Function at 0x41fa53
Capabilities:
Persist via run registry key

Disassembly:
push 0x234
mov eax, 0x4298ba
call fcn.004275fb
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
xor ebx, ebx
push 0x430a6c
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
call dword [sym.imp.K9PCUhelper.dll_unsigned_long_int___cdecl__winmajor_void_]
cmp eax, 6
jne 0x41faca
push ecx
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0x42f27c
call dword [0x42e8c8]
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x220]
mov ecx, esp
mov dword [ebp - 0x224], esp
push eax
call dword [0x42e8d8]
mov byte [ebp - 4], bl
call fcn.0041fc6a
jmp 0x41fc55
lea eax, [ebp - 0x21c]
mov edi, SysReAllocString
push eax
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x21c], edi
call dword [sym.imp.K9PCUhelper.dll_public:_void___thiscall_CRegistry::constructor_struct_HKEY____const_const__]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
call dword [0x42e8c8]
mov esi, 0x208
push esi
lea eax, [ebp - 0x218]
push ebx
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x23c], 0x2001f
call sub.MSVCR90.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.K9PCUhelper.dll_public:_int___thiscall_CRegistry::Open_struct_HKEY_____wchar_t_const___bool_]
push 1
push dword [ebp - 0x224]
lea ebx, [edi + 1]
push ebx
lea ecx, [ebp - 0x240]
call esi
test eax, eax
je 0x41fb6c
push dword [ebp - 0x220]
lea ecx, [ebp - 0x240]
call dword [sym.imp.K9PCUhelper.dll_public:_int___thiscall_CRegistry::DeleteValue_wchar_t_const__]
lea ecx, [ebp - 0x240]
call dword [sym.imp.K9PCUhelper.dll_public:_void___thiscall_CRegistry::Close_void_]
push 1
push dword [ebp - 0x224]
lea ecx, [ebp - 0x240]
push edi
call esi
test eax, eax
je 0x41fb9f
push dword [ebp - 0x220]
lea ecx, [ebp - 0x240]
call dword [sym.imp.K9PCUhelper.dll_public:_int___thiscall_CRegistry::DeleteValue_wchar_t_const__]
lea ecx, [ebp - 0x240]
call dword [sym.imp.K9PCUhelper.dll_public:_void___thiscall_CRegistry::Close_void_]
push 1
push dword [ebp - 0x224]
lea ecx, [ebp - 0x240]
push ebx
call esi
test eax, eax
je 0x41fbc6
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [ebp - 4], 4
jmp 0x41fbeb
push 1
push dword [ebp - 0x224]
lea ecx, [ebp - 0x240]
push edi
call esi
test eax, eax
je 0x41fc39
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [ebp - 4], 5
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push str.__s___autorun
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0xc
push 0
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x240]
push dword [ebp - 0x220]
call dword [sym.imp.K9PCUhelper.dll_public:_int___thiscall_CRegistry::WriteString_wchar_t_const___wchar_t_const___bool_]
lea ecx, [ebp - 0x240]
call dword [sym.imp.K9PCUhelper.dll_public:_void___thiscall_CRegistry::Close_void_]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x224]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call dword [sym.imp.K9PCUhelper.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_]
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
inc eax
call fcn.00427645
ret