Function at 0x45f7a0
Capabilities:
Get graphical window text
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0
mov edx, 0x4b5ba0
mov ecx, 0x80000001
call fcn.0045e050
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 1
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
mov ecx, 0x80000001
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 2
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000001
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 3
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000001
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 4
mov edx, 0x4b5ba0
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 5
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 6
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 7
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 8
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 9
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0xb
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0xc
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0xd
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0045e050
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0xe
push 7
mov edx, 1
mov ecx, 0x4b34dc
call fcn.0045ea10
push 0xe
push 7
xor edx, edx
mov ecx, 0x4b5b9c
call fcn.0045ea10
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0xf
push 0x18
mov edx, 1
mov ecx, 0x4b34dc
call fcn.0045ea10
push 0xf
push 0x18
xor edx, edx
mov ecx, 0x4b5b9c
call fcn.0045ea10
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0x10
mov edx, 1
mov ecx, 0x4b6044
call fcn.0045f0d0
add esp, 4
xor edx, edx
mov ecx, str.run_
push 0x10
call fcn.0045f0d0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
push 0x11
mov edx, 1
mov ecx, str.load
call fcn.0045f0d0
add esp, 4
xor edx, edx
mov ecx, str.load_
push 0x11
call fcn.0045f0d0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4e6030]
call edi
push eax
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret