Function at 0x41e7f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x46d45c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
push str.SoftwareSysinternals_s
lea ecx, [ebp - 0x218]
push ecx
call fcn.00438ac1
add esp, 0xc
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x218]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41e85e
mov dword [ebp - 4], 4
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp + 0xc]
push edx
push 0
push 0
push 0x46bde4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0xc], 0
jne 0x41eebf
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x12
mov dword [ebp - 0x21c], ecx
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 0x220]
mov dword [edx], 0x80c808d0
xor eax, eax
mov ecx, dword [ebp - 0x220]
mov word [ecx + 0xa], ax
xor edx, edx
mov eax, dword [ebp - 0x220]
mov word [eax + 0xc], dx
mov ecx, 0x138
mov edx, dword [ebp - 0x220]
mov word [edx + 0xe], cx
mov eax, 0xb4
mov ecx, dword [ebp - 0x220]
mov word [ecx + 0x10], ax
xor edx, edx
mov eax, dword [ebp - 0x220]
mov word [eax + 8], dx
xor ecx, ecx
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
push str.License_Agreement
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0041f310
add esp, 8
mov edx, dword [ebp - 0x21c]
lea eax, [edx + eax*2]
mov dword [ebp - 0x21c], eax
mov ecx, 8
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
push 0x46be40
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0041f310
add esp, 8
mov edx, dword [ebp - 0x21c]
lea eax, [edx + eax*2]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0041f300
add esp, 4
mov dword [ebp - 0x224], eax
mov edx, 7
mov eax, dword [ebp - 0x224]
mov word [eax + 8], dx
mov ecx, 3
mov edx, dword [ebp - 0x224]
mov word [edx + 0xa], cx
mov eax, 0x12a
mov ecx, dword [ebp - 0x224]
mov word [ecx + 0xc], ax
mov edx, 0xe
mov eax, dword [ebp - 0x224]
mov word [eax + 0xe], dx
mov ecx, 0x1f6
mov edx, dword [ebp - 0x224]
mov word [edx + 0x10], cx
mov eax, dword [ebp - 0x224]
mov dword [eax], 0x50000000
mov ecx, dword [ebp - 0x224]
add ecx, 0x12
mov dword [ebp - 0x21c], ecx
mov edx, 0xffff
mov eax, dword [ebp - 0x21c]
mov word [eax], dx
mov ecx, dword [ebp - 0x21c]
add ecx, 2
mov dword [ebp - 0x21c], ecx
mov edx, 0x82
mov eax, dword [ebp - 0x21c]
mov word [eax], dx
mov ecx, dword [ebp - 0x21c]
add ecx, 2
mov dword [ebp - 0x21c], ecx
push str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0041f310
add esp, 8
mov ecx, dword [ebp - 0x21c]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x21c], edx
xor eax, eax
mov ecx, dword [ebp - 0x21c]
mov word [ecx], ax
mov edx, dword [ebp - 0x21c]
add edx, 2
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x220]
mov cx, word [eax + 8]
add cx, 1
mov edx, dword [ebp - 0x220]
mov word [edx + 8], cx
mov eax, dword [ebp - 0x21c]
push eax
call fcn.0041f300
add esp, 4
mov dword [ebp - 0x224], eax
mov ecx, 0xc9
mov edx, dword [ebp - 0x224]
mov word [edx + 8], cx
mov eax, 0x9f
mov ecx, dword [ebp - 0x224]
mov word [ecx + 0xa], ax
mov edx, 0x32
mov eax, dword [ebp - 0x224]
mov word [eax + 0xc], dx
mov ecx, 0xe
mov edx, dword [ebp - 0x224]
mov word [edx + 0xe], cx
mov eax, 1
mov ecx, dword [ebp - 0x224]
mov word [ecx + 0x10], ax
mov edx, dword [ebp - 0x224]
mov dword [edx], 0x50010000
mov eax, dword [ebp - 0x224]
add eax, 0x12
mov dword [ebp - 0x21c], eax
mov ecx, 0xffff
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
mov ecx, 0x80
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
push str.Agree
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0041f310
add esp, 8
mov edx, dword [ebp - 0x21c]
lea eax, [edx + eax*2]
mov dword [ebp - 0x21c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x220]
mov dx, word [ecx + 8]
add dx, 1
mov eax, dword [ebp - 0x220]
mov word [eax + 8], dx
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0041f300
