Function at 0x404d70
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4379b1
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x442308]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
push edi
mov eax, dword [0x442308]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
push str.Keyboard_LayoutPreload
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor edi, edi
cmp eax, edi
jle 0x404dda
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
jl 0x405120
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
push esi
push 0x43c8b4
lea edx, [esp + 0xb0]
push 0x10
push edx
mov dword [esp + 0xe8], edi
call fcn.00402c40
add esp, 0x10
lea ecx, [esp + 0x2c]
mov byte [esp + 0x17], 0
call fcn.00405d00
push 0x40
lea edx, [esp + 0x68]
mov byte [esp + 0xdc], 1
mov eax, 0x31
xor ecx, ecx
push edi
push edx
mov esi, 1
mov word [esp + 0x24], ax
mov word [esp + 0x26], cx
call fcn.00423660
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push edx
push edi
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x34], 0x40
mov dword [esp + 0x38], edi
call ebx
cmp eax, edi
jne 0x404f61
lea esp, [esp]
lea edx, [esp + 0xa8]
push edx
lea eax, [esp + 0x68]
push eax
call fcn.00424328
add esp, 8
test eax, eax
je 0x404f05
xor ecx, ecx
lea eax, [esp + 0x64]
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], edi
mov word [esp + 0x4c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404eb3
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0x50]
call fcn.00401820
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xdc], 2
call fcn.00405ef0
mov byte [esp + 0xd8], 1
cmp dword [esp + 0x60], 8
jb 0x404f0a
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.00423621
add esp, 4
jmp 0x404f0a
mov byte [esp + 0x17], 1
push 0x40
inc esi
lea ecx, [esp + 0x68]
lea edx, [esi + 0x30]
xor eax, eax
push edi
push ecx
mov word [esp + 0x24], dx
mov word [esp + 0x26], ax
call fcn.00423660
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x28]
push ecx
push edi
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x34], 0x40
mov dword [esp + 0x38], edi
call ebx
test eax, eax
je 0x404e80
cmp byte [esp + 0x17], 0
jne 0x404fae
mov eax, dword [esp + 0x38]
cmp eax, edi
je 0x404f8b
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x38]
push edx
push ecx
push eax
call fcn.00406b30
mov edx, dword [esp + 0x48]
push edx
call fcn.00423621
add esp, 0x14
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call fcn.00423621
mov ecx, dword [esp + 0x2c]
add esp, 4
push ecx
jmp 0x405118
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x44]
push eax
xor edx, edx
add esi, 0x2f
push ecx
mov word [esp + 0x4c], si
mov word [esp + 0x4e], dx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov ecx, ebx
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4050b6
xor ecx, ecx
mov dword [esp + 0x18], ecx
jmp 0x405004
mov ecx, dword [esp + 0x18]
lea edx, [edi + 0x31]
mov word [esp + 0x1c], dx
xor edx, edx
mov word [esp + 0x1e], dx
cmp edi, eax
jb 0x405028
call fcn.00423d34
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
cmp dword [ecx + esi + 0x18], 8
jb 0x405039
mov eax, dword [ecx + esi + 4]
mov dword [esp + 0x20], eax
jmp 0x405041
lea edx, [ecx + esi + 4]
mov dword [esp + 0x20], edx
sub ebx, esi
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x405067
call fcn.00423d34
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx + esi + 0x14]
mov edx, dword [esp + 0x20]
lea ecx, [esi + esi + 2]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push 1
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
add dword [esp + 0x18], 0x1c
mov ecx, ebx
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
cmp edi, eax
jb 0x405000
xor edi, edi
cmp esi, edi
je 0x4050fa
cmp esi, ebx
je 0x4050f1
add esi, 0x18
cmp dword [esi], 8
jb 0x4050d4
mov edx, dword [esi - 0x14]
push edx
call fcn.00423621
add esp, 4
xor eax, eax
mov dword [esi], 7
mov dword [esi - 4], edi
mov word [esi - 0x14], ax
add esi, 0x1c
lea ecx, [esi - 0x18]
cmp ecx, ebx
jne 0x4050c3
mov esi, dword [esp + 0x38]
push esi
call fcn.00423621
add esp, 4
mov edx, dword [esp + 0x2c]
push edx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call fcn.00423621
mov eax, dword [esp + 0x2c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.0042364d
mov esp, ebp
pop ebp
ret