Function at 0x451ca0
Capabilities:
Query or enumerate registry key
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x346ec
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x103
lea ecx, [ebp - 0x30f]
push 0
push ecx
mov dword [ebp - 0x72c], eax
mov byte [ebp - 0x310], 0
call fcn.005dfd60
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov edi, 1
push edi
push str.Config_File_Not_Present._Hence_Creating_A_New_KLR_File_With_Default_Settings
push 0x6aec98
mov dword [0x6e9080], eax
call fcn.004311c0
push 0
push 4
push 0
push str.DisableNetworkScan
call fcn.00430300
push 0
push 0x104
lea edx, [ebp - 0x310]
push edx
push 0x60cf3c
push str.VBuild
push 0x60c810
mov esi, eax
call fcn.004edfd0
lea eax, [ebp - 0x310]
push eax
call fcn.005e0909
push 0x61d21c
push 0x6e9268
mov ebx, eax
call fcn.005e00ad
add esp, 0x44
mov dword [ebp - 0x734], eax
test eax, eax
je 0x452967
push 0x33fb4
lea ecx, [ebp - 0x346e8]
push 0
push ecx
call fcn.005dfd60
xor edx, edx
add esp, 0xc
test esi, esi
sete dl
xor eax, eax
mov dword [ebp - 0x346ec], 3
mov dword [ebp - 0x346e4], 7
mov dword [ebp - 0x346e0], edi
mov dword [ebp - 0x346dc], edi
mov dword [ebp - 0x346d8], edx
cmp dword [0x67e110], eax
jne 0x451dbd
mov dword [ebp - 0x346dc], eax
mov dword [ebp - 0x346d8], eax
cmp ebx, edi
jne 0x451dd3
mov dword [ebp - 0x346d4], 2
mov dword [ebp - 0x740], eax
jmp 0x451de5
mov dword [ebp - 0x346d4], edi
mov dword [ebp - 0x740], edi
mov dword [ebp - 0x75c], edi
mov dword [ebp - 0x784], 9
mov dword [ebp - 0x77c], edi
mov dword [ebp - 0x778], edi
mov dword [ebp - 0x774], edi
mov dword [ebp - 0x758], edi
mov dword [ebp - 0x754], edi
mov dword [ebp - 0x750], eax
mov dword [ebp - 0x74c], eax
mov dword [ebp - 0x73c], 0x32
mov dword [ebp - 0x738], 0x5000
mov dword [ebp - 0x748], edi
mov dword [ebp - 0x744], edi
mov dword [ebp - 0x1978c], edi
mov dword [ebp - 0x788], edi
mov dword [ebp - 0x764], eax
mov esi, 0x684780
lea ebx, [ebp - 0x346d0]
mov eax, dword [esi]
cmp byte [eax], 0
je 0x451e7a
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, edi
test cl, cl
jne 0x451e61
add esi, 4
add ebx, 0x14
cmp esi, 0x684a44
jl 0x451e56
mov dword [ebp - 0x32790], edi
mov esi, 0x684a48
lea ebx, [ebp - 0x33730]
jmp 0x451e90
mov eax, dword [esi]
cmp byte [eax], 0
je 0x451eb9
mov edx, ebx
sub edx, eax
jmp 0x451ea0
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, edi
test cl, cl
jne 0x451ea0
add esi, 4
add ebx, 0x14
cmp esi, 0x684b70
jl 0x451e90
push edi
lea eax, [ebp - 0x730]
push eax
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorExcludeFolders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x728], 0
call fcn.004dc050
add esp, 0x10
test eax, eax
jne 0x451f86
mov edx, dword [ebp - 0x730]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x208
lea ecx, [ebp - 0x518]
push ecx
xor esi, esi
push esi
push edx
mov byte [ebp - 0x518], 0
call ebx
test eax, eax
jne 0x451f79
mov edi, edi
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x720]
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorExcludeFolders_s
push ecx
call fcn.005dfb23
movzx edx, byte [ebp - 0x518]
push edx
call fcn.005e3ae6
add esp, 0x10
cmp eax, 0x45
jne 0x451f56
push 0
push 0
lea eax, [ebp - 0x720]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9480
test eax, eax
jne 0x451f58
add esi, edi
mov edx, dword [ebp - 0x730]
push 0x208
lea ecx, [ebp - 0x518]
push ecx
push esi
push edx
mov byte [ebp - 0x518], 0
call ebx
test eax, eax
je 0x451f10
mov eax, dword [ebp - 0x730]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x72c]
cmp byte [ecx], 0
je 0x452944
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, ecx
push ebx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x60c81c
push 0x61726c
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0x32
mov eax, edi
je 0x451fcc
mov eax, dword [ebp - 0x728]
cmp byte [ebx], 0
je 0x452944
test eax, eax
jne 0x452944
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x60c81c
push str.NetworkScan
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x452019
lea ecx, [ebp - 0x108]
push ecx
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x346d8], eax
push ebx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x60c81c
push str.ScanFiles0
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x452055
lea eax, [ebp - 0x108]
push eax
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x346e0], eax
push ebx
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0x60c81c
push str.ScanFiles1
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x452091
lea edx, [ebp - 0x108]
push edx
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x346dc], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x60c81c
push str.FBackupNew
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x4520dc
lea ecx, [ebp - 0x108]
push ecx
call fcn.005e0909
add esp, 4
push eax
push str.DWBackUpNew
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x60c81c
push str.BlockMalwareUrls
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x45213d
lea eax, [ebp - 0x108]
push eax
call fcn.005e0909
add esp, 4
push eax
push str.BlockMalwareUrls
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 1
push str.dwBMUSet
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0x60c81c
push str.EnableScanCompoundFile
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x452179
lea edx, [ebp - 0x108]
push edx
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x77c], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x60c81c
push str.TypeCompound0
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x4521b5
lea ecx, [ebp - 0x108]
push ecx
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x778], eax
push ebx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x60c81c
push str.TypeCompound1
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x4521f1
lea eax, [ebp - 0x108]
push eax
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x774], eax
push ebx
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0x60c81c
push str.EnableNotAVirusList
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x45222d
lea edx, [ebp - 0x108]
push edx
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x1978c], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x60c81c
push str.EnableCodeAnalyser
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x452269
lea ecx, [ebp - 0x108]
push ecx
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x764], eax
push ebx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x60c81c
push str.EnableProAct
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x4522a9
lea eax, [ebp - 0x108]
push eax
push str.SuspAppDetectEnabled
push 0x60c810
call fcn.004ee3d0
add esp, 0xc
push ebx
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0x60c81c
push str.VirusDetAction
push str.FileAV
call esi
mov al, byte [ebp - 0x108]
test al, al
je 0x4523b5
cmp al, 0x31
jne 0x4522e4
mov dword [ebp - 0x346ec], edi
jmp 0x4523b5
cmp al, 0x36
jne 0x4522f7
mov dword [ebp - 0x346ec], 6
jmp 0x4523b5
cmp al, 0x32
jne 0x45230a
mov dword [ebp - 0x346ec], 2
jmp 0x4523b5
cmp al, 0x33
jne 0x4523b5
push ebx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x60c81c
push str.IfInfectionIsimpossible
mov edi, 7
push str.FileAV
mov dword [ebp - 0x346ec], 3
mov dword [ebp - 0x346e4], edi
call esi
mov al, byte [ebp - 0x108]
test al, al
je 0x452379
cmp al, 0x37
jne 0x45235b
mov dword [ebp - 0x346e4], edi
jmp 0x452379
cmp al, 0x34
jne 0x45236b
mov dword [ebp - 0x346e4], 4
jmp 0x452379
cmp al, 0x33
jne 0x452379
mov dword [ebp - 0x346e4], 3
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x60c81c
push str.MakebackupFile
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x4523b5
lea ecx, [ebp - 0x108]
push ecx
call fcn.005e0909
add esp, 4
mov dword [ebp - 0x346e8], eax
push ebx
push 0
push 0
push 0x60c81c
push str.NotAVirusList
push str.FileAV
call fcn.004e0df0
mov edi, eax
add esp, 0x18
test edi, edi
je 0x452488
cmp byte [edi], 0
je 0x452479
xor eax, eax
push 1
push eax
push 0x2c
lea edx, [ebp - 0x724]
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x728], eax
push edx
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
je 0x452479
lea esi, [ebp - 0x3278c]
lea ecx, [ecx]
lea eax, [ebp - 0x20c]
mov ecx, eax
sub esi, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
test cl, cl
jne 0x452430
mov eax, dword [ebp - 0x728]
push 1
inc eax
push 0
mov dword [ebp - 0x728], eax
shl eax, 9
push 0x2c
lea esi, [ebp + eax - 0x3278c]
lea edx, [ebp - 0x724]
push edx
lea eax, [ebp - 0x20c]
push eax
push edi
mov byte [esi], cl
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
jne 0x452420
push edi
call fcn.005e0865
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
push ebx
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0x60c81c
push str.EnableExcludeByMask
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0
je 0x452598
lea edx, [ebp - 0x108]
push edx
call fcn.005e0909
push ebx
push 0
push 0
push 0x60c81c
push str.ExcludeBymask
push str.FileAV
mov dword [ebp - 0x32790], eax
call fcn.004e0df0
add esp, 0x1c
mov dword [ebp - 0x728], eax
test eax, eax
je 0x452598
cmp byte [eax], 0
je 0x452583
mov edx, dword [ebp - 0x728]
push 1
xor edi, edi
push edi
push 0x2c
lea eax, [ebp - 0x724]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push edx
mov dword [ebp - 0x724], edi
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
je 0x452583
lea esi, [ebp - 0x33730]
lea eax, [ebp - 0x20c]
mov ecx, eax
sub esi, ecx
