Function at 0x1005edc5
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
mov eax, dword [0x100cea68]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, eax
call fcn.1005fa68
mov ecx, eax
call fcn.1005fe2f
mov ebx, eax
push 0x100d4fb8
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x11
push 0x89
push 0x18
push 0xc
pop esi
mov dl, 1
mov ecx, esi
call fcn.1005f4e4
push 0x17
pop eax
cmp ebx, 0x3a4
jne 0x1005ee36
mov ecx, 0x1000a5a0
call fcn.10062872
movzx eax, ax
push 0x11
mov edi, 0x8a
xor dl, dl
push edi
push eax
mov ecx, esi
call fcn.1005f4e4
cmp ebx, 0x3b5
jne 0x1005ee5d
mov ecx, 0x1000a598
call fcn.10062872
movzx esi, ax
push 0x31
push 0x89
push esi
push 0xe
mov dl, 1
pop ecx
call fcn.100111cc
push 0x31
push edi
push esi
push 0xe
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x1c
pop esi
cmp ebx, 0x3b6
jne 0x1005ee95
mov ecx, 0x1000a58c
call fcn.10062872
movzx esi, ax
push 0x36
pop edi
push edi
push 0x89
push esi
push 0xf
movzx eax, si
mov dl, 1
pop ecx
mov dword [esp + 0x18], eax
call fcn.1005f4e4
push edi
push 0x8a
push esi
push 0xf
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x1f
pop esi
cmp ebx, 0x3a8
jne 0x1005eed9
mov ecx, 0x1000a584
call fcn.10062872
movzx esi, ax
push edi
push 0x89
push esi
push 0xd
mov dl, 1
pop ecx
call fcn.1005f4e4
push edi
push 0x8a
push esi
push 0xd
xor dl, dl
pop ecx
call fcn.1005f4e4
xor esi, esi
push 0x20
mov edi, esi
pop ebx
cmp edi, 0x36
jae 0x1005ef22
push ebx
push 8
push 0x24
mov dl, 1
mov ecx, edi
call fcn.1005f4e4
push ebx
push 0xa
push esi
xor dl, dl
mov ecx, edi
call fcn.1005f4e4
inc edi
cmp edi, 8
jle 0x1005ef02
push esi
push 8
push 0x28
push 0xa
mov dl, 1
pop ecx
call fcn.1005f4e4
push esi
push 0xa
push 0x28
push 0xa
xor dl, dl
pop ecx
call fcn.1005f4e4
push ebx
push 8
call fcn.1005d4a2
movzx eax, al
mov dl, 1
neg eax
sbb eax, eax
and eax, 0xffffffef
add eax, 0x24
push eax
push 0xb
pop edi
mov ecx, edi
call fcn.1005f4e4
push ebx
push 0xe
push 5
xor dl, dl
mov ecx, edi
call fcn.1005f4e4
push ebx
push 0x88
push 0x21
pop ebx
push ebx
push 0x23
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push ebx
push 0x23
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push 0x88
push ebx
push 0x13
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push ebx
push 0x13
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push 0x88
push 0x1e
pop ebx
push ebx
push 0x19
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push ebx
push 0x19
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push 0x88
push 0x26
push 0x1d
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push 0x26
push 0x1d
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push 0x88
push edi
push 0x1c
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push edi
push 0x1c
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
add edi, 0x7d
mov dl, 1
push edi
push 0x11
push 0x16
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push 0x11
push 0x16
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push edi
push 0x10
push 0x1b
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push 0x10
push 0x1b
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push edi
push 0xf
mov dl, 1
mov ecx, ebx
call fcn.1005f4e4
push 0x20
push 0x8a
push 0xf
xor dl, dl
mov ecx, ebx
call fcn.1005f4e4
push 0x20
pop ebx
push ebx
push edi
push 0x27
push 0x17
mov dl, 1
pop ecx
call fcn.1005f4e4
push ebx
push 0x8a
push 0x27
xor dl, dl
push 0x17
pop ecx
call fcn.1005f4e4
push ebx
push edi
push 0x1d
push 0x18
mov dl, 1
pop ecx
call fcn.1005f4e4
push ebx
push 0x8a
push 0x1d
push 0x18
xor dl, dl
pop ecx
call fcn.1005f4e4
push ebx
push edi
push 9
push 0x14
mov dl, 1
pop ecx
call fcn.1005f4e4
push ebx
push 0x8a
push 9
push 0x14
xor dl, dl
pop ecx
call fcn.1005f4e4
push ebx
push edi
push 0x19
push 0x15
mov dl, 1
pop ecx
call fcn.1005f4e4
push ebx
push 0x8a
push 0x19
push 0x15
xor dl, dl
pop ecx
call fcn.1005f4e4
push ebx
push edi
push 0xe
push 0x1a
mov dl, 1
pop ecx
call fcn.1005f4e4
push ebx
push 0x8a
push 0xe
push 0x1a
xor dl, dl
pop ecx
call fcn.1005f4e4
push ebx
push edi
push 0xd
push 0x1f
mov dl, 1
pop ecx
call fcn.1005f4e4
push ebx
push 0x8a
push 0xd
push 0x1f
xor dl, dl
pop ecx
call fcn.1005f4e4
push ebx
push 0x87
push 8
mov dl, 1
mov ecx, ebx
call fcn.1005f4e4
push ebx
push 0x8a
push 8
xor dl, dl
mov ecx, ebx
call fcn.1005f4e4
push ebx
add ebx, 0x6b
mov dl, 1
push ebx
push 0x12
push 0x21
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push 0x12
push 0x21
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push edi
push 1
push 0x22
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push 1
push 0x22
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push edi
push 0x1a
push 0x25
pop edi
mov dl, 1
mov ecx, edi
call fcn.1005f4e4
push 0x20
push 0x8a
push 0x1a
xor dl, dl
mov ecx, edi
call fcn.1005f4e4
push 0x20
push 0x88
push 0x1b
push 0x26
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push 0x1b
push 0x26
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push 0x88
push 0xa
push 0x27
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push 0xa
push 0x27
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x20
push 0x88
push 0x1a
mov dl, 1
mov ecx, edi
call fcn.1005f4e4
push 0x20
push 0x8a
push 0x1a
xor dl, dl
mov ecx, edi
call fcn.1005f4e4
push 0x20
pop edi
push edi
push ebx
push 7
push 0x2a
mov dl, 1
pop ecx
call fcn.1005f4e4
push edi
push 0x8a
push 7
push 0x2a
xor dl, dl
pop ecx
call fcn.1005f4e4
push edi
push ebx
push 0x16
push 0x2b
mov dl, 1
pop ecx
call fcn.1005f4e4
push edi
push 0x8a
push 0x16
push 0x2b
xor dl, dl
pop ecx
call fcn.1005f4e4
push edi
push ebx
push 0x14
push 0x2d
mov dl, 1
pop ecx
call fcn.1005f4e4
push edi
push 0x8a
push 0x14
push 0x2d
xor dl, dl
pop ecx
call fcn.1005f4e4
push edi
add edi, 0x6c
mov dl, 1
push edi
push 0x15
push 0x2e
pop ecx
call fcn.1005f4e4
push 0x20
push edi
push 0x15
push 0x2e
xor dl, dl
pop ecx
call fcn.1005f4e4
mov edi, dword [esp + 0x14]
push 0x20
pop ebx
cmp edi, 0x3a8
jne 0x1005f2f5
mov ecx, 0x1000a570
call fcn.10062872
movzx ebx, ax
push 0x20
push 0x89
push ebx
push 0x33
mov dl, 1
pop ecx
call fcn.1005f4e4
push 0x20
push 0x8a
push ebx
push 0x33
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x10
push 0xa
push 4
push 0x34
xor dl, dl
pop ecx
call fcn.1005f4e4
push 0x10
push 0xa
push 4
push 0x35
xor dl, dl
pop ecx
call fcn.1005f4e4
cmp dword [0x100d511c], 2
mov dword [esp + 0x14], esi
jne 0x1005f3d6
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push 1
push esi
push 0x1000a358
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005f3d6
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esi
push eax
lea eax, [esp + 0x424]
mov dword [esp + 0x20], 0x40
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0x1000a3f0
push dword [esp + 0x24]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1005f3c0
cmp dword [esp + 0x18], 1
jne 0x1005f3c0
lea ecx, [esp + 0x420]
call fcn.10062872
movzx ebx, ax
mov eax, ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], eax
cmp dword [esp + 0x10], esi
je 0x1005f3d0
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [esp + 0x14], esi
jne 0x1005f3f8
mov ecx, 0x1000a550
cmp edi, 0x3a8
je 0x1005f3e8
mov ecx, 0x1000a510
call fcn.10062872
movzx ebx, ax
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x1005f3fc
mov eax, dword [esp + 0xc]
push 0x2f
pop edi
cmp edi, 0x30
jne 0x1005f409
movzx ecx, bx
jmp 0x1005f411
movzx ecx, ax
cmp edi, 0x36
jae 0x1005f426
push 0x20
push 0x89
push ecx
mov dl, 1
mov ecx, edi
call fcn.1005f4e4
mov eax, dword [esp + 0xc]
cmp edi, 0x30
jne 0x1005f430
movzx ecx, bx
jmp 0x1005f438
movzx ecx, ax
cmp edi, 0x36
jae 0x1005f44d
push 0x20
push 0x8a
push ecx
xor dl, dl
mov ecx, edi
call fcn.1005f4e4
mov eax, dword [esp + 0xc]
inc edi
cmp edi, 0x33
jl 0x1005f3ff
lea eax, [esp + 0x20]
push eax
push 0x100
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, eax
test edi, edi
jle 0x1005f488
mov cx, word [esp + esi*4 + 0x20]
call fcn.1005fa68
cmp eax, 0x2e
ja 0x1005f483
mov ecx, dword [esp + esi*4 + 0x20]
mov dword [eax*4 + 0x100d5050], ecx
inc esi
cmp esi, edi
jl 0x1005f469
push 0x100d4fb8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x464]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100c6890
mov esp, ebp
pop ebp
ret