Function at 0x41ae90
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x489380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004834fa
mov ebp, dword [eax + 4]
mov eax, dword [esi + 0x1310]
add eax, 0x1b48
push 0x4b61a0
mov dword [esp + 0x18], ebp
mov eax, dword [eax]
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
je 0x41aefc
mov eax, dword [esi + 0x1310]
push ecx
add eax, 0x1b48
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0047be68
mov ecx, dword [esi + 0x1310]
call fcn.0040b6c0
mov ecx, dword [esi + 0x308]
xor ebx, ebx
push ebx
push ebx
push 0x1004
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
lea edi, [eax - 1]
cmp edi, 0xffffffff
jle 0x41af8f
lea ebx, [esi + 0x2ec]
push edi
mov ecx, ebx
call fcn.00476ced
mov ebp, eax
mov ecx, ebx
push ebp
call fcn.00456790
test eax, eax
je 0x41af81
push ebp
mov ecx, ebx
call fcn.004567d0
test eax, eax
je 0x41af81
push 0
lea edx, [esp + 0x1c]
push edi
push edx
mov ecx, ebx
call fcn.00476c48
push ebp
push edi
mov ecx, ebx
mov dword [esp + 0x2c], 0
call fcn.00456200
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
add ecx, eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x18]
call fcn.0047c0f3
dec edi
cmp edi, 0xffffffff
jg 0x41af24
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov ecx, dword [esi + 0x1310]
call fcn.0040fa20
mov edi, dword [esi + 0x135c]
mov ecx, esi
sub edi, ebx
mov dword [esi + 0x135c], edi
call fcn.0041aa30
or edi, 0xffffffff
push ebx
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4b61a0
call fcn.0047c161
mov ecx, dword [esi + 0x1310]
call fcn.0040ae30
test ebx, ebx
jle 0x41b134
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x41b05b
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4b61a0
call fcn.0047c161
push ecx
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4af4c0
mov dword [esp + 0x30], ebx
call fcn.0047c161
mov ecx, dword [esi + 0x1310]
push ebx
mov dword [esp + 0x30], edi
call fcn.00411d00
push ecx
add ebp, 0x118
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebp
call fcn.0047be68
mov ecx, dword [esi + 0x1310]
call fcn.0040b9a0
cmp dword [esi + 0x135c], ebx
jge 0x41b134
mov ecx, dword [esi + 0x1310]
push 0
push 0xc
push 0xc
call fcn.0040bea0
jmp 0x41b134
push ecx
lea eax, [ebp + 0x118]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0047be68
mov ecx, dword [esi + 0x1310]
call fcn.0040b9a0
add ebp, 0xd0
push str.PCClearPlusR.exe_pcclear
lea ecx, [esp + 0x34]
push ebp
push ecx
call fcn.0047c388
lea edx, [esp + 0x14]
mov ebx, 2
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x30]
mov eax, dword [eax - 8]
push eax
push eax
call fcn.0047c523
mov ecx, dword [esp + 0x18]
push eax
push 1
push 0
push str.PCClearPlus
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4af448
call fcn.0047c161
push ecx
mov byte [esp + 0x2c], 3
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4af41c
call fcn.0047c161
mov ecx, dword [esi + 0x1310]
push 3
mov byte [esp + 0x30], bl
call fcn.00411d00
cmp eax, 1
jne 0x41b127
mov ecx, dword [esi + 0x1310]
call fcn.0040bb00
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], edi
call fcn.0047c0f3
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 8