Function at 0x416370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d900
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov edi, ecx
call fcn.00415db0
test al, al
jne 0x4163b8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0041b630
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push dword [0x58ea20]
call fcn.00404300
push 0x485760
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00403bc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403500
add esp, 0x18
mov byte [ebp - 4], 4
or eax, 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41644a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x416834
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x416834
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x20019
push 0
push dword [ebp - 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41649a
push eax
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4164ef
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov ecx, dword [ebp - 0x20]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x416785
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x416846
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x416846
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x416785
lea ecx, [ebp - 0x48]
call fcn.0043bb76
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffff
inc eax
push eax
call fcn.0043bcf7
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x64]
call fcn.004145e0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
inc eax
push eax
push 0
push esi
mov dword [ebp - 0x64], edi
call fcn.0044e9c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1c]
add esp, 0xc
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push str.Created_by_KbdEdit
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x416558
cmp dword [ebp - 0x10], 1
mov byte [ebp - 0x60], 1
je 0x41655c
mov byte [ebp - 0x60], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
inc eax
push eax
push 0
push esi
call fcn.0044e9c0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push str.Layout_File
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x4165b9
cmp dword [ebp - 0x10], 1
jne 0x4165b9
test esi, esi
jne 0x416596
xor ecx, ecx
jmp 0x4165af
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4165a0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.004041d0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
inc eax
push eax
push 0
push esi
call fcn.0044e9c0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push str.Layout_Text
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x416619
cmp dword [ebp - 0x10], 1
jne 0x416619
test esi, esi
jne 0x4165f3
xor ecx, ecx
jmp 0x41660f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416600
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x58]
call fcn.004041d0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
inc eax
push eax
push 0
push esi
call fcn.0044e9c0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.charset
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x416656
cmp dword [ebp - 0x1c], 4
jne 0x416656
cmp dword [ebp - 0x10], 4
jne 0x416656
mov eax, dword [esi]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
inc eax
push eax
push 0
push esi
call fcn.0044e9c0
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push 0
push str.Layout_Id
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x4166fb
cmp dword [ebp - 0x30], 1
jne 0x4166fb
push esi
lea ecx, [ebp - 0x1c]
call fcn.00404300
lea eax, [ebp - 0x10]
push eax
push 0x4856e0
push dword [ebp - 0x1c]
call fcn.00419890
movzx edx, word [ebp - 0x50]
add esp, 0xc
movzx ecx, word [ebp - 0x10]
cmp eax, 1
cmove edx, ecx
mov ecx, dword [ebp - 0x1c]
mov word [ebp - 0x50], dx
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4166fb
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, 0x471758
jne 0x41683d
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41683d
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
inc eax
push eax
push 0
push esi
call fcn.0044e9c0
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push 0
push str.IME_File
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x416759
cmp dword [ebp - 0x2c], 1
jne 0x416759
test esi, esi
jne 0x416735
xor ecx, ecx
jmp 0x41674f
mov ecx, esi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416740
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.004041d0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x64]
push eax
call fcn.00414940
lea ecx, [ebp - 0x64]
mov bl, 1
call fcn.004147f0
lea ecx, [ebp - 0x48]
call fcn.0043bb8d
jmp 0x41649c
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4167cc
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x41684f
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41684f
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x416820
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x416858
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x416858
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
jmp 0x41644a
mov ecx, edx
call edi
jmp 0x4166fb
mov ecx, edx
call esi
jmp 0x416785
mov ecx, edx
call esi
jmp 0x4167cc
mov ecx, edx
call esi
jmp 0x416820