Function at 0x45b6ec
Capabilities:
Encrypt data using rc4 ksa
Open clipboard
Query or enumerate registry value
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x50], eax
mov esi, dword [0x48da44]
xor eax, eax
push ebp
push 0x45c213
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x48d550]
add edx, 0x100
mov eax, esi
call fcn.00405c48
push 0x45c224
push esi
call sub.kernel32.dll_lstrcatA
mov eax, esi
call fcn.00405e78
mov edx, dword [0x48d7f0]
mov dword [edx], eax
mov edx, dword [0x48d550]
add edx, 0x200
mov eax, esi
call fcn.00405c48
push 0x45c230
push esi
call sub.kernel32.dll_lstrcatA
mov eax, esi
call fcn.00405e78
mov edx, dword [0x48d620]
mov dword [edx], eax
mov eax, dword [0x48d620]
mov eax, dword [eax]
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.0040eba4
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45b7b9
push 0x1770
mov eax, dword [0x48d728]
push eax
push ebx
call sub.kernel32.dll__lread
cmp eax, 0x1770
jae 0x45b7b1
mov edx, dword [0x48d620]
mov edx, dword [edx]
mov ax, 2
call fcn.0040de10
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x45b7cd
mov eax, dword [0x48d728]
mov ecx, 0xff
mov edx, 0x1770
call fcn.00402db8
mov eax, dword [0x48d98c]
mov byte [eax], 1
mov edx, dword [0x48d84c]
mov eax, dword [0x48d370]
call fcn.00405c48
mov eax, dword [0x48da94]
mov dword [eax], 0xffffffff
mov ax, 0x4b
call fcn.0040bc04
mov edx, dword [0x48d550]
add edx, 0x100
call fcn.0040f5a0
mov eax, esi
call fcn.00405e78
mov edx, dword [0x48d89c]
mov dword [edx], eax
mov eax, dword [0x48d208]
mov edx, 0x11
call fcn.00405a9c
mov edx, dword [0x48d5e0]
mov eax, dword [0x48d208]
call fcn.00405c48
push 0
mov ecx, dword [0x48d208]
mov edx, dword [fcn.00406564]
xor eax, eax
call fcn.00406858
mov ebx, eax
push 0
mov edx, dword [0x48d758]
mov eax, ebx
mov ecx, 0x1e
call fcn.00406944
mov eax, ebx
call fcn.00406880
push 0
mov edx, dword [0x48d744]
mov eax, ebx
mov ecx, 0x6c
call fcn.00406944
mov eax, ebx
call fcn.00406880
push 0
mov edx, dword [0x48d760]
mov eax, ebx
mov ecx, 9
call fcn.00406944
mov eax, ebx
call fcn.00406880
push 0
mov edx, dword [0x48d5c0]
mov eax, ebx
mov ecx, 0xc
call fcn.00406944
mov eax, dword [0x48d208]
mov edx, 0x11
call fcn.00405a9c
mov edx, 0x2c
mov eax, ebx
call fcn.00402508
mov byte [ebp - 5], 0x10
mov ebx, dword [0x48d31c]
mov eax, pe_nt_image_headers32
call fcn.00402dd8
mov byte [ebx], al
inc ebx
dec byte [ebp - 5]
jne 0x45b8d9
mov edx, dword [0x48d550]
add edx, 0x100
mov eax, 0x45c244
call fcn.0040f5a0
mov eax, esi
call fcn.00405e78
mov edx, dword [0x48d7e4]
mov dword [edx], eax
mov edx, dword [0x48d550]
add edx, 0x100
mov eax, 0x45c254
call fcn.0040f5a0
mov eax, esi
call fcn.00405e78
mov edx, dword [0x48d918]
mov dword [edx], eax
push 0xffffffffffffffff
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.shell32.dll_DragAcceptFiles
push 0x11
call sub.gdi32.dll_GetStockObject
mov edi, eax
push 0
call sub.user32.dll_GetDC
mov ebx, eax
push edi
push ebx
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x4c]
push eax
push ebx
call sub.gdi32.dll_GetTextMetricsA
mov ax, word [ebp - 0x38]
inc eax
mov edx, dword [0x48d6f0]
mov word [edx], ax
mov eax, dword [0x48d630]
mov dx, word [ebp - 0x4c]
mov word [eax], dx
push 0xc
call sub.gdi32.dll_GetStockObject
push eax
push ebx
call sub.gdi32.dll_SelectObject
lea eax, [ebp - 0x4c]
push eax
push ebx
call sub.gdi32.dll_GetTextMetricsA
mov al, byte [ebp - 0x4c]
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.gdi32.dll_SelectObject
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [0x48da78]
cmp byte [eax], 0
je 0x45ba5b
push 0
push 0x31
push 2
push 0
push 0
push 0xff
push 0
push 0
push 0
push 0x190
push 0
push 0
push 9
push 0x10
call sub.gdi32.dll_CreateFontA
mov edx, dword [0x48d658]
mov dword [edx + 4], eax
cmp byte [ebp - 0x11], 0xd
jmp 0x45ba02
push 0x45c264
push 0x22
push 2
push 0
push 0
push 0x86
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffff4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.gdi32.dll_CreateFontA
mov edx, dword [0x48d658]
mov dword [edx + 8], eax
mov eax, dword [0x48d70c]
mov byte [eax], 1
jmp 0x45ba73
push 0xa
call sub.gdi32.dll_GetStockObject
mov edx, dword [0x48d658]
mov dword [edx + 4], eax
mov eax, dword [0x48d658]
mov dword [eax + 8], edi
push 0xff
push esi
mov eax, dword [0x48e700]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push esi
call sub.gdi32.dll_AddFontResourceA
push 0x1000
push 0
push 0
push 0
push 1
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [0x48d310]
mov dword [edx], eax
mov eax, dword [0x48d550]
add eax, 0x16a0
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov edx, dword [0x48d658]
mov dword [edx], eax
mov eax, dword [0x48d70c]
cmp byte [eax], 0
je 0x45bade
push 0x11
call sub.gdi32.dll_GetStockObject
mov edx, dword [0x48d658]
mov dword [edx + 0xc], eax
jmp 0x45bb0b
push 0x45c26c
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64
push 0
push 0
push 0
push 0x12
call sub.gdi32.dll_CreateFontA
mov edx, dword [0x48d658]
mov dword [edx + 0xc], eax
mov eax, dword [0x48d760]
call fcn.00412904
lea eax, [ebp - 0x50]
mov edx, esi
mov ecx, 0x22c
call fcn.0040464c
mov edx, dword [ebp - 0x50]
xor eax, eax
call fcn.0045b5c0
mov eax, dword [0x48dad8]
cmp byte [eax], 4
je 0x45bb50
mov eax, dword [0x48d550]
mov byte [eax + 0x185a], 0
mov eax, dword [0x48d550]
mov byte [eax + 0x185b], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x48daf4]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [0x48d498]
mov dword [eax], 0xff
mov eax, dword [0x48d498]
push eax
push esi
push 0
push 0
push 0x45c27c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45bba8
push 0x45c284
push esi
call sub.kernel32.dll_lstrcatA
mov eax, esi
call fcn.00405e78
mov edx, dword [0x48d8bc]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [0x48d550]
cmp byte [eax + 0x192d], 0
jne 0x45bc9d
mov eax, dword [0x48d550]
mov byte [eax + 0x192d], 1
mov eax, dword [0x48d550]
mov dword [eax + 0x1798], 0xe90000
mov eax, dword [0x48d550]
mov byte [eax + 0x192f], 1
mov eax, dword [0x48d550]
mov byte [eax + 0x192c], 1
push 0x45c290
push 0x45c298
push 0
mov ax, 0x2e6
call fcn.0040bc04
mov edx, eax
mov ecx, dword [0x48d6fc]
mov eax, dword [0x48db90]
call fcn.00410260
mov ax, 0xb
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d830]
call fcn.00405c48
mov eax, dword [0x48d830]
call fcn.00405bdc
mov edx, dword [0x48d830]
mov byte [edx + eax - 3], 0
mov eax, dword [0x48d830]
mov dl, 0x26
call fcn.0040fa38
push eax
push 0x45c298
push 1
mov ax, 0x2e6
call fcn.0040bc04
mov edx, eax
mov ecx, dword [0x48d6fc]
mov eax, dword [0x48db90]
call fcn.00410260
push 0x45c290
push 0x45c29c
push 0
mov ax, 0xac
call fcn.0040bc04
mov edx, eax
mov ecx, dword [0x48d3d0]
mov eax, dword [0x48d8c0]
call fcn.00410260
mov eax, dword [0x48d550]
cmp word [eax + 0x17bc], 0
jne 0x45bcba
mov eax, dword [0x48d550]
mov word [eax + 0x17bc], 0x19
mov eax, dword [0x48d550]
cmp byte [eax + 0x1b7a], 0
jne 0x45bce9
mov edx, dword [0x48d84c]
mov eax, dword [0x48d550]
add eax, 0x1b7a
call fcn.00405c48
mov eax, dword [0x48d550]
mov byte [eax + 0x1890], 1
mov eax, dword [0x48d550]
mov byte [eax + 0x18a9], 0
mov eax, dword [0x48d550]
cmp byte [eax + 0x1d7a], 0
jne 0x45bd5d
mov eax, dword [0x48d550]
mov byte [eax + 0x1d7a], 1
mov byte [ebp - 0x12], 3
mov ebx, dword [0x48d550]
add ebx, 0x1d7e
mov esi, dword [0x48d550]
add esi, 0x1d83
mov edi, dword [0x48d550]
add edi, 0x1de6
mov byte [ebx], 0xff
mov edx, 0x45c2a0
mov eax, esi
call fcn.00405c48
mov byte [edi], 1
inc edi
add esi, 0x21
add ebx, 2
dec byte [ebp - 0x12]
jne 0x45bd37
mov eax, dword [0x48d3ac]
mov byte [eax], 1
mov eax, dword [0x48d550]
mov al, byte [eax + 0x859]
test al, al
je 0x45bd76
mov edx, dword [0x48d550]
cmp al, 0x2a
jne 0x45bd99
mov edx, 0x45c2a4
mov eax, dword [0x48d550]
add eax, 0x859
call fcn.00405c48
mov eax, dword [0x48d550]
mov dword [eax + 0x16f4], 1
mov eax, dword [0x48d550]
cmp word [eax + 0x1dea], 0
jne 0x45bdcf
mov byte [ebp - 0x12], 7
mov edi, dword [0x48dbd4]
mov esi, dword [0x48d550]
add esi, 0x1dea
mov ax, word [edi]
mov word [esi], ax
add esi, 2
add edi, 2
dec byte [ebp - 0x12]
jne 0x45bdbe
mov eax, dword [0x48d550]
cmp word [eax + 0x1df8], 0
jne 0x45be13
mov eax, dword [0x48db74]
cmp byte [eax], 6
jae 0x45bdf4
mov eax, dword [0x48db48]
mov word [eax], 0x10
jmp 0x45bdfe
mov eax, dword [0x48db48]
mov word [eax], 0x20
mov eax, dword [0x48db48]
mov ax, word [eax]
mov edx, dword [0x48d550]
mov word [edx + 0x1df8], ax
mov eax, dword [0x48d550]
movzx eax, word [eax + 0x1df8]
mov edx, pe_nt_image_headers32
call fcn.0040bb7c
mov edx, dword [0x48db48]
mov word [edx], ax
mov eax, dword [0x48d550]
movzx eax, byte [eax + 0x188c]
inc eax
push eax
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadMenuA
mov edx, dword [0x48da28]
mov dword [edx], eax
mov eax, dword [0x48d550]
movzx eax, byte [eax + 0x188c]
inc eax
push eax
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadMenuA
mov edx, dword [0x48d520]
mov dword [edx], eax
mov eax, dword [0x48da28]
mov eax, dword [eax]
push eax
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetMenu
call fcn.0045ad64
call fcn.0045c678
push 0x45c2a8
call sub.user32.dll_RegisterClipboardFormatA
mov edx, dword [0x48d8d0]
mov dword [edx], eax
push 0x45c2b4
call sub.user32.dll_RegisterClipboardFormatA
mov edx, dword [0x48d814]
mov dword [edx], eax
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x45bf26
mov eax, dword [0x48d814]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x45bf21
mov eax, dword [0x48d814]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetClipboardData
mov edx, dword [0x48d204]
mov dword [edx], eax
mov eax, dword [0x48d204]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x48d854]
mov dword [edx], eax
mov eax, dword [0x48d854]
mov eax, dword [eax]
mov eax, dword [eax]
mov edx, dword [0x48d4a8]
mov dword [edx], eax
mov eax, dword [0x48d204]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
push 0x45c2c8
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [0x48d374]
mov dword [edx], eax
push 0xff
mov eax, dword [0x48d830]
push eax
push 0x45c2d8
push 0x45c2dc
push 0x45c2e4
call sub.kernel32.dll_GetProfileStringA
test eax, eax
jbe 0x45bfc5
