Function at 0x42d900
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x848
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x840], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x7fe
push eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x52]
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0x54]
add esp, 0xc
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 2
mov dword [esp + 0x24], 0x400
push eax
push ebx
push 0x1073
push 0x2808
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xf000
push ebx
push 0x102c
push 0x2808
push dword [0x4def88]
call edi
push eax
call esi
mov esi, eax
mov edx, 0x4ad9d4
shr esi, 0xc
mov ecx, str.STRT
dec esi
call fcn.00477440
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42d9df
push 7
mov edx, esi
mov ecx, ebx
call fcn.0042dd40
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x840]
xor ecx, esp
call fcn.0048d925
add esp, 0x848
ret
mov edx, 0x4ad9e4
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42d9fe
push 0x18
jmp 0x42d9b6
mov edx, 0x4ada04
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42da36
push 0xf013f
push 0x4af960
push 0x80000001
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4ada1c
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42da5d
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
jmp 0x42da23
mov edx, 0x4adbe8
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42da98
push 0xf013f
push 0x4af960
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4adbf8
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dad3
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4adc08
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42db0e
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4adc18
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42db49
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4adc30
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42db84
push 0xf013f
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4af880
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dbbf
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4ae48c
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dbfa
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4ae440
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dc35
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4ae450
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dc70
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4ae460
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dcab
push 0xf023f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
mov edx, esi
mov ecx, ebx
call fcn.0042df40
add esp, 0xc
jmp 0x42d9c2
mov edx, 0x4adc40
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dce1
push str.run_
push 0x4afe04
mov edx, esi
mov ecx, ebx
call fcn.0042e190
add esp, 8
jmp 0x42d9c2
mov edx, 0x4adc48
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x42dd17
push str.load_
push str.load
mov edx, esi
mov ecx, ebx
call fcn.0042e190
add esp, 8
jmp 0x42d9c2
mov ecx, dword [esp + 0x84c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x848
ret