Function at 0x42d1f0
Capabilities:
Check if file exists
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
push edi
mov edi, ecx
cmp esi, 0x1277
jne 0x42d230
push edx
push edi
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0042cb40
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xff01
jne 0x42d25e
call fcn.0042b350
xor edx, edx
call fcn.0042a800
push esi
push edi
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xc234
jne 0x42d27d
call fcn.0042c630
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xb234
jne 0x42d2b0
push esi
push edi
call dword [sym.imp.USER32.dll_KillTimer]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0x2234
jne 0x42d2de
push esi
push edi
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push str.WndClassK7MailProxy
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x42d21e
push str.DDF719EE_A802_11D9_B615_0008A17E7A0F
jmp 0x42d30a
cmp esi, 0x5234
jne 0x42d331
push esi
push edi
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push str.WndClassK7MailProxy
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x42d21e
push str.669D42CE_5BFF_11D8_B0FE_00C026A19B93
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0
push eax
push 0x7eb
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xa234
jne 0x42d364
push esi
push edi
mov dword [0x4d3e20], 0
call dword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
call fcn.00413ce0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0x7234
jne 0x42d390
cmp byte [0x4d3fac], 0
jne 0x42d21e
mov cl, 1
call fcn.0042bdb0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0x9234
jne 0x42d3b2
call fcn.0042b350
call fcn.0041cab0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xd234
jne 0x42d3d9
push esi
push edi
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0042b8a0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xff02
jne 0x42d51c
push 0x1000
call fcn.00460a14
mov esi, eax
add esp, 4
test esi, esi
je 0x42d21e
push ebx
push 0
push str.SoftwareK7_ComputingK7TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
lea ebx, [esi + 0x400]
mov byte [esi], 0
call fcn.0045e060
mov edi, eax
test edi, edi
je 0x42d435
push 0x104
push esi
push str.DirProductBase
push edi
call fcn.0045e550
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7Tlmtry.exe
push esi
push 0x4c0e3c
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42d4fe
push 0
push 0
push ebx
call fcn.0045eb50
push str.Config
push str.K7TLM
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x4c2000
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x108]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
mov edi, eax
test edi, edi
je 0x42d4ce
lea eax, [ebp - 0x10c]
push eax
push str.RunInterval
push edi
call fcn.0045e500
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10c]
mov ecx, 0xb4
test eax, eax
push 0
cmove eax, ecx
mov dword [ebp - 0x10c], eax
imul eax, eax, 0xea60
push eax
push 0xff02
push dword [0x4d3e3c]
call dword [sym.imp.USER32.dll_SetTimer]
push 1
push esi
call fcn.004609d1
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xff04
jne 0x42d548
push esi
push edi
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, 1
call fcn.0042cfc0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xff03
jne 0x42d5be
push esi
push dword [0x4d3e10]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x4d3aec], 1
jne 0x42d21e
cmp dword [0x4d59d4], 0
jne 0x42d21e
call fcn.0042c220
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x42f3d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4d59d4], eax
test eax, eax
je 0x42d21e
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 0xf234
jne 0x42d608
push esi
push edi
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0042b350
mov ecx, 3
call fcn.0042cfc0
xor edx, edx
call fcn.0042a800
cmp dword [0x4d3e14], 0
je 0x42d21e
call fcn.0041cab0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
push 0x518
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x42d693
cmp dword [esi], 0x518
jne 0x42d693
cmp dword [esi + 4], 0x4b37544b
jne 0x42d693
mov ecx, dword [esi + 8]
lea eax, [esi + 0x414]
push eax
lea edx, [esi + 0x14]
call fcn.00429d40
push 0
call fcn.0048baa1
add esp, 8
cmp eax, dword [esi + 0x10]
ja 0x42d654
test byte [esi + 8], 2
je 0x42d21e
push esi
push dword [0x4d3e10]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x518
push 0
push esi
call fcn.004644e0
add esp, 0xc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push esi
push 0x113
push dword [0x4d3e3c]
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004606ac
mov esp, ebp
pop ebp
ret