jmp 0x452540
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
test cl, cl
jne 0x452540
push 1
push 0
inc edi
push 0x2c
lea esi, [edi + edi*4]
lea edx, [ebp - 0x724]
push edx
lea esi, [ebp + esi*4 - 0x33730]
lea eax, [ebp - 0x20c]
mov byte [esi], cl
mov ecx, dword [ebp - 0x728]
push eax
push ecx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
jne 0x452531
mov edx, dword [ebp - 0x728]
push edx
call fcn.005e0865
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x60c81c
push str.ScanType
push str.FileAV
call esi
mov al, byte [ebp - 0x108]
cmp al, 0x33
jne 0x45269a
push ebx
push 0
push 0
push 0x60c81c
push str.ExcludeMask
push str.FileAV
mov dword [ebp - 0x346d4], 3
call fcn.004e0df0
add esp, 0x18
mov dword [ebp - 0x728], eax
test eax, eax
je 0x4526b8
cmp byte [eax], 0
je 0x452683
push 1
xor edi, edi
push edi
push 0x2c
lea ecx, [ebp - 0x724]
push ecx
lea edx, [ebp - 0x20c]
push edx
push eax
mov dword [ebp - 0x724], edi
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
je 0x452683
lea esi, [ebp - 0x346d0]
lea eax, [ebp - 0x20c]
mov ecx, eax
sub esi, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
test cl, cl
jne 0x452640
push 1
push 0
inc edi
push 0x2c
lea esi, [edi + edi*4]
lea edx, [ebp - 0x724]
push edx
lea esi, [ebp + esi*4 - 0x346d0]
lea eax, [ebp - 0x20c]
mov byte [esi], cl
mov ecx, dword [ebp - 0x728]
push eax
push ecx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
jne 0x452634
mov edx, dword [ebp - 0x728]
push edx
call fcn.005e0865
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
jmp 0x4526b8
cmp al, 0x32
jne 0x4526aa
mov dword [ebp - 0x346d4], 2
jmp 0x4526b8
cmp al, 0x31
jne 0x4526b8
mov dword [ebp - 0x346d4], 1
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x60c81c
push str.ExcludeFilesFolders
push str.FileAV
call esi
cmp byte [ebp - 0x108], 0x31
jne 0x452944
mov ecx, ebx
push ecx
push 0
push 0
push 0x60c81c
push str.ExcludedFolders
push str.FileAV
mov esi, 1
call fcn.004e0df0
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x452847
cmp byte [ebx], 0
je 0x45283e
push esi
push 0
push 0x2c
lea edx, [ebp - 0x724]
push edx
lea eax, [ebp - 0x108]
push eax
push ebx
lea edi, [esi + 1]
mov dword [ebp - 0x724], 0
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
je 0x45283e
nop
cmp byte [ebp - 0x108], 0x21
je 0x4527b6
or edi, 4
lea ecx, [ebp - 0x108]
push edi
push ecx
call fcn.00451ac0
add esp, 8
test eax, eax
jne 0x452814
push esi
lea edx, [ebp - 0x20c]
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorExcludeFoldersE_d
push edx
call fcn.005dfb23
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push str.ObjectName
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
inc esi
call fcn.004e7720
push edi
push str.ObjectType
lea edx, [ebp - 0x20c]
push edx
jmp 0x45280a
lea eax, [ebp - 0x107]
push edi
push eax
call fcn.00451ac0
add esp, 8
test eax, eax
jne 0x452814
push esi
lea ecx, [ebp - 0x20c]
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorExcludeFoldersE_d
push ecx
call fcn.005dfb23
add esp, 0xc
lea edx, [ebp - 0x107]
push edx
push str.ObjectName
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
inc esi
call fcn.004e7720
push edi
push str.ObjectType
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 1
push 0
push 0x2c
lea edx, [ebp - 0x724]
push edx
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], 0xffffffff
jne 0x452750
push ebx
call fcn.005e0865
add esp, 4
mov ecx, dword [ebp - 0x72c]
push ecx
push 0
push 0
push 0x60c81c
push str.ExcludedFiles
push str.FileAV
call fcn.004e0df0
mov edi, eax
add esp, 0x18
test edi, edi
je 0x452944
cmp byte [edi], 0
je 0x45293b
push 1
push 0
push 0x2c
lea edx, [ebp - 0x724]
push edx
lea eax, [ebp - 0x108]
push eax
push edi
mov dword [ebp - 0x724], 0
call fcn.004e1380
or ebx, 0xffffffff
add esp, 0x18
cmp dword [ebp - 0x724], ebx
je 0x45293b
lea ecx, [ebp - 0x108]
push 1
push ecx
call fcn.00451ac0
add esp, 8
test eax, eax
jne 0x452912
push esi
lea edx, [ebp - 0x20c]
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorExcludeFoldersE_d
push edx
call fcn.005dfb23
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push str.ObjectName
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
inc esi
call fcn.004e7720
push 1
push str.ObjectType
lea edx, [ebp - 0x20c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 1
push 0
push 0x2c
lea eax, [ebp - 0x724]
push eax
lea ecx, [ebp - 0x108]
push ecx
push edi
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x724], ebx
jne 0x4528b2
push edi
call fcn.005e0865
add esp, 4
mov esi, dword [ebp - 0x734]
push esi
push 1
lea edx, [ebp - 0x346ec]
push 0x33fb8
push edx
call fcn.005e025d
push esi
call fcn.005dff6d
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret