Function at 0x401e28
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and dword [ebp - 0x848], 0
push ebx
push eax
push ecx
push 2
mov bl, 1
call fcn.00402fb2
add esp, 0xc
cmp eax, 2
jge 0x401e64
push 3
pop eax
jmp 0x402115
push esi
push edi
push 0x431fd0
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00411293
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.0040ec80
add esp, 0x14
test eax, eax
je 0x401e95
mov byte [eax], 0
mov edi, 0x431dc8
push edi
call fcn.00411620
push eax
push edi
call fcn.004075a2
push 0x4313e0
push 0x4313d6
push 0x4313cc
push 0x4264f4
mov edi, eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00403cbc
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x426500
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.00403cbc
add esp, 0x38
lea eax, [ebp - 0x844]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401f7a
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 4
push eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f6e
push eax
call fcn.00418d08
pop ecx
push 0
push 0x15180
push edx
push eax
call fcn.0040d720
mov ecx, dword [ebp - 0x848]
xor ecx, 0x5a72bc91
sub eax, ecx
cmp eax, 0x5d
sbb bl, bl
inc bl
push dword [ebp - 0x844]
call esi
test bl, bl
je 0x401fed
xor ebx, ebx
push ebx
call fcn.00418d08
pop ecx
xor edx, edx
mov ecx, 0x15180
div ecx
xor eax, 0x5a72bc91
mov dword [ebp - 0x848], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401fef
push 4
lea eax, [ebp - 0x848]
push eax
push 4
push ebx
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x844]
call esi
jmp 0x401fef
xor ebx, ebx
push 0x530
lea eax, [ebp - 0x840]
push ebx
push eax
call fcn.0040eb20
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x836]
push eax
push 0x426508
push 0x431fd0
call fcn.00403cd8
mov eax, dword [ebp - 0x848]
push 0x426510
mov dword [ebp - 0x83a], edi
mov dword [ebp - 0x83e], eax
call fcn.00409020
push 0x42651c
mov word [ebp - 0x832], ax
call fcn.00409020
push 0x426528
mov word [ebp - 0x830], ax
call fcn.00409020
push 0x426538
mov word [ebp - 0x82e], ax
call fcn.0040907f
push eax
mov ebx, 0x104
lea eax, [ebp - 0x82c]
push ebx
push eax
call fcn.00411293
push 0x426548
call fcn.0040907f
push eax
lea eax, [ebp - 0x728]
push ebx
push eax
call fcn.00411293
add esp, 0x48
lea eax, [ebp - 0x624]
push ebx
push eax
push 0x426558
call fcn.00408028
push ebx
lea eax, [ebp - 0x520]
push eax
push 0x426564
call fcn.00408028
push ebx
lea eax, [ebp - 0x41c]
push eax
push 0x426570
call fcn.00408028
lea eax, [ebp - 0x840]
push eax
push 0x431dc8
call fcn.00408ccd
add esp, 0x2c
lea eax, [ebp - 0x108]
push eax
push 0x42657c
call fcn.0040907f
pop ecx
push eax
call fcn.00407be0
lea eax, [ebp - 0x108]
push eax
push 0x426588
call fcn.00408df2
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040d603
leave
ret