Function at 0x40a7c8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
push esi
push eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x74]
push str.SoftwareSysinternals_s
xor esi, esi
push eax
mov dword [ebp - 0x78], esi
call fcn.0044f3ea
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40a83d
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xa0]
push eax
push esi
push esi
push str.EulaAccepted
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp + 0xa0], esi
jne 0x40aac0
push ebx
push edi
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push str.Riched32.dll
lea edi, [esi + 0x12]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor eax, eax
mov word [esi + 0xa], ax
mov word [esi + 0xc], ax
mov eax, 0x138
mov word [esi + 0xe], ax
mov eax, 0xb4
mov word [esi + 0x10], ax
xor eax, eax
mov dword [esi], 0x80c808d0
mov word [esi + 8], ax
mov word [edi], ax
inc edi
inc edi
mov word [edi], ax
inc edi
inc edi
push str.License_Agreement
push edi
call fcn.0040a7a7
lea edi, [edi + eax*2]
push 8
pop eax
mov word [edi], ax
inc edi
inc edi
push str.MS_Shell_Dlg
push edi
call fcn.0040a7a7
lea eax, [edi + eax*2]
call fcn.0040a7a0
push 7
pop ecx
mov word [eax + 8], cx
push 3
pop ecx
mov word [eax + 0xa], cx
mov ecx, 0x12a
mov word [eax + 0xc], cx
push 0xe
pop ecx
mov word [eax + 0xe], cx
mov dword [eax], 0x50000000
lea edi, [eax + 0x12]
mov ecx, 0x1f6
mov word [eax + 0x10], cx
mov ebx, 0xffff
mov eax, ebx
mov word [edi], ax
inc edi
inc edi
mov eax, 0x82
mov word [edi], ax
inc edi
inc edi
push str.You_can_also_use_the__accepteula_command_line_switch_to_accept_the_EULA.
push edi
call fcn.0040a7a7
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.0040a7a0
mov ecx, 0xc9
mov word [eax + 8], cx
add ecx, 0xffffffd6
push 0x32
mov word [eax + 0xa], cx
pop ecx
push 0xe
mov word [eax + 0xc], cx
pop ecx
mov word [eax + 0xe], cx
xor ecx, ecx
inc ecx
mov word [eax + 0x10], cx
mov dword [eax], 0x50010000
lea edi, [eax + 0x12]
mov eax, ebx
mov word [edi], ax
inc edi
inc edi
lea eax, [ecx + 0x7f]
mov word [edi], ax
inc edi
inc edi
push str.Agree
push edi
call fcn.0040a7a7
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.0040a7a0
push 0x32
mov ecx, 0xff
mov word [eax + 8], cx
add ecx, 0xffffffa0
mov word [eax + 0xa], cx
pop ecx
mov word [eax + 0xc], cx
push 0xe
pop ecx
mov word [eax + 0xe], cx
push 2
pop ecx
mov word [eax + 0x10], cx
mov dword [eax], 0x50010000
lea edi, [eax + 0x12]
mov eax, ebx
mov word [edi], ax
inc edi
inc edi
lea eax, [ecx + 0x7e]
mov word [edi], ax
inc edi
inc edi
push str.Decline
push edi
call fcn.0040a7a7
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.0040a7a0
push 7
pop ecx
mov word [eax + 8], cx
push 0x32
mov ecx, 0x9f
mov word [eax + 0xa], cx
pop ecx
mov word [eax + 0xc], cx
push 0xe
pop ecx
mov word [eax + 0xe], cx
lea edi, [eax + 0x12]
mov ecx, 0x1f5
mov word [eax + 0x10], cx
mov dword [eax], 0x50010000
mov word [edi], bx
inc edi
inc edi
mov eax, 0x80
mov word [edi], ax
inc edi
inc edi
push str.Print
push edi
call fcn.0040a7a7
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.0040a7a0
push 7
pop ecx
mov word [eax + 8], cx
push 0xe
pop ecx
mov word [eax + 0xa], cx
mov ecx, 0x12a
mov word [eax + 0xc], cx
mov ecx, 0x8c
mov word [eax + 0xe], cx
lea edi, [eax + 0x12]
mov ecx, 0x1f4
push 0x48b168
push edi
mov word [eax + 0x10], cx
mov dword [eax], 0x50a11844
call fcn.0040a7a7
lea edi, [edi + eax*2]
push str.Decline
push edi
call fcn.0040a7a7
add esp, 0x40
push dword [ebp - 0x80]
xor ecx, ecx
mov word [edi + eax*2], cx
inc word [esi + 8]
push 0x40a665
xor edi, edi
push edi
push esi
push edi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push esi
mov dword [ebp + 0xa0], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0xa0], edi
pop edi
pop ebx
je 0x40aadb
push 4
lea eax, [ebp + 0xa0]
push eax
push 4
push 0
push str.EulaAccepted
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x90]
xor eax, eax
cmp dword [ebp + 0xa0], eax
pop esi
setne al
xor ecx, ebp
call fcn.0044f35b
add ebp, 0x94
leave
ret