Function at 0x421b80
Capabilities:
Accept command line arguments
Check os version
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x248
mov eax, dword [0x4d044c]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
movups xmm0, xmmword [0x4beba4]
mov dword [esp + 0xc], eax
mov eax, 0x4d4c6c
movups xmmword [0x4d6918], xmm0
cmp eax, 0xffffffff
je 0x421be1
cmp dword [0x4d4c6c], 0
mov dword [0x4d3e84], eax
je 0x421be1
mov esi, eax
mov eax, dword [esi + 0x20]
push 1
call eax
cmp dword [esi + 0x24], 0
lea esi, [esi + 0x24]
jne 0x421bd1
mov esi, dword [0x4d1038]
mov ecx, dword [0x4d103c]
cmp esi, ecx
jae 0x421c0b
mov eax, dword [esi]
test eax, eax
je 0x421c04
mov eax, dword [eax + 0x1c]
push 1
call eax
mov ecx, dword [0x4d103c]
add esi, 4
cmp esi, ecx
jb 0x421bf1
push 0x100
push 0x4d3e88
push 0x64
push edi
mov byte [0x4d3fc0], 1
call dword [sym.imp.USER32.dll_LoadStringA]
push str.CommonInfo
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [esp + 0x148]
mov dword [esp + 0x18], 0
push 0x4c0e3c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x140]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x421c80
lea eax, [esp + 0x10]
push eax
push str.BlockStopSvc
push esi
call fcn.0045e500
push esi
call edi
cmp dword [esp + 0x10], 0
mov ecx, 5
mov eax, 4
mov dword [0x4d3f88], 0
cmove eax, ecx
mov dword [0x4d3f8c], 0x10
or eax, 0xc0
mov dword [0x4d3f90], 1
mov dword [0x4d3f94], eax
mov dword [0x4d3f98], 0
mov dword [0x4d3f9c], 0
mov dword [0x4d3fa0], 0
mov dword [0x4d3fa4], 0
mov byte [0x4d3fc0], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov si, ax
mov dword [esp + 8], eax
shr si, 8
mov dword [0x4d3fb0], 0
mov dword [0x4d3fb8], 0
test eax, eax
jns 0x421d1d
mov word [0x4d3fac], 1
jmp 0x421d76
mov edx, 3
mov word [0x4d3fac], 0x100
push ecx
lea ecx, [edx + 3]
call fcn.0041ea40
mov dword [0x4d3fbc], eax
add esp, 4
mov eax, dword [esp + 8]
cmp al, 6
jb 0x421d76
mov dword [0x4d3fb0], 1
jne 0x421d62
cmp si, 1
jne 0x421d66
mov dword [0x4d3fb4], 1
jmp 0x421d76
ja 0x421d6c
jne 0x421d76
cmp si, 2
jb 0x421d76
mov dword [0x4d3fb8], 1
push str.K7TS10UpgradeInProgress
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x421d9a
push eax
mov byte [0x4d4c90], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, word [0x4c4728]
mov word [esp + 0x14], ax
mov al, byte [0x4c472a]
mov byte [esp + 0x16], al
mov eax, dword [esp + 0xc]
mov esi, eax
test eax, eax
je 0x421df0
mov edi, dword [sym.imp.USER32.dll_CharNextA]
nop
cmp byte [esi], 0
je 0x421dea
lea eax, [esp + 0x14]
nop dword [eax]
mov cl, byte [eax]
test cl, cl
je 0x421de1
cmp byte [esi], cl
je 0x421e4d
push eax
call edi
test eax, eax
jne 0x421dd0
push esi
call edi
mov esi, eax
test esi, esi
jne 0x421dc0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20019
push str.AppID
push closesocket
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call fcn.004272d0
mov esi, eax
test esi, esi
je 0x422050
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x421e35
push ecx
call edi
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret 0x10
push esi
call edi
mov esi, eax
test esi, esi
je 0x421dea
nop word [eax + eax]
push str.UnregServer
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x421f2a
push str.RegServer
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x421ed1
cmp byte [esi], 0
je 0x421eb5
lea eax, [esp + 0x14]
nop dword [eax]
mov cl, byte [eax]
test cl, cl
je 0x421ea1
cmp byte [esi], cl
