Function at 0x409bb6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7a4]
sub esp, 0x824
mov eax, dword [0x43fda4]
xor eax, ebp
mov dword [ebp + 0x7a0], eax
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x6c], esi
call fcn.00409a32
movzx eax, ax
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
mov edi, 0xf003f
push edi
push esi
push esi
push esi
push 0x433454
push 0x80000001
mov dword [ebp - 0x70], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x409c30
push 1
push 0x433450
push 1
push esi
push str.show_status
push dword [ebp - 0x64]
call ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x5a0]
push str.E0000804
push eax
call fcn.0041a59a
cmp word [ebp - 0x68], 4
pop ecx
pop ecx
je 0x409c51
cmp word [ebp - 0x68], 1
jne 0x409c5a
mov word [ebp + 0x5aa], 0x34
lea eax, [ebp - 0x64]
push eax
push edi
push esi
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409e0a
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x6c], esi
je 0x409df8
mov dword [ebp - 0x68], esi
jbe 0x409df8
xor eax, eax
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp + 0x3a0]
push ecx
push eax
push dword [ebp - 0x64]
mov word [ebp + 0x3a0], si
mov dword [ebp - 0x7c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 4
lea eax, [ebp + 0x5a8]
push eax
lea eax, [ebp + 0x3a8]
push eax
call fcn.0041a4cc
add esp, 0xc
test eax, eax
jne 0x409dca
push 4
lea eax, [ebp + 0x3a0]
pop edx
movzx ecx, word [eax]
cmp cx, 0x61
jb 0x409d08
cmp cx, 0x66
ja 0x409d08
add ecx, 0xffffffe0
mov word [eax], cx
inc eax
inc eax
dec edx
jne 0x409cf3
push 4
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp + 0x3a0]
push eax
call fcn.0041a4cc
add esp, 0xc
test eax, eax
jle 0x409d3e
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp + 0x5a0]
push eax
call fcn.0041a59a
pop ecx
pop ecx
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp - 0x60]
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts_s
push eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], 0x80
mov word [ebp + 0x1a0], si
call fcn.0041a34e
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push edi
push esi
lea eax, [ebp - 0x60]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409dca
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1a0]
push eax
push esi
push esi
push str.Ime_File
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409dc1
mov eax, dword [ebp - 0x78]
mov word [ebp + eax*2 + 0x1a0], si
lea eax, [ebp + 0x1a0]
push 0x4331b8
push eax
call fcn.00418daf
test eax, eax
pop ecx
pop ecx
je 0x409ddc
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x68]
movzx eax, word [ebp - 0x68]
cmp eax, dword [ebp - 0x6c]
jb 0x409ca3
jmp 0x409df8
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp + 0x5a0]
push eax
call fcn.0041a59a
pop ecx
pop ecx
mov dword [ebp - 0x70], 1
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x70], esi
jne 0x409f07
push 3
pop ecx
movzx eax, cx
movzx eax, word [ebp + eax*2 + 0x5a0]
cmp ax, 0x30
jb 0x409e24
cmp ax, 0x39
jb 0x409e3e
cmp ax, 0x41
jb 0x409e30
cmp ax, 0x46
jb 0x409e3e
cmp ax, 0x39
je 0x409e4d
add ecx, 0xffff
jmp 0x409e0d
movzx eax, cx
lea eax, [ebp + eax*2 + 0x5a0]
inc word [eax]
jmp 0x409e5a
movzx eax, cx
mov word [ebp + eax*2 + 0x5a0], 0x41
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp + 0x3a0]
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts_s
push eax
call fcn.0041a34e
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push edi
push esi
push esi
push esi
lea eax, [ebp + 0x3a0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409f2c
push 0x16
push 0x4331b8
push 1
push esi
push str.Ime_File
push dword [ebp - 0x64]
call ebx
push 0x12
push str.kbdus.dll
push 1
push esi
push str.Layout_File
push dword [ebp - 0x64]
call ebx
mov edi, 0x4332fc
push edi
call fcn.004194ab
pop ecx
add eax, eax
push eax
push edi
push 1
push esi
push str.Layout_Text
push dword [ebp - 0x64]
call ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x70]
push eax
push 0x5dc
push esi
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlKeyboard_Layouts
push esi
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea eax, [ebp + 0x5a0]
push eax
call fcn.00409a6a
pop ecx
mov ecx, dword [ebp + 0x7a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419911
add ebp, 0x7a4
leave
ret
xor al, al
jmp 0x409f14