Function at 0x408a6b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x25c
mov eax, 0x47c343
call fcn.00456a31
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x258], ebx
lea ecx, [ebp - 0x254]
call fcn.0040aaed
mov dword [ebp - 4], ebx
cmp dword [0x4c2574], ebx
jne 0x408ad1
mov dword [0x4c2574], reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWAREPiriformCCleaner
mov ecx, 0x4c2578
call fcn.0040a676
cmp dword [0x4c27bc], ebx
je 0x408ad1
mov dword [0x4c257c], 0x100
push str.SetupVersion
mov ecx, 0x4c25f4
call fcn.0040a676
push str.UpdateVersion
mov ecx, 0x4c25f8
call fcn.0040a676
call fcn.004217a8
mov eax, dword [0x4c257c]
or eax, 0x2001f
lea ecx, [ebp - 0x23c]
push ecx
push eax
push ebx
push dword [0x4c2578]
push dword [0x4c2574]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x408b72
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x244], 0x208
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x4a9354
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x4c2580
test eax, eax
jne 0x408b77
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.0040a676
jmp 0x408b77
mov edi, 0x4c2580
mov eax, dword [0x4c2580]
cmp dword [eax - 0xc], 0
jne 0x408c44
lea ecx, [ebp - 0x238]
call fcn.00408980
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 7
jbe 0x408b9d
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.0040a676
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x238]
call fcn.0040abc9
mov ecx, dword [0x4c2580]
call fcn.0041feac
test al, al
jne 0x408bcb
mov ecx, edi
call fcn.0040a366
jmp 0x408c44
cmp dword [ebp - 0x23c], 0
jne 0x408c44
mov eax, dword [0x4c257c]
or eax, 0x2001f
push ebx
lea ecx, [ebp - 0x23c]
push ecx
push ebx
push eax
push ebx
push ebx
push ebx
push dword [0x4c2578]
push dword [0x4c2574]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x408c1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_create_CCleaner_registry_key__gle_u
call fcn.0041e1d8
pop ecx
jmp 0x4091ce
mov ecx, dword [0x4c2580]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push ebx
push 0x4a9354
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x4c2580]
cmp dword [eax - 0xc], 0
je 0x4091c4
push 0x5c
pop eax
push eax
push 0x2f
mov ecx, edi
call fcn.00409476
mov eax, dword [0x4c2580]
mov eax, dword [eax - 0xc]
dec eax
push eax
mov ecx, edi
call fcn.004095d2
push 0x5c
pop ecx
cmp ax, cx
je 0x408c81
push ecx
mov ecx, edi
call fcn.004094f4
push edi
mov ecx, 0x4c2584
call fcn.0040951e
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x244], 0x208
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x4a8f20
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408ced
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push str.GUID
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408d37
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x254]
call fcn.0040a676
push 0x4c2590
push dword [ebp - 0x254]
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x408d26
mov edi, 0x4c2590
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x4c2580
jmp 0x408d37
lea eax, [ebp - 0x254]
push eax
mov ecx, 0x4c25a0
call fcn.0040951e
lea eax, [ebp - 0x260]
push eax
push 0x4c2590
call dword [sym.imp.RPCRT4.dll_UuidIsNil]
test eax, eax
je 0x408dbb
push 0x4c2590
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x408d69
cmp eax, 0x720
jne 0x408dbb
lea eax, [ebp - 0x258]
push eax
push 0x4c2590
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov dword [ebp - 0x260], eax
test eax, eax
jne 0x408dbb
push dword [ebp - 0x258]
mov ecx, 0x4c25a0
call fcn.0040a676
mov ecx, dword [0x4c25a0]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push ebx
push 0x4a8f20
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 2
mov ecx, 0x4c25a4
call fcn.004363e0
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov ecx, ebx
mov dword [ebp - 0x264], ecx
cmp ecx, 0x20
jae 0x408e0d
movzx eax, byte [ecx + 0x4c25a4]
push eax
push str._02X
push 3
lea eax, [ebp - 0x220]
lea eax, [eax + ecx*4]
push eax
call fcn.0040a338
add esp, 0x10
mov ecx, dword [ebp - 0x264]
inc ecx
jmp 0x408dd8
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x4c25c4
call fcn.0040a676
lea eax, [ebp - 0x24c]
push eax
push 0x4c25a4
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x408e51
push dword [ebp - 0x24c]
mov ecx, 0x4c25c8
call fcn.0040a676
