Function at 0x404600
Capabilities:
Allocate thread local storage
Check if file exists
Connect to http server
Create directory
Create http request
Delete file
Get common file path
Get file attributes
Get system information on windows
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x7c
xor esi, esi
push edi
mov word [ebp - 0x608], ax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4d0e04], eax
cmp eax, 0xffffffff
je 0x404bfe
lea eax, [ebp - 0x604]
mov dword [ebp - 0x604], 1
push eax
mov edx, str.Enabled
mov ecx, str.CloudLookup
call fcn.00401770
add esp, 4
cmp dword [ebp - 0x604], esi
je 0x404bfe
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x614], ebx
test ebx, ebx
je 0x404bfe
push str.CommonInfo
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x4c2040
lea eax, [ebp - 0x240]
mov dword [ebp - 0x604], esi
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea eax, [ebp - 0x240]
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
mov edi, eax
test edi, edi
je 0x404724
lea eax, [ebp - 0x604]
push eax
push str.OnlineLookupLog
push edi
call fcn.0045e500
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x404724
cmp dword [ebp - 0x604], 0
je 0x404724
push 0x4c1224
push str.K7FileCloudLookup.log
call fcn.0048c3a4
add esp, 8
mov dword [0x4d4684], eax
mov eax, dword [0x4d4680]
mov ecx, 1
cmp dword [ebp - 0x604], 3
cmove eax, ecx
mov dword [0x4d4680], eax
push 0
push 0x23
push ebx
push 0
mov byte [ebx], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.K7_ComputingK7TSecurityCommon
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404757
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.K7CLCache2.dat
push ebx
call esi
mov esi, dword [0x4d4684]
call fcn.00405df0
test eax, eax
jne 0x404841
test esi, esi
je 0x404784
push str._CheckAndFixDefaultConnectionSettings_DefaultConnectionSettings_NOT_FOUND.._attempting_fix_n
push esi
call fcn.00403b40
add esp, 8
push 0
push 0
push 0
push 0
push str.K7DefaultConnectionSettingsFix
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x610], eax
test eax, eax
je 0x404829
push 0
push 0
push 3
push 0
push 0
push 0x50
push str.127.0.0.1
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0x60c], eax
test eax, eax
je 0x40481d
push 0
push 0
push 0
push 0
push 0
push 0x4c1830
push 0x4c1834
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x40480f
push 0
push 0
push 0x4d
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
jmp 0x404815
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x60c]
call edi
push dword [ebp - 0x610]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.00405df0
test esi, esi
je 0x404841
push eax
push str._CheckAndFixDefaultConnectionSettings_DefaultConnectionSettings_FIX_Status:__d_n
push esi
call fcn.00403b40
add esp, 0xc
push str.CommonInfo
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x348]
mov byte [ebx + 0x400], 0
push 0x4c0e3c
lea esi, [ebx + 0x400]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x348]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
mov edi, eax
test edi, edi
je 0x4048a5
push 0x400
push esi
push str.CloudLookupConfig
push edi
call fcn.0045e550
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 1
je 0x4048bc
lea eax, [ebx + 0x400]
mov ecx, 0x32
mov esi, str.URLhttps:__fcl.k7computing.com_api_fcl_v1_public_lookupURLCTPB6F9BE8D7E6B296B67BE65D3BE5BBD19CCEC6CCAURLCTP270D7C86731DAFFBCC58873127C8330880A6FA6DURLCTP7DFD489708B5CFBE1B9CF4B0B4AC13C35AB43D6E
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4048c2
lea eax, [ebx + 0x400]
lea ecx, [ebp - 0x608]
mov byte [ebp - 0x138], 0
push ecx
push eax
