Function at 0x459690
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670500
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1cb8
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1cbc], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x1cd0], esi
mov byte [ebp - 0x1cb8], 0
push 0x103
xor edi, edi
push edi
lea ecx, [ebp - 0x1cb7]
push ecx
call fcn.005dfd60
push 0xb34
push edi
lea edx, [ebp - 0x1bb4]
push edx
call fcn.005dfd60
mov byte [ebp - 0x258], 0
push 0x207
push edi
lea eax, [ebp - 0x257]
push eax
call fcn.005dfd60
mov dword [ebp - 0x1cc4], edi
mov byte [ebp - 0x1080], 0
push 0x30b
push edi
lea ecx, [ebp - 0x107f]
push ecx
call fcn.005dfd60
add esp, 0x30
mov dword [ebp - 4], edi
mov dword [ebp - 0x1ccc], edi
lea edx, [ebp - 0x1ccc]
push edx
push str.AVCEnabled
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp esi, edi
mov edi, dword [ebp + 0x14]
je 0x4597e9
cmp edi, 4
jbe 0x4597e9
mov dword [esi], 0
push 0
push edi
call fcn.004fd720
add esp, 8
lea ecx, [ebp - 0x258]
test eax, eax
mov eax, dword [ebp + 0x1c]
push eax
push ebx
push edi
je 0x4597c6
push str.Process_suspend_1___d___s__FW:_u_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x258]
push edx
push 0x6aec98
call fcn.004311c0
mov dword [esi], 1
jmp 0x4597e6
push str.Process_suspend_Failed_1___d___s__FW:_u_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x258]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp dword [0x73f9cc], 0
jne 0x459856
mov dword [0x73f9cc], 1
push 0x104
push 0x73f8c8
call fcn.004f0410
push 0x73f8c8
call fcn.004e24e0
push 0x73f8c8
push str._sVISTAeScanMon.lan
push 0x73f6c0
call fcn.005dfb23
add esp, 0x18
mov eax, 0x73f8c8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x459832
mov ecx, dword [str.ESCAN.LAN]
mov dword [eax], ecx
mov edx, dword [0x615d64]
mov dword [eax + 4], edx
mov cx, word [0x615d68]
mov word [eax + 8], cx
push 0x73f6c0
push 0x104
lea edx, [ebp - 0x118c]
push edx
push str.Advanced_Proactive_Alert
push 0x6218ec
push str.OPTIONITEMS
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
mov ecx, ebx
lea edx, [ebp - 0x1cb8]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x459886
mov ecx, dword [ebp - 0x1cbc]
lea edx, [ebp - 0x1bb4]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4598a0
push 0x73f8c8
push 0x104
lea eax, [ebp - 0x1ab0]
push eax
push str.Access_to_the_executable
push 0x6270b4
push str.SCANINST
call esi
push 0x73f8c8
push 0x104
lea ecx, [ebp - 0x19ac]
push ecx
push str.has_been_denied_for_the_following_reason
push 0x627084
push str.SCANINST
call esi
cmp dword [ebp + 0x10], 0
je 0x45992d
mov edx, dword [ebp - 0x1cbc]
push edx
push ebx
push 0x61a768
lea eax, [ebp - 0x1080]
push eax
call fcn.005dfb23
add esp, 0x10
push 0x73f8c8
push 0x104
lea ecx, [ebp - 0x18a8]
push ecx
push str.Modification_to_the_following_registry_seems_suspicious
push 0x627048
jmp 0x45995a
mov ecx, ebx
lea edx, [ebp - 0x1080]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x459935
push 0x73f8c8
push 0x104
lea edx, [ebp - 0x18a8]
push edx
push str.Following_file_created_by_process_seems_suspicious
push 0x627010
push str.SCANINST
call esi
push 0x73f8c8
push 0x104
lea eax, [ebp - 0x17a4]
push eax
push str.Allow_Access
push 0x626ffc
push str.SCANINST
call esi
mov ecx, dword [str.null]
mov dword [ebp - 0x16a0], ecx
mov dl, byte [0x60f764]
mov byte [ebp - 0x169c], dl
push 0x73f8c8
push 0x104
lea eax, [ebp - 0x159c]
push eax
push str.Block_Access
push 0x626fe8
push str.SCANINST
call esi
mov eax, dword [str.null]
mov dword [ebp - 0x1498], eax
mov cl, byte [0x60f764]
mov byte [ebp - 0x1494], cl
mov dword [ebp - 0x1394], eax
mov byte [ebp - 0x1390], cl
mov dword [ebp - 0x1084], edi
mov byte [ebp - 0x460], 0
push 0x103
xor edi, edi
push edi
lea ecx, [ebp - 0x45f]
push ecx
call fcn.005dfd60
add esp, 0xc
push 0x6afef0
push 0x104
lea edx, [ebp - 0x460]
push edx
push 0x60c81c
push str.DirectBlockAVC
push 0x60da74
call esi
cmp byte [ebp - 0x460], 0
jne 0x459a34
lea eax, [edi + 1]
jmp 0x459a49
lea eax, [ebp - 0x460]
push eax
call fcn.005e0909
add esp, 4
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x1ccc], edi
je 0x459c07
cmp eax, edi
je 0x459bad
mov byte [ebp - 0x668], 0
push 0x103
push edi
lea ecx, [ebp - 0x667]
push ecx
call fcn.005dfd60
add esp, 0xc
push edi
push 0x2d
push ebx
lea edx, [ebp - 0x668]
push edx
call fcn.004fe4d0
test eax, eax
jne 0x459a9f
mov ecx, ebx
lea edx, [ebp - 0x668]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x459a95
cmp dword [0x71de6c], edi
je 0x459ade
mov eax, dword [ebp - 0x1cbc]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
push str.ShowEcDlgPopupx__u_:___s_
lea edx, [ebp - 0x258]
push edx
call fcn.005dfb23
push edi
mov eax, dword [0x71de6c]
push eax
lea ecx, [ebp - 0x258]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov byte [ebp - 0x974], 0
push 0x207
push edi
lea edx, [ebp - 0x973]
push edx
call fcn.005dfd60
mov dword [ebp - 0xc90], edi
push 0x318
push edi
lea eax, [ebp - 0xc8c]
push eax
call fcn.005dfd60
add esp, 0x18
push 0x73f8c8
push 0x208
lea ecx, [ebp - 0x974]
push ecx
push str.Application___s__has_been_blocked_by_eScan._Please_contact_your_Systems_Administrator_for_any_further_information.
push 0x626f40
push str.SCANINST
call esi
cmp dword [0x6ae144], edi
jne 0x459b55
push 0x2e
lea edx, [ebp - 0x974]
push edx
call fcn.005e0940
add esp, 8
cmp eax, edi
je 0x459b55
mov byte [eax + 1], 0
lea ecx, [ebp - 0x118c]
lea edx, [ebp - 0xa7a]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x459b61
mov dword [ebp - 0xc90], 1
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp - 0x974]
push ecx
lea edx, [ebp - 0xc82]
push edx
call fcn.005dfb23
add esp, 0xc
lea eax, [ebp - 0xc90]
push eax
call fcn.005138c0
mov dword [ebp - 0x1cc8], 2
jmp 0x459c4b
cmp dword [0x71de6c], edi
je 0x459bed
mov ecx, dword [ebp - 0x1cbc]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
push str.ShowAVCDlgx__u_:___s_
lea eax, [ebp - 0x258]
push eax
call fcn.005dfb23
push edi
mov ecx, dword [0x71de6c]
push ecx
lea edx, [ebp - 0x258]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
lea eax, [ebp - 0x1cb8]
push eax
call fcn.00513870
mov ecx, dword [ebp - 0x1084]
mov dword [ebp - 0x1cc8], ecx
jmp 0x459c4b
mov edx, dword [ebp - 0x1cbc]
push edx
push ebx
mov eax, dword [ebp + 0x1c]
push eax
push str.Allowing_Modification_as_AVC_Disabled___u____s_:___s_
lea ecx, [ebp - 0x258]
push ecx
call fcn.005dfb23
push edi
push 1
lea edx, [ebp - 0x258]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
mov dword [ebp - 0x1cc8], 1
mov dword [ebp - 0x1cc4], edi
cmp dword [ebp - 0x1ccc], edi
je 0x459fd7
mov eax, dword [ebp - 0x1cc8]
cmp eax, 1
je 0x459c6b
cmp eax, 2
jne 0x459fd7
mov byte [ebp - 0x35c], 0
push 0x103
push edi
lea eax, [ebp - 0x35b]
push eax
call fcn.005dfd60
mov byte [ebp - 0x564], 0
push 0x103
push edi
lea ecx, [ebp - 0x563]
push ecx
call fcn.005dfd60
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 0x1cc0], ecx
mov eax, dword [ebp - 0x1cc8]
cmp eax, 1
jne 0x459d4f
push 2
push ebx
call fcn.00555450
add esp, 8
push 0x73f8c8
push 0x104
lea edx, [ebp - 0x35c]
push edx
push str.Executable_launched_and_whitelisted_by_user.
push 0x626ebc
push str.SCANINST
call esi
push 0x73f8c8
push 0x104
lea eax, [ebp - 0x564]
push eax
push 0x6195b8
push 0x6195b4
push str.SCANINST
call esi
mov ecx, dword [ebp - 0x1cbc]
push ecx
push ebx
mov edx, dword [ebp + 0x1c]
push edx
push str.Allowing_Modification_as_User_Allowed_the_same___u____s_:___s_
lea eax, [ebp - 0x258]
push eax
call fcn.005dfb23
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x258]
push ecx
push 0x6aec98
call fcn.004311c0
mov edi, 0x3ee
mov dword [ebp - 0x1cc0], esi
mov dword [ebp - 0x1cc4], esi
jmp 0x459f45
cmp eax, 2
jne 0x459f13
mov dword [ebp - 0x1cc0], ecx
mov edi, dword [ebp + 0x14]
cmp dword [ebp - 0x1cd0], ecx
jne 0x459dc0
push ecx
push edi
call fcn.004fd720
add esp, 8
push ebx
push edi
test eax, eax
je 0x459d97
push str.Process_suspend_2___d___s
lea edx, [ebp - 0x258]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x258]
push eax
jmp 0x459db3
push str.Process_suspend_failed_2___d___s
lea ecx, [ebp - 0x258]
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x258]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp edi, 4
jbe 0x459dd0
push 0
push ebx
call fcn.00555450
add esp, 8
push 0x73f8c8
push 0x104
lea eax, [ebp - 0x35c]
push eax
push str.Executable_launched_and_seems_suspicious.
push 0x626e0c
push str.SCANINST
call esi
push 0x73f8c8
push 0x104
lea ecx, [ebp - 0x564]
push ecx
push 0x615d58
push 0x615d54
push str.SCANINST
call esi
push 0
push 0
push 0
lea edx, [ebp - 0x1cc0]
push edx
push ebx
call fcn.00454b90
add esp, 0x14
test eax, eax
jne 0x459ec6
mov byte [ebp - 0x50], al
push 0x31
push eax
lea eax, [ebp - 0x4f]
push eax
call fcn.005dfd60
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x50]
push ecx
push ebx
call fcn.00454f40
add esp, 0x24
test eax, eax
je 0x459ec6
mov byte [ebp - 0x76c], 0
push 0x103
push 0
lea edx, [ebp - 0x76b]
push edx
call fcn.005dfd60
mov eax, dword [ebp - 0x1cc0]
push eax
lea ecx, [ebp - 0x50]
push ecx
push str.__MD5:_s__SZ:_u_
lea edx, [ebp - 0x76c]
push edx
call fcn.005dfb23
add esp, 0x1c
lea eax, [ebp - 0x76c]
mov esi, eax
jmp 0x459ea0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x459ea0
sub eax, esi
lea edi, [ebp - 0x35c]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x459eb0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1cbc]
push eax
push ebx
mov ecx, dword [ebp + 0x1c]
push ecx
push str.Blocking_Modification___High_Severity___u____s_:___s_
lea edx, [ebp - 0x258]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x258]
push eax
push 0x6aec98
call fcn.004311c0
mov edi, 0x3ed
mov dword [ebp - 0x1cc0], 3
mov dword [ebp - 0x1cc4], 1
jmp 0x459f45
mov ecx, dword [ebp - 0x1cbc]
push ecx
push ebx
mov edx, dword [ebp + 0x1c]
push edx
push str.Not_Blocking___unpredicted_case___u____s_:___s_
lea eax, [ebp - 0x258]
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x258]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp edi, 0x3ed
jne 0x459f91
push ebx
lea edx, [ebp - 0xd74]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xd74]
push eax
push 0
push 0x4594b0
call fcn.005e07ac
push 0
push eax
push str.CBD_7a
call fcn.00420720
add esp, 0x18
cmp byte [ebp - 0xd74], 0
je 0x459f91
call fcn.004e03f0
jmp 0x459f81
push 0
lea ecx, [ebp - 0x1080]
push ecx
lea edx, [ebp - 0x564]
push edx
lea eax, [ebp - 0x35c]
push eax
push 0x60c810
mov ecx, dword [ebp - 0x1cc0]
push ecx
push str.eScan_EPS
push edi
call fcn.00513910
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1cc4]
jmp 0x459fe0
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret