Function at 0x45e640
Capabilities:
Get graphical window text
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0
mov edx, 0x4af960
mov ecx, 0x80000001
call fcn.0045cfe0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 1
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
mov ecx, 0x80000001
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 2
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000001
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 3
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000001
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 4
mov edx, 0x4af960
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 5
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 6
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 7
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 8
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 9
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0xa
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0xb
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0xc
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0xd
mov edx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, 0x80000002
call fcn.0045cfe0
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0xe
push 7
mov edx, 1
mov ecx, 0x4ad29c
call fcn.0045d8b0
push 0xe
push 7
xor edx, edx
mov ecx, 0x4af95c
call fcn.0045d8b0
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0xf
push 0x18
mov edx, 1
mov ecx, 0x4ad29c
call fcn.0045d8b0
push 0xf
push 0x18
xor edx, edx
mov ecx, 0x4af95c
call fcn.0045d8b0
add esp, 0x10
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0x10
mov edx, 1
mov ecx, 0x4afe04
call fcn.0045df70
add esp, 4
xor edx, edx
mov ecx, str.run_
push 0x10
call fcn.0045df70
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
push 0x11
mov edx, 1
mov ecx, str.load
call fcn.0045df70
add esp, 4
xor edx, edx
mov ecx, str.load_
push 0x11
call fcn.0045df70
add esp, 4
push 0
push 0
push 0x405
push 0x29c9
push dword [0x4def88]
call edi
push eax
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret