Function at 0x4d6940
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
xor ebx, ebx
xor eax, eax
push edi
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], ebx
lea edi, [ebx + 4]
cmp eax, str.software360TotalSecurity
je 0x4d6d1d
xor ecx, ecx
cmp ecx, str.ActiveProtection
je 0x4d6d1d
xor edx, edx
cmp edx, 0x56c0e8
je 0x4d6d1d
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.ActiveProtection
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x14]
push eax
push 0x56c0e8
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
jne 0x4d69e6
cmp dword [ebp - 0x14], edi
je 0x4d69e9
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x10]
call fcn.00443d90
cmp byte [ebp - 1], 1
jne 0x4d6d1d
mov eax, dword [ebp - 8]
cmp eax, 0xfe
jge 0x4d6a14
xor edx, edx
cmp eax, ebx
setl dl
dec edx
and edx, eax
mov dword [ebp - 0xc], edx
jmp 0x4d6a1b
mov dword [ebp - 0xc], 0xfe
cmp dword [ebp + 8], ebx
je 0x4d6d1d
mov eax, dword [ebp - 0xc]
cmp eax, 0xfe
jne 0x4d6bf6
xor eax, eax
mov dword [ebp - 8], ebx
cmp eax, str.CustomFlags
je 0x4d6ab7
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.ActiveProtection
push str.software360TotalSecurity
lea ecx, [ebp - 0x10]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 0x10], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
push str.CustomFlags
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
jne 0x4d6a9e
cmp dword [ebp - 0x14], edi
je 0x4d6aa1
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x10]
call fcn.00443d90
cmp byte [ebp - 1], 1
jne 0x4d6ab7
mov eax, dword [ebp - 8]
jmp 0x4d6d18
xor edx, edx
cmp edx, str.Flags
je 0x4d6bd0
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.ActiveProtection
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x14]
push eax
push str.Flags
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
jne 0x4d6b24
cmp dword [ebp - 0x14], edi
je 0x4d6b27
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x10]
call fcn.00443d90
cmp byte [ebp - 1], 1
jne 0x4d6bd0
mov edx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 0x18], edx
cmp eax, str.CustomFlags
je 0x4d6bc3
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.ActiveProtection
push str.software360TotalSecurity
lea ecx, [ebp - 0x14]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 0x14], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d6ba1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp - 0x14]
push edi
lea ecx, [ebp - 0x18]
push ecx
push edi
push str.CustomFlags
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 0x14]
call fcn.00443d90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x4d6d1d
push 2
mov dword [ebp - 0xc], 2
call fcn.004d0f50
mov edx, dword [ebp + 8]
push ebx
push ebx
push ebx
push ebx
push 2
mov dword [edx], eax
call fcn.004d5900
add esp, 0x18
jmp 0x4d6d1d
cmp eax, ebx
jne 0x4d6d0f
xor ecx, ecx
mov eax, 2
mov dword [ebp - 0x10], eax
cmp ecx, str.PreMode
je 0x4d6c6e
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.ActiveProtection
push str.software360TotalSecurity
lea ecx, [ebp - 0x14]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 0x14], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push str.PreMode
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call esi
lea ecx, [ebp - 0x14]
call fcn.00443d90
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
cmp eax, 0xfe
jne 0x4d6cff
xor eax, eax
cmp eax, str.CustomFlags
je 0x4d6d1d
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.ActiveProtection
push str.software360TotalSecurity
lea ecx, [ebp - 0x14]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 0x14], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x1c]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
push str.CustomFlags
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 1], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
call esi
test eax, eax
jne 0x4d6ce9
cmp dword [ebp - 0x18], edi
je 0x4d6cec
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x14]
call fcn.00443d90
cmp byte [ebp - 1], 1
jne 0x4d6d1d
mov eax, dword [ebp - 8]
jmp 0x4d6d18
push eax
call fcn.004d0f50
mov edx, dword [ebp + 8]
add esp, 4
mov dword [edx], eax
jmp 0x4d6d1d
push eax
call fcn.004d0f50
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp + 0xc], ebx
je 0x4d6dc6
xor edx, edx
mov dword [ebp - 0x10], ebx
cmp edx, str.software360TotalSecurity
je 0x4d6dc6
xor eax, eax
cmp eax, str.ActiveProtection
je 0x4d6dc6
xor ecx, ecx
cmp ecx, str.PreMode
je 0x4d6dc6
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.ActiveProtection
push str.software360TotalSecurity
lea ecx, [ebp - 0x14]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 0x14], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x1c]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
push str.PreMode
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 1], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
call esi
test eax, eax
jne 0x4d6db1
cmp dword [ebp - 0x18], edi
jne 0x4d6db1
mov bl, byte [ebp - 1]
lea ecx, [ebp - 0x14]
call fcn.00443d90
cmp bl, 1
jne 0x4d6dc6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret