebx
push str.WinDefend
call fcn.00510c30
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x3c]
push edx
push str.MsMpEng.exe
call fcn.00503770
test eax, eax
jne 0x54ced4
push str._MSMP__Exe_Not_Running_Access_denied
push ebx
call fcn.004f0f30
add esp, 8
cmp esi, ebx
je 0x54cefc
push ebx
push str.WinDefend
call fcn.004d8010
add esp, 8
cmp eax, edi
je 0x54cec6
push str._MSMP__Service_Not_Running
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x54d1e4
push str._MSMP__Service_Running
push ebx
call fcn.004f0f30
add esp, 8
call fcn.004d9b00
test eax, eax
jne 0x54cf03
push str._MSMP__OS_Not_Supported
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 4], 0xfffffffe
mov eax, 4
jmp 0x54d1e4
push str._MSMP__Service_Not_Present
jmp 0x54ceaf
push str.SoftwareMicrosoftWindows_defender_real_time_protection
lea eax, [ebp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.004d96c0
push ebx
lea ecx, [ebp - 0x1c]
lea edx, [ebp + 0x410]
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
test eax, eax
je 0x54cfb5
call fcn.004faef0
add esp, 0x10
test eax, eax
jne 0x54cf96
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], 4
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x28]
push ecx
push ebx
push ebx
push str.DisableRealtimeMonitoring
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x1c]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [ebp - 0x28], edi
jne 0x54d003
push str._MSMP__RTM_Disabled__x64_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 4], 0xfffffffe
mov eax, 2
jmp 0x54d1e4
push str._MSMP__RTM_Key_Unavailable__x64_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 4], 0xfffffffe
mov eax, 3
jmp 0x54d1e4
call fcn.004dc050
add esp, 0x10
test eax, eax
jne 0x54d1b6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], 4
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push ebx
push str.DisableRealtimeMonitoring
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x1c]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [ebp - 0x24], edi
jne 0x54d003
push str._MSMP__RTM_Disabled
jmp 0x54cf7c
mov byte [ebp], bl
push 0x207
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.005dfd60
mov edx, dword [str.eScan_Installer]
mov dword [ebp + 0x514], edx
mov eax, dword [0x656934]
mov dword [ebp + 0x518], eax
mov ecx, dword [0x656938]
mov dword [ebp + 0x51c], ecx
mov edx, dword [0x65693c]
mov dword [ebp + 0x520], edx
push 0xf4
push ebx
lea eax, [ebp + 0x524]
push eax
call fcn.005dfd60
add esp, 0x18
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x54d06e
cmp byte [eax], bl
je 0x54d06e
push eax
lea ecx, [ebp + 0x514]
push ecx
jmp 0x54d07a
push str.eScan_Installer
lea edx, [ebp + 0x514]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x208
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp + 0x208], bl
lea ecx, [ebp + 0x208]
push ecx
lea edx, [ebp + 0x514]
push edx
lea eax, [ebp]
push eax
call fcn.0054c900
add esp, 0xc
cmp eax, ebx
je 0x54d0f8
cmp byte [ebp + 0x208], bl
jne 0x54d0cc
push str._MSMP__Register_and_SetStatus_Success
push ebx
call fcn.004f0f30
add esp, 8
jmp 0x54d0e1
lea ecx, [ebp + 0x208]
push ecx
push str._MSMP__Register_Success_but_SetStatus_Fail:__s
push ebx
call fcn.004f0f30
add esp, 0xc
push edi
push 0x6568b8
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
jmp 0x54d10d
lea edx, [ebp + 0x208]
push edx
push str._MSMP__Register_Fail._SIReg_status:__s
push ebx
call fcn.004f0f30
add esp, 0xc
call fcn.004d96c0
push edi
test eax, eax
je 0x54d154
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x410]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004faef0
add esp, 0x10
test eax, eax
jne 0x54d191
mov dword [ebp - 0x20], edi
push 4
lea edx, [ebp - 0x20]
push edx
push 4
push ebx
push str.DisableRealtimeMonitoring
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x1c]
push ecx
jmp 0x54d18f
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp + 0x410]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc050
add esp, 0x10
test eax, eax
jne 0x54d191
mov dword [ebp - 0x2c], edi
push 4
lea ecx, [ebp - 0x2c]
push ecx
push 4
push ebx
push str.DisableRealtimeMonitoring
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x1c]
push eax
call esi
cmp dword [ebp - 0x34], ebx
je 0x54d1d8
push ebx
push str.WinDefend
call fcn.004d8010
add esp, 8
cmp eax, edi
jne 0x54d1d8
push edi
push ebx
push str.WinDefend
call fcn.00510c30
jmp 0x54d1d8
push str._MSMP__RTM_Key_Unavailable
jmp 0x54cf9b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xa
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x61c
mov esp, ebp
pop ebp
ret