Function at 0x459a3a
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x4b24e2
call fcn.00476679
mov esi, ecx
cmp dword [esi + 4], 0
je 0x459cf9
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x459cf9
and dword [ebp - 0x2c], 0
call fcn.0045f3cd
test eax, eax
jne 0x459a73
mov dword [ebp - 0x2c], 1
jmp 0x459ac9
mov ecx, dword [esi + 8]
call fcn.0045f3e1
push eax
lea ecx, [ebp - 0x20]
call fcn.00403c96
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x16]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 0x1c]
push eax
push str._d._d._d._d
push edi
call fcn.00479b35
add esp, 0x18
cmp eax, 4
jne 0x459ac1
cmp word [ebp - 0x1c], 0xb
jae 0x459ac1
mov dword [ebp - 0x2c], 1
lea ecx, [edi - 0x10]
call fcn.00402870
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
push str.360Preview
push str.Software360Safe_safemon
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.RFlags
push str.SOFTWARE360Safe360krnlsvc
push edi
call fcn.00469754
mov ecx, dword [esi + 8]
add esp, 0xc
call fcn.0045f406
mov ecx, dword [esi + 8]
mov edi, eax
call fcn.0045f45e
mov ebx, eax
mov ecx, ebx
mov dword [ebp - 0x38], ebx
call fcn.0043cc20
mov ecx, ebx
mov dword [ebp - 0x3c], eax
call fcn.0043cc1c
mov eax, dword [eax]
mov ecx, ebx
mov dword [ebp - 0x20], eax
call fcn.0043cbfc
mov dword [ebp - 0x34], eax
call fcn.0044f542
mov ecx, eax
call fcn.0044f47b
mov ecx, ebx
call fcn.0046f058
test eax, eax
jne 0x459c70
mov ecx, edi
call fcn.00431bcb
mov ecx, ebx
call fcn.0043cc2c
test eax, eax
jne 0x459c50
call fcn.0044d56c
push 0x2860
lea ecx, [ebp - 0x28]
call fcn.00402530
mov eax, dword [eax]
push 0
push 0
push eax
call fcn.004779d2
mov ecx, dword [ebp - 0x28]
add esp, 0xc
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00402870
push str.__showtrayicon
lea ecx, [ebp - 0x24]
call fcn.00402530
and dword [ebp - 4], 0
test ebx, ebx
je 0x459bb2
push 0x4d3fa0
lea ecx, [ebp - 0x24]
call fcn.004027b6
mov ecx, dword [esi + 8]
call fcn.0045f3cd
test eax, eax
lea eax, [ebp - 0x24]
push eax
push str._TrayInstall
jne 0x459be5
lea eax, [ebp - 0x28]
push eax
call fcn.00432b0e
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004314d4
mov ecx, dword [ebp - 0x28]
jmp 0x459c01
lea eax, [ebp - 0x40]
push eax
call fcn.00432b0e
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.004314d4
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00402870
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x459c1a
cmp dword [ebp - 0x34], 1
jne 0x459c3e
cmp dword [ebp + 0xc], eax
jne 0x459c32
cmp dword [ebp - 0x3c], eax
je 0x459c32
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x24]
test eax, eax
jne 0x459c37
jmp 0x459c3e
cmp dword [ebp + 8], eax
je 0x459c3e
mov ecx, edi
call fcn.00431939
mov ecx, dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00402870
mov ebx, dword [ebp - 0x38]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 8]
push 0
call fcn.0045f947
push eax
push dword [ebp - 0x20]
mov ecx, edi
call fcn.004305d1
mov ecx, ebx
call fcn.0043cc3c
test eax, eax
je 0x459c9a
mov ecx, dword [esi + 8]
call fcn.0045f947
test eax, eax
jne 0x459c9a
mov ecx, ebx
call fcn.0043cc38
cmp eax, 1
jne 0x459c9a
mov ecx, edi
call fcn.004319fd
mov ecx, edi
call fcn.0043209e
mov ecx, edi
call fcn.00431abd
mov ecx, dword [esi + 8]
call fcn.0045f462
push 0x4f9e18
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.0040284b
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], 3
call fcn.00460e88
push dword [ebp - 0x30]
mov ecx, edi
call fcn.00438117
mov ecx, dword [esi + 8]
call fcn.0045f437
test eax, eax
je 0x459cee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00402870
call fcn.004766fc
ret 8