Function at 0x42c0d0
Capabilities:
Get graphical window text
Hide graphical window
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x145c
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1458], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 0x2802
push dword [0x4def88]
mov byte [0x4ce7ef], 1
call esi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x2803
push dword [0x4def88]
call esi
push eax
call ebx
push 0
push 0x2804
push dword [0x4def88]
call esi
push eax
call ebx
push 0
push 0x2805
push dword [0x4def88]
call esi
push eax
call ebx
push 0
push 0x2806
push dword [0x4def88]
call esi
push eax
call ebx
push 0
push 0
push 0x402
push 0x29c8
push dword [0x4def88]
call esi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
push 0x110000
push 0
push 0x401
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0
push 1
push 0x404
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
cmp dword [0x4deb74], 4
jne 0x42c20d
push 0
push 0
push 0x130b
push 0x27fc
push dword [0x4def88]
call esi
push eax
call ebx
test eax, eax
jne 0x42c20d
push 5
push 0x29c8
push dword [0x4def88]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x4ae8a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
push 1
push 0x40b
push dword [0x4deb68]
call ebx
push 0x281e
push dword [0x4def88]
call esi
push 0
push 0
push 0x1009
push 0x2808
push dword [0x4def88]
mov edi, eax
call esi
push eax
call ebx
push 0xf000
push 0
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c28e
mov edx, 0x4ad9d4
mov ecx, str.STRT
call fcn.00477440
push eax
push 7
mov edx, 1
mov ecx, 0x4ad29c
call fcn.0042cae0
mov edx, 0x4ad9d4
mov ecx, str.STRT
call fcn.00477440
push eax
push 7
xor edx, edx
mov ecx, 0x4af95c
call fcn.0042cae0
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 1
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c300
mov edx, 0x4ad9e4
mov ecx, str.STRT
call fcn.00477440
push eax
push 0x18
mov edx, 1
mov ecx, 0x4ad29c
call fcn.0042cae0
mov edx, 0x4ad9e4
mov ecx, str.STRT
call fcn.00477440
push eax
push 0x18
xor edx, edx
mov ecx, 0x4af95c
call fcn.0042cae0
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 2
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c359
push 0x20119
push 1
mov edx, 0x4ada04
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, 0x4af960
mov ecx, 0x80000001
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 3
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c3b2
push 0x20119
push 1
mov edx, 0x4ada1c
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000001
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 4
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c40b
push 0x20119
push 2
mov edx, 0x4adbe8
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, 0x4af960
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 5
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c464
push 0x20119
push 2
mov edx, 0x4adbf8
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 6
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c4bd
push 0x20119
push 2
mov edx, 0x4adc08
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 7
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c516
push 0x20119
push 2
mov edx, 0x4adc18
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 8
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c56f
push 0x20119
push 2
mov edx, 0x4adc30
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 9
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c5c8
push 0x20219
push 4
mov edx, 0x4af880
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 0xa
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c621
push 0x20219
push 4
mov edx, 0x4ae48c
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 0xb
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c67a
push 0x20219
push 4
mov edx, 0x4ae440
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 0xc
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c6d3
push 0x20219
push 4
mov edx, 0x4ae450
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 0xd
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c72c
push 0x20219
push 4
mov edx, 0x4ae460
mov ecx, str.STRT
call fcn.00477440
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0042cf20
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 0xe
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c79c
push 1
mov edx, 0x4adc40
mov ecx, str.STRT
call fcn.00477440
mov edx, eax
mov ecx, 0x4afe04
call fcn.0042d300
add esp, 4
mov edx, 0x4adc40
mov ecx, str.STRT
push 0
call fcn.00477440
mov edx, eax
mov ecx, str.run_
call fcn.0042d300
add esp, 4
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0xf000
push 0xf
push 0x102c
push edi
call ebx
shr eax, 0xc
sub eax, 1
je 0x42c80c
push 1
mov edx, 0x4adc48
mov ecx, str.STRT
call fcn.00477440
mov edx, eax
mov ecx, str.load
call fcn.0042d300
add esp, 4
mov edx, 0x4adc48
mov ecx, str.STRT
push 0
call fcn.00477440
mov edx, eax
mov ecx, str.load_
call fcn.0042d300
add esp, 4
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0x2808
push dword [0x4def88]
call esi
push 0
push 0
push 0x1004
push eax
mov dword [esp + 0x1c], eax
call ebx
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
jle 0x42c9a7
mov esi, dword [esp + 0xc]
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x468], ax
lea eax, [esp + 0x46a]
push eax
call fcn.0048e880
add esp, 0xc
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x460]
mov dword [esp + 0x2c], 0x400
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x1073
push esi
call ebx
lea edx, [esp + 0x460]
mov ecx, edx
call fcn.0045d7e0
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xc68], ax
lea eax, [esp + 0xc6a]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x460]
push eax
lea eax, [esp + 0xc64]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0
lea eax, [esp + 0x464]
push eax
push 0x104
push 0
lea eax, [esp + 0xc70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x5a]
push eax
call fcn.0048e880
add esp, 0xc
xor eax, eax
mov word [esp + 0x258], ax
push 0x206
push eax
lea eax, [esp + 0x262]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x258]
lea edx, [esp + 0x50]
lea ecx, [esp + 0x460]
push eax
call fcn.0045ce60
add esp, 4
mov dword [esp + 0x1c], 3
lea eax, [esp + 0x50]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x1074
push esi
call ebx
lea eax, [esp + 0x258]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x1074
push esi
call ebx
inc edi
cmp edi, dword [esp + 0x10]
jl 0x42c854
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4def88]
call esi
push eax
call ebx
push 0x2808
push dword [0x4def88]
call esi
mov edi, eax
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xc68], ax
lea eax, [esp + 0xc6a]
push eax
call fcn.0048e880
add esp, 0xc
push 0
push 0
push 0x1004
push edi
call ebx
mov ecx, edi
mov esi, eax
call fcn.00476300
push esi
push eax
mov edx, 0x4af4e8
mov ecx, str.STRT
call fcn.00477440
push eax
lea eax, [esp + 0xc6c]
push 0x400
push eax
call fcn.0040a3c0
add esp, 0x14
lea eax, [esp + 0xc60]
push eax
push 1
push 0x40b
push dword [0x4deb68]
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x2802
push dword [0x4def88]
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
push 1
push 0x2803
push dword [0x4def88]
call esi
push eax
call edi
push 1
push 0x2804
push dword [0x4def88]
call esi
push eax
call edi
push 1
push 0x2805
push dword [0x4def88]
call esi
push eax
call edi
push 1
push 0x2806
push dword [0x4def88]
call esi
push eax
call edi
push 0
push 0x29c8
push dword [0x4def88]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x1464]
pop edi
pop esi
pop ebx
xor ecx, esp
mov byte [0x4ce7ef], 0
call fcn.0048d925
mov esp, ebp
pop ebp
ret