Function at 0x4b7140
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x58e5a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push esi
push str.SoftwareSysinternals_s
push 0x104
push eax
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x424], 0
call fcn.00449c20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x4b751f
push esi
call fcn.004b6aa0
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x4b751f
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push edi
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x418]
push eax
push str.SoftwareMicrosoftwindows_ntcurrentversion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x420], 0x208
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b729a
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push 0x54bb4c
push dword [ebp - 0x418]
call edi
test eax, eax
jne 0x4b7292
lea eax, [ebp - 0x20c]
push eax
push str.iotuap
call fcn.004fb9d0
add esp, 8
test eax, eax
jne 0x4b7292
push dword [ebp - 0x418]
call ebx
push dword [0x58e57c]
xor edi, edi
xor esi, esi
call fcn.004b76a0
add esp, 4
push str.Accept_Eula__Y_N__
call fcn.0042c040
call fcn.004ffba3
mov bl, al
movsx eax, bl
push eax
push 0x54bc28
call fcn.0042c040
add esp, 0xc
cmp bl, 0x79
je 0x4b726e
cmp bl, 0x59
jne 0x4b7275
mov edi, 1
mov esi, edi
cmp bl, 0x6e
je 0x4b7284
cmp bl, 0x4e
je 0x4b7284
cmp esi, 1
jne 0x4b7242
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x4b7518
push dword [ebp - 0x418]
call ebx
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x428], 4
mov dword [ebp - 0x41c], 0
call esi
test eax, eax
jne 0x4b731f
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push str.NanoServer
push dword [ebp - 0x418]
call edi
test eax, eax
jne 0x4b7317
cmp dword [ebp - 0x41c], 4
jne 0x4b7317
cmp dword [ebp - 0x420], 1
je 0x4b7577
push dword [ebp - 0x418]
call ebx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x4b757f
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push 1
push str.Riched32.dll
lea esi, [edi + 0x12]
call fcn.004b65f0
xor eax, eax
mov dword [edi], 0x80c808d0
mov dword [edi + 0xa], eax
mov dword [edi + 0xe], 0xb40138
mov word [edi + 8], ax
mov dword [esi], eax
add esi, 4
push str.License_Agreement
push esi
call fcn.004b66b0
push 0x54b978
lea esi, [esi + eax*2]
mov eax, 8
mov word [esi], ax
add esi, 2
push esi
call fcn.004b66b0
push str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
lea esi, [esi + eax*2]
mov eax, 0x82
add esi, 3
and esi, 0xfffffffc
mov dword [esi + 8], 0x30007
mov dword [esi + 0xc], 0xe012a
mov dword [esi + 0x10], 0xffff01f6
mov dword [esi], 0x50000000
mov word [esi + 0x14], ax
add esi, 0x16
push esi
call fcn.004b66b0
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
push str.Agree
mov dword [esi + 8], 0x9f00c9
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff0001
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
push esi
call fcn.004b66b0
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
push str.Decline
mov dword [esi + 8], 0x9f00ff
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff0002
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
push esi
call fcn.004b66b0
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
mov dword [esi + 8], 0x9f0007
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff01f5
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
push str.Print
push esi
call fcn.004b66b0
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x1f4
and esi, 0xfffffffc
push str.RICHEDIT
mov dword [esi + 8], 0xe0007
mov dword [esi + 0xc], 0x8c012a
mov word [esi + 0x10], ax
mov dword [esi], 0x50a11844
add esi, 0x12
push esi
call fcn.004b66b0
add esp, 0x40
lea esi, [esi + eax*2]
push str.Decline
push esi
call fcn.004b66b0
add esp, 8
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x42c]
inc word [edi + 8]
push 0x4b6700
push ecx
push edi
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0xc], 0
pop edi
je 0x4b755f
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4b755f
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push str.EulaAccepted
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x424]
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp + 0xc], eax
pop esi
setne al
xor ecx, ebp
pop ebx
call fcn.004d2a60
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x418]
call ebx
call fcn.004b7110
int3