Function at 0x422e70
Capabilities:
Create directory
Extract resource via kernel32 functions
Get geographical location
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x18], 0xcebc
mov dword [ebp - 0x2c], 0x2bc0
mov dword [ebp - 0xb0], 0x7e7d
mov dword [ebp - 0x4c], 0x14782
mov dword [ebp - 8], 0x2d2a
mov dword [ebp - 0x10], 0x58ea
mov dword [ebp - 0x54], 0xc3ed
mov dword [ebp - 0xe0], 0x6a16
mov dword [ebp - 0x40], 0x15629
mov dword [ebp - 0x50], 0x811a
mov dword [ebp - 0x30], 0xb1d0
mov dword [ebp - 0x34], 0x12921
mov dword [ebp - 0x20], 0x1371d
mov dword [ebp - 0x3c], 0x11c61
mov dword [ebp - 0xc], 0x50a4
mov dword [ebp - 0x14], 0x5dd9
mov dword [ebp - 0x24], 0x5427
mov dword [ebp - 0x48], 0x2d98
mov dword [ebp - 0x28], 0x16260
mov dword [ebp - 0x44], 0x94f0
mov dword [ebp - 0x38], 0x4f13
mov dword [ebp - 0xd4], 0xc7cf
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], 0x2a79
mov eax, dword [0x7f8324]
cmp eax, dword [0x7f8334]
jge 0x422f40
mov dword [ebp - 0x74], 1
jmp 0x422f47
mov dword [ebp - 0x74], 0
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x54]
or ecx, dword [ebp - 0x74]
je 0x422fb5
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 0xe8]
jge 0x422f85
mov dword [ebp - 0x78], 1
jmp 0x422f8c
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xc]
jge 0x422f9d
mov dword [ebp - 0x7c], 1
jmp 0x422fa4
mov dword [ebp - 0x7c], 0
mov ecx, dword [ebp - 0x78]
and ecx, dword [ebp - 0x7c]
je 0x422fb5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
add eax, 0xb9b4
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x955d
push ecx
mov edx, dword [ebp - 0x50]
add edx, 0x70ca
push edx
mov eax, dword [0x7f83b8]
add eax, 0x2d8
push eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x1d65
push ecx
mov edx, dword [0x7f8328]
add edx, 0xcf8c
push edx
mov eax, dword [0x7f82fc]
add eax, 0x125b0
push eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x3325
push ecx
mov edx, dword [0x7f82fc]
add edx, 0x1899
push edx
call fcn.0041cfc0
add esp, 0x24
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jge 0x42302f
mov dword [ebp - 0x80], 1
jmp 0x423036
mov dword [ebp - 0x80], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x44]
jge 0x42304a
mov dword [ebp - 0x84], 1
jmp 0x423054
mov dword [ebp - 0x84], 0
mov edx, dword [ebp - 0x80]
or edx, dword [ebp - 0x84]
je 0x423068
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, 0xdcf6
sub ecx, dword [ebp + 0x18]
add ecx, 0x5ce2
xor ecx, 0x99cb
mov edx, dword [ebp + 0x10]
and edx, 0xffffedf8
or edx, 0x539e
xor edx, 0xf3d2
mov byte [edx + str.bffUKGcVgfoWn], cl
mov dword [ebp - 0x58], 0
jmp 0x4230a9
mov eax, dword [ebp - 0x58]
add eax, 1
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1371c
cmp dword [ebp - 0x58], ecx
jge 0x4230c8
mov edx, dword [0x7f8330]
sub edx, 1
mov dword [0x7f8330], edx
jmp 0x4230a0
mov eax, dword [0x7f838c]
add eax, 1
mov dword [0x7f838c], eax
mov ecx, dword [ebp + 0x1c]
or ecx, 0x9387
xor ecx, 0x5674c69a
mov edx, dword [ebp + 0x1c]
sub edx, 0x7ec5
xor edx, 0x798
mov dword [edx + str.bffUKGcVgfoWn], ecx
mov dword [ebp - 0x5c], 0
jmp 0x42310b
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x50a3
cmp dword [ebp - 0x5c], ecx
jge 0x423124
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
jmp 0x423102
mov eax, 0xe7d8
sub eax, dword [ebp + 0x14]
xor eax, 0xaf81
xor eax, 0x2458
mov ecx, 0x4046
sub ecx, dword [ebp + 0x18]
or ecx, 0x4515
or ecx, 0x5dbe
xor ecx, 0xfffffdb5
mov byte [ecx + str.bffUKGcVgfoWn], al
mov dword [ebp - 0x60], 0
jmp 0x423168
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x1625f
cmp dword [ebp - 0x60], eax
jge 0x423219
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x24]
jge 0x42318d
mov dword [ebp - 0x88], 1
jmp 0x423197
mov dword [ebp - 0x88], 0
mov edx, dword [ebp - 0x44]
cmp edx, dword [0x7f832c]
jge 0x4231ae
mov dword [ebp - 0x8c], 1
jmp 0x4231b8
mov dword [ebp - 0x8c], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xf0], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xf0]
jge 0x4231ed
mov dword [ebp - 0x90], 1
jmp 0x4231f7
mov dword [ebp - 0x90], 0
mov ecx, dword [ebp - 0x88]
or ecx, dword [ebp - 0x8c]
or ecx, dword [ebp - 0x90]
je 0x423214
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
jmp 0x42315f
mov eax, dword [ebp + 0x20]
or eax, 0xebad
xor eax, 0xe41e
add eax, 0x5648
xor eax, 0x61a9
mov ecx, dword [ebp + 0x1c]
xor ecx, 0x18a7f
xor ecx, 0x10c2a
mov byte [ecx + str.bffUKGcVgfoWn], al
mov edx, dword [0x7f838c]
add edx, 0x586e
push edx
mov eax, dword [ebp - 0x1c]
add eax, 0x1203
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x976b
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x15f4
push edx
mov eax, dword [0x7f8328]
add eax, 0xf892
push eax
mov ecx, dword [0x7f838c]
add ecx, 0x141cd
push ecx
mov edx, dword [ebp - 0x38]
sub edx, 0xdbf
push edx
mov eax, dword [0x7f8328]
add eax, 0xecab
push eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x132ed
push ecx
call fcn.00414100
add esp, 0x24
mov edx, dword [ebp - 0x20]
sub edx, 0xa1b0
push edx
mov eax, dword [ebp - 0xb0]
sub eax, 0x4201
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x4375
push ecx
mov edx, dword [0x7f8320]
sub edx, 0xadeb
push edx
mov eax, dword [ebp - 8]
add eax, 0x1411f
push eax
mov ecx, dword [0x7f8334]
add ecx, 0xe393
push ecx
mov edx, dword [ebp - 0x3c]
sub edx, 0xdb0d
push edx
mov eax, dword [0x7f8320]
add eax, 0x7643
push eax
mov ecx, dword [0x7f8324]
add ecx, 0xf5e5
push ecx
call fcn.00414100
add esp, 0x24
mov edx, 0x97e1
sub edx, dword [ebp + 0x20]
xor edx, 0x1257
mov eax, dword [ebp + 0x20]
add eax, 0x6a85
xor eax, 0xf006
mov byte [eax + str.bffUKGcVgfoWn], dl
mov ecx, dword [0x7f832c]
sub ecx, 0x164ef
push ecx
mov edx, dword [ebp - 8]
add edx, 0xe0b5
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x654a
push eax
call fcn.0040dc50
add esp, 0xc
mov dword [ebp - 0x64], 0
jmp 0x423376
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0xb1cf
cmp dword [ebp - 0x64], edx
jge 0x42351f
mov eax, dword [ebp - 4]
add eax, dword [0x7f8328]
cmp eax, dword [ebp - 8]
jge 0x4233a2
mov dword [ebp - 0x94], 1
jmp 0x4233ac
mov dword [ebp - 0x94], 0
mov ecx, dword [ebp - 0xc]
imul ecx, dword [0x7f8334]
mov dword [ebp - 0xf4], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xf8], edx
mov eax, dword [0x7f8334]
sub eax, 1
mov dword [0x7f8334], eax
mov ecx, dword [ebp - 0xf4]
cmp ecx, dword [ebp - 0xf8]
jge 0x4233ec
mov dword [ebp - 0x98], 1
jmp 0x4233f6
mov dword [ebp - 0x98], 0
mov edx, dword [ebp - 0x94]
and edx, dword [ebp - 0x98]
je 0x42351a
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x7f832c]
jne 0x42351a
mov ecx, dword [0x7f83b8]
cmp ecx, dword [ebp - 0x34]
jne 0x42351a
mov edx, dword [ebp - 4]
or edx, dword [0x7f838c]
mov dword [ebp - 0xfc], edx
mov eax, dword [0x7f8324]
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xfc]
cmp edx, dword [ebp - 0x100]
jge 0x423463
mov dword [ebp - 0x9c], 1
jmp 0x42346d
mov dword [ebp - 0x9c], 0
mov eax, dword [0x7f8334]
cmp eax, dword [0x7f8330]
jge 0x423486
mov dword [ebp - 0xa0], 1
jmp 0x423490
mov dword [ebp - 0xa0], 0
mov ecx, dword [0x7f8320]
cmp ecx, dword [0x7f8388]
jge 0x4234aa
mov dword [ebp - 0xa4], 1
jmp 0x4234b4
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0x9c]
and edx, dword [ebp - 0xa0]
and edx, dword [ebp - 8]
and edx, dword [ebp - 0xa4]
je 0x42351a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jne 0x42351a
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x24]
jne 0x42351a
mov edx, dword [0x7f83b4]
cmp edx, dword [ebp - 0x18]
jne 0x42351a
mov eax, dword [0x7f82f8]
cmp eax, dword [ebp - 0x54]
jne 0x42351a
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x18]
jne 0x42351a
push 0xaebb
push 0x51fd
call dword [sym.imp.KERNEL32.dll_LoadResource]
add esp, 8
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x42336d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x104], eax
mov ecx, dword [0x7f832c]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x108]
jge 0x423557
mov dword [ebp - 0xa8], 1
jmp 0x423561
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10c], ecx
mov edx, dword [0x7f8330]
mov dword [ebp - 0x110], edx
mov eax, dword [0x7f8330]
add eax, 1
mov dword [0x7f8330], eax
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x110]
jge 0x42359d
mov dword [ebp - 0xac], 1
jmp 0x4235a7
mov dword [ebp - 0xac], 0
mov edx, dword [ebp - 0xa8]
and edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x50]
and eax, dword [ebp - 0x10]
or edx, eax
je 0x423708
mov ecx, dword [0x7f8324]
cmp ecx, dword [ebp - 0x28]
jne 0x423708
mov edx, dword [0x7f82fc]
cmp edx, dword [ebp - 0xc]
jne 0x423708
mov eax, dword [0x7f82f8]
cmp eax, dword [0x7f832c]
jge 0x4235f8
mov dword [ebp - 0xb4], 1
jmp 0x423602
mov dword [ebp - 0xb4], 0
mov ecx, dword [0x7f83b8]
sub ecx, 1
mov dword [0x7f83b8], ecx
mov edx, dword [ebp - 0xb0]
and edx, dword [0x7f83b8]
cmp edx, dword [0x7f8388]
jge 0x423631
mov dword [ebp - 0xb8], 1
jmp 0x42363b
mov dword [ebp - 0xb8], 0
mov eax, dword [0x7f8320]
cmp eax, dword [ebp - 0x34]
jge 0x423651
mov dword [ebp - 0xbc], 1
jmp 0x42365b
mov dword [ebp - 0xbc], 0
mov ecx, dword [ebp - 0xb4]
and ecx, dword [ebp - 0xb8]
and ecx, dword [ebp - 0xbc]
je 0x423708
push 0x119b4
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
add esp, 4
mov edx, dword [0x7f82fc]
imul edx, dword [0x7f832c]
cmp edx, dword [ebp - 4]
jge 0x42369f
mov dword [ebp - 0xc0], 1
jmp 0x4236a9
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp - 0x4c]
sub edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x118]
jge 0x4236e1
mov dword [ebp - 0xc4], 1
jmp 0x4236eb
mov dword [ebp - 0xc4], 0
mov ecx, dword [ebp - 0xc0]
and ecx, dword [ebp - 0xc4]
je 0x423708
mov edx, dword [0x7f83b4]
add edx, 1
mov dword [0x7f83b4], edx
mov dword [ebp - 0x68], 0
jmp 0x42371a
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0xe0]
sub ecx, 0x6a15
cmp dword [ebp - 0x68], ecx
jge 0x42380b
mov edx, dword [0x7f82f8]
cmp edx, dword [0x7f8388]
jge 0x423806
mov eax, dword [ebp - 4]
cmp eax, dword [0x7f8324]
jne 0x423806
mov ecx, dword [0x7f83b8]
cmp ecx, dword [ebp - 0x14]
jne 0x423806
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x2c]
jne 0x423806
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jne 0x423806
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0xd4]
jne 0x423806
push 0x17b18
push 0x2d09
push 0x127ba
push 0xe2c8
push 0x1300d
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
add esp, 0x14
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x30]
jge 0x4237bf
mov dword [ebp - 0xcc], 1
jmp 0x4237c9
mov dword [ebp - 0xcc], 0
mov eax, dword [0x7f8328]
cmp eax, dword [0x7f82f8]
jge 0x4237e2
mov dword [ebp - 0xc8], 1
jmp 0x4237ec
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xc8]
or ecx, dword [ebp - 0xcc]
je 0x423806
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x423711
mov eax, dword [ebp + 0x20]
and eax, 0x9dcf
sub eax, 0xdfb6
xor eax, 0xffffa52d
mov ecx, dword [ebp + 0x20]
and ecx, 0x68a7
sub ecx, 0x12093
xor ecx, 0xfffedfe4
mov byte [ecx + str.bffUKGcVgfoWn], al
mov edx, dword [0x7f832c]
cmp edx, dword [0x7f82f8]
jge 0x423852
mov dword [ebp - 0xd0], 1
jmp 0x42385c
mov dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
and eax, dword [0x7f8330]
or eax, dword [ebp - 0x10]
je 0x4238b3
mov ecx, dword [0x7f8334]
cmp ecx, dword [ebp - 0x38]
jne 0x4238b3
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jne 0x4238b3
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x48]
jne 0x4238b3
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
push 0x10628
push 0x1ec6
push 0x7ae
push 0x22c0
push 0xcffc
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
add esp, 0x14
mov edx, dword [ebp + 8]
or edx, 0xa1af
xor edx, 0x7756dbc9
mov eax, dword [ebp + 0x18]
add eax, 0x3fdf
xor eax, 0xe016
mov dword [eax + str.bffUKGcVgfoWn], edx
mov ecx, dword [ebp - 0x34]
sub ecx, 0x93b4
push ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1428
push edx
mov eax, dword [0x7f8334]
add eax, 0x5a0d
push eax
mov ecx, dword [0x7f83b4]
sub ecx, 0xb7d8
push ecx
mov edx, dword [0x7f83b8]
add edx, 0x2a59
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x12fb9
push eax
mov ecx, dword [0x7f8328]
sub ecx, 0x3463
push ecx
mov edx, dword [ebp - 8]
add edx, 0x13537
push edx
mov eax, dword [ebp - 0x4c]
add eax, 0x1904
push eax
call fcn.00414100
add esp, 0x24
mov dword [ebp - 0x6c], 0
jmp 0x423951
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0xd4]
sub edx, 0xc7ce
cmp dword [ebp - 0x6c], edx
jge 0x423987
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x18]
jge 0x423985
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x423948
mov dword [ebp - 0x70], 0
jmp 0x423999
mov ecx, dword [ebp - 0x70]
add ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 8]
sub edx, 0x2d2a
cmp dword [ebp - 0x70], edx
jge 0x423a36
mov eax, dword [0x7f83b8]
cmp eax, dword [0x7f838c]
jge 0x4239c4
mov dword [ebp - 0xd8], 1
jmp 0x4239ce
mov dword [ebp - 0xd8], 0
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0x3c]
sub eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [ebp - 0x120]
jge 0x423a03
mov dword [ebp - 0xdc], 1
jmp 0x423a0d
mov dword [ebp - 0xdc], 0
mov edx, dword [ebp - 0x40]
sub edx, dword [0x7f832c]
or edx, dword [ebp - 0xd8]
or edx, dword [ebp - 0xdc]
je 0x423a31
mov eax, dword [0x7f832c]
add eax, 1
mov dword [0x7f832c], eax
jmp 0x423990
mov eax, str.bffUKGcVgfoWn
jmp 0x423aa7
mov esp, ebp
pop ebp
ret