mov eax, dword [0x48d830]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0042b970
mov edx, eax
mov eax, dword [0x48d3c0]
call fcn.00405c48
lea eax, [ebp - 4]
call fcn.0042b970
mov edx, eax
mov eax, dword [0x48d3c0]
add eax, 0x81
call fcn.00405c48
push 0x45c2ec
mov eax, dword [0x48d3c0]
add eax, 0x81
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 4]
call fcn.0042b970
mov edx, eax
mov eax, dword [0x48d3c0]
add eax, 0x8e
call fcn.00405c48
xor eax, eax
call fcn.0042bdcc
mov eax, dword [0x48d1e4]
cmp byte [eax], 7
jbe 0x45bfee
mov eax, dword [0x48d998]
mov edx, 0xd7
call fcn.00405a9c
mov eax, dword [0x48d8b8]
mov byte [eax], 0
mov eax, dword [0x48dad8]
mov byte [eax], 0
mov eax, dword [0x48d570]
mov edx, dword [0x48d51c]
mov dword [edx], eax
mov eax, dword [0x48da7c]
mov eax, dword [eax]
mov cl, 1
xor edx, edx
call fcn.0040d3e0
test al, al
jne 0x45c017
mov eax, dword [0x48d9dc]
mov byte [eax], 0
mov ebx, dword [0x48d550]
mov bl, byte [ebx + 0x188c]
test bl, bl
jne 0x45c059
mov eax, dword [0x48d9d0]
mov esi, eax
lea edi, [ebp - 0x70]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x70]
mov edx, dword [0x48d754]
mov cl, 0x20
call fcn.00403354
mov eax, dword [0x48d9d0]
lea esi, [ebp - 0x70]
mov edi, eax
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x48d550]
cmp bl, 2
jne 0x45c095
mov eax, dword [0x48d9d0]
mov esi, eax
lea edi, [ebp - 0x70]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x70]
mov edx, dword [0x48d7a0]
mov cl, 0x20
call fcn.00403354
mov eax, dword [0x48d9d0]
lea esi, [ebp - 0x70]
mov edi, eax
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
call fcn.0045b31c
push 0
mov eax, dword [0x48da28]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetSubMenu
mov edx, dword [0x48d380]
mov dword [edx], eax
push 0
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetSubMenu
mov edx, dword [0x48d934]
mov dword [edx], eax
mov eax, dword [0x48d508]
mov byte [eax], 1
mov eax, dword [0x48d3ac]
mov byte [eax], 1
mov eax, dword [0x48d694]
mov dword [eax], 0x1c
mov eax, dword [0x48da48]
mov dword [eax], 0x1c
mov eax, dword [0x48d550]
movzx eax, word [eax + 0x17bc]
add eax, eax
add eax, 0x21b4
mov ecx, 3
xor edx, edx
div ecx
mov edx, dword [0x48d550]
cmp eax, dword [edx + 0x17c0]
mov eax, dword [0x48d3f0]
sete byte [eax]
call fcn.00402738
test eax, eax
jle 0x45c12f
mov eax, dword [0x48d808]
mov byte [eax], 0
call fcn.00402738
dec eax
jne 0x45c15a
lea edx, [ebp - 0x74]
mov eax, 1
call fcn.00402798
mov eax, dword [ebp - 0x74]
mov edx, 0x45c2fc
call fcn.004047a8
jne 0x45c15a
mov al, 1
call fcn.0045d238
mov eax, dword [0x48d550]
cmp dword [eax + 0x176c], 0
jne 0x45c18a
call fcn.00410bf0
test al, al
jne 0x45c18a
mov eax, dword [0x48d5a8]
cmp byte [eax], 0
jne 0x45c18a
mov al, 0x10
call fcn.00411204
mov eax, dword [0x48d734]
mov byte [eax], 1
mov eax, dword [0x48d550]
inc dword [eax + 0x176c]
mov eax, dword [0x48d8b8]
cmp byte [eax], 0
jne 0x45c1f5
mov eax, dword [0x48d550]
mov eax, dword [eax + 0x176c]
mov ecx, 0xe
cdq
idiv ecx
cmp edx, 0xd
jne 0x45c1d1
mov ax, 0x4c
call fcn.0040bc04
mov edx, 3
call fcn.00411d74
mov al, 4
call fcn.00411204
mov eax, dword [0x48d550]
cmp dword [eax + 0x176c], 2
jle 0x45c1f5
push 0
push 0x1b7740
push 2
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetTimer
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c21a
lea eax, [ebp - 0x74]
call fcn.00404410
lea eax, [ebp - 0x50]
call fcn.00404410
ret