Function at 0x4818a0
Capabilities:
Check for sandbox username or hostname
Get geographical location
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
push 0
push 0x51ec6c
mov byte [0x52e6b6], 1
call fcn.0049ef70
push 0x51ec68
mov dword [0x51ec68], 0x11c
call fcn.0049ab50
add esp, 0x10
mov dword [ebp - 0x198], 0x118
lea eax, [ebp - 0x198]
push eax
push 0x521bc8
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
sub esp, 0x24
mov byte [0x528180], 0
mov byte [0x5293f0], 0
mov byte [0x5207b0], 0
mov byte [0x528390], 0
mov byte [0x528360], 0
mov byte [0x523e80], 0
mov byte [0x521174], 0
mov byte [0x520830], 0
mov byte [0x525f80], 0
mov byte [0x5280e8], 0
mov dword [0x521d98], 0
call fcn.0048e560
add esp, 0x24
mov byte [0x521ce0], 0
cmp byte [0x5293f0], 0
mov byte [0x51fa40], 0
mov byte [0x5212c8], 0
mov byte [0x523ef8], 0
mov byte [0x521378], 0
mov byte [0x528240], 0
mov byte [0x528334], 0
mov byte [0x527810], 0
mov byte [0x5210c8], 0
mov byte [0x51f988], 0
je 0x4819cc
mov ecx, 0x5293f0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4819b0
sub ecx, edx
mov edx, 0x5293f0
push ecx
mov ecx, 0x521ce0
call fcn.00404224
add esp, 4
cmp byte [0x528180], 0
je 0x4819fc
mov ecx, 0x528180
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4819e0
sub ecx, edx
mov edx, 0x528180
push ecx
mov ecx, 0x51fa40
call fcn.00404224
add esp, 4
cmp byte [0x5207b0], 0
je 0x481a2c
mov ecx, 0x5207b0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481a10
sub ecx, edx
mov edx, 0x5207b0
push ecx
mov ecx, 0x5212c8
call fcn.00404224
add esp, 4
cmp byte [0x528390], 0
je 0x481a5c
mov ecx, 0x528390
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481a40
sub ecx, edx
mov edx, 0x528390
push ecx
mov ecx, 0x523ef8
call fcn.00404224
add esp, 4
cmp byte [0x528360], 0
je 0x481a8c
mov ecx, 0x528360
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481a70
sub ecx, edx
mov edx, 0x528360
push ecx
mov ecx, 0x521378
call fcn.00404224
add esp, 4
cmp byte [0x523e80], 0
je 0x481abc
mov ecx, 0x523e80
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481aa0
sub ecx, edx
mov edx, 0x523e80
push ecx
mov ecx, 0x528240
call fcn.00404224
add esp, 4
cmp byte [0x521174], 0
je 0x481aec
mov ecx, 0x521174
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481ad0
sub ecx, edx
mov edx, 0x521174
push ecx
mov ecx, 0x528334
call fcn.00404224
add esp, 4
cmp byte [0x520830], 0
je 0x481b1c
mov ecx, 0x520830
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481b00
sub ecx, edx
mov edx, 0x520830
push ecx
mov ecx, 0x527810
call fcn.00404224
add esp, 4
cmp byte [0x525f80], 0
je 0x481b4c
mov ecx, 0x525f80
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481b30
sub ecx, edx
mov edx, 0x525f80
push ecx
mov ecx, 0x5210c8
call fcn.00404224
add esp, 4
cmp byte [0x5280e8], 0
je 0x481b7c
mov ecx, 0x5280e8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481b60
sub ecx, edx
mov edx, 0x5280e8
push ecx
mov ecx, 0x51f988
call fcn.00404224
add esp, 4
push esi
push 0
push str.CLSIDA66B1D7A_A610_4e66_B8CF_C451D0932B1DGlobalInfo
push SysReAllocString
mov byte [0x523ec8], 0
mov byte [0x528bbc], 0
mov byte [0x525738], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481bc2
push 0x28
push 0x523ec8
push str.SysId
push esi
call fcn.004996b0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481c04
push 0x28
push 0x528bbc
push str.UIDInstallId
push esi
call fcn.004996b0
push 0x28
push 0x525738
push str.UIDDynamicId
push esi
call fcn.004996b0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x521244], 0
mov dword [0x525734], 0
mov dword [0x5283b0], 0
mov dword [0x528328], 0
mov dword [0x521e34], 0x1e
mov dword [0x5280d8], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481cbe
push 0x521244
push str.DateInstallation
push esi
call fcn.00499660
push 0x525734
push str.DateActivation
push esi
call fcn.00499660
push 0x5283b0
push str.DateExpiry
push esi
call fcn.00499660
push 0x528328
push str.SubscriptionType
push esi
call fcn.00499660
push 0x521e34
push str.SubscriptionDays
push esi
call fcn.00499660
push 0x5280d8
push str.SubscriptionStatus
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x528330], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481cf6
push 0x528330
push str.ProductStatus
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x529474], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481d2e
push 0x529474
push str.LifeType
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x5210c0], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481d66
push 0x5210c0
push str.AffiliateId
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x524730
mov byte [0x524730], 0
call fcn.0048fbb0
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x5213bc], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481daf
push 0x5213bc
push str.RebootPending
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x528bec], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481de7
push 0x528bec
push str.RebootDateTime
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x522e3c], 0
mov byte [0x529480], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481e2b
push 0x104
push 0x529480
push str.PackageName
push esi
call fcn.004996b0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [0x520380], 0
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x481e65
push 0x104
push 0x520380
push 0x514e08
push esi
call fcn.004996b0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
push str.K7OEMCfg.Dat
push 0x524730
push 0x506968
push 0x521e38
mov byte [0x526000], 0
mov byte [0x5213c8], 0
mov byte [0x527010], 0
mov byte [0x528bf0], 0
mov byte [0x5208b8], 0
mov byte [0x51f188], 0
mov byte [0x5278c0], 0
mov byte [0x522e40], 0
mov byte [0x5283b8], 0
mov byte [0x51fb80], 0
mov byte [0x523f30], 0
mov byte [0x523640], 0
mov byte [0x525778], 0
mov byte [0x522638], 0
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x18c], 0
push eax
mov ecx, 0x521e38
call fcn.00483b70
add esp, 0x14
cmp eax, 1
jne 0x482127
mov edi, dword [ebp - 0x18c]
push 0x800
push 0x526000
push str.PurchaseNewLicense
mov eax, dword [edi]
push str.BaseURLs
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x5213c8
push str.PurchaseAdditianalLicense
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x527010
push str.RenewExistingLicense
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x528bf0
push str.PurchaseNewProducts
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x5208b8
push str.MyAccountLoginPage
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x51f188
push str.WebSupportPage
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x5278c0
push str.OnProductErrorPage
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x522e40
push str.VirusInformationPage
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x523f30
push str.K7OfflineUpdater
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x523640
push str.K7FreeTools
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x525778
push str.K7QuickLinks
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x522638
