Function at 0x4d4040
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
call fcn.004d6940
add esp, 8
mov dword [ebp - 0xc], str.CustomFlags
cmp eax, 0xfe
je 0x4d406a
mov dword [ebp - 0xc], str.Flags
push ebx
push ebx
call fcn.004d6940
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
add esp, 8
cmp eax, 2
jne 0x4d4142
mov eax, dword [ebp + 0xc]
and eax, 0x500000
xor ecx, ecx
mov dword [ebp - 0x10], eax
cmp ecx, str.software360TotalSecurity
je 0x4d4137
xor edx, edx
cmp edx, str.ActiveProtection
je 0x4d4137
xor eax, eax
cmp eax, str.ExtFlags
je 0x4d4137
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.ActiveProtection
push str.software360TotalSecurity
lea ecx, [ebp - 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 4]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x4d410e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov edx, dword [ebp - 8]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push str.ExtFlags
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
test bl, bl
jne 0x4d4140
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x10], eax
cmp ecx, str.software360TotalSecurity
je 0x4d4137
xor edx, edx
cmp edx, str.ActiveProtection
je 0x4d4137
cmp dword [ebp - 0xc], ebx
je 0x4d4137
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.ActiveProtection
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 8]
push ecx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x4d41b5
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
test bl, bl
je 0x4d4137
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
or ecx, eax
mov dword [ebp - 4], ecx
test cl, 1
je 0x4d4353
and al, 1
movzx edi, al
xor eax, eax
mov dword [ebp - 0x10], edi
cmp eax, str.SOFTWARE360Safe
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.safemon
je 0x4d4ab9
xor edx, edx
cmp edx, str.ProcDownload
je 0x4d4ab9
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.safemon
add eax, 0x10
push str.SOFTWARE360Safe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d427c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.ProcDownload
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
test bl, bl
je 0x4d4ab9
xor edx, edx
mov dword [ebp - 0x10], edi
cmp edx, str.ProcIM
je 0x4d4ab9
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.safemon
add eax, 0x10
push str.SOFTWARE360Safe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push str.SOFTWARE360Safe
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x4d4314
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], edi
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.ProcIM
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
test bl, bl
je 0x4d4ab9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov bl, 1
test cl, 2
je 0x4d440f
shr eax, 1
and eax, 1
xor edx, edx
mov dword [ebp - 0x10], eax
cmp edx, str.SOFTWARE360Safe
je 0x4d4ab9
xor eax, eax
cmp eax, str.safemon
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.SiteAccess
je 0x4d4ab9
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.safemon
push str.SOFTWARE360Safe
lea ecx, [ebp - 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0xc]
push edx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d43e4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp - 8]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push str.SiteAccess
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test cl, 4
je 0x4d44d3
shr eax, 2
and eax, 1
mov dword [ebp - 0x10], eax
xor eax, eax
cmp eax, str.SOFTWARE360Safe
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.safemon
je 0x4d4ab9
xor edx, edx
cmp edx, str.NetPayProtect
je 0x4d4ab9
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.safemon
add eax, 0x10
push str.SOFTWARE360Safe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d44a8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.NetPayProtect
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test ecx, 0x100
je 0x4d459b
shr eax, 8
and eax, 1
xor edx, edx
mov dword [ebp - 0x10], eax
cmp edx, str.SOFTWARE360Safe
je 0x4d4ab9
xor eax, eax
cmp eax, str.safemon
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.AppMonAccess
je 0x4d4ab9
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.safemon
push str.SOFTWARE360Safe
lea ecx, [ebp - 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0xc]
push edx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d4570
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp - 8]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push str.AppMonAccess
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test ecx, 0x200
je 0x4d4662
shr eax, 9
and eax, 1
mov dword [ebp - 0x10], eax
xor eax, eax
cmp eax, str.SOFTWARE360Safe
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.safemon
je 0x4d4ab9
xor edx, edx
cmp edx, str.DrvFWAccess2
je 0x4d4ab9
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.safemon
add eax, 0x10
push str.SOFTWARE360Safe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d4637
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.DrvFWAccess2
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test ecx, 0x400
je 0x4d472a
shr eax, 0xa
and eax, 1
xor edx, edx
mov dword [ebp - 0x10], eax
cmp edx, str.SOFTWARE360Safe
je 0x4d4ab9
xor eax, eax
cmp eax, str.safemon
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.NetMonAccess
je 0x4d4ab9
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.safemon
push str.SOFTWARE360Safe
lea ecx, [ebp - 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0xc]
push edx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d46ff
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp - 8]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push str.NetMonAccess
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test ecx, 0x10000000
je 0x4d47f1
shr eax, 0x1c
and eax, 1
mov dword [ebp - 0x10], eax
xor eax, eax
cmp eax, str.SOFTWARE360Safe
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.safemon_safecamera
je 0x4d4ab9
xor edx, edx
cmp edx, str.upref
je 0x4d4ab9
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.safemon_safecamera
add eax, 0x10
push str.SOFTWARE360Safe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d47c6
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.upref
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test ecx, 0x800
je 0x4d48b9
shr eax, 0xb
and eax, 1
xor edx, edx
mov dword [ebp - 0x10], eax
cmp edx, str.SOFTWARE360Safe
je 0x4d4ab9
xor eax, eax
cmp eax, str.safemon
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.FileMonAccess
je 0x4d4ab9
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.safemon
push str.SOFTWARE360Safe
lea ecx, [ebp - 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0xc]
push edx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d488e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp - 8]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push str.FileMonAccess
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test ecx, 0x1000
je 0x4d4980
shr eax, 0xc
and eax, 1
mov dword [ebp - 0x10], eax
xor eax, eax
cmp eax, str.SOFTWARE360Safe
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.safemon
je 0x4d4ab9
xor edx, edx
cmp edx, str.MonAccess
je 0x4d4ab9
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.safemon
add eax, 0x10
push str.SOFTWARE360Safe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d4955
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.MonAccess
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test ecx, 0x2000
je 0x4d4a48
shr eax, 0xd
and eax, 1
xor edx, edx
mov dword [ebp - 0x10], eax
cmp edx, str.SOFTWARE360Safe
je 0x4d4ab9
xor eax, eax
cmp eax, str.safemon
je 0x4d4ab9
xor ecx, ecx
cmp ecx, str.AL_Keylogger
je 0x4d4ab9
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.safemon
push str.SOFTWARE360Safe
lea ecx, [ebp - 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0xc]
push edx
push str.SOFTWARE360Safe
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4d4a1d
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp - 8]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push str.AL_Keylogger
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test bl, bl
je 0x4d4b8f
test cl, 8
je 0x4d4a6c
shr eax, 3
and al, 1
movzx eax, al
push eax
call fcn.004d3b20
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add esp, 4
test ecx, 0x40000000
je 0x4d4a8b
shr eax, 0x1e
and al, 1
movzx ecx, al
push ecx
call fcn.004d3cb0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add esp, 4
or edi, 0xffffffff
mov esi, edi
mov dword [ebp - 4], edi
test ecx, 0x100000
je 0x4d4aa3
mov esi, eax
shr esi, 0x14
and esi, 1
test ecx, 0x400000
je 0x4d4ace
cmp esi, edi
jne 0x4d4ac4
mov esi, eax
shr esi, 0x14
and esi, 4
jmp 0x4d4ace
pop edi
xor bl, bl
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, eax
shr edx, 0x14
and edx, 4
or esi, edx
test ecx, 0x20000
je 0x4d4ade
mov edi, eax
shr edi, 0x11
and edi, 1
test ecx, 0x10000
je 0x4d4aef
shr eax, 0x10
and eax, 1
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jne 0x4d4b01
cmp dword [ebp - 4], esi
jne 0x4d4b01
cmp edi, esi
je 0x4d4b8f
push 1
push str.filemon
push 0x56bf64
lea ecx, [ebp - 0x6c]
call fcn.004b4200
cmp dword [ebp - 4], 0xffffffff
je 0x4d4b27
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x6c]
call fcn.004b3fe0
cmp edi, 0xffffffff
je 0x4d4b35
push edi
lea ecx, [ebp - 0x6c]
call fcn.004b4030
cmp esi, 0xffffffff
je 0x4d4b43
push esi
lea ecx, [ebp - 0x6c]
call fcn.004b3c50
lea ecx, [ebp - 0xc]
xor esi, esi
push ecx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.004b3df0
test eax, eax
je 0x4d4b87
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x6c]
call fcn.004b3e40
test eax, eax
je 0x4d4b87
cmp dword [ebp - 0xc], esi
jne 0x4d4b79
cmp dword [ebp - 8], esi
jne 0x4d4b79
xor eax, eax
jmp 0x4d4b7e
mov eax, 1
push eax
lea ecx, [ebp - 0x6c]
call fcn.004b3b10
lea ecx, [ebp - 0x6c]
call fcn.004b41d0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret