Function at 0x8a3740
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x92c
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.009687b0
test eax, eax
je 0x8a3a51
push 0xbd486c
push str.PrintScreenDisabled
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [ebp - 0x924], 1
call fcn.0094c0d0
mov esi, dword [0xbd486c]
lea eax, [ebp - 0x924]
push eax
push str.PrintScreenSetScanCode
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [ebp - 0x918], esi
call fcn.0094c0d0
xor ebx, ebx
cmp dword [ebp - 0x924], ebx
je 0x8a37cb
cmp esi, ebx
je 0x8a37d1
call fcn.008837c0
cmp eax, 2
je 0x8a37d1
mov dword [0xbd486c], ebx
mov dword [ebp - 0x918], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x914], ebx
cmp dword [ebp - 0x918], ebx
je 0x8a37fa
lea ecx, [ebp - 0x914]
push ecx
push str.SystemCurrentControlSetControlKeyboard_Layout
push 0x80000002
call edi
jmp 0x8a381f
lea edx, [ebp - 0x914]
push edx
push 1
push ebx
push str.SystemCurrentControlSetControlKeyboard_Layout
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
cmp eax, ebx
jne 0x8a3a51
push 0x800
lea eax, [ebp - 0x910]
push ebx
push eax
mov dword [ebp - 0x928], ebx
mov dword [ebp - 0x91c], ebx
mov dword [ebp - 0x920], 0x800
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x920]
push ecx
mov ecx, dword [ebp - 0x914]
lea edx, [ebp - 0x910]
push edx
lea eax, [ebp - 0x928]
push eax
push ebx
push str.Scancode_Map
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, eax
mov eax, dword [ebp - 0x920]
cmp dword [ebp - 0x918], ebx
je 0x8a3963
cmp eax, ebx
jbe 0x8a38de
cmp ecx, ebx
jne 0x8a38de
lea ecx, [ebp - 0x910]
mov esi, 0xb47b8c
cmp eax, 4
jb 0x8a38ba
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x8a38de
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x8a38a6
cmp eax, ebx
je 0x8a3908
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x8a38de
cmp eax, 1
jbe 0x8a3908
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x8a38de
cmp eax, 2
jbe 0x8a3908
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x8a3908
mov ecx, dword [ebp - 0x914]
push 0x1c
push 0xb47b8c
push 3
push ebx
push str.Scancode_Map
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x8a3908
mov dword [ebp - 0x91c], 1
mov eax, dword [ebp - 0x914]
cmp eax, ebx
je 0x8a391f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x914], ebx
cmp dword [ebp - 0x91c], ebx
je 0x8a3a51
push 0x103
lea edx, [ebp - 0x10f]
push ebx
push edx
mov byte [ebp - 0x110], bl
call fcn.00a7ffb0
add esp, 0xc
cmp dword [ebp - 0x918], ebx
je 0x8a3a22
push str.Reboot_Needed_for_PrintScreen_Block...
lea eax, [ebp - 0x110]
push eax
jmp 0x8a3a2e
cmp eax, ebx
jbe 0x8a3908
cmp ecx, ebx
jne 0x8a3908
lea ecx, [ebp - 0x910]
mov esi, 0xb47b8c
cmp eax, 4
jb 0x8a3994
jmp 0x8a3980
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x8a3908
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x8a3980
cmp eax, ebx
je 0x8a39c4
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x8a3908
cmp eax, 1
jbe 0x8a39c4
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x8a3908
cmp eax, 2
jbe 0x8a39c4
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x8a3908
mov ecx, dword [ebp - 0x914]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
lea edx, [ebp - 0x914]
push edx
push str.SystemCurrentControlSetControlKeyboard_Layout
push 0x80000002
mov dword [ebp - 0x914], ebx
call edi
test eax, eax
jne 0x8a3908
mov eax, dword [ebp - 0x914]
push str.Scancode_Map
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x8a3a14
mov dword [ebp - 0x91c], 1
mov ecx, dword [ebp - 0x914]
push ecx
call esi
jmp 0x8a3919
push str.Reboot_Needed_for_PrintScreen_UnBlock...
lea ecx, [ebp - 0x110]
push ecx
call fcn.00a78f30
add esp, 8
lea edx, [ebp - 0x110]
push edx
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
mov edx, str.Message
mov ecx, 0x80000002
call fcn.0094bd00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret