Function at 0x4049e0
Capabilities:
Accept command line arguments
Check if file exists
Get common file path
Get file attributes
Initialize winsock library
Persist via windows service
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6e4
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x6e0], eax
push ebx
push esi
xor eax, eax
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [esp + 0x24], eax
call fcn.00414710
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x404a37
push edi
push str.Error
push str.Requires_Admin_Rights
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4051fe
call fcn.00404790
call fcn.004045d0
push 0x1000
call fcn.0041957c
mov esi, eax
add esp, 4
test esi, esi
je 0x404adc
push 0
push 0x435f14
push 0x80000002
lea ebx, [esi + 0x400]
call fcn.00413e50
mov edi, eax
test edi, edi
je 0x404a8d
push 0x104
push esi
push str.DirProductBase
push edi
call fcn.004141c0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7RegExt.dll
push esi
push 0x436114
push ebx
call fcn.004014f0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404ad3
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404ad3
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404acc
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call fcn.004194d4
add esp, 4
push 0x1000
call fcn.004157b9
mov esi, eax
add esp, 4
test esi, esi
je 0x404bbd
push 0
push 0x435f14
push 0x80000002
lea edi, [esi + 0x400]
mov byte [esi], 0
call fcn.00413e50
mov ebx, eax
test ebx, ebx
je 0x404b2b
push 0x104
push esi
push str.DirProductBase
push ebx
call fcn.004141c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x43c3e8], 0
je 0x404bb2
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x404b67
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
cmp dword [esp + 0x14], 0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
je 0x404b93
push str.K7Amsi64.dll
push esi
push 0x436114
push edi
call ebx
add esp, 0x10
mov ecx, edi
call fcn.00402100
mov ecx, edi
call fcn.00402000
push str.K7Amsi.dll
push esi
push 0x436114
push edi
call ebx
add esp, 0x10
mov ecx, edi
call fcn.00402100
mov ecx, edi
call fcn.00402000
push 1
push esi
call fcn.004157ab
add esp, 8
cmp dword [0x43c4f4], 3
jne 0x404cd4
cmp dword [0x43c3e0], 0
jne 0x404cd4
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetServices
push 0x80000002
call fcn.00413e50
mov esi, eax
test esi, esi
je 0x404cd4
push edi
push str.K7PSSrvc
push esi
call fcn.00413e50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x404c11
push esi
call ebx
mov edi, 1
test edi, edi
je 0x404cd4
push 0x400
lea eax, [esp + 0x2ec]
mov byte [esp + 0x2ec], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x436650
lea eax, [esp + 0x2ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404c85
lea eax, [esp + 0x50]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x404c85
push str.K7WSLsp.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
test esi, esi
jne 0x404cd4
push str.Privacy
push str.Products
push 0x435f14
lea eax, [esp + 0x1ec]
push 0x4360e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x1e0]
push 0
push eax
push 0x80000002
call fcn.004140a0
mov esi, eax
test esi, esi
je 0x404cd4
push 1
push str.HttpFilter
push esi
call fcn.00414240
push esi
call ebx
call fcn.00403770
call fcn.00403d80
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x404d21
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x18], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
je 0x404e17
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.SOFTWAREGoogleChromeExtensionsdlpfamleaodfgmfnggonbfljhjggbdbe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404e17
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREGoogleChromeExtensionsdlpfamleaodfgmfnggonbfljhjggbdbe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404e17
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2ec]
mov dword [esp + 0x14], 0x400
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.path
push dword [esp + 0x30]
call esi
test eax, eax
jne 0x404dcf
push dword [esp + 0x10]
lea eax, [esp + 0x2ec]
push eax
push dword [esp + 0x1c]
push 0
push str.path
push dword [esp + 0x20]
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x400
push eax
lea eax, [esp + 0x2ec]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.version
push dword [esp + 0x30]
call esi
test eax, eax
jne 0x404e17
push dword [esp + 0x10]
lea eax, [esp + 0x2ec]
push eax
push dword [esp + 0x1c]
push 0
push str.version
push dword [esp + 0x20]
call ebx
mov eax, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x404e28
push eax
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404e33
