Function at 0x40897b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x25c
mov eax, 0x47ab33
call fcn.00454371
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x258], ebx
lea ecx, [ebp - 0x254]
call fcn.0040aa2d
mov dword [ebp - 4], ebx
cmp dword [0x4a749c], ebx
jne 0x4089e7
mov dword [0x4a749c], reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWAREPiriformCCleaner
mov ecx, 0x4a74a0
call fcn.0040a5c2
mov eax, dword [0x4a74a4]
mov ecx, 0x100
cmp dword [0x4a76e4], ebx
cmovne eax, ecx
mov dword [0x4a74a4], eax
push str.SetupVersion
mov ecx, 0x4a751c
call fcn.0040a5c2
push str.UpdateVersion
mov ecx, 0x4a7520
call fcn.0040a5c2
call fcn.00421346
mov eax, dword [0x4a74a4]
or eax, 0x2001f
lea ecx, [ebp - 0x23c]
push ecx
push eax
push ebx
push dword [0x4a74a0]
push dword [0x4a749c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x408a88
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x244], 0x208
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x48eb74
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x4a74a8
test eax, eax
jne 0x408a8d
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.0040a5c2
jmp 0x408a8d
mov edi, 0x4a74a8
mov eax, dword [0x4a74a8]
cmp dword [eax - 0xc], 0
jne 0x408b5a
lea ecx, [ebp - 0x238]
call fcn.00408890
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x408ab3
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.0040a5c2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x238]
call fcn.0040ab09
mov ecx, dword [0x4a74a8]
call fcn.0041facf
test al, al
jne 0x408ae1
mov ecx, edi
call fcn.0040a2b2
jmp 0x408b5a
cmp dword [ebp - 0x23c], 0
jne 0x408b5a
mov eax, dword [0x4a74a4]
or eax, 0x2001f
push ebx
lea ecx, [ebp - 0x23c]
push ecx
push ebx
push eax
push ebx
push ebx
push ebx
push dword [0x4a74a0]
push dword [0x4a749c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x408b34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_create_CCleaner_registry_key__gle_u
call fcn.0041defb
pop ecx
jmp 0x4090ee
mov ecx, dword [0x4a74a8]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push ebx
push 0x48eb74
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x4a74a8]
cmp dword [eax - 0xc], 0
je 0x4090e4
push 0x5c
pop eax
push eax
push 0x2f
mov ecx, edi
call fcn.00409396
mov eax, dword [0x4a74a8]
mov eax, dword [eax - 0xc]
dec eax
push eax
mov ecx, edi
call fcn.004094f2
push 0x5c
pop ecx
cmp ax, cx
je 0x408b97
push ecx
mov ecx, edi
call fcn.00409414
push edi
mov ecx, 0x4a74ac
call fcn.0040943e
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x244], 0x208
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x48e740
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408c03
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push str.GUID
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408c4d
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x254]
call fcn.0040a5c2
push 0x4a74b8
push dword [ebp - 0x254]
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x408c3c
mov edi, 0x4a74b8
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x4a74a8
jmp 0x408c4d
lea eax, [ebp - 0x254]
push eax
mov ecx, 0x4a74c8
call fcn.0040943e
lea eax, [ebp - 0x260]
push eax
push 0x4a74b8
call dword [sym.imp.RPCRT4.dll_UuidIsNil]
test eax, eax
je 0x408cd1
push 0x4a74b8
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x408c7f
cmp eax, 0x720
jne 0x408cd1
lea eax, [ebp - 0x258]
push eax
push 0x4a74b8
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov dword [ebp - 0x260], eax
test eax, eax
jne 0x408cd1
push dword [ebp - 0x258]
mov ecx, 0x4a74c8
call fcn.0040a5c2
mov ecx, dword [0x4a74c8]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push ebx
push 0x48e740
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 2
mov ecx, 0x4a74cc
call fcn.00435a80
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov ecx, ebx
mov dword [ebp - 0x264], ecx
cmp ecx, 0x20
jae 0x408d23
movzx eax, byte [ecx + 0x4a74cc]
push eax
push str._02X
push 3
lea eax, [ebp - 0x220]
lea eax, [eax + ecx*4]
push eax
call fcn.0040a284
add esp, 0x10
mov ecx, dword [ebp - 0x264]
inc ecx
jmp 0x408cee
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x4a74ec
call fcn.0040a5c2
lea eax, [ebp - 0x24c]
push eax
push 0x4a74cc
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x408d67
push dword [ebp - 0x24c]
mov ecx, 0x4a74f0
call fcn.0040a5c2
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov dword [ebp - 4], ebx
jmp 0x408d82
mov dword [ebp - 0x244], 4
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
push str.SetupVersion
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408dbc
mov eax, dword [ebp - 0x25c]
jmp 0x408e8f
push str.CCleaner.exe
mov edx, edi
lea ecx, [ebp - 0x248]
call fcn.00409299
pop ecx
mov byte [ebp - 4], 4
or esi, 1
mov dword [ebp - 0x250], esi
lea edx, [ebp - 0x228]
mov ecx, dword [eax]
call fcn.004221d1
test eax, eax
je 0x408e27
push str.CCleaner64.exe
mov edx, edi
lea ecx, [ebp - 0x24c]
call fcn.00409299
pop ecx
mov dword [ebp - 4], 5
or esi, 2
mov dword [ebp - 0x250], esi
lea edx, [ebp - 0x228]
mov ecx, dword [eax]
call fcn.004221d1
test eax, eax
mov byte [ebp - 0x23d], bl
jne 0x408e2e
mov byte [ebp - 0x23d], 1
push 4
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x250]
test al, 2
je 0x408e5e
and eax, 0xfffffffd
mov dword [ebp - 0x250], eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x24c]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
mov eax, dword [ebp - 0x250]
mov dword [ebp - 4], ebx
test al, 1
je 0x408e7f
and eax, 0xfffffffe
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
cmp byte [ebp - 0x23d], 0
je 0x408e99
movzx eax, word [ebp - 0x222]
mov dword [0x4a7508], eax
mov dword [0x4a74f4], eax
mov dword [ebp - 0x244], 4
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
push str.UpdateVersion
push dword [ebp - 0x23c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x408eda
mov eax, dword [ebp - 0x25c]
mov dword [0x4a74f8], eax
mov dword [0x4a750c], eax
mov dword [ebp - 0x230], str.PrefsPrivacyShareData1stParty
mov dword [ebp - 0x22c], str.PrefsPrivacyShareData3rdParty
mov dword [ebp - 0x228], str.PrefsPrivacyShowOffers1stParty
mov dword [ebp - 0x224], str.PrefsPrivacyShowOffers3rdParty
mov edi, ebx
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x244], 0x208
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push dword [ebp + edi*4 - 0x230]
push dword [ebp - 0x23c]
call esi
test eax, eax
jne 0x408fa7
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040948c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x24c]
call fcn.0040930a
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x408f96
js 0x409138
cmp word [eax], 0x31
jne 0x408f96
mov esi, edi
shr esi, 5
mov edx, dword [0x4a7530]
mov ecx, edi
and ecx, 0x1f
xor eax, eax
inc eax
shl eax, cl
or dword [edx + esi*4], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x24c]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
inc edi
cmp edi, 4
jb 0x408f04
mov eax, dword [0x4a74a8]
movzx ecx, byte [0x4a7498]
cmp dword [eax - 0xc], 0
push 1
pop eax
cmovne ecx, eax
mov byte [0x4a7498], cl
push str.RestartService
lea ecx, [ebp - 0x248]
call fcn.0040948c
mov byte [ebp - 4], 0xa
mov ecx, eax
call fcn.0040936e
push eax
lea eax, [ebp - 0x228]
push eax
mov esi, 0x4a7528
mov ecx, esi
call fcn.00409693
mov eax, dword [eax]
mov dword [eax + 0x14], 0x422139
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
push str.KillProcesses
lea ecx, [ebp - 0x248]
call fcn.0040948c
mov byte [ebp - 4], 0xc
mov ecx, eax
call fcn.0040936e
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.00409693
mov eax, dword [eax]
mov dword [eax + 0x14], 0x4221ab
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
push str.StartService
lea ecx, [ebp - 0x248]
call fcn.0040948c
mov byte [ebp - 4], 0xe
mov ecx, eax
call fcn.0040936e
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.00409693
mov eax, dword [eax]
mov dword [eax + 0x14], 0x42215f
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
push str.StopService
lea ecx, [ebp - 0x248]
call fcn.0040948c
mov byte [ebp - 4], 0x10
mov ecx, eax
call fcn.0040936e
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.00409693
mov eax, dword [eax]
mov dword [eax + 0x14], 0x422185
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
jmp 0x4090ef
push str.Unable_to_locate_CCleaner_program_path
call fcn.0041defb
pop ecx
cmp dword [ebp - 0x258], 0
je 0x409105
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp dword [ebp - 0x23c], 0
je 0x40911a
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x254]
lea ecx, [ecx - 0x10]
call fcn.0040aa0b
mov eax, dword [ebp - 0x268]
call fcn.004542c3
ret
push 0x80070057
call fcn.0040a64c
int3