push str.K7UpgradeSuccess
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x5283b8
push str.UpsellPage
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0x800
push 0x51fb80
push str.UpsellPage2
mov esi, dword [eax + 0x10]
mov ecx, esi
push str.BaseURLs
call dword [0x4f56a4]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4f56a4]
mov ecx, edi
call esi
push 0
push str.SoftwareK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x482165
push 0x526808
push str.LastUpdateChk
push esi
call fcn.00499660
push 0x52119c
push str.LastUpdatedOn
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, 0x3ff
mov dword [0x525f7c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
shr eax, 0xa
push 0x78
mov dword [0x526804], eax
lea eax, [ebp - 0x84]
push eax
push 5
push 0x800
mov byte [ebp - 0x84], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x84]
push eax
call fcn.004d1301
push 0
mov dword [0x51fa38], eax
call fcn.004c8af7
mov ecx, dword [0x522e3c]
mov esi, eax
add esp, 8
mov dword [0x521374], esi
test ecx, ecx
mov eax, 0x4c87d628
cmove ecx, eax
cmp esi, ecx
mov dword [0x522e3c], ecx
mov ecx, dword [0x5280d8]
sbb eax, eax
inc eax
mov dword [0x5210c4], eax
xor eax, eax
test ecx, ecx
setne al
mov dword [ebp - 0x18c], eax
mov dword [0x523f28], eax
xor eax, eax
cmp dword [0x528328], 2
sete al
cmp dword [0x5213bc], 0
mov dword [ebp - 0x194], eax
mov dword [0x523f2c], eax
je 0x48223d
mov eax, dword [0x528bec]
cmp eax, esi
jae 0x48223d
mov ecx, esi
sub ecx, eax
mov eax, 0xc22e4507
mul ecx
mov ecx, dword [0x5280d8]
shr edx, 0x10
jmp 0x48223f
xor edx, edx
xor edi, edi
mov dword [0x521da4], edx
xor ebx, ebx
mov dword [0x521d94], edi
cmp ecx, 0xa
mov dword [0x522e38], edi
mov dword [0x529478], edi
sete bl
mov dword [0x51faec], edi
xor eax, eax
mov dword [0x529470], ebx
cmp dword [0x528330], 7
sete al
cmp dword [ebp - 0x18c], 1
mov dword [0x51faf0], eax
jne 0x4822c7
mov edx, dword [0x5283b0]
mov eax, 0xc22e4507
cmp edx, esi
jae 0x4822aa
mov ecx, esi
lea ebx, [edi + 1]
sub ecx, edx
mul ecx
shr edx, 0x10
mov dword [0x51faec], edx
jmp 0x4822c1
sub edx, esi
mov dword [0x522e38], edx
mul edx
mov edi, edx
shr edi, 0x10
xor ebx, ebx
mov dword [0x521d94], edi
mov dword [0x529470], ebx
mov eax, dword [0x521244]
cmp esi, eax
jbe 0x4822e4
mov ecx, esi
sub ecx, eax
mov eax, 0xc22e4507
mul ecx
shr edx, 0x10
mov dword [0x529478], edx
mov eax, dword [0x526808]
mov ecx, 1
test eax, eax
cmove eax, dword [0x521244]
cmp eax, esi
jae 0x482310
sub esi, eax
mov eax, dword [0x525f78]
cmp esi, 0xa8c00
cmovae eax, ecx
mov dword [0x525f78], eax
mov eax, dword [0x51fa34]
test eax, eax
jne 0x482332
cmp dword [ebp - 0x194], 0
mov eax, 0x5a
mov ecx, 0xa
cmovne eax, ecx
mov dword [0x51fa34], eax
cmp dword [ebp - 0x18c], 0
je 0x482345
test ebx, ebx
jne 0x482349
cmp edi, eax
ja 0x482353
jmp 0x482349
test ebx, ebx
je 0x482353
mov dword [0x5278bc], 1
push 0x51ec7c
push dword [0x51ec74]
push dword [0x51ec70]
push dword [0x51ec6c]
push str.OsVer_lu__lu__lu__S
push 0x51ed88
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
pop edi
pop ebx
test esi, esi
je 0x4823ad
push 0x526800
push str.VersionTSProgram
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, word [0x526800]
push eax
movzx eax, byte [0x526802]
push eax
movzx eax, byte [0x526803]
push eax
push str._d._d._04d
push 0x523e40
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x528bb8
call fcn.0048fd80
movzx eax, word [0x528bb8]
push eax
movzx eax, byte [0x528bba]
push eax
movzx eax, byte [0x528bbb]