add esp, 4
mov dword [ebp - 0x224], eax
mov edx, 0xff
mov eax, dword [ebp - 0x224]
mov word [eax + 8], dx
mov ecx, 0x9f
mov edx, dword [ebp - 0x224]
mov word [edx + 0xa], cx
mov eax, 0x32
mov ecx, dword [ebp - 0x224]
mov word [ecx + 0xc], ax
mov edx, 0xe
mov eax, dword [ebp - 0x224]
mov word [eax + 0xe], dx
mov ecx, 2
mov edx, dword [ebp - 0x224]
mov word [edx + 0x10], cx
mov eax, dword [ebp - 0x224]
mov dword [eax], 0x50010000
mov ecx, dword [ebp - 0x224]
add ecx, 0x12
mov dword [ebp - 0x21c], ecx
mov edx, 0xffff
mov eax, dword [ebp - 0x21c]
mov word [eax], dx
mov ecx, dword [ebp - 0x21c]
add ecx, 2
mov dword [ebp - 0x21c], ecx
mov edx, 0x80
mov eax, dword [ebp - 0x21c]
mov word [eax], dx
mov ecx, dword [ebp - 0x21c]
add ecx, 2
mov dword [ebp - 0x21c], ecx
push 0x46bf04
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0041f310
add esp, 8
mov ecx, dword [ebp - 0x21c]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x21c], edx
xor eax, eax
mov ecx, dword [ebp - 0x21c]
mov word [ecx], ax
mov edx, dword [ebp - 0x21c]
add edx, 2
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x220]
mov cx, word [eax + 8]
add cx, 1
mov edx, dword [ebp - 0x220]
mov word [edx + 8], cx
mov eax, dword [ebp - 0x21c]
push eax
call fcn.0041f300
add esp, 4
mov dword [ebp - 0x224], eax
mov ecx, 7
mov edx, dword [ebp - 0x224]
mov word [edx + 8], cx
mov eax, 0x9f
mov ecx, dword [ebp - 0x224]
mov word [ecx + 0xa], ax
mov edx, 0x32
mov eax, dword [ebp - 0x224]
mov word [eax + 0xc], dx
mov ecx, 0xe
mov edx, dword [ebp - 0x224]
mov word [edx + 0xe], cx
mov eax, 0x1f5
mov ecx, dword [ebp - 0x224]
mov word [ecx + 0x10], ax
mov edx, dword [ebp - 0x224]
mov dword [edx], 0x50010000
mov eax, dword [ebp - 0x224]
add eax, 0x12
mov dword [ebp - 0x21c], eax
mov ecx, 0xffff
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
mov ecx, 0x80
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
push str.Print
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0041f310
add esp, 8
mov edx, dword [ebp - 0x21c]
lea eax, [edx + eax*2]
mov dword [ebp - 0x21c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x21c]
mov word [edx], cx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x220]
mov dx, word [ecx + 8]
add dx, 1
mov eax, dword [ebp - 0x220]
mov word [eax + 8], dx
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0041f300
add esp, 4
mov dword [ebp - 0x224], eax
mov edx, 7
mov eax, dword [ebp - 0x224]
mov word [eax + 8], dx
mov ecx, 0xe
mov edx, dword [ebp - 0x224]
mov word [edx + 0xa], cx
mov eax, 0x12a
mov ecx, dword [ebp - 0x224]
mov word [ecx + 0xc], ax
mov edx, 0x8c
mov eax, dword [ebp - 0x224]
mov word [eax + 0xe], dx
mov ecx, 0x1f4
mov edx, dword [ebp - 0x224]
mov word [edx + 0x10], cx
mov eax, dword [ebp - 0x224]
mov dword [eax], 0x50a11844
mov ecx, dword [ebp - 0x224]
add ecx, 0x12
mov dword [ebp - 0x21c], ecx
push str.RICHEDIT
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0041f310
add esp, 8
mov ecx, dword [ebp - 0x21c]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x21c], edx
push str.Decline
mov eax, dword [ebp - 0x21c]
push eax
call fcn.0041f310
add esp, 8
mov ecx, dword [ebp - 0x21c]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x21c], edx
xor eax, eax
mov ecx, dword [ebp - 0x21c]
mov word [ecx], ax
mov edx, dword [ebp - 0x21c]
add edx, 2
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x220]
mov cx, word [eax + 8]
add cx, 1
mov edx, dword [ebp - 0x220]
mov word [edx + 8], cx
mov eax, dword [ebp + 8]
push eax
push 0x41ef00
push 0
mov ecx, dword [ebp - 0x220]
push ecx
push 0
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0xc], 0
je 0x41eede
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push str.EulaAccepted
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004376f1
mov esp, ebp
pop ebp
ret