Function at 0x4f003760
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call sym.IMM32.dll_ImmLockClientImc
mov edi, eax
test edi, edi
je 0x4f003919
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x4f00379a
add eax, ecx
mov eax, dword [eax + 0x800]
and eax, 0x100
or eax, 0
je 0x4f00679e
cmp dword [edi], 0
je 0x4f0067ea
mov ecx, ebx
call fcn.4f003930
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalLock]
test eax, eax
je 0x4f003919
mov esi, dword [ebp + 0xc]
shl esi, 5
add esi, 0x98
add esi, eax
cmp dword [esi], 0xffffffff
jne 0x4f0068f2
test ebx, ebx
je 0x4f003919
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0xfdc]
test eax, eax
jns 0x4f003807
add ecx, eax
mov eax, dword [0x4f01ac28]
xor esi, esi
movzx edx, bx
cmp esi, dword [eax + 0xc]
jb 0x4f003825
ja 0x4f006865
cmp edx, dword [eax + 8]
jae 0x4f006865
mov eax, dword [0x4f01a9f0]
imul eax, edx
add eax, dword [0x4f01a9e8]
cdq
mov esi, eax
mov eax, ebx
shr eax, 0x10
cmp ax, word [esi + 0x1a]
jne 0x4f00684e
test byte [esi + 0x19], 1
jne 0x4f006865
cmp byte [esi + 0x18], 0x11
jne 0x4f006865
mov edx, dword [ecx + 0x820]
mov eax, edx
or eax, dword [ecx + 0x824]
je 0x4f006872
mov eax, dword [esi + 0x10]
cmp eax, dword [edx]
jne 0x4f006872
mov eax, dword [esi + 0x14]
cmp eax, dword [edx + 4]
jne 0x4f006872
mov edi, dword [ecx + 0x828]
add edi, dword [esi]
mov eax, dword [ecx + 0x82c]
adc eax, dword [esi + 4]
mov ecx, edi
or ecx, eax
je 0x4f006865
movzx esi, word [edi]
imul esi, dword [0x4f01a9f0]
mov eax, dword fs:[0x18]
add esi, dword [0x4f01a9e8]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x4f0038c1
add eax, ecx
cmp dword [eax + 0x78], 0
je 0x4f006884
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0xfdc]
test ecx, ecx
jns 0x4f0038dd
add eax, ecx
mov ebx, dword [eax + 0x78]
mov ecx, dword [eax + 0x7c]
mov eax, dword [esi + 8]
cdq
cmp eax, ebx
jne 0x4f00689d
cmp edx, ecx
jne 0x4f00689d
mov esi, dword [edi + 0x18]
test esi, esi
je 0x4f003919
mov eax, dword [esi]
test eax, eax
je 0x4f00390b
push eax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
je 0x4f0068bd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 1
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
jne 0x4f0067e2
mov ecx, dword [0x4f01ac28]
mov eax, ecx
or eax, dword [0x4f01ac2c]
je 0x4f0067e2
test byte [ecx], 4
je 0x4f0067e2
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov eax, ecx
shl eax, 0x10
push 1
or eax, ecx
push eax
call sym.IMM32.dll_CtfImmTIMActivate
lea esi, [edi + 0x10]
jmp 0x4f0037ae
push 2
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
test eax, eax
je 0x4f00683c
push 0x164
push 0x42
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
test eax, eax
je 0x4f00683c
push 1
push ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
push edi
push 1
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, eax
mov ecx, ebx
call fcn.4f0027a0
test eax, eax
jne 0x4f0037b7
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [edi], 0
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push edi
call sym.IMM32.dll_ImmUnlockClientImc
jmp 0x4f003919
test ax, ax
je 0x4f003845
mov edx, 0xffff
cmp ax, dx
je 0x4f003845
push 6
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x4f003919
push 0x38
push ebx
call dword [sym.imp.win32u.dll_NtUserCallOneParam]
mov edi, eax
xor eax, eax
jmp 0x4f003895
push 0xe
call dword [sym.imp.win32u.dll_NtUserGetThreadState]
test eax, eax
jne 0x4f0038cb
xor ebx, ebx
xor ecx, ecx
jmp 0x4f0038e3
mov eax, dword [edi]
mov esi, dword fs:[0x18]
push 0
push eax
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
cmp eax, dword [esi + 0x20]
jne 0x4f003919
jmp 0x4f0038f7
test byte [esi + 8], 0x40
je 0x4f003919
mov eax, dword [esi]
test eax, eax
je 0x4f0068d4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push esi
push 0
push dword [0x4f01a9dc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4f003919
mov edi, dword [ebp + 0x10]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
push ebx
call sym.IMM32.dll_ImmUnlockIMC
mov eax, 1
jmp 0x4f00391b