Function at 0x403100
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x2b0
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x2ac], eax
push ebx
push ebp
push esi
xor esi, esi
xor ebp, ebp
mov dword [esp + 0x18], 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp dword [0x43915c], 3
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x43ca0c], eax
mov eax, 0xc8
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], 1
jle 0x403175
cmp dword [0x43ccc8], 0x3b6
jne 0x403169
push 0x41cfa4
jmp 0x403192
push 0x41cf90
lea ecx, [esp + 0x3c]
push ecx
jmp 0x403197
cmp dword [0x43ccc8], 0x3b6
jne 0x40318d
push 0x41cf7c
lea edx, [esp + 0x3c]
push edx
jmp 0x403197
push 0x41c754
lea eax, [esp + 0x3c]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push esi
push str.SystemCurrentControlSetControlKeyboard_Layouts
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40321c
test dword [0x43ca0c], 0x80000000
push esi
push 0x41cf70
je 0x4031f3
push str.Software_open_error1003
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x2ac]
xor ecx, esp
call fcn.0040a10d
add esp, 0x2b0
ret
push 0x41cf10
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x2ac]
xor ecx, esp
call fcn.0040a10d
add esp, 0x2b0
ret
push edi
mov eax, dword [esp + 0x14]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea edx, [esp + 0x3c]
push edx
push esi
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x20], esi
jl 0x40329b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x208]
push eax
push ecx
push edx
mov dword [esp + 0x44], 0xc8
call edi
test eax, eax
je 0x40327a
cmp eax, 0xea
jne 0x403294
movzx eax, si
imul eax, eax, 0xc8
lea ecx, [esp + 0x1f4]
add eax, 0x42cc80
push ecx
push eax
call ebx
inc esi
sub dword [esp + 0x20], 1
jns 0x403243
movzx edi, si
xor ebx, ebx
test edi, edi
jle 0x403395
mov esi, 0x42cc80
lea ecx, [ecx]
push esi
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403386
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x130]
push eax
push 0
push 0
push str.layout_text
push ecx
mov dword [esp + 0x30], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40337b
lea esp, [esp]
mov dl, byte [esp + eax + 0x3c]
cmp dl, byte [esp + eax + 0x12c]
jne 0x403359
mov cl, byte [esp + eax + 0x3d]
cmp cl, byte [esp + eax + 0x12d]
jne 0x40334e
mov dl, byte [esp + eax + 0x3e]
cmp dl, byte [esp + eax + 0x12e]
jne 0x403351
mov cl, byte [esp + eax + 0x3f]
cmp cl, byte [esp + eax + 0x12f]
jne 0x403356
add eax, 4
cmp eax, 0x10
jl 0x403310
jmp 0x403359
inc eax
jmp 0x403359
add eax, 2
jmp 0x403359
add eax, 3
cmp eax, 0x10
je 0x4033bb
lea edx, [esp + 0x2c]
push edx
push 0x41cf08
push esi
call fcn.0040a58f
mov eax, dword [esp + 0x38]
add esp, 0xc
cmp ebp, eax
jae 0x40337b
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
add esi, 0xc8
cmp ebx, edi
jl 0x4032b0
cmp dword [0x43ccc8], 0x3b6
jne 0x4034ab
cmp ebp, 0xe0000404
jae 0x4034b8
mov ebp, 0xe0000404
jmp 0x4034b8
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [esp + 0x50]
mov ebp, 0x3b6
sub edi, 3
cmp dword [0x43ccc8], ebp
jne 0x403446
lea eax, [esp + 0x50]
push eax
call esi
cmp byte [eax + edi], 0x34
jne 0x40341b
lea ecx, [esp + 0x50]
push ecx
call esi
lea edx, [esp + 0x50]
sub edx, 2
cmp byte [eax + edx], 0x30
jne 0x40341b
lea eax, [esp + 0x50]
push eax
call esi
lea ecx, [esp + 0x50]
dec ecx
cmp byte [eax + ecx], 0x34
je 0x403479
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x50]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea edx, [esp + 0x50]
push edx
call esi
mov byte [eax + edi], 0x34
jmp 0x403587
lea edx, [esp + 0x50]
push edx
call esi
cmp byte [eax + edi], 0x38
jne 0x40348b
lea eax, [esp + 0x50]
push eax
call esi
lea ecx, [esp + 0x50]
sub ecx, 2
cmp byte [eax + ecx], 0x30
jne 0x40348b
lea edx, [esp + 0x50]
push edx
call esi
lea ecx, [esp + 0x50]
dec ecx
cmp byte [eax + ecx], 0x34
jne 0x40348b
cmp dword [0x43c1c8], 0
je 0x40362b
jmp 0x4039c0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x50]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40357c
cmp ebp, 0xe0000804
jae 0x4034b8
mov ebp, 0xe0000804
add ebp, 0x10000
push ebp
lea edx, [esp + 0x54]
push 0x41cf08
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [esp + 0x50]
sub edi, 3
cmp dword [0x43ccc8], 0x3b6
jne 0x403549
lea eax, [esp + 0x50]
push eax
call esi
cmp byte [eax + edi], 0x34
jne 0x40353c
lea ecx, [esp + 0x50]
push ecx
call esi
lea edx, [esp + 0x50]
sub edx, 2
cmp byte [eax + edx], 0x30
jne 0x40353c
lea eax, [esp + 0x50]
push eax
call esi
lea ecx, [esp + 0x50]
dec ecx
cmp byte [eax + ecx], 0x34
je 0x4035af
lea edx, [esp + 0x50]
push edx
call esi
mov byte [eax + edi], 0x34
jmp 0x403587
lea edx, [esp + 0x50]
push edx
call esi
cmp byte [eax + edi], 0x38
jne 0x40357c
lea eax, [esp + 0x50]
push eax
call esi
lea ecx, [esp + 0x50]
sub ecx, 2
cmp byte [eax + ecx], 0x30
jne 0x40357c
lea edx, [esp + 0x50]
push edx
call esi
lea ecx, [esp + 0x50]
dec ecx
cmp byte [eax + ecx], 0x34
je 0x4035af
lea edx, [esp + 0x50]
push edx
call esi
mov byte [eax + edi], 0x38
lea eax, [esp + 0x50]
push eax
call esi
lea ecx, [esp + 0x50]
mov edx, ecx
sub ecx, 2
push edx
mov byte [eax + ecx], 0x30
call esi
lea ecx, [esp + 0x50]
dec ecx
mov dword [esp + 0x1c], 0
mov byte [eax + ecx], 0x34
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [esp + 0x6c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x403626
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dword [0x43ca0c], 0x80000000
push 0
push 0x41cef4
je 0x40360f
push str.Software_open_error1004
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4039dc
push 0x41cf10
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4039dc
mov ebp, 0x3b6
cmp dword [0x43915c], 3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jg 0x403677
push str.CHENHU4.IME
cmp dword [0x43ccc8], ebp
jne 0x40365f
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.CHENHU4.IME
push 1
push 0
push str.IME_file
push ecx
jmp 0x403675
call esi
mov edx, dword [esp + 0x10]
push eax
push str.CHENHU4.IME
push 1
push 0
push str.IME_file
push edx
call ebx
mov edi, 0x80000000
test dword [0x43ca0c], edi
je 0x4036a1
push str.kbdus.kbd
call esi
push eax
mov eax, dword [esp + 0x14]
push str.kbdus.kbd
push 1
push 0
push str.layout_file
push eax
jmp 0x4036bc
push str.kbdus.dll
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.kbdus.dll
push 1
push 0
push str.layout_file
push ecx
call ebx
cmp dword [0x43ccc8], ebp
jne 0x4036ec
cmp dword [0x43915c], 3
jg 0x403712
push 0x41ce88
call esi
mov edx, dword [esp + 0x10]
push eax
push 0x41ce88
push 1
push 0
push str.layout_text
push edx
jmp 0x403710
cmp dword [0x43915c], 3
jg 0x403712
push 0x41ce70
call esi
push eax
mov eax, dword [esp + 0x14]
push 0x41ce70
push 1
push 0
push str.layout_text
push eax
call ebx
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebx
mov edx, dword [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x3c]
push edx
call esi
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x40375c
mov al, byte [esp + ecx + 0x3c]
cmp al, 0x40
jbe 0x403757
cmp al, 0x5b
jae 0x403757
add al, 0x20
mov byte [esp + ecx + 0x3c], al
inc ecx
cmp ecx, esi
jl 0x403745
test dword [0x43ca0c], edi
je 0x4038b7
xor ecx, ecx
test esi, esi
jle 0x403787
mov edi, edi
mov al, byte [esp + ecx + 0x3c]
cmp al, 0x60
jbe 0x403782
cmp al, 0x7b
jae 0x403782
sub al, 0x20
mov byte [esp + ecx + 0x3c], al
inc ecx
cmp ecx, esi
jl 0x403770
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.keyboard_layoutpreload
push 0x80000001
call ebx
test eax, eax
jne 0x4038d9
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
jmp 0x4037c0
push edi
lea ecx, [esp + 0x1f8]
push 0x41c590
push ecx
call ebp
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x200]
push eax
push ecx
call ebx
test eax, eax
jne 0x403863
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x130]
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x30], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40384e
test esi, esi
jle 0x40383f
mov cl, byte [esp + eax + 0x12c]
mov dl, cl
sub dl, 0x61
cmp dl, 0x19
ja 0x403834
add cl, 0xe0
cmp byte [esp + eax + 0x3c], cl
jne 0x40383f
inc eax
cmp eax, esi
jl 0x403820
cmp eax, esi
je 0x4039c0
lea ecx, [esi - 4]
cmp eax, ecx
jg 0x4038a1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp edi, 0x32
jl 0x4037c0
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [esp + 0x210]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4038a1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4039c0
mov eax, dword [esp + 0x10]
push esi
lea edx, [esp + 0x40]
push edx
push 1
push 0
push 0
push eax
jmp 0x4039ba
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push str.keyboard_layout
push 0x80000001
call edi
test eax, eax
je 0x4038f7
push 0
push 0x41cef4
push str.Software_open_error2003
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4039dc
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.preload
push eax
call edi
test eax, eax
jne 0x4039d1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
jmp 0x403930
push edi
lea ecx, [esp + 0x1f8]
push 0x41c590
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x130]
push eax
push 0
push 0
lea ecx, [esp + 0x204]
push ecx
push edx
mov dword [esp + 0x30], 0xc8
call ebx
test eax, eax
jne 0x4039a3
test esi, esi
jle 0x403992
mov cl, byte [esp + eax + 0x12c]
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x403987
add cl, 0x20
cmp byte [esp + eax + 0x3c], cl
jne 0x403992
inc eax
cmp eax, esi
jl 0x403973
cmp eax, esi
je 0x4039c0
lea ecx, [esi - 4]
cmp eax, ecx
jg 0x4039a3
inc edi
cmp edi, 0x32
jl 0x403930
mov ecx, dword [esp + 0x10]
push esi
lea edx, [esp + 0x40]
push edx
push 1
push 0
lea eax, [esp + 0x204]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2bc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a10d
add esp, 0x2b0
ret