Function at 0x401200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41507c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push str.SoftwareIime
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401245
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d89
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov word [ebp - 0x20c], cx
call fcn.0040ca90
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push str.Clsid
mov edi, 0x208
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], 1
call esi
test eax, eax
je 0x4012bc
push str.83DB39EE_30A2_4143_9062_0C4FD8274968
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x415c18
lea ecx, [ebp - 0x20c]
call fcn.004010b0
lea edx, [ebp - 0x214]
push edx
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push str.Guid
push edx
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], 1
call esi
test eax, eax
je 0x401317
push str.F0970D4D_3985_46B0_B882_0EC7BA3D3BD1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x415c28
lea ecx, [ebp - 0x20c]
call fcn.004010b0
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
push str.SetupLocation
mov ebx, 1
push ecx
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], ebx
call esi
test eax, eax
je 0x401373
push str.C:Program_Files
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401380
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, 0x415c38
call fcn.00401c00
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push str.IMEFileName
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], ebx
call esi
test eax, eax
je 0x4013e7
push str.Iime.ime
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4013f0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, 0x415c54
call fcn.00401c00
lea edx, [ebp - 0x214]
push edx
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push str.SwitchHotkey
push edx
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], ebx
call esi
test eax, eax
je 0x401457
push 0x411c64
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401460
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, 0x415c70
call fcn.00401c00
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00408d89
mov esp, ebp
pop ebp
ret