Function at 0x415ff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x416034
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
call fcn.00415db0
test al, al
je 0x41604a
mov ecx, dword [edi]
call fcn.00416860
test al, al
je 0x416020
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x20006
push 0
push dword [0x58ea20]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416020
mov edx, dword [edi]
lea ecx, [ebp - 0x1c]
call fcn.0041b630
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
or esi, 0xffffffff
test eax, eax
je 0x4160c1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x4162ec
cmp byte [edi + 4], 0
mov bl, 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x416156
lea ecx, [ebp - 0x18]
call fcn.004048a0
mov esi, dword [ebp - 0x18]
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 1
push 0
push str.Created_by_KbdEdit
push dword [ebp - 0x10]
call eax
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416148
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x471758
jne 0x416354
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x416354
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test bl, bl
je 0x4162d9
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [edi + 8]
push 0x58e7fc
push eax
call fcn.00413610
add esp, 8
test al, al
je 0x416193
mov ecx, dword [edi + 8]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push str.Layout_File
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x416193
xor bl, bl
jmp 0x4162d9
lea eax, [edi + 0xc]
push 0x58e7fc
push eax
call fcn.00413610
add esp, 8
test al, al
je 0x4161d0
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push str.Layout_Text
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4161d0
xor bl, bl
jmp 0x4162d9
cmp dword [edi + 0x10], 0xffffffff
lea eax, [edi + 0x10]
je 0x4161f5
push 4
push eax
push 4
push 0
push str.charset
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4161f5
xor bl, bl
jmp 0x4162d9
mov eax, 0xffff
cmp word [edi + 0x14], ax
je 0x416296
lea ecx, [ebp - 0x18]
call fcn.004048a0
mov byte [ebp - 4], 1
movzx eax, word [edi + 0x14]
push eax
lea eax, [ebp - 0x18]
push str._04hx
push eax
call fcn.00403a80
mov esi, dword [ebp - 0x18]
add esp, 0xc
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 1
push 0
push str.Layout_Id
push dword [ebp - 0x10]
call eax
xor edx, edx
movzx ebx, bl
test eax, eax
mov byte [ebp - 4], dl
cmovne ebx, edx
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416296
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x471758
jne 0x41635b
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41635b
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test bl, bl
je 0x4162d9
add edi, 0x18
push 0x58e7fc
push edi
call fcn.00413610
add esp, 8
test al, al
je 0x4162d9
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push str.IME_File
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
movzx ebx, bl
test eax, eax
cmovne ebx, edx
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x14]
call esi
or esi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x416340
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x416362
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x416362
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
jmp 0x416148
call edx
jmp 0x416296
mov ecx, edx
call esi
jmp 0x416340