Function at 0x402040
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xf4
lea ecx, [esp + 0x18]
push ebx
push esi
push edi
push eax
push str._08x
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call fcn.004116f0
test eax, eax
je 0x402146
mov eax, dword [esp + 0x104]
lea edx, [esp + 0xc]
push edx
push 0xf003f
push 0
push str.Keyboard_LayoutPreload
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x9c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor edi, edi
push ecx
push edx
mov edx, dword [esp + 0x14]
push edi
lea eax, [esp + 0x1c]
push edi
lea ecx, [esp + 0x48]
push eax
push ecx
mov esi, 0x64
push edi
push edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call ebx
cmp eax, 0x103
je 0x402136
lea eax, [esp + 0x24]
lea ecx, [esp + 0x9c]
push eax
push ecx
call fcn.00420a60
add esp, 8
test eax, eax
je 0x402126
lea edx, [esp + 0x14]
lea eax, [esp + 0x9c]
push edx
push eax
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x48]
inc edi
push ecx
push edx
push edi
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call ebx
cmp eax, 0x103
jne 0x4020ca
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40224a
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40224a
mov edx, dword [esp + 0x104]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0xc]
push ebp
push ecx
push 0xf003f
push 0
push str.keyboard_layoutpreload
push edx
call ebx
lea eax, [esp + 0x20]
xor edi, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov eax, dword [esp + 0x14]
push edi
push edi
lea ecx, [esp + 0x20]
push edi
lea edx, [esp + 0x4c]
push ecx
push edx
mov esi, 0x64
push edi
push eax
mov dword [esp + 0x34], esi
call ebp
cmp eax, 0x103
je 0x40223e
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
lea edx, [esp + 0x44]
push 0
push edx
push eax
call ebx
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
lea edx, [esp + 0xa0]
push ecx
push edx
push 0
push 0
push 0x4313e8
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x28]
lea eax, [esp + 0xa0]
push edx
push eax
call fcn.00420a60
add esp, 8
test eax, eax
je 0x40222e
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x4c]
inc edi
push edx
push eax
push edi
push ecx
mov dword [esp + 0x34], esi
call ebp
cmp eax, 0x103
jne 0x40219e
jmp 0x40223e
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov edx, dword [esp + 0x104]
push edx
call fcn.00401840
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0xf4
ret