Function at 0x18001ce40
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r12
push r13
push r14
lea rbp, [r11 - 0x388]
sub rsp, 0x458
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r13, qword [rbp + 0x3b0]
mov r12, r9
movzx edi, r8w
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x18001d125
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x38], r15
test r8w, r8w
jne 0x18001cea7
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call qword [sym.imp.ntdll.dll_wcstoul]
mov edi, eax
xor esi, esi
test byte [r12], 2
je 0x18001cf07
lea rax, str.keyboardlayout.ini
mov r8, rbx
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e0]
mov rdx, rbx
mov dword [rsp + 0x20], 9
lea rcx, str.Substitutes
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_WritePrivateProfileStringW]
lea r8, [rbp + 0x1e0]
mov word [rbp + 0x1f0], si
lea edx, [rsi + 9]
mov rcx, rbx
call fcn.18001d138
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call qword [sym.imp.ntdll.dll_wcstoul]
lea r8, str.RegistryMachineSystemCurrentControlSetControlKeyboard_Layouts_
mov edx, 0x9a
lea rcx, [rbp + 0x200]
mov r15d, eax
lea rax, [rbp + 0x200]
sub r8, rcx
nop word [rax + rax]
lea rcx, [rdx + 0x7fffff64]
test rcx, rcx
je 0x18001cf68
movzx ecx, word [r8 + rax]
test cx, cx
je 0x18001cf68
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x18001cf40
jmp 0x180040bf0
test rdx, rdx
je 0x180040bf0
xor ecx, ecx
mov r8, rbx
mov word [rax], cx
mov edx, 0x9a
lea rcx, [rbp + 0x200]
call fcn.18001d260
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x70], 0x40
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
mov edx, 0x20019
lea rcx, [rsp + 0x38]
movdqu xmmword [rsp + 0x78], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
lea rcx, [rsp + 0x40]
test eax, eax
js 0x180040c90
lea rdx, str.Layout_File
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
mov r8d, 2
mov dword [rsp + 0x20], 0x210
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, 0x80000000
mov ecx, eax
add eax, ebx
test ebx, eax
je 0x18001d114
xor eax, eax
lea rsi, [rbp - 0x24]
mov word [rbp + 0x1da], ax
lea rdx, str.Attributes
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
mov r8d, 2
mov dword [rsp + 0x20], 0x14
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jns 0x180040bf9
mov edx, 0xf000
mov ecx, r15d
shr ecx, 0x10
movzx eax, cx
and ax, dx
mov edx, 0xe000
cmp ax, dx
je 0x18001d129
test cx, cx
jne 0x180040c0a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
movzx eax, r15w
shl eax, 0x10
movzx ebx, di
or eax, ebx
mov dword [r13], eax
test rsi, rsi
je 0x180040d5b
mov r8, rsi
mov edx, 0x104
mov rcx, r14
call fcn.18001d138
mov r15, qword [rsp + 0x450]
mov rax, r14
mov rsi, qword [rsp + 0x4a0]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.180033470
add rsp, 0x458
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
cmp ecx, 0x80000005
je 0x18001d032
jmp 0x18001d03f
xor eax, eax
jmp 0x18001d0f4
mov r15d, ecx
jmp 0x18001d0ad
sub rax, 2
jmp 0x18001cf71
mov eax, dword [rbp - 0x6c]
and eax, 0xff0000
or dword [r12], eax
jmp 0x18001d085
lea rdx, str.Layout_ID
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x60]
mov r8d, 2
mov dword [rsp + 0x20], 0x30
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, eax
add eax, ebx
test ebx, eax
jne 0x180040c63
cmp ecx, 0x80000005
je 0x180040c63
mov r15d, 0xfffe
jmp 0x18001d0ad
xor eax, eax
lea rcx, [rbp - 0x54]
xor edx, edx
mov word [rbp - 0x36], ax
lea r8d, [rax + 0x10]
call qword [sym.imp.ntdll.dll_wcstol]
mov r15d, eax
mov eax, 0xf000
and r15d, 0xfff
or r15d, eax
jmp 0x18001d0ad
xor eax, eax
lea rdx, str.RegistryMachineSystemCurrentControlSetControlKeyboard_Layout
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x70], 0x40
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
mov edx, 0x20019
lea rcx, [rsp + 0x38]
movdqu xmmword [rsp + 0x78], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x18001d0b8
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
mov r8d, 2
mov dword [rsp + 0x20], 0x210
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
cmp eax, 0x80000005
jne 0x180040d2f
xor eax, eax
mov ebx, eax
jmp 0x180040d35
test eax, eax
js 0x180040d3c
xor eax, eax
mov word [rbp + 0x1da], ax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
lea rsi, [rbp - 0x24]
mov eax, 0
cmovs rsi, rax
jmp 0x18001d0b8
call qword [sym.imp.KERNELBASE.dll_WTSGetServiceSessionId]
mov ecx, eax
mov rax, qword gs:[0x60]
cmp dword [rax + 0x2c0], ecx
je 0x180040dec
call qword [sym.imp.ntdll.dll_RtlGetActiveConsoleId]
mov ecx, eax
mov rax, qword gs:[0x60]
cmp dword [rax + 0x2c0], ecx
je 0x180040dec
shr r15d, 0x10
mov eax, 0xf000
and r15w, ax
mov eax, 0xe000
cmp r15w, ax
jne 0x180040dec
mov eax, 0x3ff
and di, ax
cmp di, 0x11
jne 0x180040dc1
lea rsi, str.kbdjpn.dll
mov eax, 0x4110411
jmp 0x180040de3
cmp di, 0x12
jne 0x180040dd5
lea rsi, str.kbdkor.dll
mov eax, 0x4120412
jmp 0x180040de3
mov eax, ebx
lea rsi, str.kbdus.dll
shl eax, 0x10
or eax, ebx
mov dword [r13], eax
jmp 0x18001d0d1
mov dword [r13], 0x4090409
lea rsi, str.kbdus.dll
jmp 0x18001d0d1