Function at 0x4bf1f0
Capabilities:
Get memory capacity
Persist via winlogon helper dll registry key
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3b1c
call fcn.004d9280
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push str._br__r_n
lea eax, [ebp - 0x24]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
mov dword [ebp - 0x3b18], ebx
call esi
push str._br_
lea ecx, [ebp - 0x2f0]
push ecx
call esi
lea edx, [ebp - 0x2d0]
push edx
mov ecx, 3
call fcn.0047c870
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 4
lea eax, [ebp - 0x2d0]
push eax
push 0x5016f0
lea ecx, [ebp - 0x230]
push str.Report_created_by__s_running__s
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x2658]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp word [ebp - 0x2650], 0xc
jbe 0x4bf2d4
mov eax, 0xfff4
add word [ebp - 0x2650], ax
push 0x4ebdf8
lea ecx, [ebp - 0x250]
push ecx
jmp 0x4bf2e0
push 0x4ebdfc
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx ecx, word [ebp - 0x264c]
movzx edx, word [ebp - 0x264e]
lea eax, [ebp - 0x250]
push eax
movzx eax, word [ebp - 0x2650]
push ecx
push edx
push eax
lea ecx, [ebp - 0x348]
push str._2d:_02d:_02d__s
push ecx
call edi
movzx edx, word [ebp - 0x2658]
movzx eax, word [ebp - 0x2652]
movzx ecx, word [ebp - 0x2656]
push edx
push eax
push ecx
lea edx, [ebp - 0x250]
push str._2d__02d__4d
push edx
call edi
add esp, 0x2c
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x230]
push str._at__s__on__s_s
push eax
call edi
add esp, 0x14
push 0
lea ecx, [ebp - 0x3b14]
push ecx
lea edx, [ebp - 0x230]
push edx
call esi
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x80
push str.RegNumber
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x2d0]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x2d0]
push ecx
call esi
cmp eax, 8
jle 0x4bf3ed
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x230]
push str.Potential_Security_Vulerability_due_to_invalid_KeyGen:__s_s
push ecx
call edi
add esp, 0x10
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x230]
push 0x4e2a14
push eax
call edi
add esp, 0xc
push 0
lea ecx, [ebp - 0x3b14]
push ecx
lea edx, [ebp - 0x230]
push edx
call esi
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ebx, [ebp - 0x2d0]
call fcn.004cde50
lea ecx, [ebp - 0x24]
push ecx
mov edx, ebx
push edx
lea eax, [ebp - 0x230]
push str._b_Platform:__b___s_s
push eax
call edi
add esp, 0x10
push 0
lea ecx, [ebp - 0x3b14]
push ecx
lea edx, [ebp - 0x230]
push edx
call esi
mov ebx, dword [ebp - 0x3b18]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x506e0c], 0
je 0x4bf48a
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push 0x94
lea ecx, [ebp - 0x26f0]
push 0
push ecx
call fcn.004d29c0
add esp, 0xc
lea edx, [ebp - 0x26f0]
push edx
mov dword [ebp - 0x26f0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x506e0c], 0
je 0x4bf4f5
mov edx, dword [ebp - 0x26e0]
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x26e4]
lea ecx, [ebp - 0x26dc]
push ecx
mov ecx, dword [ebp - 0x26e8]
push edx
mov edx, dword [ebp - 0x26ec]
push eax
push ecx
push edx
push str._b_Windows_x64_Version:__b___d._d__Build__d___d__s_s
lea eax, [ebp - 0x230]
push eax
jmp 0x4bf528
mov eax, dword [ebp - 0x26e0]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x26e4]
lea edx, [ebp - 0x26dc]
push edx
mov edx, dword [ebp - 0x26e8]
push eax
mov eax, dword [ebp - 0x26ec]
push ecx
push edx
push eax
push str._b_Windows__x86__Version:__b___d._d__Build__d___d__s_s
lea ecx, [ebp - 0x230]
push ecx
call edi
add esp, 0x20
push 0x1400
lea edx, [ebp - 0x3b10]
push 0
push edx
call fcn.004d29c0
lea eax, [ebp - 0x548]
add esp, 0xc
push eax
call fcn.0047bd50
add esp, 4
lea ecx, [ebp - 0x548]
call fcn.0047af20
test eax, eax
je 0x4bf5bc
lea ecx, [ebp - 0x548]
push ecx
lea ecx, [ebp - 0x3b10]
call fcn.004c0890
add esp, 4
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x3710]
push eax
lea ecx, [ebp - 0x2f10]
push ecx
lea edx, [ebp - 0x3b10]
push edx
lea eax, [ebp - 0x230]
push str._b_Browser:__b___s____i__s__i__version__s_s
push eax
call edi
add esp, 0x18
push 0
lea ecx, [ebp - 0x3b14]
push ecx
lea edx, [ebp - 0x230]
push edx
call esi
push eax
lea eax, [ebp - 0x230]
push eax
