Function at 0x412d10
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
mov eax, dword [0x697b34]
sub esp, 0x10
test eax, eax
push esi
push edi
jne 0x412d26
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
mov edi, 0x42c5f4
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x695960
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
push ecx
call sub.IMM32.dll_ImmIsIME
push 9
mov byte [0x697b3c], al
call fcn.00415de6
add esp, 4
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x695960
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00415db7
mov eax, dword [0x697b40]
add esp, 4
test eax, eax
pop ebx
je 0x412dbe
push eax
call fcn.00415db7
add esp, 4
mov dword [0x697b40], 0
lea eax, [esp + 0x24]
push eax
push 0x20019
push 0
push 0x695960
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412e66
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push eax
push eax
push eax
push 0x42c628
push ecx
call esi
test eax, eax
jne 0x412e4f
lea edx, [esp + 8]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x34]
push 0x42c628
push eax
call esi
test eax, eax
jne 0x412e4f
mov ecx, dword [esp + 8]
push ecx
call fcn.00415de6
add esp, 4
mov dword [0x697b40], eax
test eax, eax
je 0x412e4f
mov ecx, dword [esp + 0x24]
lea edx, [esp + 8]
push edx
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x42c628
push ecx
call esi
test eax, eax
je 0x412e4f
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x412e66
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, dword [0x697b40]
test eax, eax
jne 0x412ea3
push 5
call fcn.00415de6
mov edx, eax
mov edi, 0x42ca44
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [0x697b40], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
push 0
push 0x21
push 0x283
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x697b44]
test eax, eax
jne 0x412ecf
push 5
call fcn.00415de6
add esp, 4
mov dword [0x697b44], eax
mov ecx, dword [0x697b34]
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push eax
push ecx
call sub.IMM32.dll_ImmGetConversionStatus
test byte [esp + 0xc], 8
je 0x412f1d
mov edi, 0x42ca3c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, dword [0x697b44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x10
ret
mov edi, 0x42ca34
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [0x697b44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x10
ret