Function at 0x456a2f
Capabilities:
Set registry value

Disassembly:
push 0x38
mov eax, 0x4acdf5
call fcn.00471258
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x456d0b
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x456d0b
mov dword [ebp - 0x34], ebx
call fcn.0045b9ee
test eax, eax
jne 0x456a68
mov dword [ebp - 0x34], 1
jmp 0x456abe
mov ecx, dword [esi + 8]
call fcn.0045ba49
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403c4d
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x16]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 0x1c]
push eax
push str._d._d._d._d
push edi
call fcn.00473efc
add esp, 0x18
cmp eax, 4
jne 0x456ab6
cmp word [ebp - 0x1c], 0xb
jae 0x456ab6
mov dword [ebp - 0x34], 1
lea ecx, [edi - 0x10]
call fcn.0040290e
push 4
lea eax, [ebp - 0x34]
push eax
push 4
push str.360Preview
push str.Software360Safe_safemon
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.RFlags
push str.SOFTWARE360Safe360krnlsvc
push edi
call fcn.00466826
mov ecx, dword [esi + 8]
add esp, 0xc
call fcn.0045ba6e
mov ecx, dword [esi + 8]
mov edi, eax
call fcn.0045bac6
mov ecx, eax
mov dword [ebp - 0x20], ecx
call fcn.0043c9a3
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
call fcn.0043c99f
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
call fcn.0043c991
mov dword [ebp - 0x40], eax
call fcn.0044c517
mov ecx, eax
call fcn.0044c450
mov ecx, dword [ebp - 0x20]
call fcn.0043c9c3
test eax, eax
jne 0x456c80
mov ecx, edi
call fcn.004318c9
mov ecx, dword [ebp - 0x20]
call fcn.0043c9af
test eax, eax
jne 0x456c61
call fcn.0044a835
push 0x2860
lea ecx, [ebp - 0x38]
call fcn.004025d8
mov eax, dword [eax]
push ebx
push ebx
push eax
call fcn.004725b2
mov ecx, dword [ebp - 0x38]
add esp, 0xc
add ecx, 0xfffffff0
mov dword [ebp - 0x24], eax
call fcn.0040290e
push str.__showtrayicon
lea ecx, [ebp - 0x28]
call fcn.004025d8
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], ebx
je 0x456ba8
push 0x4cdf90
lea ecx, [ebp - 0x28]
call fcn.0040285e
mov ecx, dword [esi + 8]
call fcn.0045b9ee
test eax, eax
lea eax, [ebp - 0x28]
push eax
jne 0x456bf7
lea eax, [ebp - 0x24]
cmp dword [0x4f18f0], ebx
je 0x456be3
push str._TrayInstall__cleantrust
push eax
call fcn.00432871
add esp, 0xc
mov byte [ebp - 4], 1
push dword [eax]
mov ecx, edi
call fcn.0043121c
mov ecx, dword [ebp - 0x24]
jmp 0x456c18
push str._TrayInstall__clean
push eax
call fcn.00432871
add esp, 0xc
mov byte [ebp - 4], 2
jmp 0x456bd5
lea eax, [ebp - 0x44]
push str._TrayInstall
push eax
call fcn.00432871
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0043121c
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040290e
cmp dword [ebp - 0x2c], ebx
je 0x456c2e
cmp dword [ebp - 0x40], 1
jne 0x456c52
cmp dword [ebp + 0xc], ebx
jne 0x456c46
cmp dword [ebp - 0x3c], ebx
je 0x456c46
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x24]
test eax, eax
jne 0x456c4b
jmp 0x456c52
cmp dword [ebp + 8], ebx
je 0x456c52
mov ecx, edi
call fcn.00431637
mov ecx, dword [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040290e
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 8]
push ebx
call fcn.0045bfec
push eax
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.004302b1
mov ecx, dword [ebp - 0x20]
call fcn.0043c9bf
test eax, eax
je 0x456cac
mov ecx, dword [esi + 8]
call fcn.0045bfec
test eax, eax
jne 0x456cac
mov ecx, dword [ebp - 0x20]
call fcn.0043c9bb
cmp eax, 1
jne 0x456cac
mov ecx, edi
call fcn.004316fb
mov ecx, edi
call fcn.00431d9c
mov ecx, edi
call fcn.004317bb
mov ecx, dword [esi + 8]
call fcn.0045baca
push 0x4f39f8
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.004028e9
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], 4
call fcn.0045da4b
push dword [ebp - 0x30]
mov ecx, edi
call fcn.004380c8
mov ecx, dword [esi + 8]
call fcn.0045ba9f
cmp eax, ebx
je 0x456d00
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0040290e
call fcn.004712db
ret 8