Function at 0x140001930
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x188
mov rax, qword [0x14003a2a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rcx
mov dword [rsp + 0x30], edx
mov r9, rcx
lea r8, str.SoftwareSysinternals_s
xor esi, esi
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov qword [rsp + 0x38], rsi
call fcn.140001ef0
cmp dword [rsp + 0x30], esi
jne 0x140001c67
mov rcx, rbp
call fcn.140001370
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x140001c67
call fcn.140001430
test eax, eax
je 0x1400019a8
call fcn.140001870
mov dword [rsp + 0x30], eax
jmp 0x140001c61
call fcn.1400014f0
test eax, eax
jne 0x140001cde
call fcn.140001590
test eax, eax
jne 0x140001cde
mov qword [rsp + 0x1b0], rbx
lea ecx, [rax + 0x40]
mov qword [rsp + 0x180], rdi
mov edx, 0x3e8
mov qword [rsp + 0x178], r12
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x168], r14
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14d, 1
lea rcx, str.Riched32.dll
mov edx, r14d
mov rdi, rax
lea rbx, [rax + 0x12]
call fcn.1400020c0
mov dword [rdi], 0x80c808d0
lea rdx, str.License_Agreement
mov dword [rdi + 0xa], esi
mov dword [rdi + 0xe], 0xb40138
mov word [rdi + 8], si
mov dword [rbx], esi
add rbx, 4
mov rcx, rbx
call fcn.140001020
movsxd rcx, eax
lea rdx, [0x14002c728]
lea r9, [rbx + rcx*2]
mov eax, 8
mov word [r9], ax
add r9, 2
mov rcx, r9
call fcn.140001020
movsxd rcx, eax
lea rcx, [r9 + rcx*2]
call fcn.140001010
lea r9, [rax + 0x12]
mov ecx, 0x1f6
lea rdx, str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
mov dword [r9], 0x82ffff
mov word [rax + 0x10], cx
lea rcx, [r9 + 4]
mov dword [rax + 8], 0x30007
mov dword [rax + 0xc], 0xe012a
mov dword [rax], 0x50000000
call fcn.140001020
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001010
lea r9, [rax + 0x12]
lea rcx, [r9 + 4]
mov dword [r9], 0x80ffff
lea rdx, str.Agree
mov dword [rax + 8], 0x9f00c9
mov dword [rax + 0xc], 0xe0032
mov word [rax + 0x10], r14w
mov dword [rax], 0x50010000
call fcn.140001020
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001010
lea r9, [rax + 0x12]
mov ecx, 2
lea rdx, str.Decline
mov dword [r9], 0x80ffff
mov word [rax + 0x10], cx
lea rcx, [r9 + 4]
mov dword [rax + 8], 0x9f00ff
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
call fcn.140001020
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001010
lea r9, [rax + 0x12]
mov ecx, 0x1f5
lea rdx, str.Print
mov dword [r9], 0x80ffff
mov word [rax + 0x10], cx
lea rcx, [r9 + 4]
mov dword [rax + 8], 0x9f0007
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
call fcn.140001020
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001010
mov ecx, 0x1f4
lea rdx, str.RICHEDIT
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
mov rcx, r9
mov dword [rax + 8], 0xe0007
mov dword [rax + 0xc], 0x8c012a
mov dword [rax], 0x50a11844
call fcn.140001020
movsxd rcx, eax
lea rdx, str.Decline
lea r10, [r9 + rcx*2]
mov rcx, r10
call fcn.140001020
movsxd rcx, eax
lea r9, [0x140001060]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov word [r10 + rcx*2], si
xor ecx, ecx
inc word [rdi + 8]
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov r13, qword [rsp + 0x170]
mov r12, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x1b0]
cmp dword [rsp + 0x30], esi
je 0x140001cbe
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140001cba
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
lea rdx, str.EulaAccepted
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], esi
setne sil
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400045d0
add rsp, 0x188
pop rsi
pop rbp
ret
call fcn.1400018f0
int3