Function at 0x4590be
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x4b19a4
call fcn.00475ac8
mov esi, ecx
cmp dword [esi + 4], 0
je 0x45937d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45937d
and dword [ebp - 0x2c], 0
call fcn.0045e3d5
test eax, eax
jne 0x4590f7
mov dword [ebp - 0x2c], 1
jmp 0x45914d
mov ecx, dword [esi + 8]
call fcn.0045e3e9
push eax
lea ecx, [ebp - 0x20]
call fcn.00403cb4
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x16]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 0x1c]
push eax
push str._d._d._d._d
push edi
call fcn.00479efc
add esp, 0x18
cmp eax, 4
jne 0x459145
cmp word [ebp - 0x1c], 0xb
jae 0x459145
mov dword [ebp - 0x2c], 1
lea ecx, [edi - 0x10]
call fcn.004029d4
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
push str.360Preview
push str.Software360Safe_safemon
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.RFlags
push str.SOFTWARE360Safe360krnlsvc
push edi
call fcn.00468d15
mov ecx, dword [esi + 8]
add esp, 0xc
call fcn.0045e40e
mov ecx, dword [esi + 8]
mov edi, eax
call fcn.0045e466
mov ebx, eax
mov ecx, ebx
mov dword [ebp - 0x38], ebx
call fcn.0043caed
mov ecx, ebx
mov dword [ebp - 0x3c], eax
call fcn.0043cae9
mov eax, dword [eax]
mov ecx, ebx
mov dword [ebp - 0x20], eax
call fcn.0043cac9
mov dword [ebp - 0x34], eax
call fcn.0044ef5c
mov ecx, eax
call fcn.0044ee95
mov ecx, ebx
call fcn.0046e4f0
test eax, eax
jne 0x4592f4
mov ecx, edi
call fcn.00431a02
mov ecx, ebx
call fcn.0043caf9
test eax, eax
jne 0x4592d4
call fcn.0044cf43
push 0x2860
lea ecx, [ebp - 0x28]
call fcn.00402675
mov eax, dword [eax]
push 0
push 0
push eax
call fcn.00476e02
mov ecx, dword [ebp - 0x28]
add esp, 0xc
add ecx, 0xfffffff0
mov ebx, eax
call fcn.004029d4
push str.__showtrayicon
lea ecx, [ebp - 0x24]
call fcn.00402675
and dword [ebp - 4], 0
test ebx, ebx
je 0x459236
push 0x4d2ec0
lea ecx, [ebp - 0x24]
call fcn.004028fb
mov ecx, dword [esi + 8]
call fcn.0045e3d5
test eax, eax
lea eax, [ebp - 0x24]
push eax
push str._TrayInstall
jne 0x459269
lea eax, [ebp - 0x28]
push eax
call fcn.004329c3
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00431355
mov ecx, dword [ebp - 0x28]
jmp 0x459285
lea eax, [ebp - 0x40]
push eax
call fcn.004329c3
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00431355
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004029d4
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x45929e
cmp dword [ebp - 0x34], 1
jne 0x4592c2
cmp dword [ebp + 0xc], eax
jne 0x4592b6
cmp dword [ebp - 0x3c], eax
je 0x4592b6
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x24]
test eax, eax
jne 0x4592bb
jmp 0x4592c2
cmp dword [ebp + 8], eax
je 0x4592c2
mov ecx, edi
call fcn.00431770
mov ecx, dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004029d4
mov ebx, dword [ebp - 0x38]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 8]
push 0
call fcn.0045e926
push eax
push dword [ebp - 0x20]
mov ecx, edi
call fcn.00430746
mov ecx, ebx
call fcn.0043cb09
test eax, eax
je 0x45931e
mov ecx, dword [esi + 8]
call fcn.0045e926
test eax, eax
jne 0x45931e
mov ecx, ebx
call fcn.0043cb05
cmp eax, 1
jne 0x45931e
mov ecx, edi
call fcn.00431834
mov ecx, edi
call fcn.00431ed5
mov ecx, edi
call fcn.004318f4
mov ecx, dword [esi + 8]
call fcn.0045e46a
push 0x4f8ce0
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.004029af
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], 3
call fcn.0045fd29
push dword [ebp - 0x30]
mov ecx, edi
call fcn.00437ff5
mov ecx, dword [esi + 8]
call fcn.0045e43f
test eax, eax
je 0x459372
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.004029d4
call fcn.00475b4b
ret 8