Function at 0x401130
Capabilities:
Get common file path
Get keyboard layout
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x2f4
mov eax, dword [esp + 0x2f8]
mov dword [0x42bef4], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
push eax
push edi
push edi
push edi
push 0x80000000
push edi
push 0x80000000
push 0xcf0000
push 0x4292c8
push str.Liu95
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
cmp ebx, edi
je 0x401723
mov eax, dword [esp + 0x30c]
push eax
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0x3a8
je 0x4011c2
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push edi
push str.Installation_Fail
push str.This_is_not_Simplified_Chinese_Environment._n_The_installation_will_stop.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40122c
xor edx, edx
mov ecx, eax
mov dl, ah
and eax, 0xff
shr ecx, 0x10
and edx, 0xff
push ecx
push edx
push eax
lea eax, [esp + 0x154]
push 0x42969c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push 1
lea ecx, [esp + 0x14c]
push 0x429690
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x40127e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret
cmp al, 4
jae 0x401257
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push edi
push 0x429690
push 0x429608
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret
xor edx, edx
mov dl, ah
and eax, 0xff
and edx, 0xff
push edx
push eax
lea eax, [esp + 0x150]
push str.Microsoft_Windows_95_98__u._u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x1f4]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x190]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 1
push 0x4295e0
push 0x4295c4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x401723
lea eax, [esp + 0x28c]
mov dword [esp + 0x10], edi
push eax
push 0x1e
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ebp, eax
cmp ebp, edi
jbe 0x401341
lea esi, [esp + 0x28c]
mov ecx, dword [esi]
push ecx
call sub.IMM32.dll_ImmIsIME
test eax, eax
je 0x401310
mov eax, dword [esi]
lea edx, [esp + 0x170]
push 0x20
push edx
push eax
call sub.IMM32.dll_ImmGetIMEFileNameA
lea ecx, [esp + 0x170]
push str.LIU95.IME
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40131a
inc edi
add esi, 4
cmp edi, ebp
jb 0x4012db
jmp 0x401341
push 1
push 0x4295e0
push 0x42958c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x401723
mov edx, dword [esp + edi*4 + 0x28c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401373
push eax
call dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
test eax, eax
jne 0x401373
push eax
push 0x4295e0
push 0x429548
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
push eax
push ecx
push ebx
call fcn.00401920
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
mov dword [esp + 0x14], eax
lea edx, [esp + 0x1f4]
lea eax, [esp + 0x1c]
push edx
push eax
call ebp
lea ecx, [esp + 0x1c]
push str.liugb.tab
push ecx
call edi
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
lea edx, [esp + 0x30]
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401501
lea eax, [esp + 0x18]
push 0
push eax
push 0xa684
push 0x405020
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x401407
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401501
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1f4]
lea edx, [esp + 0x1c]
push ecx
push edx
call ebp
lea eax, [esp + 0x1c]
push str.liugb2.tab
push eax
call edi
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
lea ecx, [esp + 0x30]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401501
lea edx, [esp + 0x18]
push 0
push edx
push 0xa885
push 0x40f6a8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x40154d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1c]
push 0x429338
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 5
lea ecx, [esp + 0x20]
push 0x429328
push ecx
push ebx
call esi
cmp eax, 4
jne 0x4015f7
mov edx, dword [esp + 0x30c]
mov eax, dword [esp + 0x308]
push edx
push eax
push ebx
call fcn.00401920
add esp, 0xc
lea ecx, [esp + 0x1f4]
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
push ecx
push edx
call ebp
lea eax, [esp + 0x1c]
push str.liugb2.tab
push eax
call edi
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
lea ecx, [esp + 0x30]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401450
lea edx, [esp + 0x1c]
push 0x429338
push edx
call edi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 5
lea eax, [esp + 0x20]
push 0x429328
push eax
push ebx
call esi
cmp eax, 4
jne 0x4015f7
mov ecx, dword [esp + 0x30c]
mov edx, dword [esp + 0x308]
push ecx
push edx
push ebx
call fcn.00401920
add esp, 0xc
mov dword [esp + 0x14], eax
jmp 0x40139c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x190]
lea ecx, [esp + 0x1c]
push eax
push ecx
call ebp
lea edx, [esp + 0x1c]
push str.liu95.ime
push edx
call edi
lea eax, [esp + 0x1c]
push pe_nt_image_headers32
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
lea ecx, [esp + 0x30]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4015af
push esi
call fcn.00401a10
add esp, 4
test eax, eax
jne 0x401613
lea edx, [esp + 0x1c]
push 0x429338
push edx
call edi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 5
lea eax, [esp + 0x20]
push 0x429328
push eax
push ebx
call esi
cmp eax, 4
jne 0x4015f7
mov ecx, dword [esp + 0x30c]
mov edx, dword [esp + 0x308]
push ecx
push edx
push ebx
call fcn.00401920
add esp, 0xc
mov dword [esp + 0x14], eax
jmp 0x401553
push 0x10
push 0x429518
push 0x429310
push ebx
call esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [esp + 0x1f4]
lea ecx, [esp + 0x1c]
push eax
push ecx
call ebp
lea edx, [esp + 0x1c]
push str.liu.box
push edx
call edi
push 0
push pe_nt_image_headers32
push 1
push 0
push 0
lea eax, [esp + 0x30]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x401675
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x11
push 0x4292a8
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
test eax, eax
call esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4016a6
push esi
lea edx, [esp + 0x25c]
push str._08X
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x258]
push 1
push eax
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
jmp 0x4016dd
lea ecx, [esp + 0x190]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x190]
push str.liu95.ime
push edx
call edi
lea eax, [esp + 0x190]
push 0x4295e0
push eax
call sub.IMM32.dll_ImmInstallIMEA
mov dword [esp + 0x10], eax
mov esi, eax
push esi
lea ecx, [esp + 0x20]
push 0x4293b8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x401700
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x40
lea edx, [esp + 0x20]
push 0x4293b0
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret