Function at 0x401d70
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x370
push ebx
push edi
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x20]
mov bl, 1
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x37c]
mov dword [esp + 8], eax
call fcn.004010e0
test eax, eax
jle 0x4020d3
push ebp
mov ebp, dword [sym.imp.USER32.dll_LoadStringA]
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x384]
push eax
call fcn.004010f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x28]
cmp al, 0x2f
je 0x401deb
cmp al, 0x2d
jne 0x4020a9
movsx ecx, byte [esp + 0x29]
push ecx
call fcn.004028cc
add esp, 4
cmp eax, 0x76
je 0x401e3c
mov eax, dword [0x40c4d0]
lea edi, [esp + 0x28]
lea ecx, [eax + eax*2]
inc eax
mov dword [0x40c4d0], eax
xor eax, eax
lea edx, [ecx + ecx*4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [edx*2 + 0x40c194]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4020a9
mov ecx, dword [0x40c4d4]
push 0x104
push 0x40be80
push 0x12c
push ecx
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x24], 0
call ebp
mov edx, dword [0x40c4d4]
push 0x104
push 0x40bc78
push 0x64
push edx
call ebp
push 0x40bc78
push 0x40be80
push 0x40bf84
call fcn.004027e3
mov ecx, dword [esp + 0x390]
add esp, 0xc
push 0
call fcn.004010f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x24]
and ecx, 3
lea eax, [esp + 0x80]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x184]
push ecx
push edx
push eax
call fcn.00402581
push 0
lea ecx, [esp + 0x194]
push 0
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x98]
push edx
push eax
call fcn.004024f0
lea edi, [esp + 0xa0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x28
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x78]
mov edi, str.Setup.ini
cmp byte [esp + ecx + 0x77], 0x5c
je 0x401f26
mov edi, 0x40922c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x78]
mov ecx, ebx
push eax
push 0x104
push 0x40c090
and ecx, 3
push 0x409228
push str.Version
rep movsb byte es:[edi], byte [esi]
push str.Setup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x409228
mov eax, 0x40c090
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401fa1
test cl, cl
je 0x401f9d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401fa1
add eax, 2
add esi, 2
test cl, cl
jne 0x401f79
xor eax, eax
jmp 0x401fa6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402061
mov edi, str.SOFTWAREWestwood_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x27c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Red_Alert_2
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [esp + 0x284]
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402061
lea edx, [esp + 0x20]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push str.Version
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402056
mov eax, dword [esp + 0x14]
push eax
push 0x40c090
call fcn.00402200
add esp, 8
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x40c4d4]
push 0x104
push 0x40be80
push 0x13a
push edx
call ebp
push 0x40c090
push 0x40be80
push 0x40bc78
call fcn.004027e3
add esp, 0xc
push 0x2000
push 0x40bf84
push 0x40bc78
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x384]
inc esi
mov dword [esp + 0x10], esi
call fcn.004010e0
cmp esi, eax
jl 0x401da7
pop esi
pop ebp
mov al, bl
pop edi
pop ebx
add esp, 0x370
ret
mov al, bl
pop edi
pop ebx
add esp, 0x370
ret