Function at 0x401e24
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x431418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and dword [ebp - 0x848], 0
push ebx
push eax
push ecx
push 2
mov bl, 1
call fcn.00402fa9
add esp, 0xc
cmp eax, 2
jge 0x401e60
push 3
pop eax
jmp 0x402111
push esi
push edi
push 0x431f50
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00411193
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.0040eb70
add esp, 0x14
test eax, eax
je 0x401e91
mov byte [eax], 0
mov edi, 0x431d48
push edi
call fcn.00411520
push eax
push edi
call fcn.004075fe
push str.___41:YY
push 0x4313de
push 0x4313d4
push 0x4264f4
mov edi, eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00403cb5
lea eax, [ebp - 0x20c]
push eax
push edi
push str._08X_s
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.00403cb5
add esp, 0x38
lea eax, [ebp - 0x844]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401f76
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 4
push eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f6a
push eax
call fcn.00418c08
pop ecx
push 0
push 0x15180
push edx
push eax
call fcn.0040d6b0
mov ecx, dword [ebp - 0x848]
xor ecx, 0x5a72bc91
sub eax, ecx
cmp eax, 0x5d
sbb bl, bl
inc bl
push dword [ebp - 0x844]
call esi
test bl, bl
je 0x401fe9
xor ebx, ebx
push ebx
call fcn.00418c08
pop ecx
xor edx, edx
mov ecx, 0x15180
div ecx
xor eax, 0x5a72bc91
mov dword [ebp - 0x848], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401feb
push 4
lea eax, [ebp - 0x848]
push eax
push 4
push ebx
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x844]
call esi
jmp 0x401feb
xor ebx, ebx
push 0x530
lea eax, [ebp - 0x840]
push ebx
push eax
call fcn.0040ea10
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x836]
push eax
push str._hd._hd
push 0x431f50
call fcn.00403cd1
mov eax, dword [ebp - 0x848]
push str.FORWHO
mov dword [ebp - 0x83a], edi
mov dword [ebp - 0x83e], eax
call fcn.00409061
push str.CUSTOMLOC
mov word [ebp - 0x832], ax
call fcn.00409061
push str.INDIVIDUAL
mov word [ebp - 0x830], ax
call fcn.00409061
push 0x426538
mov word [ebp - 0x82e], ax
call fcn.004090c0
push eax
mov ebx, 0x104
lea eax, [ebp - 0x82c]
push ebx
push eax
call fcn.00411193
push str.CUSTOMPATH
call fcn.004090c0
push eax
lea eax, [ebp - 0x728]
push ebx
push eax
call fcn.00411193
add esp, 0x48
lea eax, [ebp - 0x624]
push ebx
push eax
push str.BUYURL
call fcn.00408084
push ebx
lea eax, [ebp - 0x520]
push eax
push str.VERURL
call fcn.00408084
push ebx
lea eax, [ebp - 0x41c]
push eax
push str.DLDURL
call fcn.00408084
lea eax, [ebp - 0x840]
push eax
push 0x431d48
call fcn.00408d14
add esp, 0x2c
lea eax, [ebp - 0x108]
push eax
push str.PROGRAM
call fcn.004090c0
pop ecx
push eax
call fcn.00407c3c
lea eax, [ebp - 0x108]
push eax
push str.CONFIGPATH
call fcn.00408e39
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040d595
leave
ret