Function at 0x40d8a1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7a4]
sub esp, 0x824
mov eax, dword [0x43fb20]
xor eax, ebp
mov dword [ebp + 0x7a0], eax
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x6c], esi
call fcn.0040d71d
movzx eax, ax
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
mov edi, 0xf003f
push edi
push esi
push esi
push esi
push str.Control_PanelInput_Method
push 0x80000001
mov dword [ebp - 0x70], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x40d91b
push 1
push 0x437c2c
push 1
push esi
push 0x437c30
push dword [ebp - 0x64]
call ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x5a0]
push str.E0000804
push eax
call fcn.0041a076
cmp word [ebp - 0x68], 4
pop ecx
pop ecx
je 0x40d93c
cmp word [ebp - 0x68], 1
jne 0x40d945
mov word [ebp + 0x5aa], 0x34
lea eax, [ebp - 0x64]
push eax
push edi
push esi
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40daf5
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x6c], esi
je 0x40dae3
mov dword [ebp - 0x68], esi
jbe 0x40dae3
xor eax, eax
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp + 0x3a0]
push ecx
push eax
push dword [ebp - 0x64]
mov word [ebp + 0x3a0], si
mov dword [ebp - 0x7c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 4
lea eax, [ebp + 0x5a8]
push eax
lea eax, [ebp + 0x3a8]
push eax
call fcn.0041a2ea
add esp, 0xc
test eax, eax
jne 0x40dab5
push 4
lea eax, [ebp + 0x3a0]
pop edx
movzx ecx, word [eax]
cmp cx, 0x61
jb 0x40d9f3
cmp cx, 0x66
ja 0x40d9f3
add ecx, 0xffffffe0
mov word [eax], cx
inc eax
inc eax
dec edx
jne 0x40d9de
push 4
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp + 0x3a0]
push eax
call fcn.0041a2ea
add esp, 0xc
test eax, eax
jle 0x40da29
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp + 0x5a0]
push eax
call fcn.0041a076
pop ecx
pop ecx
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp - 0x60]
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts_s
push eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], 0x80
mov word [ebp + 0x1a0], si
call fcn.0041a16c
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push edi
push esi
lea eax, [ebp - 0x60]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dab5
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1a0]
push eax
push esi
push esi
push str.Ime_File
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40daac
mov eax, dword [ebp - 0x78]
mov word [ebp + eax*2 + 0x1a0], si
lea eax, [ebp + 0x1a0]
push 0x435d48
push eax
call fcn.00418f4c
test eax, eax
pop ecx
pop ecx
je 0x40dac7
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x68]
movzx eax, word [ebp - 0x68]
cmp eax, dword [ebp - 0x6c]
jb 0x40d98e
jmp 0x40dae3
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp + 0x5a0]
push eax
call fcn.0041a076
pop ecx
pop ecx
mov dword [ebp - 0x70], 1
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x70], esi
jne 0x40dbf2
push 3
pop ecx
movzx eax, cx
movzx eax, word [ebp + eax*2 + 0x5a0]
cmp ax, 0x30
jb 0x40db0f
cmp ax, 0x39
jb 0x40db29
cmp ax, 0x41
jb 0x40db1b
cmp ax, 0x46
jb 0x40db29
cmp ax, 0x39
je 0x40db38
add ecx, 0xffff
jmp 0x40daf8
movzx eax, cx
lea eax, [ebp + eax*2 + 0x5a0]
inc word [eax]
jmp 0x40db45
movzx eax, cx
mov word [ebp + eax*2 + 0x5a0], 0x41
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp + 0x3a0]
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts_s
push eax
call fcn.0041a16c
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push edi
push esi
push esi
push esi
lea eax, [ebp + 0x3a0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dc17
push 0x16
push 0x435d48
push 1
push esi
push str.Ime_File
push dword [ebp - 0x64]
call ebx
push 0x12
push str.kbdus.dll
push 1
push esi
push str.Layout_File
push dword [ebp - 0x64]
call ebx
mov edi, 0x437d74
push edi
call fcn.0041970d
pop ecx
add eax, eax
push eax
push edi
push 1
push esi
push str.Layout_Text
push dword [ebp - 0x64]
call ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x70]
push eax
push 0x5dc
push esi
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlKeyboard_Layouts
push esi
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea eax, [ebp + 0x5a0]
push eax
call fcn.0040d755
pop ecx
mov ecx, dword [ebp + 0x7a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418c19
add ebp, 0x7a4
leave
ret
xor al, al
jmp 0x40dbff