Function at 0x70267310
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x47c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x474], eax
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0x24], ebx
call fcn.70202720
cmp byte [0x7034d642], bl
je 0x702676e5
cmp byte [0x7035947c], bl
je 0x702676e5
cmp byte [0x7035947d], bl
je 0x702676e5
push 0x216
lea ecx, [esp + 0x26e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x274], ax
call fcn.702e95e0
add esp, 0xc
push 0x7032ae18
push 0x70359d48
lea edx, [esp + 0x270]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x268]
push eax
push 0x93a80
push str.wrmtl
push 0x7032ae50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, 1
mov ebp, eax
cmp esi, edi
jne 0x70267501
mov ecx, 0x75
mov word [esp + 0x48], cx
mov ecx, 0x6f
mov word [esp + 0x4e], cx
mov edx, 0x69
mov word [esp + 0x4a], dx
mov ecx, 0x6c
mov word [esp + 0x54], cx
mov edx, 0x64
mov word [esp + 0x50], dx
xor edx, edx
mov word [esp + 0x56], dx
mov ecx, 0x69
mov word [esp + 0x2a], cx
mov eax, 0x6d
mov word [esp + 0x4c], ax
mov ecx, 0x64
mov word [esp + 0x30], cx
mov eax, 0x65
mov word [esp + 0x52], ax
mov edx, 0x6d
mov word [esp + 0x2c], dx
mov ecx, 0x5f
mov word [esp + 0x36], cx
mov eax, 0x75
mov word [esp + 0x28], ax
mov edx, 0x65
mov word [esp + 0x32], dx
mov ecx, 0x75
mov eax, 0x6f
mov edx, 0x70
mov word [esp + 0x3c], cx
mov word [esp + 0x2e], ax
mov word [esp + 0x38], dx
xor ecx, ecx
mov eax, 0x6c
mov edx, 0x73
push 0x1fe
mov word [esp + 0x46], cx
mov word [esp + 0x38], ax
mov word [esp + 0x3e], ax
mov word [esp + 0x42], dx
xor eax, eax
lea ecx, [esp + 0x6e]
xor edx, edx
push ebx
push ecx
mov word [esp + 0x4c], ax
mov word [esp + 0x50], dx
mov word [esp + 0x74], ax
call fcn.702e95e0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x54]
push edx
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 0x1fe
call esi
test eax, eax
jne 0x702676e5
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 8
lea eax, [esp + 0x10]
lea edx, [esp + 0x14]
jmp 0x7026768e
cmp esi, 3
je 0x7026750f
cmp esi, 4
jne 0x702676e5
mov edx, 0x68
mov word [esp + 0x4a], dx
mov eax, 0x73
mov word [esp + 0x4c], ax
mov edx, 0x67
mov eax, edx
mov word [esp + 0x52], ax
mov word [esp + 0x50], dx
mov ecx, 0x63
mov word [esp + 0x48], cx
mov ecx, 0x75
mov word [esp + 0x4e], cx
mov eax, 0x74
mov word [esp + 0x58], ax
xor eax, eax
mov word [esp + 0x5e], ax
mov word [esp + 0x64], ax
mov ecx, 0x65
mov word [esp + 0x54], cx
xor ecx, ecx
mov word [esp + 0x5a], cx
mov word [esp + 0x60], cx
mov word [esp + 0x66], cx
mov edx, 0x73
mov word [esp + 0x56], dx
xor edx, edx
mov word [esp + 0x5c], dx
mov word [esp + 0x62], dx
mov eax, 0x68
mov word [esp + 0x2a], ax
mov ecx, 0x73
mov word [esp + 0x2c], cx
mov eax, 0x67
mov ecx, eax
mov edx, 0x63
mov word [esp + 0x28], dx
mov word [esp + 0x32], cx
mov word [esp + 0x30], ax
mov edx, 0x75
mov word [esp + 0x2e], dx
mov ecx, 0x74
mov word [esp + 0x38], cx
mov edx, 0x65
mov word [esp + 0x34], dx
mov eax, 0x73
mov word [esp + 0x36], ax
mov ecx, 0x6c
mov edx, 0x5f
mov eax, 0x70
mov word [esp + 0x3e], cx
mov word [esp + 0x3a], dx
mov word [esp + 0x3c], ax
xor ecx, ecx
mov edx, 0x75
mov eax, 0x73
push 0x1fe
mov word [esp + 0x48], cx
mov word [esp + 0x44], dx
mov word [esp + 0x46], ax
lea ecx, [esp + 0x6e]
xor edx, edx
xor eax, eax
push ebx
push ecx
mov word [esp + 0x52], dx
mov word [esp + 0x74], ax
call fcn.702e95e0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x54]
push edx
push str.SOFTWARE360Safe_safemon
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x1fe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x702676e5
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 8
lea eax, [esp + 0x14]
lea edx, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x34]
push eax
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call esi
test eax, eax
jne 0x702676e5
push ebx
call fcn.702e58be
add esp, 4
push ebx
call fcn.702e58be
add esp, 4
push ebx
call fcn.702e58be
add esp, 4
sub eax, dword [esp + 0x18]
sbb edx, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, ecx
jg 0x702676e5
jl 0x702676e1
cmp eax, ebp
ja 0x702676e5
mov dword [esp + 0x24], edi
mov ecx, dword [esp + 0x484]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.702e1c2f
add esp, 0x47c
ret