Function at 0x140002950
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x198
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, rcx
mov dword [rsp + 0x30], edx
mov r8, rcx
lea rdx, str.SoftwareSysinternals_s
lea rcx, [rsp + 0x50]
xor esi, esi
mov qword [rsp + 0x38], rsi
call fcn.140003560
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400029dd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.EulaAccepted
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x30], esi
jne 0x140002d41
call fcn.140002330
test eax, eax
je 0x1400029fe
call fcn.140002890
mov dword [rsp + 0x30], eax
jmp 0x140002d3d
call fcn.1400023f0
test eax, eax
jne 0x140002d9d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x140002d9d
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x188], r12
mov qword [rsp + 0x180], r13
mov edx, 0x3e8
mov ecx, 0x40
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x170], r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea rcx, str.Riched32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.License_Agreement
lea rdx, [rdi + 0x16]
sub rdx, rcx
mov dword [rdi], 0x80c808d0
mov dword [rdi + 0xa], esi
mov qword [rdi + 0xe], 0xb40138
mov word [rdi + 8], si
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140002aa0
lea rcx, str.MS_Shell_Dlg
lea rdx, [rdi + 0x3c]
mov eax, 8
sub rdx, rcx
mov word [rdi + 0x3a], ax
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140002ad0
mov ecx, 0x1f6
lea rax, [rdi + 0x59]
and rax, 0xfffffffffffffffc
lea r8, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
lea rdx, [r8 + 4]
mov dword [rax + 8], 0x30007
mov dword [rax + 0xc], 0xe012a
mov dword [rax], 0x50000000
mov dword [r8], 0x82ffff
sub rdx, rcx
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140002b20
mov word [r8 + 0x96], si
inc word [rdi + 8]
lea rax, [r8 + 0x9b]
and rax, 0xfffffffffffffffc
mov ecx, 1
lea r8, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.Agree
lea rdx, [r8 + 4]
mov dword [rax + 8], 0x9f00c9
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r8], 0x80ffff
sub rdx, rcx
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140002b80
mov word [r8 + 0x12], si
inc word [rdi + 8]
lea rax, [r8 + 0x17]
and rax, 0xfffffffffffffffc
lea rdx, str.Decline
mov ecx, 2
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
mov dword [rax + 8], 0x9f00ff
lea r8, [r9 + 4]
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r9], 0x80ffff
mov rcx, rdx
sub r8, rdx
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x140002be0
mov r15, qword [rsp + 0x170]
mov r14, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x1c0]
mov word [r9 + 0x16], si
inc word [rdi + 8]
lea rax, [r9 + 0x1b]
and rax, 0xfffffffffffffffc
mov ecx, 0x1f5
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.Print
lea r8, [r9 + 4]
mov dword [rax + 8], 0x9f0007
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r9], 0x80ffff
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x140002c60
mov r13, qword [rsp + 0x180]
mov r12, qword [rsp + 0x188]
mov word [r9 + 0x12], si
inc word [rdi + 8]
lea rax, [r9 + 0x17]
mov ecx, 0x1f4
and rax, 0xfffffffffffffffc
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.RICHEDIT
mov r8, r9
mov dword [rax + 8], 0xe0007
mov dword [rax + 0xc], 0x8c012a
sub r8, rcx
mov dword [rax], 0x50a11844
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x140002cd0
lea rcx, [r9 + 0x12]
sub rcx, rdx
nop dword [rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x140002cf0
mov word [r9 + 0x24], si
inc word [rdi + 8]
lea r9, [0x140001f40]
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x190]
test eax, eax
je 0x140002d6e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.EulaAccepted
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], esi
setne sil
mov eax, esi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140003990
add rsp, 0x198
pop rsi
pop rbp
ret
call fcn.140002910
int3