jmp 0x4bf5eb
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x230]
push str.Browser:_Unable_to_find_default_browser._s
push edx
call edi
add esp, 0xc
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x2710]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x270c]
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp - 0x24]
push edx
push eax
lea ecx, [ebp - 0x230]
push str.Memory_currently_in_use:__ld___s_s
push ecx
call edi
add esp, 0x14
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x80
lea edx, [ebp - 0x648]
mov ecx, 0xc
call fcn.004ca1e0
add esp, 4
push 0x200
lea edx, [ebp - 0x648]
push 0x4e2d04
push edx
lea ecx, [ebp - 0x548]
mov edx, CreateStatusWindowA
call fcn.004bff10
lea eax, [ebp - 0x548]
dec eax
mov dword [ebp - 0x3b1c], eax
add esp, 0xc
lea eax, [ebp - 0x548]
push eax
call esi
mov ecx, dword [ebp - 0x3b1c]
cmp byte [eax + ecx], 0x3b
jne 0x4bf6b4
lea edx, [ebp - 0x548]
push edx
call esi
mov ecx, dword [ebp - 0x3b1c]
mov byte [eax + ecx], 0
push 0x4ec204
lea edx, [ebp - 0x548]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x548]
call fcn.0047af20
test eax, eax
je 0x4bf79a
push 0x1400
lea eax, [ebp - 0x3b10]
push 0
push eax
call fcn.004d29c0
lea ecx, [ebp - 0x548]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x3b10]
call fcn.004c0890
add esp, 4
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x3710]
push eax
lea ecx, [ebp - 0x2f10]
push ecx
lea edx, [ebp - 0x230]
push str.MSIE:__s___s__s
push edx
call edi
add esp, 0x14
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ebx, [ebp - 0x548]
call fcn.00404570
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
push ecx
lea edx, [ebp - 0x230]
push str.IE_Cookie_Path:__s__s
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
mov eax, dword [ebp - 0x3b18]
lea edx, [ebp - 0x230]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebp - 0x3b18]
jmp 0x4bf7d0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x230]
push str.MSIE:_Internet_Explorer_Not_found._s
push edx
call edi
add esp, 0xc
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4ebdd4
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x3b1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
call esi
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x2d0]
push ecx
lea ecx, [ebp - 0x548]
mov ebx, str.AOL.EXE
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf85b
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x230]
push str.America_Online_version__s_s
push ecx
call edi
add esp, 0x10
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
mov edx, dword [ebp - 0x3b18]
push eax
lea ecx, [ebp - 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x548]
mov ebx, str.firefox.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf8c3
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x548]
push edx
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x230]
push str.Firefox__s_installed_in__s_s
push ecx
call edi
add esp, 0x14
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
mov edx, dword [ebp - 0x3b18]
push eax
lea ecx, [ebp - 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x548]
mov ebx, str.Mozilla.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf92b
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x548]
push edx
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x230]
push str.Mozilla__s_installed_in__s_s
push ecx
call edi
add esp, 0x14
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
mov edx, dword [ebp - 0x3b18]
push eax
lea ecx, [ebp - 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x548]
mov ebx, str.Netscp.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf993
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x548]
push edx
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x230]
push str.Netscape__s_installed_in__s_s
push ecx
call edi
add esp, 0x14
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
mov edx, dword [ebp - 0x3b18]
push eax
lea ecx, [ebp - 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x548]
mov ebx, str.palemoon.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf9fd
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x548]
push edx
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x230]
push str.Pale_Moon__s_installed_in__s_s
push ecx
call edi
add esp, 0x14
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
mov ebx, dword [ebp - 0x3b18]
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4bfa03
mov ebx, dword [ebp - 0x3b18]
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x230]
push 0x4e2a14
push eax
call edi
add esp, 0xc
push 0
lea ecx, [ebp - 0x3b14]
push ecx
lea edx, [ebp - 0x230]
push edx
call esi
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x80
lea edx, [ebp - 0x648]
mov ecx, 0x26f
call fcn.004ca1e0
add esp, 4
push 0x2000
lea ecx, [ebp - 0x648]
push str.Window_Title
push ecx
lea ecx, [ebp - 0x2648]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfab6
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2648]
push eax
lea ecx, [ebp - 0x230]
push str.HKCU_Window_Title___s_s
push ecx
call edi
add esp, 0x10
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea edx, [ebp - 0x648]
push str.Default_Page_URL
push edx
lea ecx, [ebp - 0x2648]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfb1b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2648]
push ecx
lea edx, [ebp - 0x230]
push str.HKCU_Default_Page_URL___s_s
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea eax, [ebp - 0x648]
push str.Default_Page_URL
push eax
lea ecx, [ebp - 0x2648]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfb80
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x2648]
push edx
lea eax, [ebp - 0x230]
push str.HKLM_Default_Page_URL___s_s
push eax
call edi
add esp, 0x10
push 0
lea ecx, [ebp - 0x3b14]
push ecx
lea edx, [ebp - 0x230]
push edx
call esi
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea ecx, [ebp - 0x648]
push str.Start_Page
push ecx
lea ecx, [ebp - 0x2648]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfbe5
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2648]
push eax
lea ecx, [ebp - 0x230]
push str.HKCU_Start_Page___s_s
push ecx
call edi
add esp, 0x10
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea edx, [ebp - 0x648]
push str.Start_Page
push edx
lea ecx, [ebp - 0x2648]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfc4a
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2648]
push ecx
lea edx, [ebp - 0x230]
push str.HKLM_Start_Page___s_s
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x230]
push 0x4e2a14
push ecx
call edi
add esp, 0xc
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea edx, [ebp - 0x328]
push str.DefaultUserName
push edx
lea ecx, [ebp - 0x2648]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfce5
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2648]
push ecx
lea edx, [ebp - 0x230]
push str.WinLogon_DefaultUserName_s_s
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea eax, [ebp - 0x328]
push str.DefaultDomainName
push eax
lea ecx, [ebp - 0x2648]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfd4a
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x2648]
push edx
lea eax, [ebp - 0x230]
push str.WinLogon_DefaultDomainName_s_s
push eax
call edi
add esp, 0x10
push 0
lea ecx, [ebp - 0x3b14]
push ecx
lea edx, [ebp - 0x230]
push edx
call esi
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea ecx, [ebp - 0x328]
push str.Shell
push ecx
lea ecx, [ebp - 0x2648]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfdaf
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2648]
push eax
lea ecx, [ebp - 0x230]
push str.WinLogon_Shell_s_s
push ecx
call edi
add esp, 0x10
push 0
lea edx, [ebp - 0x3b14]
push edx
lea eax, [ebp - 0x230]
push eax
call esi
push eax
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea edx, [ebp - 0x328]
push str.UserInit
push edx
lea ecx, [ebp - 0x2648]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4bfe14
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2648]
push ecx
lea edx, [ebp - 0x230]
push str.WinLogon_UserInit_s_s
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x230]
push 0x4e2a18
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x3b14]
push eax
lea ecx, [ebp - 0x230]
push ecx
call esi
push eax
lea edx, [ebp - 0x230]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret