Function at 0x1006047c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0xc8
push edi
xor edi, edi
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], edi
test esi, esi
je 0x100606fa
xor eax, eax
mov dword [esi], eax
mov word [esi + 4], ax
lea eax, [ebp - 0x328]
push eax
push 0x20019
push edi
push 0x10003f0c
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100606e5
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x338]
push eax
push edi
push 0x10007660
push dword [ebp - 0x328]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea eax, [ebp - 0x194]
je 0x10060674
push ebx
push eax
push 0x1002
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x330], eax
test eax, eax
je 0x100606e2
xor eax, eax
lea ecx, [ebp - 0x324]
mov word [ebp - 0x324], ax
mov edx, ebx
lea eax, [ebp - 0x194]
push eax
call fcn.1000b82d
push ebx
lea eax, [ebp - 0x194]
push eax
push 0x1c21
push dword [0x1008b1e4]
call dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [ebp - 0x194]
call fcn.1006040d
mov dword [ebp - 0x32c], eax
mov ecx, edi
mov dword [ebp - 0x334], ecx
test eax, eax
jle 0x10060662
lea ebx, [ebp - 0x324]
lea edx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, di
jne 0x10060594
sub ebx, edx
sar ebx, 1
push 0xc8
lea eax, [ebp - 0x194]
push eax
lea eax, [ecx + 0x1c22]
push eax
push dword [0x1008b1e4]
call dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [ebp - 0x194]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x100605cb
sub ecx, edx
sar ecx, 1
cmp ecx, ebx
jb 0x100605fc
lea eax, [ebx + ebx]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x194]
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10060613
mov ecx, dword [ebp - 0x334]
inc ecx
mov dword [ebp - 0x334], ecx
cmp ecx, dword [ebp - 0x32c]
jl 0x100605a3
jmp 0x10060662
xor ecx, ecx
lea eax, [ebp - 0x194]
mov word [esi], cx
mov cx, word [ebp - 0x194]
push 0x28
pop ebx
test cx, cx
je 0x10060644
movzx ecx, cx
cmp cx, bx
je 0x10060644
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x10060630
movzx ecx, word [eax]
test cx, cx
je 0x10060662
cmp cx, bx
jne 0x10060662
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov eax, dword [eax]
mov dword [esi], eax
xor eax, eax
mov word [esi + 4], ax
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10060667
jmp 0x100606cd
xor ecx, ecx
mov word [esi], cx
mov cx, word [ebp - 0x194]
push 0x28
pop ebx
test cx, cx
je 0x1006069f
movzx ecx, cx
cmp cx, bx
je 0x1006069f
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x1006068b
movzx ecx, word [eax]
test cx, cx
je 0x100606bd
cmp cx, bx
jne 0x100606bd
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov eax, dword [eax]
mov dword [esi], eax
xor eax, eax
mov word [esi + 4], ax
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x100606c2
sub ecx, edx
sar ecx, 1
jne 0x100606e2
mov edx, dword [ebp + 0xc]
mov ecx, esi
push 0x1000770c
call fcn.1000b82d
xor edi, edi
inc edi
cmp dword [ebp - 0x328], 0
je 0x100606fa
push dword [ebp - 0x328]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret 8