Function at 0x1060f47
Capabilities:
Get common file path
Get keyboard layout

Disassembly:
push 0x50
mov eax, 0x10b725d
call fcn.010aac1c
mov esi, ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x10]
push eax
push 0x10135c0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], 0x80070057
call fcn.010ab82f
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, 0x69
jae 0x1061347
mov eax, ecx
imul eax, eax, 0xc
lea edi, [eax + esi]
cmp dword [edi + 8], ebx
je 0x1061347
mov esi, ecx
imul esi, esi, 0x24
add esi, 0x1012318
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x10], ebx
cmp eax, ebx
je 0x1060ff1
mov esi, dword [esi + 8]
sub esi, ebx
je 0x1060fe5
dec esi
je 0x1060fd4
dec esi
je 0x1060fc0
mov dword [ebp - 0x10], 0x8000ffff
jmp 0x1061347
push dword [edi + 4]
push eax
push dword [edi + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1061347
push eax
push dword [edi + 4]
push dword [edi + 8]
call fcn.01060794
jmp 0x1061347
mov ecx, dword [edi + 8]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x1061347
cmp dword [esi + 8], 3
je 0x1061297
cmp ecx, 0x5a
ja 0x106122e
cmp ecx, 0x59
jae 0x106121d
cmp ecx, 5
je 0x10611fb
cmp ecx, 0xf
je 0x10610bf
cmp ecx, 0x10
je 0x1061097
cmp ecx, 0x11
je 0x106107d
cmp ecx, 0x14
jbe 0x1060fb4
cmp ecx, 0x17
jbe 0x1061245
cmp ecx, 0x18
jne 0x1060fb4
push 0x2c
pop esi
mov dword [ebp - 0x5c], esi
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, eax
call fcn.01031d96
mov dword [ebp - 0x54], 3
cmp dword [edi + 4], esi
jne 0x1061071
push esi
lea eax, [ebp - 0x5c]
jmp 0x1060fc3
mov dword [ebp - 0x10], 0x80004005
jmp 0x1061347
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
push dword [edi + 8]
mov ecx, eax
call fcn.01035408
jmp 0x106128f
push ebx
push ebx
call fcn.010ab9f9
mov esi, eax
cmp esi, ebx
je 0x1061071
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [edi + 8]
push ebx
push esi
push ebx
mov dword [ecx], eax
call fcn.010abb1d
jmp 0x1061347
cmp dword [edi + 4], 4
jne 0x1061071
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x59
mov byte [ebp - 0x28], 1
mov byte [ebp - 0x27], 1
call fcn.010acd08
test eax, eax
jne 0x10610eb
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x14], eax
jmp 0x10610ee
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov esi, 0x3ff
push 9
and ecx, esi
pop edx
mov word [ebp - 0x26], ax
cmp dx, cx
jne 0x1061119
and eax, 0xfc00
lea ecx, [esi + 1]
cmp cx, ax
je 0x1061119
mov eax, 0x809
mov word [ebp - 0x26], ax
lea ecx, [ebp - 0x4c]
call fcn.0105a02d
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.010a8ac6
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x10611b2
push dword [ebp - 0x26]
lea ecx, [ebp - 0x4c]
call fcn.010a8a00
test eax, eax
jne 0x10611ad
mov eax, dword [ebp - 0x26]
push 4
and eax, esi
pop ecx
mov dword [ebp - 0x20], eax
cmp cx, ax
je 0x10611a6
lea ecx, [ebp - 0x4c]
call fcn.010a8571
cmp eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp + 8], ebx
jle 0x106119e
cmp dword [ebp - 0x10], ebx
jl 0x106119e
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x4c]
call fcn.010a87de
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x106118d
mov eax, dword [ebp - 0x1c]
mov ecx, eax
and ecx, esi
cmp word [ebp - 0x20], cx
je 0x106119a
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x18]
jl 0x1061165
jmp 0x106119e
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 8], eax
jne 0x10611ad
mov dword [ebp - 0x10], 0x80004005
cmp dword [ebp - 0x10], ebx
jge 0x10611e2
mov esi, 0x409
mov eax, esi
cmp ax, word [ebp - 0x26]
je 0x10611df
push 0x809
lea ecx, [ebp - 0x4c]
call fcn.010a8a00
test eax, eax
je 0x10611db
mov eax, 0x809
mov word [ebp - 0x26], ax
jmp 0x10611df
mov word [ebp - 0x26], si
mov byte [ebp - 0x27], bl
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.0105a1be
push dword [edi + 4]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x28]
jmp 0x1060fc3
call sub.MFC42u.dll_AfxGetModuleState
mov ecx, dword [edi + 4]
mov eax, dword [eax + 0xc]
push ebx
shr ecx, 1
push ecx
push dword [edi + 8]
push 0xefa1
push eax
call fcn.010ac403
jmp 0x1061347
mov eax, dword [edi + 4]
push ebx
shr eax, 1
push eax
push dword [edi + 8]
call fcn.010761ad
jmp 0x106128f
sub ecx, 0x5b
je 0x1061280
dec ecx
je 0x1061274
dec ecx
je 0x1061264
dec ecx
je 0x1061251
sub ecx, 6
jne 0x1060fb4
mov dword [ebp - 0x10], 0xc6c81000
jmp 0x1061347
push dword [edi + 8]
push ebx
push ebx
push 0x8027
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x106128f
mov eax, dword [edi + 4]
shr eax, 1
push eax
push dword [edi + 8]
call fcn.01076ce4
jmp 0x106128f
push dword [edi + 8]
push ebx
push ebx
push 0x8005
jmp 0x106125b
mov eax, dword [edi + 4]
push ebx
shr eax, 1
push eax
push dword [edi + 8]
call fcn.01076b4d
mov dword [ebp - 0x10], eax
jmp 0x1061347
push dword [esi + 0xc]
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10612f8
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
call fcn.0106176a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, ebx
je 0x1061308
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1061308
test byte [ecx + 0x1c], 4
je 0x1061308
cmp eax, ebx
jle 0x10612e3
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x1011d08
push 0xb
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01079041
jmp 0x1061308
call sub.MFC42u.dll_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42u.dll_CWinApp::GetAppRegistryKey
mov dword [ebp + 8], eax
cmp dword [ebp + 8], ebx
je 0x106132f
mov ecx, dword [ebp - 0x18]
push esi
push dword [ebp + 8]
call fcn.01060ce5
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x106132f
cmp dword [edi + 4], 4
jne 0x106132f
mov edi, dword [edi + 8]
lea esi, [ebp + 8]
movsd dword es:[edi], dword [esi]
jmp 0x1061344
mov dword [ebp - 0x10], 0x80004005
cmp dword [ebp + 8], ebx
je 0x1061347
push ebx
push dword [ebp + 8]
call fcn.010ac882
mov dword [ebp + 8], ebx
mov esi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.010ab876
mov eax, esi
call fcn.010aad08
ret 4