Function at 0x454df0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x28
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
mov esi, 2
push str.mode
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [esp + 0x1c], esi
call fcn.0042c6f0
add esp, 8
test al, al
jne 0x454e31
push esi
push str.mode
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [esp + 0x1c], esi
call fcn.004547c0
add esp, 8
mov eax, dword [esp + 0x14]
mov edi, 0x30013f0f
lea esi, [esp + 0xc]
mov dword [esp + 0xc], edi
call fcn.00454c10
test al, al
jne 0x454e4f
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0xc]
push ecx
push str.Flags
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
call fcn.004547c0
xor ebp, ebp
xor edi, edi
xor edx, edx
add esp, 8
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebp
cmp edx, str.SOFTWARE360Safe_safemon
je 0x454e98
mov eax, 0x20006
mov ecx, str.SOFTWARE360Safe_safemon
mov edx, reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x28]
call fcn.0040df10
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push ebp
shr eax, 8
push str.AppMonAccess
and eax, 1
push edi
mov dword [esp + 0x38], eax
call esi
mov edx, dword [esp + 0xc]
push 4
lea eax, [esp + 0x24]
push eax
push 4
push ebp
shr edx, 9
push str.DrvFWAccess2
and edx, 1
push edi
mov dword [esp + 0x38], edx
call esi
mov ecx, dword [esp + 0xc]
push 4
lea edx, [esp + 0x24]
push edx
push 4
push ebp
shr ecx, 0xa
push str.NetMonAccess
and ecx, 1
push edi
mov dword [esp + 0x38], ecx
call esi
mov eax, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push ebp
shr eax, 0xb
push str.FileMonAccess
and eax, 1
push edi
mov dword [esp + 0x38], eax
call esi
mov edx, dword [esp + 0xc]
push 4
lea eax, [esp + 0x24]
push eax
push 4
push ebp
shr edx, 0xc
push str.MonAccess
and edx, 1
push edi
mov dword [esp + 0x38], edx
call esi
mov eax, dword [esp + 0x14]
mov esi, 1
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], ebp
mov dword [esp + 0x10], esi
cmp eax, ebp
je 0x454f67
cmp eax, esi
jne 0x454f6b
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push eax
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x454ff0
cmp dword [esp + 0x10], esi
jne 0x454fe7
lea ecx, [esp + 0x18]
push ecx
push str.AVWriteProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebp
call fcn.0042c6f0
add esp, 8
test al, al
je 0x454fe7
cmp dword [esp + 0x18], ebp
jne 0x454fe7
lea edx, [esp + 0x1c]
push edx
push str.AVReadProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.0042c6f0
add esp, 8
test al, al
je 0x454fe7
cmp dword [esp + 0x1c], ebp
jne 0x454fe7
mov dword [esp + 0x10], ebp
push 4
lea eax, [esp + 0x14]
push eax
jmp 0x45500b
cmp dword [esp + 0x14], 0xfe
je 0x455022
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x10]
je 0x455022
push 4
lea edx, [esp + 0x14]
push edx
push 4
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esp + 0xc]
cmp ecx, ebp
je 0x455054
xor eax, eax
test ecx, 0x100000
je 0x455036
mov eax, esi
test ecx, 0x200000
je 0x455041
or eax, 2
push eax
push str.AVEngine
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.004547c0
add esp, 8
cmp edi, ebp
je 0x45505f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
add esp, 0x28
ret