Function at 0x407570
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Get common file path
Get file attributes
Link many functions at runtime
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
push 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4079b2
lea esi, [edi + 0x400]
call fcn.00414e20
test al, al
jne 0x407610
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.K7WSLsp.dll
push edi
push 0x436114
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407610
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x407610
push str.DllUnregisterServer
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407609
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0x435f14
push 0x80000002
mov byte [edi], 0
call fcn.00413e50
mov ebx, eax
test ebx, ebx
je 0x407642
push 0x104
push edi
push str.DirProductBase
push ebx
call fcn.004141c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7SRExt.dll
push edi
push 0x436114
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407689
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x407689
push str.DllUnregisterServer
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407682
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [ebp - 0x120], 0
call fcn.00413e50
mov ebx, eax
test ebx, ebx
je 0x4076c3
lea eax, [ebp - 0x120]
push eax
push str.ProductType
push ebx
call fcn.00414170
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [ebp - 0x11c], 0
call fcn.00413e50
mov ebx, eax
test ebx, ebx
je 0x4076fd
lea eax, [ebp - 0x11c]
push eax
push str.ProductMode
push ebx
call fcn.00414170
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x11c], 1
jne 0x40774d
push str.K7RegExt.dll
push edi
push 0x436114
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40774d
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x40774d
push str.DllUnregisterServer
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407746
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.K7SRVer.ini
push str.K7SR
push edi
push 0x4360e8
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x110]
push esi
push 0x400
push eax
push str.k7srff_k7computing.com
push str.ExtnId
push str.k7mozillaextn
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x110], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
je 0x40783a
lea eax, [ebp - 0x110]
push eax
push str.SOFTWAREMozillaFirefoxExtensions
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x118], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4077e6
lea eax, [ebp - 0x118]
push eax
call ebx
push eax
call esi
cmp dword [ebp - 0x118], 0
je 0x40783a
lea eax, [ebp - 0x114]
push eax
push 0xf013f
push 0
push str.SOFTWAREMozillaFirefoxExtensions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40783a
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x114], 0
push str.k7srff_k7computing.com
push str.SOFTWAREMozillaFirefoxExtensions
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x118], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x407882
lea eax, [ebp - 0x118]
push eax
call ebx
push eax
call esi
cmp dword [ebp - 0x118], 0
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
je 0x4078de
lea eax, [ebp - 0x114]
push eax
push 0xf013f
push 0
push str.SOFTWAREMozillaNativeMessagingHosts
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4078de
push str.com.k7computing.k7webprotection
push dword [ebp - 0x114]
call ebx
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x114], 0
jmp 0x4078ea
push str.SOFTWAREMozillaNativeMessagingHostscom.k7computing.k7webprotection
push 0x80000002
call esi
push str.SOFTWAREMozillaPlugins_k7computing.com_k7webprotection
push 0x80000002
call esi
push str.SOFTWAREGoogleChromeExtensionsdlpfamleaodfgmfnggonbfljhjggbdbe
push 0x80000002
call esi
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x118], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x407939
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x118], 0
je 0x407987
lea eax, [ebp - 0x114]
push eax
push 0xf013f
push 0
push str.SOFTWAREGoogleChromeExtensions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407987
push str.dlpfamleaodfgmfnggonbfljhjggbdbe
push dword [ebp - 0x114]
call ebx
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x114], 0
call fcn.00407130
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041559f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041559f
mov esp, ebp
pop ebp
ret