Function at 0x401150
Capabilities:
Check for sandbox username or hostname
Get geographical location
Get hostname

Disassembly:
sub esp, 0x94
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
push esi
push edi
push 0x11c
xor ebx, ebx
push ebx
push 0x427bc8
mov byte [0x431c58], 1
call fcn.0040a320
add esp, 0xc
push 0x427bc8
mov dword [0x427bc8], 0x11c
call fcn.00409160
add esp, 4
lea eax, [esp + 0x14]
push eax
push 0x42f708
mov dword [esp + 0x1c], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x429ac0
push 0x430da8
push 0x42f858
push 0x4308d8
mov byte [0x426860], bl
mov byte [0x428d98], bl
mov byte [0x42f608], bl
mov byte [0x4292a0], bl
mov byte [0x429b40], bl
mov byte [0x427970], bl
mov byte [0x4308d8], bl
mov byte [0x42f858], bl
mov byte [0x430da8], bl
mov byte [0x429ac0], bl
mov dword [0x42f600], ebx
push 0x428d98
push 0x426860
mov ebx, 0x427970
mov edi, 0x429b40
mov eax, 0x4292a0
mov ecx, 0x42f608
call fcn.004033a0
xor bl, bl
add esp, 0x18
mov byte [0x430e28], bl
mov byte [0x4279b8], bl
mov byte [0x42e550], bl
mov byte [0x427b9c], bl
mov byte [0x430900], bl
mov byte [0x42c4c8], bl
mov byte [0x430d78], bl
mov byte [0x427ce8], bl
mov byte [0x4267b0], bl
mov byte [0x426700], bl
cmp byte [0x428d98], bl
je 0x40129c
mov eax, 0x428d98
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401280
sub eax, edx
push eax
mov eax, 0x428d98
mov ecx, 0x430e28
call fcn.00403550
add esp, 4
cmp byte [0x426860], bl
je 0x4012cc
mov eax, 0x426860
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4012b0
sub eax, edx
push eax
mov eax, 0x426860
mov ecx, 0x4279b8
call fcn.00403550
add esp, 4
cmp byte [0x42f608], bl
je 0x4012fc
mov eax, 0x42f608
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4012e0
sub eax, edx
push eax
mov eax, 0x42f608
mov ecx, 0x42e550
call fcn.00403550
add esp, 4
cmp byte [0x4292a0], bl
je 0x40132c
mov eax, 0x4292a0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401310
sub eax, edx
push eax
mov eax, 0x4292a0
mov ecx, 0x427b9c
call fcn.00403550
add esp, 4
cmp byte [0x429b40], bl
je 0x40135c
mov eax, 0x429b40
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401340
sub eax, edx
push eax
mov eax, 0x429b40
mov ecx, 0x430900
call fcn.00403550
add esp, 4
cmp byte [0x427970], bl
je 0x40138c
mov eax, 0x427970
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401370
sub eax, edx
push eax
mov eax, 0x427970
mov ecx, 0x42c4c8
call fcn.00403550
add esp, 4
cmp byte [0x4308d8], bl
je 0x4013bc
mov eax, 0x4308d8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4013a0
sub eax, edx
push eax
mov eax, 0x4308d8
mov ecx, 0x430d78
call fcn.00403550
add esp, 4
cmp byte [0x42f858], bl
je 0x4013ec
mov eax, 0x42f858
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4013d0
sub eax, edx
push eax
mov eax, 0x42f858
mov ecx, 0x427ce8
call fcn.00403550
add esp, 4
cmp byte [0x430da8], bl
je 0x40141c
mov eax, 0x430da8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401400
sub eax, edx
push eax
mov eax, 0x430da8
mov ecx, 0x4267b0
call fcn.00403550
add esp, 4
cmp byte [0x429ac0], bl
je 0x40144c
mov eax, 0x429ac0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401430
sub eax, edx
push eax
mov eax, 0x429ac0
mov ecx, 0x426700
call fcn.00403550
add esp, 4
mov byte [0x427a64], bl
mov byte [0x430d40], bl
mov byte [0x42dd20], bl
push 0x42dd20
mov ebx, 0x430d40
mov edi, 0x427a64
call fcn.00403200
xor ebx, ebx
add esp, 4
mov dword [0x427d94], ebx
mov dword [0x427a94], ebx
mov dword [0x42685c], ebx
mov dword [0x4267ac], ebx
mov dword [0x42e5fc], 0x1e
mov dword [0x427ce4], ebx
call fcn.00403480
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [0x42bc40], ebx
call fcn.00408ef0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
cmp esi, ebx
je 0x4014d9
push 0x42bc40
push str.ProductStatus
push esi
call fcn.00408f70
push esi
call edi
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [0x42bc38], ebx
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401508
push 0x42bc38
push str.LifeType
push esi
call fcn.00408f70
push esi
call edi
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [0x431cb0], ebx
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401537
push 0x431cb0
push str.AffiliateId
push esi
call fcn.00408f70
push esi
call edi
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurity
push 0x80000002
mov byte [0x42c520], bl
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x40156b
push 0x104
push 0x42c520
push str.DirProductBase
push esi
call fcn.00408f20
push esi
call edi
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [0x431c80], ebx
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x40159a
push 0x431c80
push str.RebootPending
push esi
call fcn.00408f70
push esi
call edi
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [0x431c68], ebx
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x4015c9
push 0x431c68
push str.RebootDateTime
push esi
call fcn.00408f70
push esi
call edi
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [0x431cb4], ebx
mov byte [0x427a98], bl
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401603
push 0x104
push 0x427a98
push str.PackageName
push esi
call fcn.00408f20
push esi
call edi
push str.K7OEMCfg.Dat
push 0x42c520
push str._s_s
push 0x4300d8
mov byte [0x42d520], bl
mov byte [0x42e600], bl
mov byte [0x4270e8], bl
mov byte [0x42bc48], bl
mov byte [0x427d98], bl
mov byte [0x42a370], bl
mov byte [0x42dd50], bl
mov byte [0x429b70], bl
mov byte [0x42b430], bl
mov byte [0x42ee00], bl
mov byte [0x4268e0], bl
mov byte [0x4292c0], bl
mov byte [0x42f8d8], bl
mov byte [0x42ab70], bl
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x20]
push ecx
push ebx
push 0x4300d8
mov dword [esp + 0x2c], ebx
call fcn.00402e90
add esp, 0x1c
cmp eax, 1
jne 0x401834
mov esi, dword [esp + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42d520
push str.PurchaseNewLicense
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42e600
push str.PurchaseAdditianalLicense
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x4270e8
push str.RenewExistingLicense
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42bc48
push str.PurchaseNewProducts
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x427d98
push str.MyAccountLoginPage
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42a370
push str.WebSupportPage
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42dd50
push str.OnProductErrorPage
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x429b70
push str.VirusInformationPage
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x4268e0
push str.K7OfflineUpdater
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x4292c0
push str.K7FreeTools
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42f8d8
push str.K7QuickLinks
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42ab70
push str.K7UpgradeSuccess
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42b430
push str.UpsellPage
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 0x800
push 0x42ee00
push str.UpsellPage2
push str.BaseURLs
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x40]
mov ecx, esi
call eax
push ebx
push str.SoftwareK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x40186d
push 0x431c60
push str.LastUpdateChk
push esi
call fcn.00408f70
push 0x431c64
push str.LastUpdatedOn
push esi
call fcn.00408f70