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov dword [ebp - 4], ebx
jmp 0x408e6c
mov dword [ebp - 0x244], 4
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
push str.SetupVersion
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408ea6
mov eax, dword [ebp - 0x25c]
jmp 0x408f79
push str.CCleaner.exe
mov edx, edi
lea ecx, [ebp - 0x248]
call fcn.00409379
pop ecx
mov byte [ebp - 4], 4
or esi, 1
mov dword [ebp - 0x250], esi
lea edx, [ebp - 0x228]
mov ecx, dword [eax]
call fcn.00422632
test eax, eax
je 0x408f11
push str.CCleaner64.exe
mov edx, edi
lea ecx, [ebp - 0x24c]
call fcn.00409379
pop ecx
mov dword [ebp - 4], 5
or esi, 2
mov dword [ebp - 0x250], esi
lea edx, [ebp - 0x228]
mov ecx, dword [eax]
call fcn.00422632
test eax, eax
mov byte [ebp - 0x23d], bl
jne 0x408f18
mov byte [ebp - 0x23d], 1
push 4
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x250]
test al, 2
je 0x408f48
and eax, 0xfffffffd
mov dword [ebp - 0x250], eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x24c]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
mov eax, dword [ebp - 0x250]
mov dword [ebp - 4], ebx
test al, 1
je 0x408f69
and eax, 0xfffffffe
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
cmp byte [ebp - 0x23d], 0
je 0x408f83
movzx eax, word [ebp - 0x222]
mov dword [0x4c25e0], eax
mov dword [0x4c25cc], eax
mov dword [ebp - 0x244], 4
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
push str.UpdateVersion
push dword [ebp - 0x23c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x408fc4
mov eax, dword [ebp - 0x25c]
mov dword [0x4c25d0], eax
mov dword [0x4c25e4], eax
mov dword [ebp - 0x230], str.PrefsPrivacyShareData1stParty
mov dword [ebp - 0x22c], str.PrefsPrivacyShareData3rdParty
mov dword [ebp - 0x228], str.PrefsPrivacyShowOffers1stParty
mov dword [ebp - 0x224], str.PrefsPrivacyShowOffers3rdParty
mov edi, ebx
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x244], 0x208
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push dword [ebp + edi*4 - 0x230]
push dword [ebp - 0x23c]
call esi
test eax, eax
jne 0x409091
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040956c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x24c]
call fcn.004093ea
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x409080
js 0x409218
cmp word [eax], 0x31
jne 0x409080
mov esi, edi
shr esi, 5
mov edx, dword [0x4c2608]
mov ecx, edi
and ecx, 0x1f
xor eax, eax
inc eax
shl eax, cl
or dword [edx + esi*4], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x24c]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
inc edi
cmp edi, 4
jb 0x408fee
mov eax, dword [0x4c2580]
cmp dword [eax - 0xc], 0
je 0x4090ad
mov byte [0x4c2570], 1
push str.RestartService
lea ecx, [ebp - 0x248]
call fcn.0040956c
mov byte [ebp - 4], 0xa
mov ecx, eax
call fcn.0040944e
push eax
lea eax, [ebp - 0x228]
push eax
mov esi, 0x4c2600
mov ecx, esi
call fcn.00409773
mov eax, dword [eax]
mov dword [eax + 0x14], 0x42259a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
push str.KillProcesses
lea ecx, [ebp - 0x248]
call fcn.0040956c
mov byte [ebp - 4], 0xc
mov ecx, eax
call fcn.0040944e
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.00409773
mov eax, dword [eax]
mov dword [eax + 0x14], 0x42260c
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
push str.StartService
lea ecx, [ebp - 0x248]
call fcn.0040956c
mov byte [ebp - 4], 0xe
mov ecx, eax
call fcn.0040944e
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.00409773
mov eax, dword [eax]
mov dword [eax + 0x14], 0x4225c0
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
push str.StopService
lea ecx, [ebp - 0x248]
call fcn.0040956c
mov byte [ebp - 4], 0x10
mov ecx, eax
call fcn.0040944e
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.00409773
mov eax, dword [eax]
mov dword [eax + 0x14], 0x4225e6
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
jmp 0x4091cf
push str.Unable_to_locate_CCleaner_program_path
call fcn.0041e1d8
pop ecx
cmp dword [ebp - 0x258], 0
je 0x4091e5
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp dword [ebp - 0x23c], 0
je 0x4091fa
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x254]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
mov eax, dword [ebp - 0x268]
call fcn.00456983
ret
push 0x80070057
call fcn.0040a70e
int3