Function at 0x57515d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x874
mov eax, 0x58bad3
call fcn.00531c83
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84c], esp
push str.package
call fcn.004036c4
lea eax, [ebp - 0x868]
xor ebx, ebx
push eax
xor ecx, ecx
mov dword [ebp - 4], ebx
call fcn.005786e9
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.005785fa
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x82c]
call fcn.004043ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x868]
mov byte [ebp - 4], 3
call fcn.00403a16
cmp dword [ebp - 0x818], 8
lea ecx, [ebp - 0x848]
lea eax, [ebp - 0x82c]
cmovae eax, dword [ebp - 0x82c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x575426
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0054ae60
add esp, 0xc
mov dword [ebp - 0x814], 0x400
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push str.UninstallStringOld
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x575426
cmp dword [ebp - 0x814], eax
je 0x575426
sub esp, 0x18
mov esi, esp
push str..exe
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84c], esp
push str.package
call fcn.004036c4
lea eax, [ebp - 0x844]
mov byte [ebp - 4], 4
push eax
xor ecx, ecx
call fcn.005786e9
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.005785fa
mov edx, eax
mov byte [ebp - 4], 5
mov ecx, esi
call fcn.0040404c
pop ecx
call fcn.00579ae9
add esp, 0x18
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x844]
push ebx
push 1
call fcn.00403a16
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dl, 1
lea ecx, [ebp - 0x810]
call fcn.00579c2d
mov esi, eax
test esi, esi
je 0x5752dc
cmp esi, 0x13
jne 0x575426
push dword [ebp - 0x848]
mov esi, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84c], esp
push str.package
call fcn.004036c4
lea eax, [ebp - 0x880]
mov byte [ebp - 4], 6
push eax
xor ecx, ecx
call fcn.005786e9
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.005785fa
push eax
mov edx, 0x5c2f88
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x844]
call fcn.004043ac
pop ecx
push eax
lea ecx, [ebp - 0x82c]
call fcn.00402048
push ebx
push 1
lea ecx, [ebp - 0x844]
call fcn.00403a16
push ebx
push 1
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 3
call fcn.00403a16
cmp dword [ebp - 0x818], 8
lea ecx, [ebp - 0x848]
lea eax, [ebp - 0x82c]
cmovae eax, dword [ebp - 0x82c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x5753b4
cmp dword [ebp - 0x818], 8
lea ecx, [ebp - 0x848]
lea eax, [ebp - 0x82c]
cmovae eax, dword [ebp - 0x82c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x575426
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84c], esp
push 0x5c3148
call fcn.004036c4
lea eax, [ebp - 0x844]
mov byte [ebp - 4], 8
push eax
xor ecx, ecx
call fcn.005786e9
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.005785fa
cmp dword [ebp - 0x830], 8
lea ecx, [ebp - 0x844]
mov eax, dword [ebp - 0x834]
cmovae ecx, dword [ebp - 0x844]
add eax, eax
push eax
push ecx
push 1
push ebx
push str.AppInstanceUid
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
push 1
lea ecx, [ebp - 0x844]
call fcn.00403a16
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84c], esp
push 0x5c2fd4
call fcn.004036c4
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x814], esp
push 0x5c2d2e
call fcn.004036c4
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
push str.UNINSTALL
call fcn.004036c4
mov dl, 1
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00571a9e
add esp, 0x48
lea ecx, [ebp - 0x82c]
push ebx
push 1
call fcn.00403a16
mov eax, esi
call fcn.00531c2d
ret