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
call esi
and eax, 0x3ff
mov dword [0x42bc44], eax
call esi
push 0x78
lea edx, [esp + 0x1c]
movzx ecx, ax
push edx
push 5
shr ecx, 0xa
push 0x800
mov dword [0x42f604], ecx
mov byte [esp + 0x28], bl
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp + 0x18]
push eax
call fcn.00409d60
add esp, 4
push ebx
mov dword [0x42bc3c], eax
call fcn.0040a9ad
mov ecx, eax
mov eax, dword [0x431cb4]
add esp, 4
mov dword [0x431ca8], ecx
cmp eax, ebx
jne 0x4018db
mov eax, 0x4c87d628
mov dword [0x431cb4], eax
mov edi, dword [0x427ce4]
cmp ecx, eax
sbb edx, edx
inc edx
xor eax, eax
cmp edi, ebx
setne al
mov dword [0x431c88], edx
xor edx, edx
cmp dword [0x4267ac], 2
sete dl
mov ebp, eax
mov dword [0x431c6c], ebp
mov dword [0x431c78], edx
cmp dword [0x431c80], ebx
je 0x401934
mov eax, dword [0x431c68]
cmp eax, ecx
jae 0x401934
mov edx, ecx
sub edx, eax
mov eax, 0xc22e4507
mul edx
shr edx, 0x10
mov dword [0x431ca0], edx
jmp 0x40193a
mov dword [0x431ca0], ebx
xor eax, eax
xor esi, esi
cmp edi, 0xa
sete al
xor edx, edx
cmp dword [0x42bc40], 7
mov dword [0x431c98], esi
sete dl
mov dword [0x431c94], ebx
mov dword [0x431c8c], ebx
mov edi, eax
mov dword [0x431c9c], ebx
mov dword [0x431c70], edi
mov dword [0x431c74], edx
cmp ebp, 1
jne 0x4019c0
mov eax, dword [0x42685c]
cmp eax, ecx
jae 0x40199c
mov edx, ecx
sub edx, eax
mov eax, 0xc22e4507
mul edx
shr edx, 0x10
mov dword [0x431c9c], edx
mov edi, ebp
jmp 0x4019ba
sub eax, ecx
mov edx, eax
mov eax, 0xc22e4507
mov dword [0x431c94], edx
mul edx
mov esi, edx
shr esi, 0x10
mov dword [0x431c98], esi
xor edi, edi
mov dword [0x431c70], edi
mov ebp, dword [0x427d94]
cmp ecx, ebp
jbe 0x4019de
mov edx, ecx
sub edx, ebp
mov eax, 0xc22e4507
mul edx
shr edx, 0x10
mov dword [0x431c8c], edx
mov eax, dword [0x431c60]
cmp eax, ebx
jne 0x4019e9
mov eax, ebp
cmp eax, ecx
jae 0x401a08
sub ecx, eax
mov eax, 0xc22e4507
mul ecx
shr edx, 0x10
cmp edx, 7
jbe 0x401a08
mov dword [0x431c7c], 1
mov eax, dword [0x431ca4]
cmp eax, ebx
jne 0x401a25
mov eax, dword [0x431c78]
neg eax
sbb eax, eax
and eax, 0xffffffb0
add eax, 0x5a
mov dword [0x431ca4], eax
cmp dword [0x431c6c], ebx
je 0x401a37
cmp edi, ebx
jne 0x401a3b
cmp esi, eax
ja 0x401a45
jmp 0x401a3b
cmp edi, ebx
je 0x401a45
mov dword [0x431c84], 1
mov eax, dword [0x427bd4]
mov ecx, dword [0x427bd0]
mov edx, dword [0x427bcc]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x427bdc
push eax
push ecx
push edx
push str.OsVer_lu__lu__lu__S
push 0x430940
call edi
add esp, 0x18
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401aa4
push 0x431ccc
push str.VersionTSProgram
push esi
call fcn.00408f70
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call ebp
jmp 0x401aaa
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, word [0x431ccc]
movzx ecx, byte [0x431cce]
movzx edx, byte [0x431ccf]
push eax
push ecx
push edx
push str._d._d._04d
push 0x42b370
call edi
add esp, 0x14
push ebx
push str.SoftwareK7_ComputingCommonInfoAntiVirus
push 0x80000002
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401afa
push 0x431cd0
push str.VDefVersion
push esi
call fcn.00408f70
push esi
call ebp
movzx eax, word [0x431cd0]
movzx ecx, byte [0x431cd2]
movzx edx, byte [0x431cd3]
push eax
push ecx
push edx
push str._d._d._04d
push 0x430ed8
call edi
add esp, 0x14
push ebx
push str.SoftwareK7_ComputingCommonInfoAntiVirus
push 0x80000002
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401b4a
push 0x431cd4
push str.VDefDate
push esi
call fcn.00408f70
push esi
call ebp
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityK7TSAgnt
push 0x80000002
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401b83
