Function at 0x401830
Capabilities:
Get common file path
Get keyboard layout
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [esp + 0x438]
push ebx
push esi
push edi
xor ebx, ebx
push 0x4088a4
push eax
mov dword [esp + 0x18], ebx
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
call fcn.00402045
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, eax
add esp, 8
test esi, esi
je 0x401961
lea esp, [esp]
push 0x4088a0
push esi
call edi
test eax, eax
je 0x40193f
push str._vista
push esi
call edi
test eax, eax
je 0x40193f
push 0x408890
push esi
call edi
test eax, eax
je 0x40193f
push 0x40888c
push esi
call edi
test eax, eax
je 0x401938
push 0x408888
push esi
call edi
test eax, eax
je 0x401938
push str._trial
push esi
call edi
test eax, eax
je 0x401931
push 0x408878
push esi
call edi
test eax, eax
je 0x401931
push str._killself
push esi
call edi
test eax, eax
je 0x40192a
push 0x408860
push esi
call edi
test eax, eax
je 0x40192a
push str._author
push esi
call edi
test eax, eax
je 0x401904
push 0x408850
push esi
call edi
test eax, eax
jne 0x401944
push 0x40
push str.Author
push str.Luke_Chang
push 0
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x42c
ret 0x10
mov byte [esp + 0xf], 1
jmp 0x401944
mov ebx, 6
jmp 0x401944
mov byte [esp + 0xe], 1
jmp 0x401944
mov byte [esp + 0xe], 3
push 0x4088a4
push 0
call fcn.00402045
mov esi, eax
add esp, 8
test esi, esi
jne 0x401870
mov dword [esp + 0x10], ebx
mov eax, dword [0x40a040]
cmp eax, 0xffffffff
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetACP]
jne 0x401995
call ebp
sub eax, 0x3a8
je 0x40198b
sub eax, 0xe
je 0x401987
mov eax, 2
jmp 0x401990
xor eax, eax
jmp 0x401990
mov eax, 1
mov dword [0x40a040], eax
mov ecx, dword [eax*4 + 0x40a048]
push 0x104
push 0x40a748
mov dword [0x40a84c], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [esp + 0x12]
test al, al
jne 0x4019ef
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00401060
mov eax, dword [esp + 0x30]
add esp, 8
test eax, eax
jne 0x4019ea
mov ecx, dword [esp + 0x24]
push 0x80
push ecx
call fcn.00401000
add esp, 8
test al, al
je 0x4019ef
mov byte [esp + 0x12], 3
mov eax, dword [0x40a040]
cmp eax, 0xffffffff
jne 0x401a1c
call ebp
sub eax, 0x3a8
je 0x401a12
sub eax, 0xe
je 0x401a0e
mov eax, 2
jmp 0x401a17
xor eax, eax
jmp 0x401a17
mov eax, 1
mov dword [0x40a040], eax
mov edx, dword [0x40a84c]
mov eax, dword [eax*4 + 0x40a054]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x121
push edx
push eax
push 0
call esi
cmp eax, 1
jne 0x401f0c
test ebx, ebx
jne 0x401adc
push str.liu.box
push 0x40a748
lea eax, [esp + 0x278]
push str._s_s
push eax
call fcn.00401f28
mov eax, dword [0x40a040]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x401a97
call ebp
sub eax, 0x3a8
je 0x401a8d
sub eax, 0xe
je 0x401a89
mov eax, 2
jmp 0x401a92
xor eax, eax
jmp 0x401a92
mov eax, 1
mov dword [0x40a040], eax
mov edx, dword [eax*4 + 0x40a09c]
lea ecx, [esp + 0x270]
push ecx
push edx
lea eax, [esp + 0x37c]
push eax
call fcn.00401f28
mov ecx, dword [0x40a84c]
add esp, 0xc
push 0x123
push ecx
lea edx, [esp + 0x37c]
push edx
push 0
call esi
cmp eax, 2
mov dword [esp + 0x14], eax
je 0x401f0c
cmp byte [esp + 0x12], 3
je 0x401cfd
lea eax, [esp + 0x2c]
push eax
push 0x1e
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ebx, eax
xor esi, esi
test ebx, ebx
jbe 0x401b50
lea esp, [esp]
mov ecx, dword [esp + esi*4 + 0x2c]
push ecx
call sub.IMM32.dll_ImmIsIME
test eax, eax
je 0x401b4b
mov eax, dword [esp + esi*4 + 0x2c]
push 0x104
lea edx, [esp + 0x170]
push edx
push eax
call sub.IMM32.dll_ImmGetIMEFileNameA
push str.LIUNT.IME
lea ecx, [esp + 0x170]
push ecx
call edi
test eax, eax
je 0x401ba4
push str.LIU95.IME
lea edx, [esp + 0x170]
push edx
call edi
test eax, eax
je 0x401baf
inc esi
cmp esi, ebx
jb 0x401b00
mov al, byte [esp + 0x12]
test al, al
je 0x401bf0
mov esi, dword [esp + 0x20]
push esi
lea eax, [esp + 0xa8]
push 0x408838
push eax
call fcn.00401f28
add esp, 0xc
push esi
call dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
test eax, eax
jne 0x401ce3
mov eax, dword [0x40a040]
cmp eax, 0xffffffff
jne 0x401bc8
call ebp
sub eax, 0x3a8
je 0x401bbe
sub eax, 0xe
je 0x401bba
mov eax, 2
jmp 0x401bc3
mov esi, dword [esp + esi*4 + 0x2c]
mov byte [esp + 0x12], 1
jmp 0x401b60
mov esi, dword [esp + esi*4 + 0x2c]
mov byte [esp + 0x12], 2
jmp 0x401b60
xor eax, eax
jmp 0x401bc3
mov eax, 1
mov dword [0x40a040], eax
mov ecx, dword [0x40a84c]
mov edx, dword [eax*4 + 0x40a06c]
push 0x10
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x42c
ret 0x10
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x1c]
push eax
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts
push 0x80000002
call ebp
mov eax, dword [esp + 0x1c]
xor esi, esi
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xb8]
push edx
push esi
mov ebx, 0x64
push eax
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x401cd2
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xa8]
push edx
push eax
inc esi
mov dword [esp + 0x24], ebx
call ebp
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x170]
push edx
push 0
push 0
push str.IME_file
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.LIUNT.IME
lea ecx, [esp + 0x170]
push ecx
call edi
test eax, eax
je 0x401cc6
push str.LIU95.IME
lea edx, [esp + 0x170]
push edx
call edi
test eax, eax
je 0x401ccd
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xb8]
push ecx
push esi
push edx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x401c37
jmp 0x401cd2
mov byte [esp + 0x12], 1
jmp 0x401cd2
mov byte [esp + 0x12], 2
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.KERNEL32.dll_GetACP]
mov al, byte [esp + 0x12]
test al, al
je 0x401d51
lea ecx, [esp + 0xa4]
push ecx
call fcn.004012a0
add esp, 4
jmp 0x401d51
push str.liuvista.dll
push 0x40a748
lea edx, [esp + 0x278]
push str._s_s
push edx
call fcn.00401f28
add esp, 0x10
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
push 0
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
push str.DllUnregisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401d51
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movsx eax, byte [esp + 0x12]
dec eax
je 0x401e72
dec eax
je 0x401e66
dec eax
je 0x401e28
mov esi, dword [esp + 0x14]
push esi
call fcn.004016a0
add esp, 4
test eax, eax
jne 0x401dad
mov eax, dword [0x40a040]
cmp eax, 0xffffffff
jne 0x401eb0
call ebp
sub eax, 0x3a8
je 0x401ea6
sub eax, 0xe
je 0x401da6
mov eax, 2
jmp 0x401eab
xor eax, eax
jmp 0x401eab
cmp eax, 0xffffffff
jne 0x401e87
push esi
call fcn.00401780
add esp, 4
test eax, eax
je 0x401d7c
cmp eax, 0xffffffff
jne 0x401e87
push str.LIU2000
call fcn.00401400
push str.LIU98
call fcn.00401400
add esp, 8
mov eax, dword [0x40a040]
cmp eax, 0xffffffff
jne 0x401e58
call ebp
sub eax, 0x3a8
je 0x401e4e
sub eax, 0xe
je 0x401e13
mov eax, 2
mov edx, dword [eax*4 + 0x40a084]
mov dword [0x40a040], eax
push 0x30
jmp 0x401eef
xor eax, eax
mov edx, dword [eax*4 + 0x40a084]
mov dword [0x40a040], eax
push 0x30
jmp 0x401eef
mov eax, dword [esp + 0x14]
push eax
call fcn.004015c0
add esp, 4
test eax, eax
je 0x401d7c
jge 0x401e87
push str.LIU2007
call fcn.00401400
add esp, 4
jmp 0x401de3
mov eax, 1
mov dword [0x40a040], eax
mov edx, dword [eax*4 + 0x40a084]
push 0x30
jmp 0x401eef
mov eax, dword [esp + 0x14]
push eax
call fcn.00401780
jmp 0x401e7c
mov eax, dword [esp + 0x14]
push eax
call fcn.004016a0
add esp, 4
test eax, eax
je 0x401d7c
mov eax, dword [0x40a040]
cmp eax, 0xffffffff
jne 0x401ee6
call ebp
sub eax, 0x3a8
je 0x401edc
sub eax, 0xe
je 0x401ed8
mov eax, 2
jmp 0x401ee1
mov eax, 1
mov dword [0x40a040], eax
mov ecx, dword [0x40a84c]
mov edx, dword [eax*4 + 0x40a090]
push 0x10
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x42c
ret 0x10
xor eax, eax
jmp 0x401ee1
mov eax, 1
mov dword [0x40a040], eax
mov edx, dword [eax*4 + 0x40a078]
push 0x40
mov ecx, dword [0x40a84c]
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, byte [esp + 0x13]
test al, al
je 0x401f0c
call fcn.00401500
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x42c
ret 0x10