Function at 0x4f0033d0
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call sym.IMM32.dll_ImmLockClientImc
mov esi, eax
test esi, esi
je 0x4f003596
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x4f00340a
add eax, ecx
mov eax, dword [eax + 0x800]
and eax, 0x100
or eax, 0
je 0x4f0035a1
cmp dword [esi], 0
je 0x4f0035ed
mov ecx, ebx
call fcn.4f003930
push edi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [ebp - 4], eax
test eax, eax
je 0x4f003596
test byte [eax + 0x130], 0x10
jne 0x4f0066ae
mov dword [ebp - 8], 0
test ebx, ebx
je 0x4f00358c
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0xfdc]
test eax, eax
jns 0x4f003477
add ecx, eax
mov eax, dword [0x4f01ac28]
xor esi, esi
movzx edx, bx
cmp esi, dword [eax + 0xc]
jb 0x4f003495
ja 0x4f0066d1
cmp edx, dword [eax + 8]
jae 0x4f0066d1
mov eax, dword [0x4f01a9f0]
imul eax, edx
add eax, dword [0x4f01a9e8]
cdq
mov esi, eax
mov eax, ebx
shr eax, 0x10
cmp ax, word [esi + 0x1a]
jne 0x4f0066ba
test byte [esi + 0x19], 1
jne 0x4f0066d1
cmp byte [esi + 0x18], 0x11
jne 0x4f0066d1
mov edx, dword [ecx + 0x820]
mov eax, edx
or eax, dword [ecx + 0x824]
je 0x4f0066de
mov eax, dword [esi + 0x10]
cmp eax, dword [edx]
jne 0x4f0066de
mov eax, dword [esi + 0x14]
cmp eax, dword [edx + 4]
jne 0x4f0066de
mov edi, dword [ecx + 0x828]
add edi, dword [esi]
mov eax, dword [ecx + 0x82c]
adc eax, dword [esi + 4]
mov ecx, edi
or ecx, eax
je 0x4f0066d1
movzx esi, word [edi]
imul esi, dword [0x4f01a9f0]
mov eax, dword fs:[0x18]
add esi, dword [0x4f01a9e8]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x4f003531
add eax, ecx
cmp dword [eax + 0x78], 0
je 0x4f0066f0
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x4f00354d
add eax, ecx
mov ebx, dword [eax + 0x78]
mov ecx, dword [eax + 0x7c]
mov eax, dword [esi + 8]
cdq
cmp eax, ebx
jne 0x4f006709
cmp edx, ecx
jne 0x4f006709
mov esi, dword [edi + 0x18]
test esi, esi
je 0x4f003589
mov eax, dword [esi]
test eax, eax
je 0x4f00357b
push eax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
je 0x4f006729
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], 0
jne 0x4f00675e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
jne 0x4f0035e5
mov ecx, dword [0x4f01ac28]
mov eax, ecx
or eax, dword [0x4f01ac2c]
je 0x4f0035e5
test byte [ecx], 4
je 0x4f0035e5
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov eax, ecx
shl eax, 0x10
push 1
or eax, ecx
push eax
call sym.IMM32.dll_CtfImmTIMActivate
lea edi, [esi + 0x10]
jmp 0x4f00341e
push 2
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
test eax, eax
je 0x4f00669c
push 0x164
push 0x42
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
je 0x4f00669c
push 1
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
push esi
push 1
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, eax
mov ecx, ebx
call fcn.4f0027a0
test eax, eax
jne 0x4f003427
jmp 0x4f00668e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], 0
push edi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push esi
call sym.IMM32.dll_ImmUnlockClientImc
jmp 0x4f003596
mov dword [ebp - 8], 1
jmp 0x4f00345c
test ax, ax
je 0x4f0034b5
mov edx, 0xffff
cmp ax, dx
je 0x4f0034b5
push 6
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x4f003589
push 0x38
push ebx
call dword [sym.imp.win32u.dll_NtUserCallOneParam]
mov edi, eax
xor eax, eax
jmp 0x4f003505
push 0xe
call dword [sym.imp.win32u.dll_NtUserGetThreadState]
test eax, eax
jne 0x4f00353b
xor ebx, ebx
xor ecx, ecx
jmp 0x4f003553
mov eax, dword [edi]
mov esi, dword fs:[0x18]
push 0
push eax
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
cmp eax, dword [esi + 0x20]
jne 0x4f003589
jmp 0x4f003567
test byte [esi + 8], 0x40
je 0x4f003589
mov eax, dword [esi]
test eax, eax
je 0x4f006740
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push esi
push 0
push dword [0x4f01a9dc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4f003589
mov edi, dword [ebp + 0xc]
lea esi, [eax + 0x7c]
mov ecx, 7
mov eax, 1
rep movsd dword es:[edi], dword [esi]
jmp 0x4f003598