Function at 0x459f50
Capabilities:
Get common file path
Get graphical window text
Get program files directory
Get startup folder

Disassembly:
sub esp, 0x8a4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x89c], eax
push ebx
push ebp
push esi
push edi
push 0
push dword [0x4e5c0c]
push 0x29c5
push dword [0x4e6030]
push 0x1c2
push 0x4b0
push 0xa
push 0xa
push 0x4000800d
push 0x4b34dc
push str.SysListView32
push 0x300
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x10124
push 0
mov ebp, eax
push 0x1036
push ebp
mov dword [esp + 0x88], ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push 0
push 7
push 0x21
push 0x10
push 0x10
call esi
mov edi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x4f5c
push dword [0x4e5c0c]
mov dword [0x4e2834], eax
call edi
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push eax
push 0xffffffffffffffff
push dword [0x4e2834]
call ebx
push dword [0x4e2834]
push 1
push 0x1003
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 7
push 0x21
push 0x10
push 0x10
call esi
mov esi, 0x4f63
mov ebp, eax
movzx ecx, si
push ecx
push dword [0x4e5c0c]
call edi
push eax
push 0xffffffffffffffff
push ebp
call ebx
inc esi
cmp esi, 0x4f72
jle 0x45a021
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
mov ebp, dword [esp + 0x7c]
push 3
push 0x1003
push ebp
call ebx
mov edx, 0x4b46c4
mov dword [esp + 0x7c], 0xe
mov ecx, str.STRT
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0xe6
call fcn.00478640
mov dword [esp + 0x88], eax
lea eax, [esp + 0x7c]
push eax
push 0
push 0x1061
push ebp
call ebx
mov edx, 0x4b3bc4
mov dword [esp + 0x84], 0xe6
mov ecx, str.STRT
call fcn.00478640
mov dword [esp + 0x88], eax
lea eax, [esp + 0x7c]
push eax
push 1
push 0x1061
push ebp
call ebx
mov edx, 0x4b59e8
mov dword [esp + 0x84], 0xe6
mov ecx, str.STRT
call fcn.00478640
mov dword [esp + 0x88], eax
lea eax, [esp + 0x7c]
push eax
push 2
push 0x1061
push ebp
call ebx
mov edx, 0x4b4ae4
mov dword [esp + 0x84], 0x1ae
mov ecx, str.STRT
call fcn.00478640
mov dword [esp + 0x88], eax
lea eax, [esp + 0x7c]
push eax
push 3
push 0x1061
push ebp
call ebx
mov edx, 0x4b3e80
mov dword [esp + 0x84], 0x2bc
mov ecx, str.TWEAK
call fcn.00478640
mov dword [esp + 0x88], eax
lea eax, [esp + 0x7c]
push eax
push 4
push 0x1061
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [0x4e2938], 0x10b
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [0x4e2944], 0
mov dword [0x4e2948], 0
mov dword [0x4e2940], 0
mov dword [esp + 0x20], 0x60
mov dword [esp + 0x24], 0x1011
mov dword [esp + 0x68], 0
mov dword [esp + 0x28], str.Logon:_HKCUSoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp + 0x38], 0
call ebx
mov dword [esp + 0x18], str.Logon:_HKCUSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
mov dword [esp + 0x28], 1
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 2
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKCUSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 3
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareMicrosoftWindowsCurrentVersionRun
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 4
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 5
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 6
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 7
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 8
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 9
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0xa
call ebx
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0xb
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0xc
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0xd
call ebx
movups xmm0, xmmword [str.Logon:]
push 0x7f0
lea eax, [esp + 0xbc]
push 0
push eax
movups xmmword [esp + 0xb4], xmm0
call fcn.0048fb10
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esp + 0x7c]
add esp, 0xc
push eax
push 7
push 0
call edi
mov esi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0xb6]
push eax
push dword [esp + 0x74]
call esi
lea eax, [esp + 0xa8]
mov dword [esp + 0x28], 0xe
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
call ebx
lea eax, [esp + 0x70]
push eax
push 0x18
push 0
call edi
lea eax, [esp + 0xb6]
push eax
push dword [esp + 0x74]
call esi
lea eax, [esp + 0xa8]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_Win.ini:__Run__Section
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x10
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Logon:_Win.ini:__Load__Section
push eax
push 0xffffffffffffffff
mov dword [esp + 0x30], 0x11
push 0x1091
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x58], 1
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x28], str.Explorer:_HKCUSoftwareClassesProtocolsFilter
mov dword [esp + 0x38], 0x12
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesProtocolsFilter
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x13
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesProtocolsHandler
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x14
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesProtocolsHandler
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x15
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSOFTWAREMicrosoftInternet_ExplorerDesktopComponents
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x16
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareMicrosoftActive_SetupInstalled_Components
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x17
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeMicrosoftActive_SetupInstalled_Components
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x18
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x19
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x1a
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push eax
push 0xffffffffffffffff
mov dword [esp + 0x30], 0x1b
push 0x1091
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x1c
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x1d
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x1e
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x1f
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesShellExPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x20
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesShellExPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x21
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x22
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x23
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x24
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
push eax
push 0xffffffffffffffff
push 0x1091
mov dword [esp + 0x34], 0x25
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x26
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x27
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesDirectoryShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x28
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesDirectoryShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x29
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesDirectoryShellexDragDropHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x2a
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesDirectoryShellexDragDropHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x2b
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeClassesDirectoryShellexDragDropHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x2c
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesDirectoryShellexPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x2d
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesDirectoryShellexPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x2e
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeClassesDirectoryShellexPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x2f
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesDirectoryShellexCopyHookHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x30
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesDirectoryShellexCopyHookHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x31
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeClassesDirectoryShellexCopyHookHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x32
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x33
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x34
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesFolderShellexColumnHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x35
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesFolderShellexColumnHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x36
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeClassesFolderShellexColumnHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x37
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesFolderShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x38
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesFolderShellExContextMenuHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x39
call ebx
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesFolderShellExDragDropHandlers
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0x3a
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesFolderShellExDragDropHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x3b
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesFolderShellExExtShellFolderViews
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x3c
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesFolderShellExExtShellFolderViews
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x3d
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareClassesFolderShellExPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x3e
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareClassesFolderShellExPropertySheetHandlers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x3f
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x40
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x41
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x42
call ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.Explorer:_HKCUSoftwareMicrosoftCtfLangBarAddin
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
mov dword [esp + 0x38], 0x43
call ebx
mov dword [esp + 0x18], str.Explorer:_HKLMSoftwareMicrosoftCtfLangBarAddin
mov dword [esp + 0x28], 0x44
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push 0x1091
push ebp
call ebx
push 0
push 1
push 0x109d
push ebp
call ebx
mov ecx, dword [esp + 0x8ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x8a4
ret