Function at 0x140001aa0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x288
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, rcx
mov dword [rsp + 0x30], edx
mov r8, rcx
lea rdx, str.SoftwareSysinternals_s
lea rcx, [rsp + 0x40]
xor esi, esi
mov qword [rsp + 0x38], rsi
call fcn.140007ff8
cmp dword [rsp + 0x30], esi
jne 0x140001e4f
mov rcx, rbp
call fcn.140001340
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x140001e4f
call fcn.140001520
test eax, eax
je 0x140001b13
call fcn.1400019e0
mov dword [rsp + 0x30], eax
jmp 0x140001e49
call fcn.140002b40
test eax, eax
jne 0x140001ec6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x140001ec6
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + 0x280], rdi
mov qword [rsp + 0x278], r12
mov qword [rsp + 0x270], r13
mov edx, 0x3e8
mov ecx, 0x40
mov qword [rsp + 0x268], r14
mov qword [rsp + 0x260], r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea rcx, str.Riched32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.License_Agreement
lea rdx, [rdi + 0x16]
sub rdx, rcx
mov dword [rdi], 0x80c808d0
mov dword [rdi + 0xa], esi
mov qword [rdi + 0xe], 0xb40138
mov word [rdi + 8], si
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140001bb0
lea rcx, str.MS_Shell_Dlg
lea rdx, [rdi + 0x3c]
mov eax, 8
sub rdx, rcx
mov word [rdi + 0x3a], ax
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140001be0
mov ecx, 0x1f6
lea rax, [rdi + 0x59]
and rax, 0xfffffffffffffffc
lea r8, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
lea rdx, [r8 + 4]
mov dword [rax + 8], 0x30007
mov dword [rax + 0xc], 0xe012a
mov dword [rax], 0x50000000
mov dword [r8], 0x82ffff
sub rdx, rcx
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140001c30
mov word [r8 + 0x96], si
inc word [rdi + 8]
lea rax, [r8 + 0x9b]
and rax, 0xfffffffffffffffc
mov ecx, 1
lea r8, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.Agree
lea rdx, [r8 + 4]
mov dword [rax + 8], 0x9f00c9
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r8], 0x80ffff
sub rdx, rcx
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140001c90
mov word [r8 + 0x12], si
inc word [rdi + 8]
lea rax, [r8 + 0x17]
and rax, 0xfffffffffffffffc
lea rdx, str.Decline
mov ecx, 2
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
mov dword [rax + 8], 0x9f00ff
lea r8, [r9 + 4]
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r9], 0x80ffff
mov rcx, rdx
sub r8, rdx
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x140001cf0
mov r15, qword [rsp + 0x260]
mov r14, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x2b0]
mov word [r9 + 0x16], si
inc word [rdi + 8]
lea rax, [r9 + 0x1b]
and rax, 0xfffffffffffffffc
mov ecx, 0x1f5
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.Print
lea r8, [r9 + 4]
mov dword [rax + 8], 0x9f0007
mov dword [rax + 0xc], 0xe0032
mov dword [rax], 0x50010000
mov dword [r9], 0x80ffff
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x140001d70
mov r13, qword [rsp + 0x270]
mov r12, qword [rsp + 0x278]
mov word [r9 + 0x12], si
inc word [rdi + 8]
lea rax, [r9 + 0x17]
mov ecx, 0x1f4
and rax, 0xfffffffffffffffc
lea r9, [rax + 0x12]
mov word [rax + 0x10], cx
lea rcx, str.RICHEDIT
mov r8, r9
mov dword [rax + 8], 0xe0007
mov dword [rax + 0xc], 0x8c012a
sub r8, rcx
mov dword [rax], 0x50a11844
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x140001de0
lea rcx, [r9 + 0x12]
sub rcx, rdx
nop dword [rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x140001e00
mov word [r9 + 0x24], si
inc word [rdi + 8]
lea r9, section..text
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov rcx, rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x280]
cmp dword [rsp + 0x30], esi
je 0x140001ea6
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140001ea2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.EulaAccepted
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], esi
setne sil
mov eax, esi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008390
add rsp, 0x288
pop rsi
pop rbp
ret
call fcn.140001a60
int3