Function at 0x42c660
Capabilities:
Get graphical window text
Hide graphical window
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x2802
push dword [0x4e6030]
mov byte [0x4d582f], 1
call edi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 0
push 0x2803
push dword [0x4e6030]
call edi
push eax
call ebp
push 0
push 0x2804
push dword [0x4e6030]
call edi
push eax
call ebp
push 0
push 0x2805
push dword [0x4e6030]
call edi
push eax
call ebp
push 0
push 0x2806
push dword [0x4e6030]
call edi
push eax
call ebp
push 0
push 0
push 0x402
push 0x29c8
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0x110000
push 0
push 0x401
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0
push 1
push 0x404
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
cmp dword [0x4e5c1c], 4
jne 0x42c786
push 0
push 0
push 0x130b
push 0x27fc
push dword [0x4e6030]
call edi
push eax
call esi
test eax, eax
jne 0x42c786
push 5
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x4b4ae4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push 1
push 0x40b
push dword [0x4e5c10]
call esi
push 0x281e
push dword [0x4e6030]
call edi
push 0
push 0
push 0x1009
push 0x2808
push dword [0x4e6030]
mov ebx, eax
call edi
push eax
call esi
push 0xf000
push 0
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42c807
mov edx, 0x4b3c14
mov ecx, str.STRT
call fcn.00478640
push eax
push 7
mov edx, 1
mov ecx, 0x4b34dc
call fcn.0042ce60
mov edx, 0x4b3c14
mov ecx, str.STRT
call fcn.00478640
push eax
push 7
xor edx, edx
mov ecx, 0x4b5b9c
call fcn.0042ce60
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 1
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42c879
mov edx, 0x4b3c24
mov ecx, str.STRT
call fcn.00478640
push eax
push 0x18
mov edx, 1
mov ecx, 0x4b34dc
call fcn.0042ce60
mov edx, 0x4b3c24
mov ecx, str.STRT
call fcn.00478640
push eax
push 0x18
xor edx, edx
mov ecx, 0x4b5b9c
call fcn.0042ce60
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 2
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42c8d2
push 0x20119
push 1
mov edx, 0x4b3c44
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, 0x4b5ba0
mov ecx, 0x80000001
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 3
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42c92b
push 0x20119
push 2
mov edx, 0x4b3c5c
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000001
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 4
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42c984
push 0x20119
push 3
mov edx, 0x4b3e28
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, 0x4b5ba0
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 5
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42c9dd
push 0x20119
push 4
mov edx, 0x4b3e38
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 6
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42ca36
push 0x20119
push 5
mov edx, 0x4b3e48
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 7
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42ca8f
push 0x20119
push 6
mov edx, 0x4b3e58
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 8
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cae8
push 0x20119
push 7
mov edx, 0x4b3e70
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 9
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cb41
push 0x20219
push 8
mov edx, 0x4b5ac0
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 0xa
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cb9a
push 0x20219
push 9
mov edx, 0x4b46cc
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 0xb
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cbf3
push 0x20219
push 0xa
mov edx, 0x4b4680
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 0xc
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cc4c
push 0x20219
push 0xb
mov edx, 0x4b4690
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 0xd
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cca5
push 0x20219
push 0xc
mov edx, 0x4b46a0
mov ecx, str.STRT
call fcn.00478640
push eax
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0042d2a0
add esp, 0xc
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 0xe
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cd15
push 1
mov edx, 0x4b3e80
mov ecx, str.STRT
call fcn.00478640
mov edx, eax
mov ecx, 0x4b6044
call fcn.0042d640
add esp, 4
mov edx, 0x4b3e80
mov ecx, str.STRT
push 0
call fcn.00478640
mov edx, eax
mov ecx, str.run_
call fcn.0042d640
add esp, 4
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf000
push 0xf
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
je 0x42cd85
push 1
mov edx, 0x4b3e88
mov ecx, str.STRT
call fcn.00478640
mov edx, eax
mov ecx, str.load
call fcn.0042d640
add esp, 4
mov edx, 0x4b3e88
mov ecx, str.STRT
push 0
call fcn.00478640
mov edx, eax
mov ecx, str.load_
call fcn.0042d640
add esp, 4
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
cmp byte [0x4d6bc4], 0
je 0x42cdac
call fcn.0042c4a0
push 0
push 0
push 0x405
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call esi
push 0x2808
push dword [0x4e6030]
call edi
mov ecx, eax
call fcn.0042da60
push 1
push 0x2802
push dword [0x4e6030]
call edi
push eax
call ebp
push 1
push 0x2803
push dword [0x4e6030]
call edi
push eax
call ebp
push 1
push 0x2804
push dword [0x4e6030]
call edi
push eax
call ebp
push 1
push 0x2805
push dword [0x4e6030]
call edi
push eax
call ebp
push 1
push 0x2806
push dword [0x4e6030]
call edi
push eax
call ebp
push 0
push 0x29c8
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov byte [0x4d582f], 0
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret