Function at 0x436210
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x473238
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
mov esi, ecx
lea ecx, [eax - 1]
cmp ecx, 8
ja case.0x436249.4
jmp dword [ecx*4 + 0x4364b4]
cmp dword [esi + 0x58c], 0
mov dword [esi + 0xb4], eax
je case.0x436249.4
jmp case.0x436249.5
mov dword [esi + 0xb4], eax
jmp case.0x436249.4
mov dword [esi + 0xb4], eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], 0
movzx ecx, word [esp + 0x2c]
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
push ecx
movzx ecx, word [esp + 0x2a]
push edx
movzx edx, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push ecx
push edx
push eax
push str._04d__02d__02d__02d:_02d:_02d
lea edi, [esp + 0x60]
call fcn.004543e0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax - 0xc]
add esp, 0x1c
add ecx, ecx
push ecx
push eax
push 1
push str.lastscantime
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push esi
call fcn.00433b90
lea edx, [esp + 0x14]
lea ebx, [esi + 0x5fc]
push edx
mov dword [esp + 0x18], 2
call fcn.00431420
mov edi, dword [eax]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 4
call fcn.00431420
mov ebp, dword [eax]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 1
call fcn.00431420
mov eax, dword [eax]
push edi
push ebp
push eax
push str.count_dcount_opti_dcount_nr_d
push str.http:__update.360safe.com_safe_leakscan.html_
push 3
mov ecx, 0x490040
call fcn.0045dc00
add esp, 0x18
push esi
call fcn.00433db0
push esi
call fcn.004350d0
lea eax, [esp + 0x44]
call fcn.004568e0
jmp case.0x436249.4
cmp dword [esi + 0x2d4], 0
mov dword [esi + 0xb4], eax
je 0x4363de
lea edx, [esp + 0x18]
push edx
mov ecx, 0x9d0f
call fcn.00454940
mov dword [esp + 0x3c], 1
mov eax, dword [eax]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0044e380
add esp, 8
lea eax, [esp + 0x44]
call fcn.004568e0
lea eax, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004568e0
mov ecx, 1
call fcn.0044add0
mov ecx, dword [esi + 0x2d8]
push ecx
call fcn.00435fc0
push esi
mov dword [esi + 0x11ac], 4
call fcn.00436ff0
cmp dword [esi + 0x2cc], 0
je case.0x436249.4
lea edx, [esp + 0x14]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.0x436249.4
lea eax, [esp + 0x14]
push eax
push 9
call fcn.00449a50
jmp case.0x436249.4
cmp dword [esi + 0x2d4], 0
je 0x436485
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x9d08
call fcn.00454940
mov dword [esp + 0x3c], 2
mov eax, dword [eax]
push eax
lea edx, [esp + 0x48]
push edx
call fcn.0044e380
add esp, 8
lea eax, [esp + 0x44]
call fcn.004568e0
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004568e0
mov ecx, 1
call fcn.0044add0
mov eax, dword [esi + 0x2d8]
push eax
call fcn.00435fc0
push esi
mov dword [esi + 0x11ac], 0
call fcn.00436ff0
xor edx, edx
call fcn.00449bf0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4