Function at 0x14018efe0
Capabilities:
Get common file path
Get keyboard layout
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x398
mov r13, qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor edx, edx
xor ecx, ecx
xor ebp, ebp
call r13
mov edi, eax
test eax, eax
jle 0x14018f2ec
mov r9d, 0x1a2
lea r8, global___func__.10
lea rdx, [0x14036d000]
mov ecx, 2
mov dword [rsp + 0x20], eax
call qword [dbg.default_logger]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rsi, qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
call rsi
xor ecx, ecx
mov rbx, rax
call rsi
movsxd rcx, edi
shl rcx, 3
mov rsi, rax
call sym.malloc
mov ecx, edi
mov qword [rsp + 0x38], rax
mov rdx, rax
call r13
mov r13d, eax
mov rax, qword [dbg.default_logger]
test r13d, r13d
jle 0x14018f2b8
cmp edi, r13d
je 0x14018f433
mov dword [rsp + 0x28], r13d
mov r9d, 0x1af
lea r8, global___func__.10
lea rdx, str._s___u_:_Locale_size_mismatch___Expected__i__received__i__n
mov dword [rsp + 0x20], edi
mov ecx, 3
call rax
mov r12, qword [0x1403c73e8]
test r12, r12
je 0x14018f48e
movsxd rdx, r13d
mov rax, qword [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdx
mov rsi, rdi
xor ebp, ebp
mov rdi, r12
lea r13, [rax + rdx*8]
lea r15, str._s___u_:_Removing_locale_ID__p_from_the_cache._n
mov r12, rax
lea r14, str._s___u_:_Found_locale_ID__p_in_the_cache._n
mov rdx, qword [rdi]
mov rax, r12
nop word cs:[rax + rax]
cmp rdx, qword [rax]
je 0x14018f308
add rax, 8
cmp rax, r13
jne 0x14018f100
mov qword [rsp + 0x20], rdx
mov r9d, 0x1d6
mov rdx, r15
mov ecx, 1
lea r8, global___func__.10
call qword [dbg.default_logger]
mov rax, qword [rdi + 0x28]
cmp qword [0x1403c73e0], rdi
mov qword [rsi + 0x28], rax
je 0x14018f348
mov rcx, rdi
call sym.free
mov rdi, qword [rsi + 0x28]
test rdi, rdi
jne 0x14018f0f0
mov rdi, rsi
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov r15, rdi
mov qword [rsp + 0x48], rbx
mov r14, qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
lea r13, [rax + rdx*8]
mov rdi, rax
jmp 0x14018f1bc
mov rax, qword [rdi]
mov r9d, 0x23c
lea r8, global___func__.10
lea rdx, str._s___u_:_Could_not_find_keyboard_map_for_locale__p__n
mov ecx, 4
mov qword [rsp + 0x20], rax
call qword [dbg.default_logger]
add rdi, 8
cmp r13, rdi
je 0x14018f2da
mov rcx, qword [rdi]
test rcx, rcx
je 0x14018f1af
lea rbx, [rsp + 0x170]
xor edx, edx
call r14
mov dword [rsp + 0x54], 0x104
mov rcx, rbx
mov dword [rsp + 0x50], 1
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
test eax, eax
je 0x14018f188
lea r12, [rsp + 0x280]
mov r9, rbx
mov edx, 0x3c
lea r8, str.SYSTEMCurrentControlSetControlKeyboard_Layouts_s
mov rcx, r12
call dbg.__mingw_snprintf
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
mov r9d, 1
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14018f188
lea rax, [rsp + 0x54]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.Layout_File
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14018f188
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14018f369
mov r9d, 0x237
lea r8, global___func__.10
mov ecx, 4
lea rdx, str._s___u_:_GetSystemDirectory___failed__n
call qword [dbg.default_logger]
jmp 0x14018f1af
mov r9d, 0x243
lea r8, global___func__.10
mov ecx, 4
lea rdx, str._s___u_:_GetKeyboardLayoutList___failed__n
call rax
mov r14, qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov rcx, qword [rsp + 0x38]
call sym.free
xor edx, edx
mov rcx, rsi
call r14
mov eax, ebp
add rsp, 0x398
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rax], 0
mov rax, qword [rdi]
mov r9d, 0x1c9
mov rdx, r14
lea r8, global___func__.10
mov ecx, 1
mov qword [rsp + 0x20], rax
call qword [dbg.default_logger]
cmp qword [rdi], rbx
je 0x14018f360
add ebp, 1
mov rsi, rdi
jmp 0x14018f14f
mov qword [0x1403c73e0], 0
jmp 0x14018f147
mov qword [0x1403c73e0], rdi
jmp 0x14018f337
mov rax, qword [rsp + 0x40]
mov r9, rbx
mov edx, 0x104
mov rcx, r12
lea r8, str._s_s
mov qword [rsp + 0x20], rax
call dbg.__mingw_snprintf
mov rax, qword [rsp + 0x40]
lea rdx, str._s___u_:_Loading_layout_for__p:__s._n
mov r9d, 0x1fe
lea r8, global___func__.10
mov ecx, 1
mov qword [rsp + 0x28], rax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
call qword [dbg.default_logger]
mov ecx, 0x30
call sym.malloc
mov rcx, r12
mov rbx, rax
mov rax, qword [rdi]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.KbdLayerDescriptor
mov qword [rbx + 8], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14018f458
call rax
mov rdx, qword [rax]
movq xmm0, qword [rdx]
movhps xmm0, qword [rax + 8]
movups xmmword [rbx + 0x10], xmm0
mov rax, qword [rax + 0x10]
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x20], rax
test r15, r15
je 0x14018f4a3
mov qword [r15 + 0x28], rbx
mov rax, qword [rsp + 0x48]
cmp qword [rbx], rax
je 0x14018f49a
add ebp, 1
mov r15, rbx
jmp 0x14018f1af
mov dword [rsp + 0x20], r13d
mov r9d, 0x1b2
lea r8, global___func__.10
lea rdx, str._s___u_:_Received__i_locales._n
mov ecx, 2
call rax
jmp 0x14018f0af
mov r9d, 0x22e
lea r8, global___func__.10
mov ecx, 4
lea rdx, str._s___u_:_GetProcAddress___failed_for_KbdLayerDescriptor__n
call qword [dbg.default_logger]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call sym.free
jmp 0x14018f1af
xor edi, edi
xor ebp, ebp
movsxd rdx, r13d
jmp 0x14018f165
mov qword [0x1403c73e0], rbx
jmp 0x14018f428
mov qword [0x1403c73e8], rbx
jmp 0x14018f41e