Function at 0x413126
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe60
mov eax, dword [0x6a1564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x824]
push ebx
xor edi, edi
mov esi, ecx
push edi
push eax
call fcn.00543220
push ebx
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.00543220
push ebx
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.00543220
add esp, 0x24
call fcn.00421d63
push eax
lea ecx, [ebp - 0xe60]
call fcn.0040b1c2
call fcn.00421d63
push eax
lea ecx, [ebp - 0xe5c]
call fcn.0040b1c2
push 0x5fe7c8
mov ebx, 0x5fafbc
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.00404de4
push str.SystemCurrentControlSetControlKeyboard_Layouts_
lea eax, [ebp - 0xa2c]
push ebx
push eax
call fcn.00404de4
push 0x5faef8
lea ebx, [esi + 0x198]
push 0x5fafbc
push ebx
call fcn.00404de4
lea eax, [ebp - 0x61c]
push str.wn.ime
push eax
call fcn.0054ab6b
lea eax, [ebp - 0x61c]
push eax
call fcn.0054fe94
add esp, 0x30
mov dword [ebp - 0xe58], eax
lea eax, [ebp - 0xe4c]
mov esi, edi
push eax
lea eax, [ebp - 0x824]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4133e8
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00543220
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xe40], 1
push edi
push eax
mov dword [ebp - 0xe48], 0x104
call fcn.00543220
add esp, 0x18
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe40]
push eax
push edi
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x4133ab
push 0x208
lea eax, [ebp - 0xc34]
inc esi
push 0
push eax
call fcn.00543220
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xc34]
push 0x5faefc
push eax
call fcn.00404de4
add esp, 0x1c
lea eax, [ebp - 0xe54]
push eax
lea eax, [ebp - 0xc34]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4133e8
push 0x208
push eax
lea eax, [ebp - 0xe3c]
push eax
call fcn.00543220
add esp, 0xc
mov dword [ebp - 0xe50], 0x104
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xe40]
push eax
push 0
push str.Ime_File
push dword [ebp - 0xe54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413348
lea eax, [ebp - 0xe3c]
push eax
call fcn.0054fe94
push dword [ebp - 0xe58]
push eax
call fcn.0054ab2b
add esp, 0xc
test eax, eax
je 0x4133c7
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00543220
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xe40], 1
push 0
push eax
mov dword [ebp - 0xe48], 0x104
call fcn.00543220
add esp, 0x18
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe40]
push eax
push 0
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp - 0xe4c]
mov dword [ebp - 0xe44], 0x104
call edi
test eax, eax
je 0x413287
jmp 0x4133dc
lea eax, [ebp - 0x20c]
push eax
push 0x5fafbc
push ebx
call fcn.00404de4
add esp, 0xc
push dword [ebp - 0xe4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xe5c]
lea ecx, [ecx - 0x10]
call fcn.0040bbcd
mov ecx, dword [ebp - 0xe60]
lea ecx, [ecx - 0x10]
call fcn.0040bbcd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e9c4
mov esp, ebp
pop ebp
ret