Function at 0x40cff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe60
mov eax, dword [0x61c554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x824]
push ebx
xor edi, edi
mov esi, ecx
push edi
push eax
call fcn.0045ef40
push ebx
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.0045ef40
push ebx
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.0045ef40
add esp, 0x24
call fcn.0042619e
push eax
lea ecx, [ebp - 0xe60]
call fcn.0040cf55
call fcn.0042619e
push eax
lea ecx, [ebp - 0xe5c]
call fcn.0040cf55
push str.Keyboard_LayoutPreload
mov ebx, 0x5a3330
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004065f3
push str.SystemCurrentControlSetControlKeyboard_Layouts_
lea eax, [ebp - 0xa2c]
push ebx
push eax
call fcn.004065f3
push 0x608fd4
lea ebx, [esi + 0x20c]
push 0x5a3330
push ebx
call fcn.004065f3
lea eax, [ebp - 0x61c]
push str.znyWBSrf.ime
push eax
call fcn.00462bac
lea eax, [ebp - 0x61c]
push eax
call fcn.0046be74
add esp, 0x30
mov dword [ebp - 0xe58], eax
lea eax, [ebp - 0xe4c]
mov esi, edi
push eax
lea eax, [ebp - 0x824]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40d2b2
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0045ef40
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xe40], 1
push edi
push eax
mov dword [ebp - 0xe48], 0x104
call fcn.0045ef40
add esp, 0x18
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe40]
push eax
push edi
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x40d275
push 0x208
lea eax, [ebp - 0xc34]
inc esi
push 0
push eax
call fcn.0045ef40
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xc34]
push 0x5a41fc
push eax
call fcn.004065f3
add esp, 0x1c
lea eax, [ebp - 0xe54]
push eax
lea eax, [ebp - 0xc34]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40d2b2
push 0x208
push eax
lea eax, [ebp - 0xe3c]
push eax
call fcn.0045ef40
add esp, 0xc
mov dword [ebp - 0xe50], 0x104
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xe40]
push eax
push 0
push str.Ime_File
push dword [ebp - 0xe54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d212
lea eax, [ebp - 0xe3c]
push eax
call fcn.0046be74
push dword [ebp - 0xe58]
push eax
call fcn.00462b6c
add esp, 0xc
test eax, eax
je 0x40d291
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0045ef40
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xe40], 1
push 0
push eax
mov dword [ebp - 0xe48], 0x104
call fcn.0045ef40
add esp, 0x18
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe40]
push eax
push 0
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp - 0xe4c]
mov dword [ebp - 0xe44], 0x104
call edi
test eax, eax
je 0x40d151
jmp 0x40d2a6
lea eax, [ebp - 0x20c]
push eax
push 0x5a3330
push ebx
call fcn.004065f3
add esp, 0xc
push dword [ebp - 0xe4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xe5c]
lea ecx, [ecx - 0x10]
call fcn.0040d2df
mov ecx, dword [ebp - 0xe60]
lea ecx, [ecx - 0x10]
call fcn.0040d2df
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448575
mov esp, ebp
pop ebp
ret