push eax
call ebx
push 0x1000
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x404f1b
push 0
push 0x435f14
push 0x80000002
lea ebx, [esi + 0x400]
mov byte [esi], 0
call fcn.00413e50
mov edi, eax
test edi, edi
je 0x404e95
push 0x104
push esi
push str.DirProductBase
push edi
call fcn.004141c0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x404e9b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7SRChromeNMHmanifest_ff.json
push esi
push 0x436114
push ebx
call fcn.004014f0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404f0b
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMozillaNativeMessagingHostscom.k7computing.k7webprotection
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404f0b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
push 1
push 0
push 0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call edi
mov dword [esp + 0x10], 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404f2a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004034e0
cmp dword [0x43c3e0], 0
je 0x40501b
push 0x1000
mov dword [esp + 0x10], 0
call fcn.004157b9
mov esi, eax
add esp, 4
test esi, esi
je 0x40501b
push 0
lea edi, [esi + 0x104]
mov byte [esi], 0
push 0x435f14
lea eax, [edi + 0x104]
push 0x80000002
mov dword [esp + 0x24], eax
call fcn.00413e50
mov ebx, eax
test ebx, ebx
je 0x404f9d
push 0x104
push esi
push str.DirProductBase
push ebx
call fcn.004141c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push str.K7WscShl.exe
push esi
push 0x436114
push edi
call ebx
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405010
push 0x4363b8
push edi
mov edi, dword [esp + 0x20]
push str.__s___s
push edi
call ebx
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push 0
push edi
call fcn.00414350
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405010
push 0x2bf20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x405006
push 0xffffffffffffffff
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push esi
call fcn.004157ab
add esp, 8
mov edi, dword [esp + 0x24]
push str._skipreg
push edi
call fcn.00416370
xor ecx, ecx
mov esi, 1
test eax, eax
push str._autoreg
push edi
cmovne esi, ecx
call fcn.00416370
add esp, 0x10
test eax, eax
je 0x405052
mov dword [esp + 0x20], 1
xor esi, esi
push str._openconsole
push edi
call fcn.00416370
test eax, eax
mov ecx, 1
push str._checkcriticalupdate
mov ebx, 0
push edi
cmovne ebx, ecx
call fcn.00416370
add esp, 0x10
test eax, eax
je 0x405083
call fcn.004041c0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 8
push eax
mov dword [esp + 0x30], 0xa0
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push str.RICHED32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test esi, esi
je 0x4050b4
call fcn.00402310
push str.K7CmnRes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x43c3ec], eax
call fcn.00402bf0
mov esi, eax
cmp esi, 1
jne 0x4051f8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4050e5
call fcn.00402310
mov eax, dword [esp + 0x20]
test ebx, ebx
jne 0x4050f1
test eax, eax
je 0x405187
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._parent
push eax
call fcn.00416370
add esp, 8
test eax, eax
je 0x405127
lea ecx, [esp + 0xc]
add eax, 8
push ecx
push 0x436598
push eax
call fcn.00402280
add esp, 0xc
test ebx, ebx
je 0x405156
mov ebx, dword [esp + 0xc]
call fcn.0040a430
mov esi, eax
test esi, esi
je 0x405187
mov ecx, dword [esi]
push str._OnInstall
push 0
push ebx
push esi
call dword [ecx + 0x78]
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x405187
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405187
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x64
push 0x54d
push eax
call esi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x10
push dword [esp + 0x18]
call esi
mov dword [esp + 0x40], 0x10
mov byte [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x48], eax
mov word [esp + 0x4d], 0x101
mov byte [esp + 0x4f], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov dword [esp + 0x34], 0x10
lea eax, [esp + 0x40]
mov ecx, 0x10010
mov dword [esp + 0x30], eax
lea eax, [esp + 0x24]
push eax
jns 0x4051dd
lea eax, [esp + 0x34]
push eax
call fcn.0040e700
add esp, 8
jmp 0x4051f3
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.0040e470
add esp, 0x14
mov esi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x43c564], 1
jne 0x40520c
call fcn.00401640
call fcn.00403360
test edi, edi
je 0x405218
push edi
call ebx
mov eax, dword [0x43c3ec]
test eax, eax
je 0x40522e
push eax
call ebx
mov dword [0x43c3ec], 0
mov ecx, dword [esp + 0x6ec]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041559f
mov esp, ebp
pop ebp
ret