Function at 0x404fb0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x581e00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x84c]
push eax
push 0xf003f
push 0
push str.Keyboard_Layoutpreload
push SysReAllocString
call esi
test eax, eax
jne 0x405246
lea ecx, [ebp - 0x83c]
push ecx
push 0xf003f
push eax
push str.SystemCurrentControlSetControlKeyboard_Layouts
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x405246
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x848], 0x3e8
mov dword [ebp - 0x844], 1
xor esi, esi
jmp 0x405030
mov ecx, dword [ebp - 0x84c]
push esi
call fcn.00404c20
test eax, eax
je 0x40514c
push esi
lea edx, [ebp - 0x838]
push 0x560f34
push edx
xor bl, bl
call fcn.0050cc59
add esp, 0xc
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x450]
push ecx
mov ecx, dword [ebp - 0x84c]
lea edx, [ebp - 0x844]
push edx
push 0
lea eax, [ebp - 0x838]
push eax
push ecx
call edi
push ecx
lea edx, [ebp - 0x450]
mov ecx, esp
mov dword [ebp - 0x850], esp
push edx
call fcn.00401d20
mov edx, dword [ebp - 0x83c]
call fcn.00404ba0
test eax, eax
je 0x405138
mov edx, dword [ebp - 0x83c]
lea eax, [ebp - 0x840]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x450]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405246
lea eax, [ebp - 0x848]
push eax
mov eax, dword [ebp - 0x840]
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x844]
push edx
push 0
push str.IME_File
push eax
mov dword [ebp - 0x848], 0x3e8
mov dword [ebp - 0x844], 1
call edi
lea ecx, [ebp - 0x450]
push str.singlePY.ime
push ecx
call fcn.0050e486
add esp, 8
test eax, eax
jne 0x405127
mov bl, 1
mov edx, dword [ebp - 0x840]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x40514c
mov ecx, dword [ebp - 0x84c]
lea eax, [ebp - 0x838]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc esi
cmp esi, 0x64
jl 0x405030
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, 0xe0010804
mov edx, dword [ebp - 0x83c]
push esi
push edx
call fcn.00404ae0
test eax, eax
je 0x405209
push esi
lea eax, [ebp - 0x68]
push str._08X
push eax
call fcn.0050cc59
mov eax, dword [ebp - 0x83c]
add esp, 0xc
lea ecx, [ebp - 0x840]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x68]
push edx
push eax
call ebx
test eax, eax
jne 0x405246
lea ecx, [ebp - 0x848]
push ecx
mov ecx, dword [ebp - 0x840]
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x844]
push eax
push 0
push str.IME_File
push ecx
mov dword [ebp - 0x848], 0x3e8
mov dword [ebp - 0x844], 1
call edi
lea edx, [ebp - 0x450]
push str.singlePY.ime
push edx
call fcn.0050e486
add esp, 8
test eax, eax
je 0x40521d
mov eax, dword [ebp - 0x840]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0x10000
cmp esi, 0xe0ff0804
jb 0x405161
jmp 0x40522e
mov edx, dword [ebp - 0x83c]
lea ecx, [ebp - 0x68]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x84c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [ebp - 0x83c]
push ecx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050cbf9
mov esp, ebp
pop ebp
ret