Function at 0x406ab6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x254
mov eax, 0x465135
call fcn.00463b54
xor ebx, ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x250], ebx
call fcn.004068d0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00405f99
mov dword [ebp - 4], 1
cmp dword [0x48bd78], ebx
jne 0x406b33
mov esi, str.SOFTWAREPiriformCCleaner
mov dword [0x48bd78], 0x80000002
mov ecx, esi
call fcn.004082a0
push eax
push esi
mov ecx, 0x48bd7c
call fcn.00408222
mov eax, dword [0x48bd80]
mov ecx, 0x100
cmp dword [0x48bf5c], ebx
cmovne eax, ecx
mov dword [0x48bd80], eax
mov esi, str.SetupVersion
mov ecx, esi
call fcn.004082a0
push eax
push esi
mov ecx, 0x48bde0
call fcn.00408222
mov esi, str.UpdateVersion
mov ecx, esi
call fcn.004082a0
push eax
push esi
mov ecx, 0x48bde4
call fcn.00408222
call fcn.0041e571
lea eax, [ebp - 0x238]
push eax
mov eax, dword [0x48bd80]
or eax, 0x2001f
push eax
push ebx
push dword [0x48bd7c]
push dword [0x48bd78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov edi, 0x48bd84
mov dword [ebp - 0x260], ebx
test ebx, ebx
jne 0x406bf4
mov word [ebp - 0x14], ax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x240], 0x208
push eax
push ebx
push ebx
push 0x478010
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406bf6
lea ecx, [ebp - 0x21c]
call fcn.004082a0
push eax
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.00408222
jmp 0x406bf6
xor ebx, ebx
mov eax, dword [0x48bd84]
cmp dword [eax - 0xc], 0
jne 0x406cce
lea ecx, [ebp - 0x234]
call fcn.004069cb
mov esi, eax
mov byte [ebp - 4], 2
cmp dword [esi + 0x14], 8
jb 0x406c1e
mov esi, dword [esi]
mov ecx, esi
call fcn.004082a0
push eax
push esi
mov ecx, edi
call fcn.00408222
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.0040414f
mov ecx, dword [0x48bd84]
call fcn.0041d1a9
test al, al
jne 0x406c55
mov ecx, edi
call fcn.00406358
jmp 0x406cce
cmp dword [ebp - 0x238], 0
jne 0x406cce
push ebx
lea eax, [ebp - 0x238]
push eax
mov eax, dword [0x48bd80]
push ebx
or eax, 0x2001f
push eax
push ebx
push ebx
push ebx
push dword [0x48bd7c]
push dword [0x48bd78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x406ca8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_create_CCleaner_registry_key__gle_u
call fcn.0041b909
pop ecx
jmp 0x407232
mov ecx, dword [0x48bd84]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push ebx
push 0x478010
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x48bd84]
cmp dword [eax - 0xc], 0
je 0x407228
push 0x5c
pop esi
push esi
push 0x2f
mov ecx, edi
call fcn.004075aa
mov eax, dword [0x48bd84]
mov ecx, edi
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.004076f0
cmp ax, si
je 0x406d08
push ecx
mov ecx, edi
call fcn.00407625
push edi
mov ecx, 0x48bd88
call fcn.0040764f
xor eax, eax
mov dword [ebp - 0x240], 0x208
mov word [ebp - 0x14], ax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push 0x477c28
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 0x48bd8c
test eax, eax
je 0x406d79
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push str.GUID
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406dc3
lea ecx, [ebp - 0x21c]
call fcn.004082a0
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00408222
push esi
push dword [ebp - 0x24c]
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x406db2
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x406dc3
lea eax, [ebp - 0x24c]
mov ecx, 0x48bd9c
push eax
call fcn.0040764f
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.RPCRT4.dll_UuidIsNil]
mov ebx, dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x406e4a
push esi
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0x25c], eax
test eax, eax
je 0x406df3
cmp eax, 0x720
jne 0x406e4a
lea eax, [ebp - 0x250]
push eax
push esi
call ebx
mov dword [ebp - 0x25c], eax
test eax, eax
jne 0x406e4a
mov ecx, dword [ebp - 0x250]
call fcn.004082a0
push eax
push dword [ebp - 0x250]
mov ecx, 0x48bd9c
call fcn.00408222
mov ecx, dword [0x48bd9c]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push 0x477c28
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0x48bda0
call fcn.00404313
test eax, eax
jne 0x406ee8
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x21c]
mov word [ebp - 0x21c], ax
xor esi, esi
movzx eax, byte [esi + 0x48bda0]
push eax
push str._02X
push 3
push edi
call fcn.0040817c
add esp, 0x10
add edi, 4
inc esi
cmp esi, 0x20
jb 0x406e6f
lea ecx, [ebp - 0x21c]
call fcn.004082a0
push eax
lea eax, [ebp - 0x21c]
mov ecx, 0x48bdc0
push eax
call fcn.00408222
lea eax, [ebp - 0x244]
push eax
push 0x48bda0
call ebx
test eax, eax
jne 0x406ee8
mov ecx, dword [ebp - 0x244]
call fcn.004082a0
push eax
push dword [ebp - 0x244]
mov ecx, 0x48bdc4
call fcn.00408222
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 4
push eax
lea eax, [ebp - 0x258]
push eax
push 0
push 0
push str.SetupVersion
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406f24
mov eax, dword [ebp - 0x258]
jmp 0x406ff5
mov esi, 0x48bd84
lea ecx, [ebp - 0x248]
push str.CCleaner.exe
mov edx, esi
call fcn.004074c4
pop ecx
mov byte [ebp - 4], 3
xor ebx, ebx
inc ebx
lea edx, [ebp - 0x224]
mov dword [ebp - 0x254], ebx
mov ecx, dword [eax]
call fcn.0041f38b
test eax, eax
je 0x406f95
push str.CCleaner64.exe
mov edx, esi
lea ecx, [ebp - 0x244]
call fcn.004074c4
pop ecx
mov dword [ebp - 4], 4
lea edx, [ebp - 0x224]
push 3
pop ebx
mov dword [ebp - 0x254], ebx
mov ecx, dword [eax]
call fcn.0041f38b
mov byte [ebp - 0x239], 0
test eax, eax
jne 0x406f9c
mov byte [ebp - 0x239], 1
push 3
pop eax
mov dword [ebp - 4], eax
test bl, 2
je 0x406fc1
and ebx, 0xfffffffd
mov dword [ebp - 0x254], ebx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00406985
xor eax, eax
inc eax
mov dword [ebp - 4], eax
test al, bl
je 0x406fe5
and ebx, 0xfffffffe
mov dword [ebp - 0x254], ebx
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00406985
cmp byte [ebp - 0x239], 0
je 0x406fff
movzx eax, word [ebp - 0x21e]
mov dword [0x48bdd8], eax
mov dword [0x48bdc8], eax
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 4
push eax
lea eax, [ebp - 0x258]
push eax
push 0
push 0
push str.UpdateVersion
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407040
mov eax, dword [ebp - 0x258]
mov dword [0x48bdcc], eax
mov dword [0x48bddc], eax
mov dword [ebp - 0x22c], str.PrefsPrivacyShareData1stParty
xor edi, edi
mov dword [ebp - 0x228], str.PrefsPrivacyShareData3rdParty
mov dword [ebp - 0x224], str.PrefsPrivacyShowOffers1stParty
mov dword [ebp - 0x220], str.PrefsPrivacyShowOffers3rdParty
xor eax, eax
mov dword [ebp - 0x240], 0x208
mov word [ebp - 0x14], ax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push dword [ebp + edi*4 - 0x22c]
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407113
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x244]
call fcn.0040769d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x244]
call fcn.0040751e
mov eax, dword [ebp - 0x244]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4070fd
js 0x40727c
cmp word [eax], 0x31
jne 0x4070fd
mov edx, dword [0x48bdf0]
mov esi, edi
shr esi, 5
mov ecx, edi
and ecx, 0x1f
mov eax, dword [edx + esi*4]
bts eax, ecx
mov dword [edx + esi*4], eax
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00406985
jmp 0x407116
xor ebx, ebx
inc ebx
inc edi
cmp edi, 4
jb 0x40706a
mov eax, dword [0x48bd84]
movzx ecx, byte [0x48bd74]
push str.RestartService
cmp dword [eax - 0xc], 0
cmovne ecx, ebx
mov byte [0x48bd74], cl
lea ecx, [ebp - 0x248]
call fcn.0040769d
mov byte [ebp - 4], 9
mov ecx, eax
call fcn.00407582
mov esi, 0x48bde8
push eax
mov ecx, esi
call fcn.004073e6
mov dword [eax], 0x41f2f3
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00406985
push str.KillProcesses
lea ecx, [ebp - 0x248]
call fcn.0040769d
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.00407582
push eax
mov ecx, esi
call fcn.004073e6
mov dword [eax], 0x41f365
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00406985
push str.StartService
lea ecx, [ebp - 0x248]
call fcn.0040769d
mov byte [ebp - 4], 0xd
mov ecx, eax
call fcn.00407582
push eax
mov ecx, esi
call fcn.004073e6
mov dword [eax], 0x41f319
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00406985
push str.StopService
lea ecx, [ebp - 0x248]
call fcn.0040769d
mov byte [ebp - 4], 0xf
mov ecx, eax
call fcn.00407582
push eax
mov ecx, esi
call fcn.004073e6
mov dword [eax], 0x41f33f
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00406985
jmp 0x407233
push str.Unable_to_locate_CCleaner_program_path
call fcn.0041b909
pop ecx
cmp dword [ebp - 0x250], 0
je 0x407249
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp dword [ebp - 0x238], 0
je 0x40725e
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24c]
lea ecx, [ecx - 0x10]
call fcn.00406985
mov eax, dword [ebp - 0x260]
call fcn.00463afe
ret
push 0x80070057
call fcn.004065a6
int3