Function at 0x404678
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x404680
push ecx
push ebx
push esi
push edi
mov eax, 0x404618
call fcn.00403704
mov ebx, 0x406684
mov esi, 0x4066b4
xor eax, eax
push ebp
push 0x404911
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.004043e0
push 0x404920
push 0
push 0
call fcn.004037f0
mov edi, eax
push 0
push edi
call sub.user32.dll_DrawTextA
cmp eax, 0x102
je 0x4048f6
call fcn.00404280
call fcn.00403f70
call fcn.00403fc0
call fcn.00404420
lea eax, [ebp - 0x18]
call fcn.00404228
lea eax, [ebp - 0x18]
mov edx, 0x404934
call fcn.00403224
mov eax, dword [ebp - 0x18]
call fcn.00404014
test al, al
jne 0x4047ad
push 0
lea eax, [ebp - 0x1c]
call fcn.00404228
lea eax, [ebp - 0x1c]
mov edx, 0x404934
call fcn.00403224
mov eax, dword [ebp - 0x1c]
call fcn.00403304
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402678
mov eax, dword [ebp - 0x20]
call fcn.00403304
push eax
call fcn.004037d0
push 0x4066e0
push 0x404944
push 0x80000002
call sub.user32.dll_GetClientRect
lea eax, [ebp - 0x24]
call fcn.00404228
lea eax, [ebp - 0x24]
mov edx, 0x404934
call fcn.00403224
mov eax, dword [ebp - 0x24]
call fcn.0040321c
push eax
lea eax, [ebp - 0x28]
call fcn.00404228
lea eax, [ebp - 0x28]
mov edx, 0x404934
call fcn.00403224
mov eax, dword [ebp - 0x28]
call fcn.00403304
push eax
push 1
push 0
push 0x404974
mov eax, dword [0x4066e0]
push eax
call sub.user32.dll_GetDC
mov eax, 0x40667c
mov edx, 0x40498c
call fcn.00403124
push 0
call fcn.00403858
mov edi, eax
mov dword [ebx], 0x30
mov eax, 0x404998
mov dword [ebx + 0x28], eax
mov dword [ebx + 4], 0x23
mov dword [ebx + 0x14], edi
mov dword [ebx + 8], 0x404484
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
push 0x4049a4
mov eax, dword [0x406650]
push eax
call fcn.00403938
mov dword [ebx + 0x18], eax
push 0x4049a4
mov eax, dword [0x406650]
push eax
call fcn.00403938
mov dword [ebx + 0x2c], eax
push 0x7f00
push 0
call fcn.00403930
mov dword [ebx + 0x1c], eax
push 0
call sub.gdi32.dll_GetStockObject
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
push ebx
call fcn.00403950
test ax, ax
jne 0x404855
push 0
push 0x4049b0
push 0x4049b8
push 0
call fcn.00403940
jmp 0x4048f6
push 0xcf0000
push 0xffffffffffffff9c
push 0xffffffffffffff9c
push 0
push 0
push 0
push 0
push edi
push 0
mov ecx, 0x4049d0
mov edx, dword [ebx + 0x28]
mov eax, 0x300
call fcn.0040399c
mov ebx, eax
test ebx, ebx
je 0x4048b0
push 0x80
push 0xffffffffffffffec
push ebx
call fcn.00403960
push 0
push ebx
call fcn.00403970
push ebx
call fcn.00403980
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
call fcn.00403968
jmp 0x4048c3
push 0
push 0x4049b0
push 0x4049dc
push 0
call fcn.00403940
mov eax, dword [0x4066e4]
mov dword [eax], ebx
call dword [0x4066d0]
jmp 0x4048de
push esi
call fcn.00403978
push esi
call fcn.004038f8
push 0
push 0
push 0
push esi
call fcn.00403928
test eax, eax
jne 0x4048d2
lea eax, [ebp - 0x2c]
call fcn.004043e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404918
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.004030f4
ret