Function at 0x40fb60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
mov esi, 2
push str.mode
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [ebp - 0xc], esi
call fcn.004019c0
add esp, 8
test al, al
jne 0x40fba1
push esi
push str.mode
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [ebp - 0xc], esi
call fcn.00401ae0
add esp, 8
mov eax, dword [ebp - 0xc]
mov edi, 0x30013f0f
lea esi, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.0040f9b0
test al, al
jne 0x40fbbb
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
push ecx
push str.Flags
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
call fcn.00401ae0
xor ebx, ebx
xor edi, edi
xor edx, edx
add esp, 8
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
cmp edx, str.SOFTWARE360Safe_safemon
je 0x40fbff
push 0x20006
mov ecx, str.SOFTWARE360Safe_safemon
mov edx, reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x24]
call fcn.00424a20
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push ebx
shr eax, 8
push str.AppMonAccess
and eax, 1
push edi
mov dword [ebp - 0x18], eax
call esi
mov edx, dword [ebp - 4]
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
shr edx, 9
push str.DrvFWAccess2
and edx, 1
push edi
mov dword [ebp - 0x18], edx
call esi
mov ecx, dword [ebp - 4]
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
shr ecx, 0xa
push str.NetMonAccess
and ecx, 1
push edi
mov dword [ebp - 0x18], ecx
call esi
mov eax, dword [ebp - 4]
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push ebx
shr eax, 0xb
push str.FileMonAccess
and eax, 1
push edi
mov dword [ebp - 0x18], eax
call esi
mov edx, dword [ebp - 4]
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
shr edx, 0xc
push str.MonAccess
and edx, 1
push edi
mov dword [ebp - 0x18], edx
call esi
mov eax, dword [ebp - 0xc]
mov esi, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], 1
cmp eax, ebx
je 0x40fcb7
cmp eax, 1
jne 0x40fcba
mov dword [ebp - 8], ebx
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x40fd37
mov eax, 1
cmp dword [ebp - 8], eax
jne 0x40fd30
lea ecx, [ebp - 0x10]
push ecx
push str.AVWriteProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
call fcn.004019c0
add esp, 8
test al, al
je 0x40fd30
cmp dword [ebp - 0x10], ebx
jne 0x40fd30
lea edx, [ebp - 0x14]
push edx
push str.AVReadProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.004019c0
add esp, 8
test al, al
je 0x40fd30
cmp dword [ebp - 0x14], ebx
jne 0x40fd30
mov dword [ebp - 8], ebx
push esi
lea eax, [ebp - 8]
push eax
jmp 0x40fd4d
cmp dword [ebp - 0xc], 0xfe
je 0x40fd63
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 8]
je 0x40fd63
push esi
lea edx, [ebp - 8]
push edx
push esi
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x40fd96
xor eax, eax
test ecx, 0x100000
je 0x40fd79
mov eax, 1
test ecx, 0x400000
je 0x40fd83
or eax, esi
push eax
push str.AVEngine
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.00401ae0
add esp, 8
cmp edi, ebx
je 0x40fda1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret