Function at 0x44e448
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x44e451
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e7fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004028a8
lea edx, [ebp - 0x1c]
mov eax, 0x44e814
call fcn.004081a8
mov eax, dword [ebp - 0x1c]
call fcn.00404358
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.00404090
mov ecx, dword [ebp - 0x40]
mov dl, 1
mov eax, dword [0x425738]
call fcn.004257e8
mov dword [0x455bd8], eax
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x44e82c
mov edx, 0x44e83c
mov eax, dword [0x455bd8]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x24]
call fcn.00403f30
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
call fcn.00402b9c
mov ebx, eax
test ebx, ebx
jle 0x44e7d4
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0xc]
mov edx, 0x44e84c
call fcn.00403f30
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x28]
call fcn.00407c70
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004041a4
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, 0x44e85c
mov eax, dword [0x455bd8]
mov esi, dword [eax]
call dword [esi]
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x20]
call fcn.00403f30
mov eax, dword [ebp - 0x20]
call fcn.00404358
mov edi, eax
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.004083f0
mov esi, eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00408444
mov edx, edi
lea eax, [ebp - 0x4c]
call fcn.00404090
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.004042a4
jne 0x44e7ca
inc dword [0x455bfc]
mov eax, dword [0x455bfc]
cmp eax, dword [0x455bf8]
jne 0x44e6ce
mov dl, 1
mov eax, dword [0x426684]
call fcn.00426784
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00426824
lea eax, [ebp - 0x50]
mov ecx, 0x44e86c
mov edx, dword [0x453db4]
call fcn.004041a4
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, ebx
call fcn.0042688c
mov ecx, 0x44e88c
mov edx, 0x44e898
mov eax, ebx
call fcn.00426c28
mov ecx, 0x44e88c
mov edx, 0x44e8a4
mov eax, ebx
call fcn.00426c28
mov ecx, 0x44e88c
mov edx, 0x44e8b0
mov eax, ebx
call fcn.00426c28
mov eax, ebx
call fcn.00403160
mov dl, 1
mov eax, dword [0x426684]
call fcn.00426784
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00426824
xor ecx, ecx
mov edx, 0x44e8c0
mov eax, ebx
call fcn.0042688c
mov edx, 0x44e900
mov eax, ebx
call fcn.00426b28
xor ecx, ecx
mov edx, 0x44e910
mov eax, ebx
call fcn.0042688c
mov edx, 0x44e900
mov eax, ebx
call fcn.00426b28
mov eax, ebx
call fcn.00403160
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x2f8]
xor edx, edx
call fcn.00425024
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x2fc]
xor edx, edx
call fcn.00425024
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x300]
xor edx, edx
call fcn.00425024
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x304]
xor edx, edx
call fcn.00425024
mov byte [0x453dd0], 1
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x308]
mov dl, 1
call fcn.00425024
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x30c]
xor edx, edx
call fcn.00425024
jmp 0x44e7d4
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x3c]
add eax, 5
mov dword [0x455c08], eax
mov eax, dword [ebp - 0x38]
add eax, 5
mov dword [0x455c0c], eax
mov eax, dword [0x455c0c]
push eax
mov eax, dword [0x455c08]
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0
push 0
push 2
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 4
call sub.user32.dll_mouse_event
mov eax, dword [0x455bfc]
cmp eax, dword [0x455c00]
jne 0x44e7be
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x308]
xor edx, edx
call fcn.00425024
mov eax, dword [0x455c04]
push eax
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x455bd0]
mov eax, dword [eax + 0x308]
mov dl, 1
call fcn.00425024
mov dl, 1
mov eax, dword [0x426684]
call fcn.00426784
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00426824
lea eax, [ebp - 0x54]
mov ecx, 0x44e94c
mov edx, dword [0x453db4]
call fcn.004041a4
mov edx, dword [ebp - 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.0042688c
lea edx, [ebp - 0x58]
mov eax, dword [0x455c04]
call fcn.00407c70
mov ecx, dword [ebp - 0x58]
mov edx, 0x44e960
mov eax, ebx
call fcn.00426c28
mov eax, ebx
call fcn.00403160
jmp 0x44e7d4
push 0x1f4
call sub.kernel32.dll_Sleep_1
jmp 0x44e7d4
inc dword [ebp - 0x28]
dec ebx
jne 0x44e4f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e803
lea eax, [ebp - 0x58]
mov edx, 7
call fcn.00403ebc
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00403ebc
ret