Function at 0x401f40
Capabilities:
Accept command line arguments
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x433368]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x218], eax
xor eax, eax
mov dword [ebp - 0x210], eax
test edi, edi
je 0x401f75
test ebx, ebx
jne 0x401fa3
push str.CommandLineToArgvW
push str.Shell32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402002
mov edi, 0x4343e0
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
call esi
mov ebx, eax
xor esi, esi
cmp dword [edi], esi
jle 0x402002
xor eax, eax
mov dword [ebp - 0x210], eax
push 0x42b520
push dword [ebx + esi*4]
call fcn.00405ac5
add esp, 8
test eax, eax
je 0x401fe0
push str._accepteula
push dword [ebx + esi*4]
call fcn.00405ac5
add esp, 8
test eax, eax
je 0x401fe0
inc esi
cmp esi, dword [edi]
jl 0x401fb1
jmp 0x402002
mov eax, dword [edi]
dec eax
mov dword [ebp - 0x210], 1
cmp esi, eax
jge 0x402000
mov eax, dword [ebx + esi*4 + 4]
mov dword [ebx + esi*4], eax
inc esi
mov eax, dword [edi]
dec eax
cmp esi, eax
jl 0x401ff1
dec dword [edi]
push dword [ebp - 0x218]
mov ebx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push str.SoftwareSysinternals_s
push eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], 0
call fcn.00406654
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40207c
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 4
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push str.EulaAccepted
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x214], 0
mov esi, 1
jne 0x40233a
call fcn.00401780
test eax, eax
je 0x4020a7
call fcn.00401bc0
mov dword [ebp - 0x214], eax
jmp 0x402336
call fcn.00401840
test eax, eax
jne 0x402386
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 3
je 0x402386
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
push str.Riched32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
xor eax, eax
mov dword [edi], 0x80c808d0
mov ecx, str.License_Agreement
mov dword [edi + 0xa], eax
lea edx, [edi + 0x16]
mov dword [edi + 0xe], 0xb40138
mov word [edi + 8], ax
sub edx, ecx
mov dword [edi + 0x12], eax
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402110
mov eax, 8
lea edx, [edi + 0x3c]
mov ecx, str.MS_Shell_Dlg
mov word [edi + 0x3a], ax
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402133
lea eax, [edi + 0x59]
mov ecx, 0x1f6
and eax, 0xfffffffc
lea esi, [eax + 0x12]
lea edx, [esi + 4]
mov word [eax + 0x10], cx
mov ecx, str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
mov dword [eax + 8], 0x30007
sub edx, ecx
mov dword [eax + 0xc], 0xe012a
mov dword [eax], 0x50000000
mov dword [esi], 0x82ffff
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402180
xor eax, eax
mov ecx, 1
mov word [esi + 0x96], ax
lea eax, [esi + 0x9b]
inc word [edi + 8]
and eax, 0xfffffffc
lea esi, [eax + 0x12]
lea edx, [esi + 4]
mov word [eax + 0x10], cx
mov ecx, str.Agree
mov dword [eax + 8], 0x9f00c9
sub edx, ecx
mov dword [eax + 0xc], 0xe0032
mov dword [eax], 0x50010000
mov dword [esi], 0x80ffff
jmp 0x4021e0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4021e0
xor eax, eax
mov ecx, 2
mov word [esi + 0x12], ax
lea eax, [esi + 0x17]
inc word [edi + 8]
and eax, 0xfffffffc
lea esi, [eax + 0x12]
lea edx, [esi + 4]
mov word [eax + 0x10], cx
mov ecx, str.Decline
mov dword [eax + 8], 0x9f00ff
sub edx, ecx
mov dword [eax + 0xc], 0xe0032
mov dword [eax], 0x50010000
mov dword [esi], 0x80ffff
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402230
xor eax, eax
mov ecx, 0x1f5
mov word [esi + 0x16], ax
lea eax, [esi + 0x1b]
inc word [edi + 8]
and eax, 0xfffffffc
lea esi, [eax + 0x12]
lea edx, [esi + 4]
mov word [eax + 0x10], cx
mov ecx, str.Print
mov dword [eax + 8], 0x9f0007
sub edx, ecx
mov dword [eax + 0xc], 0xe0032
mov dword [eax], 0x50010000
mov dword [esi], 0x80ffff
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402280
xor eax, eax
mov ecx, 0x1f4
mov word [esi + 0x12], ax
lea eax, [esi + 0x17]
inc word [edi + 8]
and eax, 0xfffffffc
lea esi, [eax + 0x12]
mov word [eax + 0x10], cx
mov ecx, str.RICHEDIT
mov dword [eax + 8], 0xe0007
mov edx, esi
mov dword [eax + 0xc], 0x8c012a
mov dword [eax], 0x50a11844
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4022d0
mov ecx, str.Decline
lea edx, [esi + 0x12]
sub edx, ecx
lea ebx, [ebx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4022f0
push dword [ebp - 0x218]
xor eax, eax
push 0x401420
push eax
push edi
mov word [esi + 0x24], ax
inc word [edi + 8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push edi
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, dword [ebp - 0x214]
mov esi, 1
test eax, eax
je 0x402358
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push 0
push str.EulaAccepted
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], 0
mov ecx, dword [ebp - 4]
cmovne ebx, esi
xor eax, eax
test ebx, ebx
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00405d02
mov esp, ebp
pop ebp
ret
call fcn.00401c20
int3