je 0x421eac
push eax
call edi
test eax, eax
jne 0x421e90
push esi
call edi
mov esi, eax
test esi, esi
jne 0x421e84
jmp 0x421eb5
push esi
call edi
mov esi, eax
test esi, esi
jne 0x421e60
mov eax, dword [esp + 0xc]
push 0
push 0x4c4744
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004214a0
call fcn.00420c30
cmp byte [0x4d3fac], 0
je 0x421f07
push 0
push ecx
mov ecx, 0x4d3e58
call fcn.0041eca0
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret 0x10
push 1
push ecx
mov ecx, 0x4d3e58
call fcn.0041eca0
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x4221d4
mov ecx, 0x4d3e58
call fcn.0041f730
push 0
push 0
mov edx, 0x64
call fcn.004249f0
sub esp, 8
mov ecx, 0x4d3e58
call fcn.00423240
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e320
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x421ff8
push 0x1000
call fcn.00460a14
mov edi, eax
add esp, 4
test edi, edi
je 0x421ff0
lea eax, [esp + 0xc]
mov byte [edi], 0
push eax
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push str.BootExecute
push esi
mov dword [esp + 0x24], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [edi], 0
mov esi, edi
je 0x421fe1
push 0x4c42f4
push esi
call fcn.0048b841
add esp, 8
test eax, eax
je 0x422016
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], 0
jne 0x421fc0
mov esi, dword [esp + 0x10]
push 1
push edi
call fcn.004609d1
add esp, 8
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0xc]
add eax, 0xfffffff8
push eax
lea eax, [esi + 8]
push eax
push esi
call fcn.00464a30
mov eax, dword [esp + 0x18]
add esp, 0xc
mov esi, dword [esp + 0x10]
sub eax, 8
mov dword [esp + 0xc], eax
push eax
push edi
push dword [esp + 0x10]
push 0
push str.BootExecute
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x421fe5
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x1c]
push 0x20019
push str.A0BBD622_B251_11D9_B616_0008A17E7A0F
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.004272d0
mov edi, eax
test edi, edi
je 0x4220b9
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x422096
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call eax
test esi, esi
je 0x4220a1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], 0x104
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42213c
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x422137
mov eax, dword [esp + 8]
test eax, eax
je 0x422129
cmp eax, 2
jbe 0x422122
cmp eax, 7
jne 0x422129
cmp ecx, 1
jb 0x422129
cmp byte [esp + ecx + 0x37], 0
jne 0x422129
cmp ecx, 1
jbe 0x422147
cmp byte [esp + ecx + 0x36], 0
jne 0x422129
jmp 0x422147
cmp byte [esp + ecx + 0x37], 0
je 0x422147
mov byte [esp + 0x38], 0
mov byte [0x4d3fc0], 0
jmp 0x42214e
mov byte [esp + 0x38], 0
mov byte [0x4d3fc0], 0
test eax, eax
jne 0x42214e
mov byte [0x4d3fc0], 1
push 0x421b20
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp byte [0x4d3fc0], 0
mov dword [esp + 0x1c], 0x4d3e88
mov dword [esp + 0x20], 0x41fec0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
je 0x4221a1
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x422198
mov byte [0x4d3fc0], al
jmp 0x4221a1
cmp byte [0x4d3fc0], 0
jne 0x4221ab
mov ecx, 0x4d3e58
call fcn.004200d0
mov eax, dword [0x4d3f98]
mov dword [esp + 8], eax
test edi, edi
je 0x4221c3
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x4221c9
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4221d0
push esi
call edi
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret 0x10