Function at 0x401840
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
push edi
call fcn.004116f0
test eax, eax
je 0x401a63
mov ecx, dword [esp + 0x114]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.keyboard_layoutpreload
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
mov eax, dword [esp + 0x18]
push 0
lea edx, [esp + 0x2c]
push 0
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x4018b4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 2
push edx
push 0x42
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call edi
mov ebp, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
push eax
push 0x42
call esi
push eax
call edi
mov esi, eax
test esi, esi
mov dword [esp + 0x24], esi
je 0x401d0a
lea ecx, [esp + 0x2c]
mov eax, 0x64
lea edx, [esp + 0xac]
xor ebx, ebx
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], eax
push edx
mov edx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x24]
push ebx
lea ecx, [esp + 0x58]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x4019db
sub esi, ebp
mov dword [esp + 0x14], esi
jmp 0x401949
mov esi, dword [esp + 0x14]
lea edi, [esp + 0xac]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi + ebp]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x64
mov edx, ecx
mov esi, edi
mov edi, ebp
add ebp, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xac]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push 0
push 0
lea eax, [esp + 0x58]
push edx
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x401945
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
test ebx, ebx
jle 0x4019ff
mov edi, ebp
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x10]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x14]
add edi, 0x64
dec eax
mov dword [esp + 0x14], eax
jne 0x4019e5
push ebx
push esi
push ebp
call fcn.00401d20
add esp, 0xc
xor eax, eax
test ebx, ebx
jle 0x401cd5
mov ebp, esi
lea esi, [eax + 1]
lea eax, [esp + 0x30]
push esi
push 0x42a110
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
push ebp
push 1
lea ecx, [esp + 0x3c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, esi
add ebp, 0x64
cmp eax, ebx
jl 0x401a16
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
jmp 0x401cd5
mov edx, dword [esp + 0x114]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push str.keyboard_layoutpreload
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x38]
push 0
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x401ac0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
push eax
push 0x42
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call edi
mov ebp, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ebp
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 2
push ecx
push 0x42
call esi
push eax
call edi
mov esi, eax
test esi, esi
mov dword [esp + 0x24], esi
je 0x401d0a
lea edx, [esp + 0x40]
xor ebx, ebx
push edx
mov edx, dword [esp + 0x14]
push ebx
push ebx
lea eax, [esp + 0x24]
push ebx
lea ecx, [esp + 0x58]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x38], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x401c21
sub esi, ebp
mov dword [esp + 0x14], esi
jmp 0x401b49
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea ecx, [esp + 0x50]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xac]
push eax
push ecx
push 0
push 0
push 0x4313e8
push edx
mov dword [esp + 0x44], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0xac]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi + ebp]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x40]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x58]
inc ebx
push ecx
push edx
push ebx
push eax
add ebp, 0x64
mov dword [esp + 0x38], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x401b45
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
test ebx, ebx
jle 0x401c45
mov edi, ebp
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x10]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x14]
add edi, 0x64
dec eax
mov dword [esp + 0x14], eax
jne 0x401c2b
push ebx
push esi
push ebp
call fcn.00401d20
add esp, 0xc
xor eax, eax
test ebx, ebx
jle 0x401cd5
mov ebp, esi
lea esi, [eax + 1]
lea edx, [esp + 0x30]
push esi
push 0x42a110
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x30]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0x4313e8
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x2c]
push ebp
push 1
push eax
push 0x4313e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add ebp, 0x64
cmp eax, ebx
jl 0x401c58
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
call ebx
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call esi
push ebp
call edi
push eax
call ebx
push ebp
call edi
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret