Function at 0x4096c2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x25c
mov eax, 0x475096
call fcn.004505aa
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x254], ebx
call fcn.00409480
push eax
lea ecx, [ebp - 0x250]
call fcn.00408c39
mov dword [ebp - 4], 1
cmp dword [0x4a03d8], ebx
jne 0x409741
mov dword [0x4a03d8], reloc.OLEAUT32.dll_SysReAllocString
mov edi, str.SOFTWAREPiriformCCleaner
mov ecx, edi
call fcn.0040b056
push eax
push edi
mov ecx, 0x4a03dc
call fcn.0040afd8
mov eax, dword [0x4a03e0]
mov ecx, 0x100
cmp dword [0x4a0604], ebx
cmovne eax, ecx
mov dword [0x4a03e0], eax
mov edi, str.SetupVersion
mov ecx, edi
call fcn.0040b056
push eax
push edi
mov ecx, 0x4a0444
call fcn.0040afd8
mov edi, str.UpdateVersion
mov ecx, edi
call fcn.0040b056
push eax
push edi
mov ecx, 0x4a0448
call fcn.0040afd8
call fcn.00420e38
mov eax, dword [0x4a03e0]
or eax, 0x2001f
lea ecx, [ebp - 0x240]
push ecx
push eax
push ebx
push dword [0x4a03dc]
push dword [0x4a03d8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x409800
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x248], 0x208
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x489c34
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409800
lea ecx, [ebp - 0x220]
call fcn.0040b056
push eax
lea eax, [ebp - 0x220]
push eax
mov edi, 0x4a03e4
mov ecx, edi
call fcn.0040afd8
jmp 0x409805
mov edi, 0x4a03e4
mov eax, dword [0x4a03e4]
cmp dword [eax - 0xc], 0
jne 0x4098ec
lea ecx, [ebp - 0x238]
call fcn.004095d7
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x409837
mov eax, dword [eax]
mov dword [ebp - 0x23c], eax
mov ecx, eax
call fcn.0040b056
push eax
push dword [ebp - 0x23c]
mov ecx, edi
call fcn.0040afd8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.0040b111
mov ecx, dword [0x4a03e4]
call fcn.0041f708
test al, al
jne 0x409873
mov ecx, edi
call fcn.00408f6d
jmp 0x4098ec
cmp dword [ebp - 0x240], 0
jne 0x4098ec
mov eax, dword [0x4a03e0]
or eax, 0x2001f
push ebx
lea ecx, [ebp - 0x240]
push ecx
push ebx
push eax
push ebx
push ebx
push ebx
push dword [0x4a03dc]
push dword [0x4a03d8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x4098c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_create_CCleaner_registry_key__gle_u
call fcn.0041dafb
pop ecx
jmp 0x409ec4
mov ecx, dword [0x4a03e4]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push ebx
push 0x489c34
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x4a03e4]
cmp dword [eax - 0xc], 0
je 0x409eba
push 0x5c
pop eax
push eax
push 0x2f
mov ecx, edi
call fcn.0040a11e
mov eax, dword [0x4a03e4]
mov eax, dword [eax - 0xc]
dec eax
push eax
mov ecx, edi
call fcn.0040a264
push 0x5c
pop ecx
cmp ax, cx
je 0x409929
push ecx
mov ecx, edi
call fcn.0040a199
push edi
mov ecx, 0x4a03e8
call fcn.0040a1c3
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x248], 0x208
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x489800
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x409995
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push str.GUID
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4099eb
lea ecx, [ebp - 0x220]
call fcn.0040b056
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x250]
call fcn.0040afd8
push 0x4a03f0
push dword [ebp - 0x250]
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x4099da
mov edi, 0x4a03f0
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x4a03e4
jmp 0x4099eb
lea eax, [ebp - 0x250]
push eax
mov ecx, 0x4a0400
call fcn.0040a1c3
lea eax, [ebp - 0x260]
push eax
push 0x4a03f0
call dword [sym.imp.RPCRT4.dll_UuidIsNil]
test eax, eax
je 0x409a7b
push 0x4a03f0
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x409a1d
cmp eax, 0x720
jne 0x409a7b
lea eax, [ebp - 0x254]
push eax
push 0x4a03f0
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov dword [ebp - 0x260], eax
test eax, eax
jne 0x409a7b
mov ecx, dword [ebp - 0x254]
call fcn.0040b056
push eax
push dword [ebp - 0x254]
mov ecx, 0x4a0400
call fcn.0040afd8
mov ecx, dword [0x4a0400]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push ebx
push 0x489800
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 3
mov ecx, 0x4a0404
call fcn.00434e20
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov ecx, ebx
mov dword [ebp - 0x264], ecx
cmp ecx, 0x20
jae 0x409acd
movzx eax, byte [ecx + 0x4a0404]
push eax
push str._02X
push 3
lea eax, [ebp - 0x220]
lea eax, [eax + ecx*4]
push eax
call fcn.0040af2d
add esp, 0x10
mov ecx, dword [ebp - 0x264]
inc ecx
jmp 0x409a98
lea ecx, [ebp - 0x220]
call fcn.0040b056
push eax
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x4a0424
call fcn.0040afd8
lea eax, [ebp - 0x23c]
push eax
push 0x4a0404
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x409b1d
push dword [ebp - 0x23c]
mov ecx, 0x4a0428
call fcn.0040b072
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov dword [ebp - 4], 1
jmp 0x409b40
mov dword [ebp - 0x248], 4
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
push str.SetupVersion
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409b7a
mov eax, dword [ebp - 0x25c]
jmp 0x409c50
push str.CCleaner.exe
mov edx, edi
lea ecx, [ebp - 0x258]
call fcn.0040a03a
pop ecx
mov byte [ebp - 4], 5
or esi, 1
mov dword [ebp - 0x24c], esi
lea edx, [ebp - 0x228]
mov ecx, dword [eax]
call fcn.00421c85
test eax, eax
je 0x409be5
push str.CCleaner64.exe
mov edx, edi
lea ecx, [ebp - 0x23c]
call fcn.0040a03a
pop ecx
mov dword [ebp - 4], 6
or esi, 2
mov dword [ebp - 0x24c], esi
lea edx, [ebp - 0x228]
mov ecx, dword [eax]
call fcn.00421c85
test eax, eax
mov byte [ebp - 0x241], bl
jne 0x409bec
mov byte [ebp - 0x241], 1
push 5
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x24c]
test al, 2
je 0x409c1c
and eax, 0xfffffffd
mov dword [ebp - 0x24c], eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x23c]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov eax, dword [ebp - 0x24c]
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
test cl, al
je 0x409c40
and eax, 0xfffffffe
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], cl
mov ecx, dword [ebp - 0x258]
lea ecx, [ecx - 0x10]
call fcn.00409575
cmp byte [ebp - 0x241], 0
je 0x409c5a
movzx eax, word [ebp - 0x222]
mov dword [0x4a043c], eax
mov dword [0x4a042c], eax
mov dword [ebp - 0x248], 4
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
push str.UpdateVersion
push dword [ebp - 0x240]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x409c9b
mov eax, dword [ebp - 0x25c]
mov dword [0x4a0430], eax
mov dword [0x4a0440], eax
mov dword [ebp - 0x230], str.PrefsPrivacyShareData1stParty
mov dword [ebp - 0x22c], str.PrefsPrivacyShareData3rdParty
mov dword [ebp - 0x228], str.PrefsPrivacyShowOffers1stParty
mov dword [ebp - 0x224], str.PrefsPrivacyShowOffers3rdParty
mov edi, ebx
mov dword [ebp - 0x23c], ebx
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x248], 0x208
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push dword [ebp + edi*4 - 0x230]
push dword [ebp - 0x240]
call esi
test eax, eax
jne 0x409d77
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x258]
call fcn.0040a211
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x258]
call fcn.0040a092
mov eax, dword [ebp - 0x258]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x409d65
js 0x409f0e
cmp word [eax], 0x31
jne 0x409d65
shr edi, 5
mov esi, dword [0x4a0454]
mov ecx, dword [ebp - 0x23c]
and ecx, 0x1f
xor edx, edx
inc edx
shl edx, cl
or dword [esi + edi*4], edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [ebp - 0x23c]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x258]
lea ecx, [ecx - 0x10]
call fcn.00409575
inc edi
mov dword [ebp - 0x23c], edi
cmp edi, 4
jb 0x409ccb
mov eax, dword [0x4a03e4]
movzx ecx, byte [0x4a03d4]
cmp dword [eax - 0xc], 0
push 1
pop ebx
cmovne ecx, ebx
mov byte [0x4a03d4], cl
push str.RestartService
lea ecx, [ebp - 0x23c]
call fcn.0040a211
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.0040a0f6
push eax
lea eax, [ebp - 0x228]
push eax
mov esi, 0x4a044c
mov ecx, esi
call fcn.0040a444
mov eax, dword [eax]
mov dword [eax + 0x14], 0x421bed
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x23c]
lea ecx, [ecx - 0x10]
call fcn.00409575
push str.KillProcesses
lea ecx, [ebp - 0x23c]
call fcn.0040a211
mov byte [ebp - 4], 0xd
mov ecx, eax
call fcn.0040a0f6
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.0040a444
mov eax, dword [eax]
mov dword [eax + 0x14], 0x421c5f
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x23c]
lea ecx, [ecx - 0x10]
call fcn.00409575
push str.StartService
lea ecx, [ebp - 0x23c]
call fcn.0040a211
mov byte [ebp - 4], 0xf
mov ecx, eax
call fcn.0040a0f6
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.0040a444
mov eax, dword [eax]
mov dword [eax + 0x14], 0x421c13
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x23c]
lea ecx, [ecx - 0x10]
call fcn.00409575
push str.StopService
lea ecx, [ebp - 0x23c]
call fcn.0040a211
mov byte [ebp - 4], 0x11
mov ecx, eax
call fcn.0040a0f6
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.0040a444
mov eax, dword [eax]
mov dword [eax + 0x14], 0x421c39
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x23c]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x409ec5
push str.Unable_to_locate_CCleaner_program_path
call fcn.0041dafb
pop ecx
cmp dword [ebp - 0x254], 0
je 0x409edb
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp dword [ebp - 0x240], 0
je 0x409ef0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x250]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov eax, dword [ebp - 0x268]
call fcn.004504f7
ret
push 0x80070057
call fcn.004091c0
int3