Function at 0x401c09
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov dword [ebp - 8], eax
cmp dword [0x40406c], esi
je 0x401c32
cmp dword [0x404068], esi
jne 0x401c3d
cmp word [ebp + 0xc], 1
jne 0x401fb8
cmp word [ebp + 0xc], 1
je 0x401cbc
cmp word [ebp + 0xc], 3
jne 0x401c70
xor edi, edi
cmp dword [0x4040e8], edi
je 0x401c66
push 2
push edi
push dword [ebp + 8]
call fcn.00402891
mov dword [0x4040e8], edi
push 2
push dword [ebp + 8]
call fcn.004025f0
mov eax, dword [0x40406c]
mov edi, dword [eax + 4]
test edi, edi
je 0x401fb8
mov ebx, dword [eax]
test ebx, ebx
jle 0x401ca4
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
mov eax, dword [0x404068]
push eax
dec ebx
add edi, 4
call dword [sym.imp.COMCTL32.dll_ImageList_Remove]
test ebx, ebx
jne 0x401c86
mov eax, dword [0x40406c]
push eax
call dword [sym.imp.COMCTL32.dll_DPA_Destroy]
mov eax, dword [0x404068]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp word [ebp + 0xc], 3
je 0x401fb8
xor edi, edi
push edi
call dword [sym.imp.COMCTL32.dll_DPA_Create]
mov dword [0x40406c], eax
cmp eax, edi
je 0x401fb8
push edi
push edi
push 1
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x404068], eax
cmp eax, edi
jne 0x401d1f
mov eax, dword [0x40406c]
push eax
call dword [sym.imp.COMCTL32.dll_DPA_Destroy]
mov dword [0x40406c], edi
mov dword [0x404068], edi
jmp 0x401fb8
mov eax, dword [ebp - 8]
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov dword [ebp - 0x14], 0
cmp dword [ebp - 8], 0
je 0x401ef0
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], 0
mov eax, dword [edi]
mov ecx, eax
shr ecx, 0x10
and ch, 0xf0
cmp ch, 0xe0
jne 0x401d72
push 0
push 0
push eax
call sub.IMM32.dll_ImmGetDescriptionA
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
lea ecx, [ebp - 0xf8]
and eax, 0xffff
push eax
push 0x401014
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x58], 0
push ecx
push str.systemcurrentcontrolsetcontrol_nlsLocale
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401ddf
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x58]
push eax
lea edx, [ebp - 0xf8]
mov dword [ebp - 0xc], 0x40
push ecx
push 0
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401dd6
mov byte [ebp - 0x58], 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x58], 0
jne 0x401dfc
push 0x40
lea eax, [ebp - 0x58]
push eax
push 0xc8
push dword [0x404078]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [ebp - 0x10], 0
je 0x401e08
mov eax, dword [ebp - 0x10]
inc eax
jmp 0x401e12
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x18
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x401f4c
cmp dword [ebp - 0x10], 0
je 0x401e44
push dword [ebp - 0xc]
lea ecx, [ebx + 0x14]
push ecx
push dword [edi]
call sub.IMM32.dll_ImmGetDescriptionA
jmp 0x401e52
lea eax, [ebp - 0x58]
lea ecx, [ebx + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [edi]
mov eax, ecx
mov dword [ebx], ecx
shr eax, 0x10
and ah, 0xf0
cmp ah, 0xe0
jne 0x401eab
cmp cx, 0x404
je 0x401e7f
cmp cx, 0x411
je 0x401e7f
cmp cx, 0x412
je 0x401e7f
cmp cx, 0x804
jne 0x401e87
mov esi, 1
or dword [ebx + 8], esi
push 0x20
lea eax, [ebp - 0x78]
push eax
push dword [ebx]
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x401eab
push 0
lea eax, [ebp - 0x78]
push eax
push dword [0x404068]
call fcn.004019ad
jmp 0x401eb5
push dword [edi]
push dword [ebp + 8]
call fcn.004019f6
push eax
push 0xffffffffffffffff
push dword [0x404068]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push ebx
mov dword [ebx + 4], eax
push 0x7fff
push dword [0x40406c]
call dword [sym.imp.COMCTL32.dll_DPA_InsertPtr]
cmp eax, 0xffffffff
je 0x401f4c
add edi, 4
mov eax, dword [ebp - 8]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jb 0x401d4f
test esi, esi
je 0x401f04
push section..data
mov eax, dword [0x40407c]
push eax
call fcn.004027ee
xor ecx, ecx
cmp dword [ebp - 4], ecx
je 0x401f39
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, eax
shr edx, 0x10
and dh, 0xf0
cmp dh, 0xe0
jne 0x401f39
cmp dword [0x4040e8], ecx
jne 0x401f39
push ecx
push eax
push dword [ebp + 8]
call fcn.00402891
mov dword [0x4040e8], 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], 2
jae 0x401fae
push 2
jmp 0x401fb0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x40406c]
mov esi, dword [eax + 4]
test esi, esi
je 0x401fb8
mov edi, dword [eax]
dec edi
test edi, edi
jle 0x401f86
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
mov eax, dword [0x404068]
push eax
dec edi
add esi, 4
call dword [sym.imp.COMCTL32.dll_ImageList_Remove]
test edi, edi
jne 0x401f68
mov eax, dword [0x40406c]
push eax
call dword [sym.imp.COMCTL32.dll_DPA_Destroy]
mov eax, dword [0x404068]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
xor eax, eax
push 2
mov dword [0x40406c], eax
mov dword [0x404068], eax
jmp 0x401fb0
push 0
push dword [ebp + 8]
call fcn.004025f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8