push 0x431cb8
push str.PolicyNum
push esi
call fcn.00408f70
push 0x431cbc
push str.PolicyVer
push esi
call fcn.00408f70
push esi
call ebp
call fcn.00402f10
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
call fcn.00408ef0
mov esi, eax
cmp esi, ebx
je 0x401bb1
push 0x431cc8
push str.AutoUpdate
push esi
call fcn.00408f70
push esi
call ebp
call fcn.00402fb0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42d520
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x42d520
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x42e600
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x42e600
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x4270e8
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x4270e8
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x42bc48
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x42bc48
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x427d98
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x427d98
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x42a370
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x42a370
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x42dd50
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x42dd50
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x429b70
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x429b70
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x42b430
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x42b430
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x42ee00
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x42ee00
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x4268e0
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x4268e0
push 0x428598
call fcn.00401f90
add esp, 0x18
push 0x4292c0
push 0x428598
call esi
push ebx
push ebx
push ebx
push ebx
push 0x4292c0
push 0x428598
call fcn.00401f90
add esp, 0x18
push str.action:273_1263286091_65
push 0x42f688
call esi
push str.action:273_1263286091_82
push 0x42b3b0
call esi
push str.action:273_1263286091_85
push 0x428e20
call esi
push str.action:273_1263286091_68
push 0x430f18
call esi
push str.action:273_1263286091_69
push 0x42c448
call esi
call fcn.00403050
test eax, eax
jne 0x401db7
mov eax, 1
mov dword [0x431cdc], eax
mov dword [0x431cd8], eax
mov dword [0x431ce0], eax
mov dword [0x431ce4], eax
mov dword [0x424bec], eax
call section..text
push 0x41f558
mov ecx, 0x4279b0
mov ebx, str.OAScn
mov dword [0x431ce8], eax
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x4279b4
call fcn.00403130
add esp, 4
push 0x41f558
mov ecx, 0x4308f8
mov ebx, str.ODScn
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x4308fc
call fcn.00403130
add esp, 4
push 0x41f558
mov ecx, 0x4270e0
mov ebx, str.CvrDet
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x4270e4
call fcn.00403130
add esp, 4
push 0x41f558
mov ecx, 0x428e18
mov ebx, str.HIPS
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x428e1c
call fcn.00403130
add esp, 4
push 0x41f558
mov ecx, 0x430d70
mov ebx, str.UrlMalwr
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x430d74
call fcn.00403130
add esp, 4
push 0x41f558
mov ecx, 0x42f820
mov ebx, str.UrlPhish
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x42f824
call fcn.00403130
add esp, 4
push 0x41f558
mov ecx, 0x427968
mov ebx, str.FWIDS
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x42796c
call fcn.00403130
add esp, 4
push 0x41f558
mov ecx, 0x42bc30
mov ebx, str.FWOth
call fcn.00403130
add esp, 4
push 0
mov ecx, 0x42bc34
call fcn.00403130
mov ecx, dword [esp + 0xa0]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov eax, 1
xor ecx, esp
call fcn.00409279
add esp, 0x94
ret