Function at 0x435db0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x48c2d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004834fa
mov ebx, dword [eax + 4]
mov eax, dword [esi + 0x1f94]
add eax, 0x1b48
push 0x4b61a0
mov dword [esp + 0x1c], ebx
mov eax, dword [eax]
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
je 0x435e1c
mov eax, dword [esi + 0x1f94]
push ecx
add eax, 0x1b48
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0047be68
mov ecx, dword [esi + 0x1f94]
call fcn.0040b6c0
mov ecx, dword [esi + 0x178]
xor ebp, ebp
push ebp
push ebp
push 0x1004
push ecx
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_SendMessageA]
lea edi, [eax - 1]
cmp edi, 0xffffffff
jle 0x435ead
lea ebx, [esi + 0x15c]
push edi
mov ecx, ebx
call fcn.00476ced
mov ebp, eax
mov ecx, ebx
push ebp
call fcn.00456790
test eax, eax
je 0x435ea1
push ebp
mov ecx, ebx
call fcn.004567d0
test eax, eax
je 0x435ea1
push 0
lea edx, [esp + 0x18]
push edi
push edx
mov ecx, ebx
call fcn.00476c48
push ebp
push edi
mov ecx, ebx
mov dword [esp + 0x2c], 0
call fcn.00456200
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
add ecx, eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x14]
call fcn.0047c0f3
dec edi
cmp edi, 0xffffffff
jg 0x435e44
mov ebx, dword [esp + 0x18]
xor ebp, ebp
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0x2040]
sub ecx, eax
mov dword [esi + 0x2040], ecx
jns 0x435ec7
mov dword [esi + 0x2040], ebp
push 0xffffffffffffffff
push ebp
push 1
mov ecx, esi
call fcn.00437c80
push 0x4ad458
push 0x4c4
mov ecx, esi
mov dword [esi + 0x205c], ebp
mov dword [esi + 0x2058], ebp
mov dword [esi + 0x2054], ebp
mov dword [esi + 0x2050], ebp
call fcn.0047b5e7
push 0x4ad458
push 0x4c5
mov ecx, esi
call fcn.0047b5e7
push 0x4ad458
push 0x4c6
mov ecx, esi
call fcn.0047b5e7
push 0x4ad458
push 0x4c7
mov ecx, esi
call fcn.0047b5e7
cmp dword [esi + 0x207c], ebp
jne 0x4360af
mov ecx, dword [esi + 0x1f94]
call fcn.0040fa20
cmp dword [esp + 0x10], ebp
jle 0x4360e7
cmp dword [esp + 0x30], ebp
jne 0x435fd1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4b61a0
call fcn.0047c161
push ecx
mov dword [esp + 0x2c], 1
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4b02a4
call fcn.0047c161
mov ecx, dword [esi + 0x1f94]
push 1
mov dword [esp + 0x30], 0xffffffff
call fcn.00411d00
push ecx
add ebx, 0x118
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0047be68
mov ecx, dword [esi + 0x1f94]
call fcn.0040b9a0
cmp dword [esi + 0x2040], ebp
jne 0x4360e7
mov ecx, esi
mov dword [esi + 0x206c], ebp
call fcn.00437f70
jmp 0x4360e7
push ecx
lea edx, [ebx + 0x118]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.0047be68
mov ecx, dword [esi + 0x1f94]
call fcn.0040b9a0
add ebx, 0xd0
push str.PCClearPlusR.exe_pcclear
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.0047c388
lea ecx, [esp + 0x2c]
mov ebx, 2
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x30]
mov eax, dword [edx - 8]
push eax
push eax
call fcn.0047c523
push eax
mov eax, dword [esp + 0x34]
push 1
push ebp
push str.PCClearPlus
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4af448
call fcn.0047c161
push ecx
mov byte [esp + 0x2c], 3
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4af41c
call fcn.0047c161
mov ecx, dword [esi + 0x1f94]
push 3
mov byte [esp + 0x30], bl
call fcn.00411d00
cmp eax, 1
jne 0x43609c
mov ecx, dword [esi + 0x1f94]
call fcn.0040bb00
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.0047c0f3
jmp 0x4360e7
mov eax, dword [esi + 0x2040]
mov edx, dword [esp + 0x30]
cmp eax, ebp
mov dword [esi + 0x2084], edx
jne 0x4360c9
mov dword [esi + 0x206c], ebp
mov eax, dword [esi + 0x1f94]
mov ecx, dword [eax + 0x1c08]
cmp ecx, ebp
mov ecx, esi
jne 0x4360e2
call fcn.004363b0
jmp 0x4360e7
call fcn.004365d0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 8