Function at 0x401e28
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and dword [ebp - 0x848], 0
push ebx
push eax
push ecx
push 2
mov bl, 1
call fcn.00402fb2
add esp, 0xc
cmp eax, 2
jge 0x401e64
push 3
pop eax
jmp 0x402115
push esi
push edi
push 0x431fc0
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004110f3
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.0040eae0
add esp, 0x14
test eax, eax
je 0x401e95
mov byte [eax], 0
mov edi, 0x431db8
push edi
call fcn.00411480
push eax
push edi
call fcn.00407597
push str.___41:YY
push 0x4313d6
push 0x4313cc
push 0x4264f4
mov edi, eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00403cbc
lea eax, [ebp - 0x20c]
push eax
push edi
push str._08X_s
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.00403cbc
add esp, 0x38
lea eax, [ebp - 0x844]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401f7a
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 4
push eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f6e
push eax
call fcn.00418b68
pop ecx
push 0
push 0x15180
push edx
push eax
call fcn.0040d6e0
mov ecx, dword [ebp - 0x848]
xor ecx, 0x5a72bc91
sub eax, ecx
cmp eax, 0x5d
sbb bl, bl
inc bl
push dword [ebp - 0x844]
call esi
test bl, bl
je 0x401fed
xor ebx, ebx
push ebx
call fcn.00418b68
pop ecx
xor edx, edx
mov ecx, 0x15180
div ecx
xor eax, 0x5a72bc91
mov dword [ebp - 0x848], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401fef
push 4
lea eax, [ebp - 0x848]
push eax
push 4
push ebx
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x844]
call esi
jmp 0x401fef
xor ebx, ebx
push 0x530
lea eax, [ebp - 0x840]
push ebx
push eax
call fcn.0040e980
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x836]
push eax
push str._hd._hd
push 0x431fc0
call fcn.00403cd8
mov eax, dword [ebp - 0x848]
push str.FORWHO
mov dword [ebp - 0x83a], edi
mov dword [ebp - 0x83e], eax
call fcn.00409015
push str.CUSTOMLOC
mov word [ebp - 0x832], ax
call fcn.00409015
push str.INDIVIDUAL
mov word [ebp - 0x830], ax
call fcn.00409015
push 0x426538
mov word [ebp - 0x82e], ax
call fcn.00409074
push eax
mov ebx, 0x104
lea eax, [ebp - 0x82c]
push ebx
push eax
call fcn.004110f3
push str.CUSTOMPATH
call fcn.00409074
push eax
lea eax, [ebp - 0x728]
push ebx
push eax
call fcn.004110f3
add esp, 0x48
lea eax, [ebp - 0x624]
push ebx
push eax
push str.BUYURL
call fcn.0040801d
push ebx
lea eax, [ebp - 0x520]
push eax
push str.VERURL
call fcn.0040801d
push ebx
lea eax, [ebp - 0x41c]
push eax
push str.DLDURL
call fcn.0040801d
lea eax, [ebp - 0x840]
push eax
push 0x431db8
call fcn.00408cc2
add esp, 0x2c
lea eax, [ebp - 0x108]
push eax
push str.PROGRAM
call fcn.00409074
pop ecx
push eax
call fcn.00407bd5
lea eax, [ebp - 0x108]
push eax
push str.CONFIGPATH
call fcn.00408de7
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040d5ca
leave
ret