push eax
push str._d._d._04d
push 0x528200
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x28
push 0
push str.SoftwareK7_ComputingCommonInfoAntiVirus
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x482438
push 0x525774
push str.VDefDate
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityK7TSAgnt
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x482476
push 0x5282a0
push str.PolicyNum
push esi
call fcn.00499660
push 0x525730
push str.PolicyVer
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x188]
push 0x506f78
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x188]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x4824ca
push 0x521e28
push str.LastScanTime
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x4824f8
push 0x5211ac
push str.AutoUpdate
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Backup
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x188]
push 0x506f78
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x188]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x48254c
push 0x5210bc
push str.LastBackupRun
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x526000
call fcn.00481870
mov ecx, 0x5213c8
call fcn.00481870
mov ecx, 0x527010
call fcn.00481870
mov ecx, 0x528bf0
call fcn.00481870
mov ecx, 0x5208b8
call fcn.00481870
mov ecx, 0x51f188
call fcn.00481870
mov ecx, 0x5278c0
call fcn.00481870
mov ecx, 0x522e40
call fcn.00481870
mov ecx, 0x5283b8
call fcn.00481870
mov ecx, 0x51fb80
call fcn.00481870
mov ecx, 0x523f30
call fcn.00481870
mov ecx, 0x523640
call fcn.00481870
push str.action:273_1263286091_65
push 0x521da8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.action:273_1263286091_82
push 0x5211b0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.action:273_1263286091_85
push 0x5282a8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.action:273_1263286091_68
push 0x51faf8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.action:273_1263286091_69
push 0x521248
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Privilege
push str.CommonInfo
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x188]
push 0x506f78
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x188]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x4826aa
push 0x51ed84
push str.UserCanDoUpdate
push esi
call fcn.00499660
push 0x523f24
push str.UserCanDoAVScan
push esi
call fcn.00499660
push 0x5213b8
push str.UserCanChangeProtectionStatus
push esi
call fcn.00499660
push 0x5280e4
push str.UserCanChangeAVSettings
push esi
call fcn.00499660
push 0x51b0d8
push str.UserCanDoUninstall
push esi
call fcn.00499660
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4826dc
mov dword [0x51ed84], 1
mov dword [0x523f24], 1
mov dword [0x5213b8], 1
mov dword [0x5280e4], 1
mov dword [0x51b0d8], 1
lea eax, [ebp - 0x190]
mov dword [ebp - 0x194], 0
push eax
push 1
push 0xa
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x190], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
pop esi
test eax, eax
jne 0x482735
lea eax, [ebp - 0x190]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48280a
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x48280a
cmp dword [ebp - 0x114], 6
jb 0x4827ae
lea eax, [ebp - 0x1a0]
push eax
push 4
lea eax, [ebp - 0x19c]
push eax
push 0x12
push dword [ebp - 0x190]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x48280a
cmp dword [ebp - 0x19c], 3
jne 0x4827ae
lea eax, [ebp - 0x1a0]
push eax
push 4
lea eax, [ebp - 0x18c]
push eax
push 0x13
push dword [ebp - 0x190]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x48280a
cmp dword [ebp - 0x18c], 0
jne 0x4827d0
lea eax, [ebp - 0x18c]
push eax
push 1
push dword [ebp - 0x190]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x48280a
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x1a4], 0x44
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x48280a
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp dword [ebp - 0x190], 0
jne 0x482825
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x18c]
test eax, eax
je 0x482836
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x194]
mov edx, str.OAScn
push 0x5280d0
mov ecx, 0x513d64
mov dword [0x5210b8], eax
call fcn.00492b80
push 0x5280d4
mov edx, str.OAScn
xor ecx, ecx
call fcn.00492b80
push 0x523ec0
mov edx, str.ODScn
mov ecx, 0x513d64
call fcn.00492b80
push 0x523ec4
mov edx, str.ODScn
xor ecx, ecx
call fcn.00492b80
push 0x5208b0
mov edx, str.CvrDet
mov ecx, 0x513d64
call fcn.00492b80
push 0x5208b4
mov edx, str.CvrDet
xor ecx, ecx
call fcn.00492b80
push 0x52576c
mov edx, str.HIPS
mov ecx, 0x513d64
call fcn.00492b80
push 0x525770
mov edx, str.HIPS
xor ecx, ecx
call fcn.00492b80
push 0x521d8c
mov edx, str.EHIPS
mov ecx, 0x513d64
call fcn.00492b80
push 0x521d90
mov edx, str.EHIPS
xor ecx, ecx
call fcn.00492b80
push 0x51fb78
mov edx, 0x50d288
mov ecx, 0x513d64
call fcn.00492b80
push 0x51fb7c
mov edx, 0x50d288
xor ecx, ecx
call fcn.00492b80
push 0x5280c0
mov edx, str.UrlMalwr
mov ecx, 0x513d64
call fcn.00492b80
push 0x5280c4
mov edx, str.UrlMalwr
xor ecx, ecx
call fcn.00492b80
push 0x528174
mov edx, str.UrlPhish
mov ecx, 0x513d64
call fcn.00492b80
push 0x528178
mov edx, str.UrlPhish
xor ecx, ecx
call fcn.00492b80
add esp, 0x40
mov edx, str.UrlPhish
mov ecx, 0x513d64
push 0x528174
call fcn.00492b80
push 0x528178
mov edx, str.UrlPhish
xor ecx, ecx
call fcn.00492b80
push 0x5280dc
mov edx, str.UrlScnd
mov ecx, 0x513d64
call fcn.00492b80
push 0x5280e0
mov edx, str.UrlScnd
xor ecx, ecx
call fcn.00492b80
push 0x521230
mov edx, str.FWIDS
mov ecx, 0x513d64
call fcn.00492b80
push 0x521234
mov edx, str.FWIDS
xor ecx, ecx
call fcn.00492b80
push 0x521d9c
mov edx, str.FWOth
mov ecx, 0x513d64
call fcn.00492b80
push 0x521da0
mov edx, str.FWOth
xor ecx, ecx
call fcn.00492b80
push 0x521194
mov edx, str.FWAppCtlAlw
mov ecx, 0x513d64
call fcn.00492b80
push 0x521198
mov edx, str.FWAppCtlAlw
xor ecx, ecx
call fcn.00492b80
push 0x5213c0
mov edx, str.FWAppCtlBlk
mov ecx, 0x513d64
call fcn.00492b80
push 0x5213c4
mov edx, str.FWAppCtlBlk
xor ecx, ecx
call fcn.00492b80
push 0x528298
mov edx, str.AMSIScn
mov ecx, 0x513d64
call fcn.00492b80
push 0x52829c
mov edx, str.AMSIScn
xor ecx, ecx
call fcn.00492b80
push 0x52123c
mov edx, str.DataShield
mov ecx, 0x513d64
call fcn.00492b80
push 0x521240
mov edx, str.DataShield
xor ecx, ecx
call fcn.00492b80
add esp, 0x40
mov edx, str.WebCamAlw
mov ecx, 0x513d64
push 0x521e2c
call fcn.00492b80
push 0x521e30
mov edx, str.WebCamAlw
xor ecx, ecx
call fcn.00492b80
push 0x528168
mov edx, str.WebCamBlk
mov ecx, 0x513d64
call fcn.00492b80
push 0x52816c
mov edx, str.WebCamBlk
xor ecx, ecx
call fcn.00492b80
push 0x5211a4
mov edx, str.WebVisits
mov ecx, 0x513d64
call fcn.00492b80
push 0x5211a8
mov edx, str.WebVisits
xor ecx, ecx
call fcn.00492b80
push 0x5280c8
mov edx, str.PvcAcsDnd
mov ecx, 0x513d64
call fcn.00492b80
push 0x5280cc
mov edx, str.PvcAcsDnd
xor ecx, ecx
call fcn.00492b80
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
mov eax, 1
call fcn.0049d307
mov esp, ebp
pop ebp
ret