call fcn.0048ca51
mov edi, eax
add esp, 8
test edi, edi
je 0x4049be
push 4
push str.URL
push edi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x40490f
push 0x400
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x404975
push 7
push str.URLCTP
push edi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x404975
xor esi, esi
lea ebx, [edi + 7]
nop dword [eax + eax]
lea eax, [ebp - 0x604]
mov dword [ebp - 0x604], 0
push eax
push str._02X
push ebx
call fcn.00401d30
mov edx, dword [0x4d4640]
add esp, 0xc
mov al, byte [ebp - 0x604]
add ebx, 2
lea ecx, [edx + edx*4]
mov byte [esi + ecx*4 + 0x4d45f0], al
inc esi
cmp esi, 0x14
jb 0x404930
inc edx
mov dword [0x4d4640], edx
push 8
push str.TIMEOUT
push edi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x40499d
push 0xa
push eax
lea eax, [edi + 8]
push eax
call fcn.0048e325
add esp, 0xc
mov dword [0x4d0e08], eax
lea eax, [ebp - 0x608]
push eax
push 0
call fcn.0048ca51
mov edi, eax
add esp, 8
test edi, edi
jne 0x4048e3
mov ebx, dword [ebp - 0x614]
cmp byte [ebp - 0x138], 0
je 0x404bec
push 0x104
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x550]
push eax
call fcn.0048c669
add esp, 0xc
mov dword [0x4d4650], 0
xorps xmm0, xmm0
mov dword [0x4d466c], 0
lea eax, [ebp - 0x550]
movlpd qword [0x4d4648], xmm0
movlpd qword [0x4d465c], xmm0
push 0x4d4644
push 0
push 0
push eax
movlpd qword [0x4d4664], xmm0
movlpd qword [0x4d4678], xmm0
mov dword [0x4d4644], 0x3c
mov dword [0x4d4654], 0x4d43e8
mov dword [0x4d4658], 0x104
mov dword [0x4d4670], 0x4d4910
mov dword [0x4d4674], 0x104
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x404bec
mov eax, dword [0x4d0e08]
mov ecx, 0x1388
test eax, eax
push 0
cmove eax, ecx
mov dword [0x4d0e08], eax
call fcn.0048baa1
add esp, 4
mov dword [0x4d43dc], eax
xor eax, eax
mov word [0x4d4688], ax
push eax
push str.CLSIDA66B1D7A_A610_4e66_B8CF_C451D0932B1DGlobalInfo
push closesocket
call fcn.0045e060
mov esi, eax
test esi, esi
je 0x404aca
push 0x28
lea eax, [ebp - 0x2c]
push eax
push str.SysId
push esi
call fcn.0045e550
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x404ad0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
test eax, eax
je 0x404ae8
push eax
call esi
push 0x28
lea eax, [ebp - 0x2c]
push eax
push 0x4d4688
call fcn.0048c669
xor eax, eax
add esp, 0xc
mov word [0x4d4708], ax
mov dword [ebp - 0x600], eax
lea eax, [ebp - 0x600]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [ebp - 0x600]
cmp eax, 0xffffffc4
je 0x404b2b
mov esi, str.UUtqcmNJaFlHVENJMUgxajRhOXlTazlhZGhKZE9zbldmbjE1YkFqTXladHdhZ2JCM2RPOURneGpjcEZ2VjNEWGIzRlJaSEJzY3NCUUZkWFRYeVZ3S2xtT2tnblRldHJ6VlV5ck45YzlDcXA
cmp eax, 0xffffff88
jne 0x404b30
mov esi, str.Tk5SeGtaaHBuUXh1ZUhwdmM0dGd4V3dOUDdWbFFialNaSGg5TEEyWmthTnJWQThSOWxZbzRtZkl1cHBrOXF3ckZ4RVN1Y0NqR010RWIyRThFS05YRWJ2bFZtQ2g1SDk4MW9na0p0UUhJNkM
mov ecx, 0x48
mov edi, 0x4d4708
rep movsd dword es:[edi], dword [esi]
push 0xb8
push 1
movsw word es:[edi], word [esi]
call fcn.0048e95f
mov esi, eax
add esp, 8
test esi, esi
je 0x404bec
mov dword [esi + 0x18], 0x7e
mov dword [esi + 0x20], 2
mov dword [esi + 0x24], 2
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x634]
mov dword [esi + 0x14], eax
mov dword [0x4d43d8], esi
cmp dword [esi + 0x30], 0
jne 0x404bec
sub esp, 8
mov dword [esi + 0x24], 3
mov edx, ebx
call fcn.00409be0
add esp, 8
test eax, eax
je 0x404bdb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 8
mov edx, ebx
call fcn.00409be0
add esp, 8
test eax, eax
jne 0x404bec
mov dword [0x4d43e0], 1
mov esi, 1
jmp 0x404bee
xor esi, esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret