Function at 0x404bfe
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x264
mov eax, 0x5a94c2
call fcn.00553ddb
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x24c], eax
test esi, esi
jne 0x404c2a
xor al, al
jmp 0x404f23
lea eax, [ebp - 0x230]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x5bf568
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404c23
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x240]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x230]
mov dword [ebp - 0x240], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x404c82
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404c23
mov eax, ebx
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x248], 0x208
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
cmp dword [ebp - 0x240], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
jbe 0x404d9a
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x22c]
push ecx
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x248], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x244]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404d81
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x260]
push eax
push ebx
push str.Target_IME
push dword [ebp - 0x244]
mov dword [ebp - 0x260], 3
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404d79
lea eax, [ebp - 0x22c]
push eax
call fcn.00554e95
pop ecx
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x258]
call fcn.004265a8
cmp dword [ebp - 0x26c], esi
je 0x404e89
push dword [ebp - 0x244]
call edi
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp eax, dword [ebp - 0x240]
jb 0x404cbc
mov edi, dword [ebp - 0x254]
mov ebx, dword [ebp - 0x258]
push 0x64
pop esi
mov dword [ebp - 0x23c], esi
lea eax, [ebp - 0x23c]
push eax
push edi
push ebx
call fcn.00404720
add esp, 0xc
cmp eax, edi
je 0x404dd3
inc esi
mov dword [ebp - 0x23c], esi
cmp esi, 0x96
jle 0x404daf
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
pop ebx
cmp esi, 0x96
jge 0x404f16
push esi
lea eax, [ebp - 0x24]
push str._08d
push eax
call fcn.00554d64
add esp, 0xc
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x234], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x404ee0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x238]
push eax
push 3
push ebx
push str.Key_Modifiers
push dword [ebp - 0x234]
mov dword [ebp - 0x238], ebx
call esi
test eax, eax
jne 0x404e81
mov eax, dword [ebp - 0x264]
push 4
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x238]
push eax
push 3
push ebx
push str.Target_IME
push dword [ebp - 0x234]
call esi
test eax, eax
je 0x404eb5
push dword [ebp - 0x234]
jmp 0x404ede
lea eax, [ebp - 0x22c]
push eax
call fcn.00553cf3
pop ecx
push dword [ebp - 0x244]
mov esi, eax
call edi
push dword [ebp - 0x230]
call edi
cmp esi, dword [ebp + 0x10]
jg 0x404f16
lea eax, [ebp - 0x22c]
jmp 0x404f06
push 4
lea eax, [ebp - 0x238]
push eax
push 3
push ebx
push str.Virtual_Key
push dword [ebp - 0x234]
mov dword [ebp - 0x238], ebx
call esi
push dword [ebp - 0x234]
test eax, eax
je 0x404eea
call edi
push dword [ebp - 0x230]
call edi
jmp 0x404f16
call edi
push dword [ebp - 0x230]
call edi
lea eax, [ebp - 0x24]
push eax
call fcn.00553cf3
pop ecx
cmp eax, dword [ebp + 0x10]
jg 0x404f16
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24c]
call fcn.00554537
pop ecx
mov bl, 1
pop ecx
lea ecx, [ebp - 0x258]
call fcn.0040204a
mov al, bl
call fcn.00553d8a
ret 0xc