Function at 0x4185c0
Capabilities:
Query or enumerate registry key
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x240], ecx
push edi
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], edi
mov byte [ebp - 0x110], 0
call fcn.0045e060
mov ebx, eax
test ebx, ebx
je 0x418662
push 0x104
lea eax, [ebp - 0x110]
push eax
push str.PackageComponents
push ebx
call fcn.0045e550
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 1
jne 0x418662
cmp byte [ebp - 0x110], 0
je 0x418662
lea eax, [ebp - 0x110]
push 0x4c2a00
push eax
call fcn.00463f60
xor ecx, ecx
add esp, 8
test eax, eax
setne cl
mov dword [ebp - 0x228], ecx
test eax, eax
je 0x419112
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea eax, [ebp - 0x110]
push str.General
push str.FireWall
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x4c2000
push 0x104
push eax
mov byte [ebp - 0x22d], 0
call ebx
add esp, 0x1c
lea eax, [ebp - 0x110]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
mov esi, eax
test esi, esi
je 0x4186cb
lea eax, [ebp - 0x22d]
push eax
push str.ReportXferStats
push esi
call fcn.0045e4b0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x22d], 0
je 0x419112
cmp dword [0x4d4c60], edi
je 0x419112
push str.AppInfo
push str.CommonInfo
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x4c1ff4
lea eax, [ebp - 0x110]
push 0x104
push eax
call ebx
add esp, 0x18
lea eax, [ebp - 0x110]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e320
mov ebx, eax
mov dword [ebp - 0x24c], ebx
test ebx, ebx
je 0x419112
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 0x240], edi
je 0x41879d
lea eax, [ebp - 0x288]
mov dword [ebp - 0x284], edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 0x288], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea ecx, [ebp - 0x288]
mov eax, dword [ecx]
cmp eax, dword [0x4d6904]
jne 0x418787
mov eax, dword [ecx + 4]
cmp eax, dword [0x4d6908]
je 0x4190c9
mov eax, dword [ebp - 0x288]
mov dword [0x4d6904], eax
mov eax, dword [ebp - 0x284]
mov dword [0x4d6908], eax
push 0x11800
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x254], esi
test esi, esi
je 0x4190c3
push 0
lea eax, [esi + 0x1000]
mov byte [esi], 0
push str.SoftwareK7_ComputingK7TotalSecurity
lea ebx, [eax + 0x1000]
mov dword [ebp - 0x27c], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x248], ebx
call fcn.0045e060
mov edi, eax
test edi, edi
je 0x418807
push 0x104
push esi
push str.DirProductBase
push edi
call fcn.0045e550
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7AppCtrl.dat
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
call fcn.00437eb0
mov edi, dword [ebp - 0x23c]
xor ecx, ecx
add esp, 4
cmp eax, 1
cmovne edi, ecx
xor eax, eax
xor cl, cl
mov dword [ebp - 0x234], edi
mov byte [ebp - 0x22f], cl
mov edi, dword [ebp - 0x24c]
lea ecx, [ebp - 0x218]
push 0x104
push ecx
push eax
push edi
mov dword [ebp - 0x240], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x418f2f
push eax
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.0045e320
mov edi, eax
mov dword [ebp - 0x280], edi
test edi, edi
je 0x418f2f
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0
push eax
push str.BWUsageUpdated
push edi
call fcn.0045e500
cmp dword [ebp - 0x228], 0
je 0x418f1c
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
push str.XferStartTime
push edi
call fcn.0045e500
cmp dword [ebp - 0x244], 0
je 0x418f1c
push 0x400
push esi
push str.FilePath
push edi
mov byte [ebp - 0x22e], 0
mov byte [esi], 0
call fcn.0045e550
cmp byte [esi], 0
je 0x41892f
push 0x10
lea eax, [esi + 1]
push str.:PROGRAM_FILES_
push eax
call fcn.0048f15c
add esp, 0xc
test eax, eax
je 0x418928
push 0x16
lea eax, [esi + 1]
push str.:PROGRAM_FILES__X86__
push eax
call fcn.0048f15c
add esp, 0xc
test eax, eax
jne 0x41892f
mov byte [ebp - 0x22e], 1
push 0x400
push esi
push str.FileSigner
push edi
mov byte [esi], 0
call fcn.0045e550
mov edx, dword [ebp - 0x234]
test edx, edx
je 0x4189bc
cmp byte [esi], 0
je 0x4189bc
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x22c], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418960
sub ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x228], ecx
cmp ecx, 0x80
jae 0x4189bc
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x228], 0
push eax
push esi
push str.FileSigner
mov ecx, edx
call fcn.004376d0
test eax, eax
je 0x4189ae
push eax
call fcn.00491469
add esp, 4
mov dword [ebp - 0x228], eax
jmp 0x4189b4
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x418f02
mov eax, dword [ebp - 0x248]
add eax, 0xc800
cmp ebx, eax
ja 0x418f1c
push 0x400
push esi
push 0x4c2a78
push edi
mov byte [esi], 0
call fcn.0045e550
mov edx, dword [ebp - 0x234]
test edx, edx
je 0x418a5c
cmp byte [esi], 0
je 0x418a5c
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x22c], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418a00
sub ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x228], ecx
cmp ecx, 0x80
jae 0x418a5c
lea eax, [ebp - 0x290]
mov dword [ebp - 0x228], 0
push eax
push esi
push 0x4c2a78
mov ecx, edx
call fcn.004376d0
test eax, eax
je 0x418a4e
push eax
call fcn.00491469
add esp, 4
mov dword [ebp - 0x228], eax
jmp 0x418a54
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x418f02
push 0x400
push esi
push str.FileVendor
push edi
mov byte [esi], 0
call fcn.0045e550
mov edx, dword [ebp - 0x234]
test edx, edx
je 0x418b64
cmp byte [esi], 0
je 0x418b64
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x22c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418a92
sub ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x228], ecx
cmp ecx, 0x80
jae 0x418af4
lea eax, [ebp - 0x294]
mov dword [ebp - 0x228], 0
push eax
push esi
push str.FileVendor
mov ecx, edx
call fcn.004376d0
test eax, eax
je 0x418ae0
push eax
call fcn.00491469
add esp, 4
mov dword [ebp - 0x228], eax
jmp 0x418ae6
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x418f02
mov edx, dword [ebp - 0x234]
cmp byte [ebp - 0x22e], 0
jne 0x418b64
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x22c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418b08
sub ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x228], ecx
cmp ecx, 0x80
jae 0x418b64
lea eax, [ebp - 0x298]
mov dword [ebp - 0x228], 0
push eax
push esi
push str.FileVendor_NonPgm
mov ecx, edx
call fcn.004376d0
test eax, eax
je 0x418b56
push eax
call fcn.00491469
add esp, 4
mov dword [ebp - 0x228], eax
jmp 0x418b5c
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x418f02
push 0x400
push esi
push str.FileMD5
push edi
mov byte [esi], 0
call fcn.0045e550
mov edx, dword [ebp - 0x234]
test edx, edx
je 0x418bee
cmp byte [esi], 0
je 0x418bee
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x22c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418b92
sub ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x228], ecx
cmp ecx, 0x80
jae 0x418bee
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x228], 0
push eax
push esi
push str.FileMD5
mov ecx, edx
call fcn.004376d0
test eax, eax
je 0x418be0
push eax
call fcn.00491469
add esp, 4
mov dword [ebp - 0x228], eax
jmp 0x418be6
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x418f02
push esi
push str.MD5_s
push ebx
mov dword [ebp - 0x250], ebx
call fcn.00401a50
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x23c], ebx
push 0
push str.UserData
push edi
call fcn.0045e320
mov dword [ebp - 0x22c], eax
test eax, eax
jne 0x418c2d
mov ebx, dword [ebp - 0x250]
jmp 0x418f02
lea ecx, [esi + 0x1000]
xor ebx, ebx
push ecx
push ebx
mov edx, eax
mov byte [ecx], bl
call fcn.00414550
mov edi, eax
add esp, 8
test edi, edi
je 0x418dea
mov esi, dword [ebp - 0x23c]
nop dword [eax]
nop word [eax + eax]
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0
push eax
push str.XferStartTime
push dword [ebp - 0x280]
call fcn.0045e500
cmp dword [ebp - 0x228], 0
je 0x418db3
xorps xmm0, xmm0
lea eax, [ebp - 0x260]
push eax
mov edx, str.IntranetOutXferBytes
movlpd qword [ebp - 0x260], xmm0
mov ecx, edi
movlpd qword [ebp - 0x268], xmm0
movlpd qword [ebp - 0x270], xmm0
movlpd qword [ebp - 0x278], xmm0
call fcn.00414660
add esp, 4
lea eax, [ebp - 0x268]
mov edx, str.IntranetInXferBytes
mov ecx, edi
push eax
call fcn.00414660
add esp, 4
lea eax, [ebp - 0x270]
mov edx, str.InternetOutXferBytes
mov ecx, edi
push eax
call fcn.00414660
add esp, 4
lea eax, [ebp - 0x278]
mov edx, str.InternetInXferBytes
mov ecx, edi
push eax
call fcn.00414660
mov eax, dword [ebp - 0x27c]
add esp, 4
push eax
push ebx
push str.UNAME_lu_s
push esi
call fcn.00401a50
push dword [ebp - 0x228]
add esi, eax
push ebx
push str.UXTS_lu_lu
push esi
call fcn.00401a50
push dword [ebp - 0x25c]
add esi, eax
push dword [ebp - 0x260]
push ebx
push str.UAOX_lu_I64u
push esi
call fcn.00401a50
add esp, 0x34
add esi, eax
push dword [ebp - 0x264]
push dword [ebp - 0x268]
push ebx
push str.UAIX_lu_I64u
push esi
call fcn.00401a50
add esp, 0x14
add esi, eax
push dword [ebp - 0x26c]
push dword [ebp - 0x270]
push ebx
push str.UEOX_lu_I64u
push esi
call fcn.00401a50
add esp, 0x14
add esi, eax
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push ebx
push str.UEIX_lu_I64u
push esi
call fcn.00401a50
add esp, 0x14
add esi, eax
push 0
push str.XferStartTime
push edi
call fcn.0045e790
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x27c]
inc ebx
mov edx, dword [ebp - 0x22c]
push eax
push ebx
mov byte [eax], 0
call fcn.00414550
mov edi, eax
add esp, 8
test edi, edi
jne 0x418c60
mov dword [ebp - 0x23c], esi
mov esi, dword [ebp - 0x254]
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x280]
lea eax, [ebp - 0x260]
xorps xmm0, xmm0
mov edx, str.IntranetOutXferBytes
push eax
mov ecx, edi
movlpd qword [ebp - 0x260], xmm0
movlpd qword [ebp - 0x268], xmm0
movlpd qword [ebp - 0x270], xmm0
movlpd qword [ebp - 0x278], xmm0
call fcn.00414660
add esp, 4
lea eax, [ebp - 0x268]
mov edx, str.IntranetInXferBytes
mov ecx, edi
push eax
call fcn.00414660
add esp, 4
lea eax, [ebp - 0x270]
mov edx, str.InternetOutXferBytes
mov ecx, edi
push eax
call fcn.00414660
add esp, 4
lea eax, [ebp - 0x278]
mov edx, str.InternetInXferBytes
mov ecx, edi
push eax
call fcn.00414660
mov ebx, dword [ebp - 0x23c]
add esp, 4
push dword [ebp - 0x244]
push str.XTS_lu
push ebx
call fcn.00401a50
add esp, 0xc
add ebx, eax
push dword [ebp - 0x25c]
push dword [ebp - 0x260]
push str.AOX_I64u
push ebx
call fcn.00401a50
push dword [ebp - 0x264]
add ebx, eax
push dword [ebp - 0x268]
push str.AIX_I64u
push ebx
call fcn.00401a50
push dword [ebp - 0x26c]
add ebx, eax
push dword [ebp - 0x270]
push str.EOX_I64u
push ebx
call fcn.00401a50
push dword [ebp - 0x274]
add ebx, eax
push dword [ebp - 0x278]
push str.EIX_I64u
push ebx
call fcn.00401a50
inc ebx
mov byte [ebp - 0x22f], 1
add esp, 0x40
add ebx, eax
push 0
push str.XferStartTime
push edi
call fcn.0045e790
push 0
push str.BWUsageUpdated
push edi
call fcn.0045e790
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x240]
inc eax
jmp 0x418842
cmp byte [ebp - 0x22f], 0
je 0x4190b7
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 0
mov byte [ebx], 0
sub ebx, dword [ebp - 0x248]
push 0xc0000000
push 0x4c95fc
add ebx, 2
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x418faa
nop dword [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x418fe0
push 0x2710
push 0x4c95fc
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push 0x4c95fc
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x418f70
lea eax, [ebx + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x419006
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x24c]
mov dword [ebp - 0x238], eax
jmp 0x4190c9
cmp esi, 0xffffffff
jne 0x418faa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x24c]
mov dword [ebp - 0x238], 0
jmp 0x4190c9
mov dword [edi], 0x4b374147
mov dword [edi + 4], 0xa
mov dword [edi + 8], ebx
test ebx, ebx
je 0x41902d
push ebx
push dword [ebp - 0x248]
lea eax, [edi + 0xc]
push eax
call fcn.0046c5d0
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x419055
mov dword [ebp - 0x238], eax
jmp 0x41908b
push 0
lea eax, [ebp - 0x250]
mov dword [ebp - 0x250], 0
push eax
push 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebx + 0xc]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov dword [ebp - 0x238], ebx
cmp esi, 0xffffffff
je 0x419097
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x24c]
jmp 0x4190c9
mov edi, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x24c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4190fb
mov eax, dword [edi + 4]
mov dword [edi], 0x4be6a8
test eax, eax
je 0x4190ed
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x224
push edi
call fcn.004609d1
add esp, 8
mov eax, dword [ebp - 0x238]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret