Function at 0x57543b
Capabilities:
Set registry value

Disassembly:
push 0x78
mov eax, 0x58da12
call fcn.00532017
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
call fcn.00571132
sub esp, 0x18
mov dword [0x5fe59c], 1
mov ecx, esp
mov dword [ebp - 0x38], esp
mov esi, str.sessioncode
push esi
call fcn.004036e4
and dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004036e4
xor ecx, ecx
mov byte [ebp - 4], 1
call fcn.005795a4
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00579433
or eax, 1
xor ecx, ecx
push eax
call fcn.005795a4
or edi, 0xffffffff
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0057935f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x5c6108
call fcn.004036e4
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
xor ecx, ecx
call fcn.005795a4
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.005794b5
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
mov edx, str.transactionid
push eax
call fcn.004043cc
pop ecx
mov ecx, 0x4b0
call fcn.00572b28
add esp, 0x18
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x30]
push 0
push 1
call fcn.00403a36
sub esp, 0x18
mov ecx, esp
push str.AREA_EVALUATEINSTALL
call fcn.004036e4
call fcn.00571e8b
add esp, 0x18
call fcn.00576ccc
mov esi, eax
test esi, esi
je 0x575541
mov dword [0x5fe59c], 2
jmp 0x575937
sub esp, 0x18
mov esi, str.sessioncode
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004036e4
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.004036e4
xor ecx, ecx
mov byte [ebp - 4], 5
call fcn.005795a4
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00579433
or eax, 2
xor ecx, ecx
push eax
call fcn.005795a4
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0057935f
sub esp, 0x18
mov dword [0x5fe59c], 3
mov ecx, esp
push str.AREA_GETSETTINGS
call fcn.004036e4
call fcn.00571e8b
add esp, 0x18
mov ecx, ebx
call fcn.0057682c
mov esi, eax
test esi, esi
je 0x5755d1
mov dword [0x5fe59c], 4
jmp 0x575937
sub esp, 0x18
mov dword [0x5fe59c], 0x15
mov ecx, esp
push str.AREA_WAITFORUSER
call fcn.004036e4
call fcn.00571e8b
add esp, 0x18
call fcn.00576475
mov esi, eax
test esi, esi
je 0x57560c
mov dword [0x5fe59c], 0x16
jmp 0x575937
sub esp, 0x18
mov dword [0x5fe59c], 5
mov ecx, esp
push str.AREA_PREINSTALL
call fcn.004036e4
call fcn.00571e8b
add esp, 0x18
call fcn.00575f47
mov esi, eax
test esi, esi
je 0x575647
mov dword [0x5fe59c], 6
jmp 0x575937
sub esp, 0x18
mov dword [0x5fe59c], 9
mov ecx, esp
push 0x5c4ffc
call fcn.004035e2
mov ecx, 0x4bb
call fcn.00572b28
mov ecx, esp
push str.AREA_DOWNLOAD
call fcn.004036e4
call fcn.00571e8b
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, str.askoffer
push esi
call fcn.004036e4
push 0
xor ecx, ecx
mov dword [ebp - 4], 6
call fcn.005795a4
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0057935f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004036e4
xor ecx, ecx
mov dword [ebp - 4], 7
call fcn.005795a4
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00579433
cmp eax, 1
jne 0x57576c
mov edx, 0x570084
lea ecx, [ebp - 0x38]
call fcn.00409693
mov esi, eax
mov dword [ebp - 4], 8
lea edi, [ebp - 0x2c]
xor eax, eax
lea ecx, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040adbf
mov eax, dword [esi]
and dword [esi], 0
mov dword [ebp - 0x2c], 0x5c6d24
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040af5e
cmp dword [ebp - 0x1c], 0
je 0x57572d
push 4
push dword [ebp - 0x1c]
call fcn.00531641
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.0040aebe
cmp dword [ebp - 0x38], 0
je 0x575747
push 4
push dword [ebp - 0x38]
call fcn.00531641
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xa
call fcn.004108b0
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp dword [ebp - 0x14], 0
setne al
test al, al
je 0x57576c
call fcn.0055589b
mov ecx, ebx
call fcn.0057661a
mov esi, eax
test esi, esi
je 0x575788
mov dword [0x5fe59c], 0xa
jmp 0x575937
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.askoffer
call fcn.004036e4
xor ecx, ecx
mov dword [ebp - 4], 0xb
call fcn.005795a4
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00579433
cmp eax, 1
jne 0x5758a8
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push 0x20006
sub esp, 0x18
mov dword [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.package
call fcn.004036e4
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 0xd
push eax
xor ecx, ecx
call fcn.005795a4
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.005794b5
mov esi, eax
push 0x5c5258
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xe
call fcn.004035e2
push esi
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x54]
call fcn.004051f9
pop ecx
cmp dword [eax + 0x14], 8
jb 0x575834
mov eax, dword [eax]
push eax
push SysReAllocString
lea ecx, [ebp - 0x24]
call fcn.004031a2
test eax, eax
lea ecx, [ebp - 0x54]
push 0
push 1
sete bl
call fcn.00403a36
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.00403a36
push 0
push 1
lea ecx, [ebp - 0x84]
call fcn.00403a36
test bl, bl
je 0x575899
push 4
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 1
push eax
push 4
push 0
push str.DoneDwl
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x24]
call fcn.0040321c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040321c
mov ebx, dword [ebp - 0x3c]
sub esp, 0x18
mov dword [0x5fe59c], 0xb
mov ecx, esp
push 0x5c4ffc
call fcn.004035e2
mov ecx, 0x4bc
call fcn.00572b28
mov ecx, esp
push str.AREA_INSTALL
call fcn.004036e4
call fcn.00571e8b
add esp, 0x18
mov ecx, ebx
call fcn.00576120
mov esi, eax
test esi, esi
je 0x5758f8
mov dword [0x5fe59c], 0xc
jmp 0x575937
sub esp, 0x18
mov dword [0x5fe59c], 0xf
mov ecx, esp
push str.AREA_POSTINSTALL
call fcn.004036e4
call fcn.00571e8b
add esp, 0x18
call fcn.00575c6f
mov esi, eax
test esi, esi
je 0x575930
mov dword [0x5fe59c], 0x10
jmp 0x575937
mov ecx, ebx
call fcn.005762cb
mov eax, esi
call fcn.00531fc1
ret