Function at 0x1001fde0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007b567
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
push ebx
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x45], eax
mov esi, 1
push esi
mov dword [esp + 0x4d], eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x51], eax
push 0x100827ec
xor ebx, ebx
push ecx
mov dword [esp + 0x6c], 0x10
mov byte [esp + 0x50], bl
mov word [esp + 0x5d], ax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x10098a04]
add esp, 0xc
mov ecx, 0x10098a04
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [0x10098a04]
mov ecx, 0x10098a04
mov dword [esp + 0x26c], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x18
push str.keyboard_layoutpreload_
lea ecx, [esp + 0x18]
mov byte [esp + 0x274], 1
call fcn.100048d0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.10002a40
add esp, 4
add eax, 0x10
mov dword [esp + 0x64], eax
lea eax, [esp + 0x44]
mov byte [esp + 0x26c], 2
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1001feb0
sub eax, ecx
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.1000cde0
push fcn.100034a0
push fcn.10003480
push 0x64
push 4
lea edx, [esp + 0xe0]
push edx
xor edi, edi
call fcn.100697e1
lea eax, [esp + 0xd0]
mov byte [esp + 0x26c], 3
mov ebp, 0x100968e0
mov dword [esp + 0x1c], eax
jmp 0x1001ff03
mov esi, dword [esp + 0x58]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1001ff5d
xor eax, eax
mov byte [esp + 0x68], bl
mov ecx, 0x18
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
test eax, eax
je 0x10020153
mov edi, 1
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x68]
mov byte [esp + eax + 0x24], cl
inc eax
cmp cl, bl
jne 0x1001ff50
xor ecx, ecx
inc esi
mov dword [esp + 0x35], ecx
push esi
mov dword [esp + 0x3d], ecx
lea edx, [esp + 0x38]
mov dword [esp + 0x41], ecx
push 0x100827ec
push edx
mov dword [esp + 0x64], esi
mov byte [esp + 0x40], bl
mov word [esp + 0x4d], cx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x18
push str.keyboard_layoutpreload_
lea ecx, [esp + 0x18]
call fcn.100048d0
lea eax, [esp + 0x34]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001ffa4
sub eax, edx
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
call fcn.1000cde0
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10020153
push 0x32
push str.SystemCurrentControlSetControlKeyboard_Layouts_
lea ecx, [esp + 0x1c]
call fcn.100048d0
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001fff1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
call fcn.1000cde0
mov eax, dword [esp + 0x1c]
mov ecx, eax
add eax, 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10020020
sub eax, esi
push eax
lea edx, [esp + 0x28]
push edx
call fcn.100048d0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10020120
push 0x50
call fcn.10067994
mov ecx, dword [esp + 0x1c]
add esp, 4
lea edx, [esp + 0x54]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x64]
push eax
push ebx
push str.IME_File
push ecx
mov dword [esp + 0x74], 1
mov dword [esp + 0x6c], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100200a5
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10020094
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
jmp 0x1002010b
cmp edi, ebx
je 0x100200f0
cmp esi, ebx
jne 0x100200c6
xor eax, eax
push eax
push esi
mov ecx, 0x10096a70
call fcn.100048d0
push esi
call fcn.10069196
add esp, 4
jmp 0x10020140
mov eax, esi
lea edx, [eax + 1]
jmp 0x100200d0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100200d0
sub eax, edx
push eax
push esi
mov ecx, 0x10096a70
call fcn.100048d0
push esi
call fcn.10069196
add esp, 4
jmp 0x10020140
cmp esi, ebx
jne 0x100200f8
xor eax, eax
jmp 0x10020109
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10020100
sub eax, edx
push eax
push esi
mov ecx, ebp
call fcn.100048d0
push esi
add ebp, 4
call fcn.10069196
add esp, 4
jmp 0x10020140
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10020127
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, ebp
call fcn.100048d0
add ebp, 4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x1001feff
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push fcn.100034a0
push 0x64
push 4
lea eax, [esp + 0xdc]
push eax
mov byte [esp + 0x27c], 2
call fcn.100691f9
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
mov byte [esp + 0x26c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100201a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x26c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100201c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x26c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100201f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x264]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret