Function at 0x41317a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe60
mov eax, dword [0x69f564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x824]
push ebx
xor edi, edi
mov esi, ecx
push edi
push eax
call fcn.005426c0
push ebx
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.005426c0
push ebx
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.005426c0
add esp, 0x24
call fcn.00421c9b
push eax
lea ecx, [ebp - 0xe60]
call fcn.0040b182
call fcn.00421c9b
push eax
lea ecx, [ebp - 0xe5c]
call fcn.0040b182
push 0x5fd7a8
mov ebx, 0x5f9f9c
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.00404de4
push str.SystemCurrentControlSetControlKeyboard_Layouts_
lea eax, [ebp - 0xa2c]
push ebx
push eax
call fcn.00404de4
push 0x5f9ed8
lea ebx, [esi + 0x198]
push 0x5f9f9c
push ebx
call fcn.00404de4
lea eax, [ebp - 0x61c]
push str.wn.ime
push eax
call fcn.00549ff0
lea eax, [ebp - 0x61c]
push eax
call fcn.0054f2af
add esp, 0x30
mov dword [ebp - 0xe58], eax
lea eax, [ebp - 0xe4c]
mov esi, edi
push eax
lea eax, [ebp - 0x824]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41343c
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.005426c0
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xe40], 1
push edi
push eax
mov dword [ebp - 0xe48], 0x104
call fcn.005426c0
add esp, 0x18
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe40]
push eax
push edi
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x4133ff
push 0x208
lea eax, [ebp - 0xc34]
inc esi
push 0
push eax
call fcn.005426c0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xc34]
push 0x5f9edc
push eax
call fcn.00404de4
add esp, 0x1c
lea eax, [ebp - 0xe54]
push eax
lea eax, [ebp - 0xc34]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41343c
push 0x208
push eax
lea eax, [ebp - 0xe3c]
push eax
call fcn.005426c0
add esp, 0xc
mov dword [ebp - 0xe50], 0x104
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xe40]
push eax
push 0
push str.Ime_File
push dword [ebp - 0xe54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41339c
lea eax, [ebp - 0xe3c]
push eax
call fcn.0054f2af
push dword [ebp - 0xe58]
push eax
call fcn.00549fb0
add esp, 0xc
test eax, eax
je 0x41341b
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005426c0
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xe40], 1
push 0
push eax
mov dword [ebp - 0xe48], 0x104
call fcn.005426c0
add esp, 0x18
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe40]
push eax
push 0
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp - 0xe4c]
mov dword [ebp - 0xe44], 0x104
call edi
test eax, eax
je 0x4132db
jmp 0x413430
lea eax, [ebp - 0x20c]
push eax
push 0x5f9f9c
push ebx
call fcn.00404de4
add esp, 0xc
push dword [ebp - 0xe4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xe5c]
lea ecx, [ecx - 0x10]
call fcn.0040bb8d
mov ecx, dword [ebp - 0xe60]
lea ecx, [ecx - 0x10]
call fcn.0040bb8d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e8de
mov esp, ebp
pop ebp
ret