Function at 0x76fc33d0
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call sym.IMM32.dll_ImmLockClientImc
mov esi, eax
test esi, esi
je 0x76fc3596
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x76fc340a
add eax, ecx
mov eax, dword [eax + 0x800]
and eax, 0x100
or eax, 0
je 0x76fc35a1
cmp dword [esi], 0
je 0x76fc35ed
mov ecx, ebx
call fcn.76fc3930
push edi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [ebp - 4], eax
test eax, eax
je 0x76fc3596
test byte [eax + 0x130], 0x10
jne 0x76fc671e
mov dword [ebp - 8], 0
test ebx, ebx
je 0x76fc358c
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0xfdc]
test eax, eax
jns 0x76fc3477
add ecx, eax
mov eax, dword [0x76fdac28]
xor esi, esi
movzx edx, bx
cmp esi, dword [eax + 0xc]
jb 0x76fc3495
ja 0x76fc6741
cmp edx, dword [eax + 8]
jae 0x76fc6741
mov eax, dword [0x76fda9f0]
imul eax, edx
add eax, dword [0x76fda9e8]
cdq
mov esi, eax
mov eax, ebx
shr eax, 0x10
cmp ax, word [esi + 0x1a]
jne 0x76fc672a
test byte [esi + 0x19], 1
jne 0x76fc6741
cmp byte [esi + 0x18], 0x11
jne 0x76fc6741
mov edx, dword [ecx + 0x820]
mov eax, edx
or eax, dword [ecx + 0x824]
je 0x76fc674e
mov eax, dword [esi + 0x10]
cmp eax, dword [edx]
jne 0x76fc674e
mov eax, dword [esi + 0x14]
cmp eax, dword [edx + 4]
jne 0x76fc674e
mov edi, dword [ecx + 0x828]
add edi, dword [esi]
mov eax, dword [ecx + 0x82c]
adc eax, dword [esi + 4]
mov ecx, edi
or ecx, eax
je 0x76fc6741
movzx esi, word [edi]
imul esi, dword [0x76fda9f0]
mov eax, dword fs:[0x18]
add esi, dword [0x76fda9e8]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x76fc3531
add eax, ecx
cmp dword [eax + 0x78], 0
je 0x76fc6760
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x76fc354d
add eax, ecx
mov ebx, dword [eax + 0x78]
mov ecx, dword [eax + 0x7c]
mov eax, dword [esi + 8]
cdq
cmp eax, ebx
jne 0x76fc6779
cmp edx, ecx
jne 0x76fc6779
mov esi, dword [edi + 0x18]
test esi, esi
je 0x76fc3589
mov eax, dword [esi]
test eax, eax
je 0x76fc357b
push eax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
je 0x76fc6799
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], 0
jne 0x76fc67ce
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
jne 0x76fc35e5
mov ecx, dword [0x76fdac28]
mov eax, ecx
or eax, dword [0x76fdac2c]
je 0x76fc35e5
test byte [ecx], 4
je 0x76fc35e5
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov eax, ecx
shl eax, 0x10
push 1
or eax, ecx
push eax
call sym.IMM32.dll_CtfImmTIMActivate
lea edi, [esi + 0x10]
jmp 0x76fc341e
push 2
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
test eax, eax
je 0x76fc670c
push 0x164
push 0x42
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
je 0x76fc670c
push 1
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
push esi
push 1
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, eax
mov ecx, ebx
call fcn.76fc27a0
test eax, eax
jne 0x76fc3427
jmp 0x76fc66fe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], 0
push edi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push esi
call sym.IMM32.dll_ImmUnlockClientImc
jmp 0x76fc3596
mov dword [ebp - 8], 1
jmp 0x76fc345c
test ax, ax
je 0x76fc34b5
mov edx, 0xffff
cmp ax, dx
je 0x76fc34b5
push 6
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x76fc3589
push 0x38
push ebx
call dword [sym.imp.win32u.dll_NtUserCallOneParam]
mov edi, eax
xor eax, eax
jmp 0x76fc3505
push 0xe
call dword [sym.imp.win32u.dll_NtUserGetThreadState]
test eax, eax
jne 0x76fc353b
xor ebx, ebx
xor ecx, ecx
jmp 0x76fc3553
mov eax, dword [edi]
mov esi, dword fs:[0x18]
push 0
push eax
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
cmp eax, dword [esi + 0x20]
jne 0x76fc3589
jmp 0x76fc3567
test byte [esi + 8], 0x40
je 0x76fc3589
mov eax, dword [esi]
test eax, eax
je 0x76fc67b0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push esi
push 0
push dword [0x76fda9dc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x76fc3589
mov edi, dword [ebp + 0xc]
lea esi, [eax + 0x7c]
mov ecx, 7
mov eax, 1
rep movsd dword es:[edi], dword [esi]
jmp 0x76fc3598