Function at 0x406290
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x5c4fc8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x59f610
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], edx
push str.SoftwareSysinternals_s
push eax
mov dword [ebp - 0x42c], 0
call fcn.00405d20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
cmp dword [ebp - 0x418], 0
jne 0x40667e
call fcn.00406930
mov dword [ebp - 0x418], eax
test eax, eax
jne 0x40667e
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor esi, esi
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x428]
push eax
push str.SoftwareMicrosoftwindows_ntcurrentversion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x420], 0x208
mov dword [ebp - 0x41c], esi
call edi
test eax, eax
jne 0x4063e7
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
push 0x5a5f24
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406377
lea eax, [ebp - 0x20c]
push eax
push str.iotuap
call fcn.0054748e
add esp, 8
test eax, eax
mov eax, 1
cmove esi, eax
push dword [ebp - 0x428]
call ebx
test esi, esi
je 0x4063e7
push str.SYSINTERNALS_SOFTWARE_LICENSE_TERMS_nThese_license_terms_are_an_agreement_between_Sysinternals_a_wholly_owned_subsidiary_of_Microsoft_Corporation__and_you.Please_read_them.They_apply_to_the_software_you_are_downloading_from_technet.microsoft.com___sysinternals__which_includes_the_media_on_which_you_received_it__if_any.The_terms_also_apply_to_any_Sysinternals_n_updates__nsupplements__nInternet___based_services__nand_support_services_nfor_this_software__unless_other_terms_accompany_those_items.If_so__those_terms_apply._nBY_USING_THE_SOFTWARE__YOU_ACCEPT_THESE_TERMS.IF_YOU_DO_NOT_ACCEPT_THEM__DO_NOT_USE_THE_SOFTWARE._n_nIf_you_comply_with_these_license_terms__you_have_the_rights_below._nINSTALLATION_AND_USER_RIGHTS_nYou_may_install_and_use_any_number_of_copies_of_the_software_on_your_devices._n_nSCOPE_OF_LICENSE_nThe_software_is_licensed__not_sold.This_agreement_only_gives_you_some_rights_to_use_the_software.Sysinternals_reserves_all_other_rights.Unless_applicable_law_gives_you_more_rights_despite_this_limitation__you_may_use_the_software_only_as_expressly_permitted_in_this_agreement.In_doing_so__you_must_comply_with_any_technical_limitations_in_the_software_that_only_allow_you_to_use_it_in_certain_ways.You_may_not_n_work_around_any_technical_limitations_in_the_software__nreverse_engineer__decompile_or_disassemble_the_software__except_and_only_to_the_extent_that_applicable_law_expressly_permits__despite_this_limitation__nmake_more_copies_of_the_software_than_specified_in_this_agreement_or_allowed_by_applicable_law__despite_this_limitation__npublish_the_software_for_others_to_copy__nrent__lease_or_lend_the_software__ntransfer_the_software_or_this_agreement_to_any_third_party__or_n_use_the_software_for_commercial_software_hosting_services._n_nSENSITIVE_INFORMATION_nPlease_be_aware_that__similar_to_other_debug_tools_that_capture
xor edi, edi
xor esi, esi
call fcn.00405cc0
add esp, 4
push str.Accept_Eula__Y_N__
call fcn.00405d50
call fcn.00547623
mov bl, al
movsx eax, bl
push eax
push 0x5a6000
call fcn.00405d50
add esp, 0xc
cmp bl, 0x79
je 0x4063c0
cmp bl, 0x59
jne 0x4063c7
mov edi, 1
mov esi, edi
cmp bl, 0x6e
je 0x4063d6
cmp bl, 0x4e
je 0x4063d6
cmp esi, 1
jne 0x406394
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x418], edi
jmp 0x406673
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
xor esi, esi
mov dword [ebp - 0x420], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x424], 4
mov dword [ebp - 0x41c], esi
call edi
test eax, eax
jne 0x406477
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
push str.NanoServer
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406467
cmp dword [ebp - 0x41c], 4
jne 0x406467
cmp dword [ebp - 0x420], 1
mov eax, 1
cmove esi, eax
push dword [ebp - 0x428]
call ebx
test esi, esi
jne 0x4066db
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x4066db
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push str.Riched32.dll
lea esi, [edi + 0x12]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
mov dword [edi], 0x80c808d0
mov dword [edi + 0xa], eax
mov edx, str.License_Agreement
mov dword [edi + 0xe], 0xb40138
mov word [edi + 8], ax
mov dword [esi], eax
add esi, 4
mov ecx, esi
call fcn.00406250
mov edx, 0x5a5d50
lea esi, [esi + eax*2]
mov eax, 8
mov word [esi], ax
add esi, 2
mov ecx, esi
call fcn.00406250
mov edx, str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
lea esi, [esi + eax*2]
mov eax, 0x82
add esi, 3
and esi, 0xfffffffc
mov dword [esi + 8], 0x30007
mov dword [esi + 0xc], 0xe012a
mov dword [esi + 0x10], 0xffff01f6
mov dword [esi], 0x50000000
mov word [esi + 0x14], ax
add esi, 0x16
mov ecx, esi
call fcn.00406250
xor ecx, ecx
mov edx, str.Agree
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
mov dword [esi + 8], 0x9f00c9
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff0001
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
mov ecx, esi
call fcn.00406250
xor ecx, ecx
mov edx, str.Decline
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
mov dword [esi + 8], 0x9f00ff
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff0002
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
mov ecx, esi
call fcn.00406250
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
mov dword [esi + 8], 0x9f0007
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff01f5
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
mov edx, str.Print
mov ecx, esi
call fcn.00406250
xor ecx, ecx
mov edx, str.RICHEDIT
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x1f4
and esi, 0xfffffffc
mov dword [esi + 8], 0xe0007
mov dword [esi + 0xc], 0x8c012a
mov word [esi + 0x10], ax
mov dword [esi], 0x50a11844
add esi, 0x12
mov ecx, esi
call fcn.00406250
mov edx, str.Decline
lea esi, [esi + eax*2]
mov ecx, esi
call fcn.00406250
push 0x59f610
xor ecx, ecx
push 0x406040
push ecx
push edi
mov word [esi + eax*2], cx
inc word [edi + 8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push edi
mov dword [ebp - 0x418], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x418], 0
pop edi
pop esi
je 0x4066c1
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x414]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4066c1
push 4
lea eax, [ebp - 0x418]
push eax
push 4
push 0
push str.EulaAccepted
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x42c]
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x418], eax
pop ebx
setne al
xor ecx, ebp
call fcn.0053e7e5
mov esp, ebp
pop ebp
ret
call fcn.00406870
int3