Function at 0x10044500
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7318
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x10145188]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.WIN7_
mov esi, 1
push esi
mov dword [ebp - 0x628], ebx
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 8
lea ecx, [ebp - 0x624]
mov dword [ebp - 0x64c], 0x104
call dword [0x100ec970]
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], 0
call dword [0x100ec970]
lea ecx, [ebp - 0x63c]
call dword [0x100ec970]
push str.Keyboard_LayoutPreload
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push str.SystemCurrentControlSetControlKeyboard_Layouts_
lea ecx, [ebp - 0x63c]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push esi
lea eax, [ebp - 0x624]
push 0x100f3db8
push eax
mov dword [ebp - 0x644], esi
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
mov edx, dword [ebp - 0x638]
add esp, 0xc
lea ecx, [ebp - 0x62c]
push ecx
push edx
push SysReAllocString
mov dword [ebp - 0x630], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100447f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x64c]
push eax
mov eax, dword [ebp - 0x624]
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp - 0x62c]
lea edx, [ebp - 0x630]
push edx
push 0
push eax
push ecx
call esi
test eax, eax
jne 0x100447f4
lea ecx, [ebp - 0x634]
call dword [0x100ec970]
lea edx, [ebp - 0x63c]
push edx
lea eax, [ebp - 0x650]
push eax
lea edi, [ebp - 0x418]
mov byte [ebp - 4], 3
call fcn.10001a90
add esp, 8
push eax
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
lea ecx, [ebp - 0x650]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov edx, dword [ebp - 0x634]
lea ecx, [ebp - 0x640]
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1004477f
lea eax, [ebp - 0x654]
push eax
mov eax, dword [ebp - 0x640]
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x630]
push edx
push 0
push str.Layout_text
push eax
mov dword [ebp - 0x654], 0x104
call esi
test eax, eax
jne 0x1004477f
mov ebx, dword [ebx + 8]
push 0xc
call dword [sym.imp.mfc100u.dll_new]
mov edi, eax
add esp, 4
test edi, edi
je 0x100446e9
mov ecx, edi
call dword [0x100ec970]
lea ecx, [edi + 4]
call dword [0x100ec970]
jmp 0x100446eb
xor edi, edi
lea ecx, [ebp - 0x418]
push ecx
mov ecx, edi
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
lea edx, [ebp - 0x620]
push edx
lea ecx, [edi + 4]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
mov eax, dword [edi + 4]
push eax
push str.Get_input_lanaguage_:__s
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 0xc
push 0
push str.US_Keyboard
lea ecx, [edi + 4]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Find_1]
test eax, eax
js 0x1004474f
mov ecx, dword [ebp - 0x628]
mov dword [ecx + 0x10], edi
mov edx, dword [edi + 4]
push edx
push str.Get_US_Keyboard_input_lanaguage_:__s
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 0xc
mov dword [edi + 8], 0
test ebx, ebx
je 0x10044774
cmp dword [ebx + 8], 0
je 0x10044769
mov ebx, dword [ebx + 8]
cmp dword [ebx + 8], 0
jne 0x10044760
mov dword [ebx + 8], edi
mov ebx, dword [ebp - 0x628]
jmp 0x1004477f
mov eax, dword [ebp - 0x628]
mov dword [eax + 8], edi
mov ebx, eax
mov ecx, dword [ebp - 0x640]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x644]
inc eax
push eax
lea edx, [ebp - 0x624]
push 0x100f3db8
push edx
mov dword [ebp - 0x644], eax
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0xc
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x64c]
push eax
mov eax, dword [ebp - 0x624]
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp - 0x62c]
lea edx, [ebp - 0x630]
push edx
push 0
push eax
push ecx
call esi
test eax, eax
je 0x1004461d
mov edx, dword [ebp - 0x62c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x1fc
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0xff
lea edx, [ebp - 0x210]
push edx
push eax
call dword [sym.imp.IMM32.dll_ImmGetDescriptionW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x648]
call dword [0x100ec95c]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x648]
cmp dword [ecx - 0xc], 0
jne 0x1004486a
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
jmp 0x100448a5
mov esi, dword [ebx + 8]
test esi, esi
je 0x100448a5
push 0
lea eax, [ebp - 0x210]
push eax
lea ecx, [esi + 4]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Find_1]
test eax, eax
js 0x1004489e
mov dword [ebx + 0xc], esi
mov ecx, dword [esi + 4]
push ecx
push str.default_input_lanaguage_is__s
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 0xc
mov esi, dword [esi + 8]
test esi, esi
jne 0x10044871
xor edx, edx
cmp dword [ebx + 8], edx
lea ecx, [ebp - 0x648]
setne dl
mov esi, edx
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp - 0x63c]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp - 0x638]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp - 0x624]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d0962
mov esp, ebp
pop ebp
ret