Function at 0x439e0c
Capabilities:
Set registry value

Disassembly:
mov eax, 0x46f3b4
call fcn.0045b030
sub esp, 0x4c
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov edi, dword [ebp - 0x1c]
push 1
mov dword [ebp - 0x10], ecx
lea esi, [ecx + 0x54]
pop ebx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x439e3b
xor eax, eax
jmp 0x439e43
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
dec eax
cmp dword [ebp - 0x14], eax
jae 0x439e65
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0043baa1
mov edi, dword [eax]
mov ecx, dword [ebp - 0x10]
push edi
mov dword [edi], ebx
call fcn.00436b4f
inc dword [ebp - 0x14]
jmp 0x439e30
call fcn.004352ee
test eax, eax
mov esi, str._StartAll_
jne 0x439ebc
push eax
push ebx
call fcn.004394c8
mov eax, dword [0x4802e0]
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
and dword [ebp - 4], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
mov eax, esi
mov dword [ebp - 0x40], 5
test eax, eax
je 0x439ea6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.00403113
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00436a6b
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x114]
call fcn.00449089
test eax, eax
jne 0x439f1c
mov eax, dword [ebp - 0x10]
push ebx
lea ecx, [eax + 0x114]
call fcn.00448fe2
mov eax, dword [0x4802e0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
mov eax, esi
test eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], 4
je 0x439f06
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.00403113
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00436a6b
call fcn.00435295
test eax, eax
jne 0x439f71
push eax
push ebx
call fcn.004380f3
mov eax, dword [0x4802e0]
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
mov eax, esi
test eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x40], 6
je 0x439f5b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.00403113
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00436a6b
and dword [ebp - 0x1c], 0
call fcn.00406467
test eax, eax
jne 0x43a044
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.0043600a
mov eax, dword [ebp - 0x10]
add esp, 0xc
push ebx
lea ecx, [eax + 0x54]
call fcn.0043baa1
mov edi, dword [eax]
call fcn.00406467
cmp eax, ebx
je 0x439ffb
mov ecx, dword [ebp - 0x10]
and dword [edi], 0
push edi
call fcn.00436b4f
call fcn.0040ce32
test eax, eax
jne 0x43a044
mov eax, dword [0x4802e0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 3
mov dword [ebp - 0x3c], eax
mov eax, esi
test eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
je 0x439fe8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.00403113
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
jmp 0x43a03f
call fcn.0040ce32
test eax, eax
jne 0x43a044
mov eax, dword [0x4802e0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov dword [ebp - 0x3c], eax
xor eax, eax
test ecx, ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], eax
je 0x43a02e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.00403113
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00436a6b
mov eax, dword [0x4802e0]
mov dword [ebp - 0x48], eax
mov eax, str.AppMonAccess
mov dword [ebp - 4], 5
test eax, eax
je 0x43a067
push str.AppMonAccess
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.AppMonAccess
push eax
lea ecx, [ebp - 0x48]
call fcn.00403113
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 6
test eax, eax
je 0x43a08d
cmp eax, ebx
je 0x43a08d
mov dword [ebp - 0x18], eax
call fcn.0040ce32
test eax, eax
je 0x43a0a3
call fcn.0040ce8c
test eax, eax
je 0x43a3d5
call fcn.0040c5be
test eax, eax
jne 0x43a3d5
and dword [ebp - 0x14], eax
call fcn.00405f51
test eax, eax
jne 0x43a16c
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.00435bb0
mov eax, dword [ebp - 0x10]
add esp, 0x10
push 0
lea ecx, [eax + 0x54]
call fcn.0043baa1
mov edi, dword [eax]
call fcn.00405f51
cmp eax, ebx
je 0x43a12f
mov ecx, dword [ebp - 0x10]
and dword [edi], 0
push edi
call fcn.00436b4f
mov eax, dword [0x4802e0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x58], 0
mov dword [ebp - 0x54], eax
mov eax, esi
test eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x50], ebx
je 0x43a11c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403113
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
jmp 0x43a167
mov eax, dword [0x4802e0]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x54], ecx
mov ecx, esi
test ecx, ecx
mov byte [ebp - 4], 8
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], eax
je 0x43a156
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403113
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.00436a6b
mov eax, dword [0x4802e0]
mov dword [ebp - 0x30], eax
mov eax, str.MonAccess
mov byte [ebp - 4], 9
test eax, eax
je 0x43a18c
push str.MonAccess
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.MonAccess
push eax
lea ecx, [ebp - 0x30]
call fcn.00403113
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x43a1af
cmp eax, ebx
je 0x43a1af
mov dword [ebp - 0x18], eax
call fcn.0040b773
test eax, eax
jne 0x43a264
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.00435f26
mov eax, dword [ebp - 0x10]
add esp, 0xc
lea edi, [eax + 0x54]
mov ecx, edi
call fcn.0043ba8e
cmp eax, 2
ja 0x43a1e3
mov ecx, edi
call fcn.0043bbcd
mov eax, dword [ebp - 0x10]
add eax, 0x54
mov eax, dword [eax + 4]
mov edi, dword [eax + 8]
call fcn.0040b773
cmp eax, ebx
je 0x43a232
mov ecx, dword [ebp - 0x10]
and dword [edi], 0
push edi
call fcn.00436b4f
mov eax, dword [0x4802e0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ebx
call fcn.0043b9cb
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
jmp 0x43a25f
mov eax, dword [0x4802e0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x50], 0
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x54], eax
call fcn.0043b9cb
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
call fcn.00436a6b
mov eax, dword [0x4802e0]
mov dword [ebp - 0x28], eax
push str.FileMonAccess
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xd
call fcn.0043b9cb
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x43a292
cmp eax, ebx
je 0x43a292
mov dword [ebp - 0x18], eax
call fcn.00435349
test eax, eax
jne 0x43a35d
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.004390db
add esp, 0xc
call fcn.0040ce32
test eax, eax
je 0x43a2c3
call fcn.0040ce8c
test eax, eax
je 0x43a35d
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x54]
mov ecx, edi
call fcn.0043ba8e
cmp eax, 3
ja 0x43a2dc
mov ecx, edi
call fcn.0043bbcd
mov eax, dword [ebp - 0x10]
add eax, 0x54
mov eax, dword [eax + 4]
mov edi, dword [eax + 0xc]
call fcn.00435349
cmp eax, ebx
je 0x43a32b
mov ecx, dword [ebp - 0x10]
and dword [edi], 0
push edi
call fcn.00436b4f
mov eax, dword [0x4802e0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x58], 3
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ebx
call fcn.0043b9cb
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x58]
jmp 0x43a358
mov eax, dword [0x4802e0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x50], 0
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x58], 3
mov dword [ebp - 0x54], eax
call fcn.0043b9cb
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x58]
call fcn.00436a6b
mov eax, dword [0x4802e0]
mov dword [ebp - 0x38], eax
push str.FileMonAccess
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x11
call fcn.0043b9cb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], edi
test eax, eax
mov byte [ebp - 4], 0xe
je 0x43a38b
cmp eax, ebx
je 0x43a38b
mov dword [ebp - 0x18], eax
push dword [edi]
push dword [ebp - 0x38]
call fcn.00437c8a
pop ecx
pop ecx
lea ecx, [ebp - 0x38]
call fcn.00403037
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 0xa
push dword [eax]
push dword [ebp - 0x28]
call fcn.00437c8a
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00403037
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 6
push dword [eax]
push dword [ebp - 0x30]
call fcn.00437c8a
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00403037
call fcn.0040ce32
test eax, eax
je 0x43a3e7
call fcn.0040ce8c
test eax, eax
je 0x43a45c
call fcn.0040c5be
test eax, eax
jne 0x43a45c
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0x4806c8
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWARE360Safe_safemon
push esi
mov dword [ebp - 0x14], ebx
call edi
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push str.IMEPRO
push str.SOFTWARE360Safe_safemon
push esi
mov dword [ebp - 0x14], ebx
call edi
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0x480928
push str.SOFTWARE360Safe_safemon
push esi
mov dword [ebp - 0x14], ebx
call edi
push ebx
push str.DefaultBrowserLock
call fcn.00437c8a
push ebx
push 0x480960
call fcn.00437c8a
add esp, 0x10
mov eax, dword [ebp - 0x10]
push 6
lea esi, [eax + 0x54]
mov ecx, esi
call fcn.0043baa1
mov ecx, dword [ebp - 0x10]
mov edi, dword [eax]
call fcn.0043b91b
test eax, eax
jne 0x43a48e
push eax
push eax
call fcn.004380f3
and dword [edi], 0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00436b4f
mov ecx, dword [ebp - 0x10]
call fcn.0043979a
call fcn.0040ce32
test eax, eax
je 0x43a4a8
call fcn.0040ce8c
test eax, eax
je 0x43a4b1
call fcn.0040c5be
test eax, eax
je 0x43a4cf
push ebx
mov ecx, esi
call fcn.0043baa1
mov eax, dword [eax]
cmp dword [eax], 0
je 0x43a50f
push 0xc37c
push ebx
push 0xa
call fcn.0040dca4
jmp 0x43a50c
xor edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x43a4dc
xor eax, eax
jmp 0x43a4e4
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
dec eax
cmp edi, eax
jae 0x43a511
push edi
mov ecx, esi
call fcn.0043baa1
mov eax, dword [eax]
cmp dword [eax], 0
jne 0x43a4fd
cmp edi, 6
jne 0x43a500
inc edi
jmp 0x43a4d1
push 0
push dword [ebp - 0x18]
push 0xa
call fcn.0043625a
add esp, 0xc
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0043548d
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret