Function at 0x100817f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f2fee
mov eax, dword fs:[0]
push eax
sub esp, 0x388
mov eax, dword [0x10275008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x35c], ebx
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x37c], esi
mov dword [ebp - 0x360], 0
call fcn.1000ab20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x360], 1
xor edi, edi
call fcn.100052e0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea ecx, [ebp - 0x378]
push 0x10225b08
call fcn.10005290
push str.Keyboard_LayoutPreload
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 2
call fcn.10005290
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x354]
cmp dword [ebp - 0x380], 8
lea eax, [ebp - 0x394]
push ecx
cmovae eax, dword [ebp - 0x394]
push 0x20019
push edi
push eax
push dword [ebx + 0x14]
mov dword [ebp - 0x354], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x10081929
cmp dword [ebp - 0x364], 8
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
lea eax, [ebp - 0x378]
cmovae eax, dword [ebp - 0x378]
push ebx
push eax
push dword [ebp - 0x354]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x354]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 2
call fcn.10005250
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 1
call fcn.10005250
test ebx, ebx
jne 0x1008198c
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10081954
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.10005390
push 0x10
lea eax, [ebp - 0x218]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov edi, eax
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea ecx, [ebp - 0x378]
push str.Keyboard_LayoutSubstitutes
call fcn.10005290
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x354]
cmp dword [ebp - 0x364], 8
lea eax, [ebp - 0x378]
push ecx
cmovae eax, dword [ebp - 0x378]
push 0x20019
push ebx
push eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x354], ebx
push dword [eax + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x358], eax
test eax, eax
jne 0x10081a45
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ebx
push eax
push dword [ebp - 0x354]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x354]
mov dword [ebp - 0x358], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 1
call fcn.10005250
cmp dword [ebp - 0x358], 0
jne 0x10081a73
push 0x10
lea eax, [ebp - 0x218]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov ebx, eax
mov eax, 0x409
test edi, edi
push 0x11c
cmove edi, eax
movzx eax, di
mov dword [ebp - 0x354], eax
lea eax, [ebp - 0x350]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x350], 0x11c
lea ecx, [ebp - 0x350]
call fcn.100e34f0
test al, al
mov eax, dword [ebp - 0x354]
je 0x10081ada
cmp dword [ebp - 0x34c], 6
jb 0x10081ada
cmp edi, eax
jne 0x10081ada
mov ecx, dword [ebp - 0x35c]
push esi
push eax
call fcn.10081b60
mov dword [esi + 8], ebx
jmp 0x10081b25
push 0x26
push 0x10224e80
lea ecx, [esi + 0x10]
mov dword [esi], eax
call fcn.10005390
push 0x26
push 0x10224e80
lea ecx, [esi + 0x28]
call fcn.10005390
mov dword [esi + 8], ebx
test ebx, ebx
je 0x10081b0f
movzx eax, bx
imul eax, eax, 0x10001
mov dword [esi + 4], eax
jmp 0x10081b25
cmp edi, dword [ebp - 0x354]
jne 0x10081b22
imul eax, dword [esi], 0x10001
mov dword [esi + 4], eax
jmp 0x10081b25
mov dword [esi + 4], edi
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.10005250
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101c837b
mov esp, ebp
pop ebp
ret 4