Function at 0x4d5ef0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor ecx, ecx
xor al, al
cmp byte [ebp + 8], al
push ebx
setne cl
xor edx, edx
push esi
push edi
mov dword [ebp - 0xc], ecx
cmp edx, str.software360TotalSecurity
je 0x4d60cb
xor ecx, ecx
cmp ecx, str.ActiveProtection
je 0x4d60cb
cmp edx, str.TrayAutoRun
je 0x4d60cb
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.ActiveProtection
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push str.software360TotalSecurity
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d5f88
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push str.TrayAutoRun
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 8]
sete bl
call fcn.00443d90
cmp bl, 1
jne 0x4d6114
cmp byte [ebp + 8], 0
je 0x4d60d2
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
lea ecx, [ebp - 8]
add eax, 0x10
push ecx
mov dword [ebp + 8], eax
call fcn.004c75f0
lea edx, [ebp - 0xc]
push edx
mov esi, eax
call fcn.004c58b0
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
push edx
lea eax, [ebp + 8]
push str.__s_safemon_s___start
push eax
call fcn.0044ff30
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d6024
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d6043
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
push ecx
mov ecx, esp
push str.QHSafeTray
call fcn.00464b60
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00464b60
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00448da0
mov esi, dword [ebp + 8]
mov ecx, esi
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4d6073
sub ecx, edi
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push esi
push 1
push eax
call fcn.00438180
add esp, 0x10
lea ecx, [ebp - 0x1c]
call fcn.00448540
push 0
push 3
push 0
push 0
push 0x20
call fcn.004a2350
lea eax, [esi - 0x10]
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4d60c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ecx
mov ecx, esp
push str.QHSafeTray
call fcn.00464b60
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00464b60
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00448da0
push eax
call fcn.00438260
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.00448540
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret