Function at 0x642680
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [esp + 0x218]
push ebx
push eax
lea ecx, [esp + 0x14]
xor ebx, ebx
push str.SoftwareSysinternals_s
push ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
call fcn.0064342f
add esp, 0xc
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x6426e8
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
lea edx, [esp + 4]
push ecx
push edx
push ebx
push ebx
push str.EulaAccepted
push eax
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 4], ebx
jne 0x6428f1
push esi
push edi
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push str.Riched32.dll
lea edi, [esi + 0x12]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], 0x80c808d0
mov word [esi + 0xa], bx
mov word [esi + 0xc], bx
mov word [esi + 0xe], 0x138
mov word [esi + 0x10], 0xb4
mov word [esi + 8], 4
mov word [edi], bx
add edi, 2
push str.License_Agreement
mov word [edi], bx
add edi, 2
push edi
call fcn.00642cc0
lea edi, [edi + eax*2]
push str.MS_Shell_Dlg
mov word [edi], 8
add edi, 2
push edi
call fcn.00642cc0
lea eax, [edi + eax*2]
push eax
call fcn.00642cb0
lea edi, [eax + 0x12]
mov word [eax + 8], 0xc9
mov word [eax + 0xa], 0x9f
mov word [eax + 0xc], 0x32
mov word [eax + 0xe], 0xe
mov word [eax + 0x10], 1
mov dword [eax], 0x50010000
mov word [edi], 0xffff
add edi, 2
push str.Agree
mov word [edi], 0x80
add edi, 2
push edi
call fcn.00642cc0
lea eax, [edi + eax*2]
mov word [eax], bx
add eax, 2
push eax
call fcn.00642cb0
lea edi, [eax + 0x12]
mov word [eax + 8], 0xff
mov word [eax + 0xa], 0x9f
mov word [eax + 0xc], 0x32
mov word [eax + 0xe], 0xe
mov word [eax + 0x10], 2
mov dword [eax], 0x50010000
mov word [edi], 0xffff
add edi, 2
push str.Decline
mov word [edi], 0x80
add edi, 2
push edi
call fcn.00642cc0
lea eax, [edi + eax*2]
mov word [eax], bx
add eax, 2
push eax
call fcn.00642cb0
mov ebx, 7
lea edi, [eax + 0x12]
mov word [eax + 8], bx
mov word [eax + 0xa], 0x9f
mov word [eax + 0xc], 0x32
mov word [eax + 0xe], 0xe
mov word [eax + 0x10], 0x1f5
mov dword [eax], 0x50010000
mov word [edi], 0xffff
add edi, 2
mov word [edi], 0x80
add edi, 2
push str.Print
push edi
call fcn.00642cc0
lea eax, [edi + eax*2]
mov word [eax], 0
add eax, 2
push eax
call fcn.00642cb0
lea edi, [eax + 0x12]
push str.RICHEDIT
push edi
mov word [eax + 8], bx
mov word [eax + 0xa], bx
mov word [eax + 0xc], 0x12a
mov word [eax + 0xe], 0x90
mov word [eax + 0x10], 0x1f4
mov dword [eax], 0x50a11844
call fcn.00642cc0
add esp, 0x40
lea edi, [edi + eax*2]
push str.Decline
push edi
call fcn.00642cc0
mov ecx, dword [esp + 0x22c]
add esp, 8
mov word [edi + eax*2], 0
push ecx
push 0x642910
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
pop edi
test eax, eax
pop esi
je 0x6428ef
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push 4
push edx
push 4
push 0
push str.EulaAccepted
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 4]
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
add esp, 0x214
ret