Function at 0x140002350
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x188
mov rax, qword [0x140064198]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rcx
mov dword [rsp + 0x30], edx
mov r8, rcx
lea rdx, str.SoftwareSysinternals_s
xor esi, esi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rsi
call fcn.140002910
cmp dword [rsp + 0x30], esi
jne 0x140002682
mov rcx, rbp
call fcn.140001c10
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x140002682
call fcn.140001d40
test eax, eax
je 0x1400023c3
call fcn.140002290
mov dword [rsp + 0x30], eax
jmp 0x14000267c
call fcn.140001e00
test eax, eax
jne 0x1400026f9
call fcn.140001ea0
test eax, eax
jne 0x1400026f9
mov qword [rsp + 0x1b0], rbx
lea ecx, [rax + 0x40]
mov qword [rsp + 0x180], rdi
mov edx, 0x3e8
mov qword [rsp + 0x178], r12
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x168], r14
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14d, 1
lea rcx, str.Riched32.dll
mov edx, r14d
mov rdi, rax
lea rbx, [rax + 0x12]
call fcn.140002ac0
mov dword [rdi], 0x80c808d0
lea rdx, str.License_Agreement
mov dword [rdi + 0xa], esi
mov dword [rdi + 0xe], 0xb40138
mov word [rdi + 8], si
mov dword [rbx], esi
add rbx, 4
mov rcx, rbx
call fcn.140001880
movsxd rcx, eax
lea rdx, str.MS_Shell_Dlg
lea r9, [rbx + rcx*2]
mov eax, 8
mov word [r9], ax
add r9, 2
mov rcx, r9
call fcn.140001880
movsxd rcx, eax
lea rcx, [r9 + rcx*2]
call fcn.140001870
lea r9, [rax + 0x12]
mov ecx, 0x1f6
lea rdx, str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
mov word [rax + 0x10], cx
lea rcx, [r9 + 4]
mov dword [rax + 8], 0x30007
mov dword [rax + 0xc], 0xe012a
mov dword [rax], 0x50000000
mov dword [r9], 0x82ffff
call fcn.140001880
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001870
lea r9, [rax + 0x12]
lea rcx, [r9 + 4]
lea rdx, str.Agree
mov dword [rax + 8], 0x9f00c9
mov dword [rax + 0xc], 0xe0032
mov word [rax + 0x10], r14w
mov dword [rax], 0x50010000
mov dword [r9], 0x80ffff
call fcn.140001880
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001870
lea r9, [rax + 0x12]
mov ecx, 2
lea rdx, str.Decline
mov word [rax + 0x10], cx
lea rcx, [r9 + 4]
mov dword [rax + 8], 0x9f00ff
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r9], 0x80ffff
call fcn.140001880
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001870
lea r9, [rax + 0x12]
mov ecx, 0x1f5
lea rdx, str.Print
mov word [rax + 0x10], cx
lea rcx, [r9 + 4]
mov dword [rax + 8], 0x9f0007
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r9], 0x80ffff
call fcn.140001880
movsxd rcx, eax
lea r9, [r9 + 6]
mov word [r9 + rcx*2 - 2], si
lea rcx, [r9 + rcx*2]
inc word [rdi + 8]
call fcn.140001870
mov ecx, 0x1f4
lea rdx, str.RICHEDIT
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
mov rcx, r9
mov dword [rax + 8], 0xe0007
mov dword [rax + 0xc], 0x8c012a
mov dword [rax], 0x50a11844
call fcn.140001880
movsxd rcx, eax
lea rdx, str.Decline
lea r10, [r9 + rcx*2]
mov rcx, r10
call fcn.140001880
movsxd rcx, eax
lea r9, [0x1400018c0]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov word [r10 + rcx*2], si
xor ecx, ecx
inc word [rdi + 8]
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov r13, qword [rsp + 0x170]
mov r12, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x1b0]
cmp dword [rsp + 0x30], esi
je 0x1400026d9
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400026d5
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
lea rdx, str.EulaAccepted
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], esi
setne sil
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140002da0
add rsp, 0x188
pop rsi
pop rbp
ret
call fcn.140002310
int3