Function at 0x450e30
Capabilities:
Check if file exists
Create thread
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4aaf23
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4c97a0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c97a0]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x244]
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x20], edi
call fcn.00445aa0
test eax, eax
je 0x450eb2
push str.AtCompat
push str.action_s
push str.http:__update.360safe.com_safe_leakpop.html_
push 1
push 0x4cd998
mov dword [ebp + 0xe0], 4
call fcn.0047e9e0
add esp, 0x14
xor eax, eax
jmp 0x4513a8
push 0x206
lea ecx, [esp + 0x2a]
xor eax, eax
push edi
push ecx
mov word [esp + 0x30], ax
call fcn.0048dc10
add esp, 0xc
push 0x104
lea edx, [esp + 0x28]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...leakrepair.dll
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
push 0x9caa
mov dword [esp + 0x240], edi
call fcn.0046c4a0
mov ecx, eax
add esp, 4
cmp ecx, edi
je 0x450f31
lea edx, [esp + 0x14]
push edx
mov eax, 0x9caa
call fcn.0046c580
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x244], 1
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x450f6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x23c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x450f91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [ebp + 0xe4]
lea eax, [esp + 0x24]
call fcn.00445ba0
test eax, eax
je 0x45137a
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push 0x9cab
mov dword [esp + 0x240], 2
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x450ff0
lea edx, [esp + 0x14]
push edx
mov eax, 0x9cab
call fcn.0046c580
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
push eax
mov dword [esp + 0x244], 3
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x451029
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x23c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x451050
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x23c], 4
cmp dword [esi], ecx
je 0x451085
mov eax, dword [esi + 4]
test eax, eax
je 0x451085
lea ecx, [esp + 0x1c]
push ecx
push 0x4ac80c
push 0x4b9664
call eax
test eax, eax
jge 0x4510a5
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x23c], 0xffffffff
test ecx, ecx
je 0x45137a
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
jmp 0x45137a
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4510bd
mov dword [esp + 0x23c], 0xffffffff
jmp 0x45137a
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
lea edi, [ebp + 0xf0]
push edi
push 0x4b9674
push 0
push eax
call edx
test eax, eax
jge 0x4510fb
mov dword [esp + 0x23c], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x45137a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x45137a
mov eax, dword [edi]
test eax, eax
je 0x4510d7
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0x8002
push 0x8003
push 0x8001
push ebx
push eax
call edx
test eax, eax
jl 0x4510d7
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
push 0x9caf
mov byte [esp + 0x240], 5
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x451161
lea eax, [esp + 0x14]
push eax
mov eax, 0x9caf
call fcn.0046c580
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push esi
push ecx
mov byte [esp + 0x244], 6
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x451197
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x23c], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4511bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
xor ebx, ebx
test eax, eax
mov eax, dword [0x4d01d8]
setge bl
cmp dword [ebp + 0xaf4], 0
mov dword [esp + 0x20], ebx
je 0x451209
cmp dword [ebp + 0xaec], 0
jne 0x451209
test eax, eax
jne 0x451209
cmp dword [ebp + 0xaf0], eax
je 0x451209
mov eax, dword [ebp + 0xb00]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.lastpdaydate
jmp 0x451234
cmp dword [ebp + 0xb08], 0
je 0x451244
cmp dword [ebp + 0xaec], 0
jne 0x451244
test eax, eax
je 0x451244
mov eax, dword [ebp + 0xb14]
mov ecx, dword [eax - 0xc]
lea edx, [ecx + ecx]
push edx
push eax
push 1
push str.lastnoticedate
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea esi, [ebp + 8]
mov dword [ebp + 0x224], eax
lea eax, [esi + 0x28]
push eax
push 0
push esi
push 0x445c40
push 0
push 0
call edi
cmp dword [0x4d01d8], 0
mov dword [esi + 0x24], eax
mov dword [ebp + 0x220], 1
jne 0x45129b
cmp dword [0x4d01cc], 0
jne 0x4512bc
cmp dword [0x4d01c8], 0
jne 0x4512bc
lea ecx, [esp + 0x18]
push ecx
push 0
push ebp
push 0x450bf0
push 0
push 0
mov dword [esp + 0x30], 0
call edi
mov dword [ebp + 0x228], eax
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
push 0x9cb0
mov byte [esp + 0x240], 7
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x451301
lea edx, [esp + 0x14]
push edx
mov eax, 0x9cb0
call fcn.0046c580
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push esi
push eax
mov byte [esp + 0x244], 8
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x451337
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x23c], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45135b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x23c], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x451376
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test ebx, ebx
jne 0x4513a4
mov esi, ebp
call fcn.00450d50
lea eax, [esp + 0x24]
push eax
mov dword [ebp + 0xe0], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4513a4
mov dword [ebp + 0xe0], 3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0048b133
add esp, 0x22c
ret 4