Function at 0x44e920
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a0588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [0x4cc854]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x2c], 0x10
mov byte [esp + 0x12], 0x31
mov byte [esp + 0x13], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x1c], eax
push str..DEFAULTkeyboard_layoutpreload_
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50], 1
call fcn.0048c58c
mov ecx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x14]
mov dword [esp + 0x28], 1
push eax
push ecx
push reloc.WS2_32.dll_closesocket
call ebp
test eax, eax
jne 0x44eb1d
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebx + 0x1a60]
jmp 0x44e9b1
mov esi, dword [esp + 0x20]
push str..DEFAULTkeyboard_layoutpreload_
lea ecx, [esp + 0x1c]
call fcn.0048c58c
lea edx, [esp + 0x2c]
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1e]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44eb16
push str.SystemCurrentControlSetControlKeyboard_Layouts_
lea ecx, [esp + 0x20]
call fcn.0048c58c
mov ecx, dword [0x4cc854]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], ecx
push edx
lea ecx, [esp + 0x24]
call fcn.0048c58c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
mov byte [esp + 0x50], 2
call fcn.0048c81b
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], 1
call fcn.0048c403
mov ecx, esi
lea edx, [esp + 0x34]
add esi, 4
push edx
mov dword [esp + 0x24], esi
call fcn.0048c58c
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push ecx
push reloc.imgsimul.dll_Ordinal_2
call ebp
test eax, eax
jne 0x44eb06
push 0x50
call fcn.0048c144
mov ecx, dword [esp + 0x28]
add esp, 4
lea edx, [esp + 0x30]
mov esi, eax
push edx
lea eax, [esp + 0x2c]
push esi
push eax
push 0
push str.Layout_text
push ecx
mov dword [esp + 0x48], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44eadd
mov edx, dword [ebx + 0x7c]
push esi
push eax
push 0x143
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call fcn.0048c16d
mov eax, dword [esp + 0x28]
add esp, 4
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov cl, byte [esp + 0x12]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
inc cl
push edx
push eax
push reloc.WS2_32.dll_closesocket
mov byte [esp + 0x1e], cl
call ebp
test eax, eax
je 0x44e9ad
jmp 0x44eb1d
push str.Query_error
lea ecx, [ebx + 0x1a5c]
call fcn.0048c58c
mov edx, dword [esp + 0x24]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
push esi
call fcn.0048c16d
add esp, 4
jmp 0x44eb1d
push str.open_error
lea ecx, [ebx + 0x1a5c]
call fcn.0048c58c
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov edx, dword [ebx + 0x7c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x146
push edx
call esi
test eax, eax
jle 0x44eb7c
mov eax, dword [ebx + 0x7c]
push 0
push 0
push 0x14e
push eax
call esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.0048c403
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0048c403
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.0048c403
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0048c403
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret