Function at 0x42dc40
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x848
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x840], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x7fe
push eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x52]
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0x54]
add esp, 0xc
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 2
mov dword [esp + 0x24], 0x400
push eax
push ebx
push 0x1073
push 0x2808
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xf000
push ebx
push 0x102c
push 0x2808
push dword [0x4e6030]
call edi
push eax
call esi
mov esi, eax
mov edx, 0x4b3c14
shr esi, 0xc
mov ecx, str.STRT
dec esi
call fcn.00478640
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dd1f
push 7
mov edx, esi
mov ecx, ebx
call fcn.0042e080
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x840]
xor ecx, esp
call fcn.0048ea75
add esp, 0x848
ret
mov edx, 0x4b3c24
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dd3e
push 0x18
jmp 0x42dcf6
mov edx, 0x4b3c44
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dd76
push 0xf013f
push 0x4b5ba0
push 0x80000001
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b3c5c
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dd9d
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
jmp 0x42dd63
mov edx, 0x4b3e28
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42ddd8
push 0xf013f
push 0x4b5ba0
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b3e38
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42de13
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b3e48
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42de4e
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b3e58
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42de89
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b3e70
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dec4
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b5ac0
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42deff
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b46cc
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42df3a
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b468c
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42df75
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b469c
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dfb0
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b46ac
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dfeb
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042e280
add esp, 0xc
jmp 0x42dd02
mov edx, 0x4b3e80
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42e021
push str.run_
push 0x4b6044
mov edx, esi
mov ecx, ebx
call fcn.0042e4d0
add esp, 8
jmp 0x42dd02
mov edx, 0x4b3e88
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42e057
push str.load_
push str.load
mov edx, esi
mov ecx, ebx
call fcn.0042e4d0
add esp, 8
jmp 0x42dd02
mov ecx, dword [esp + 0x84c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x848
ret