Function at 0x7efb4b
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x8d9490]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x7efc1f
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push dword [0x8d9490]
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x7efc1f
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push dword [0x8d948c]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x7efc1f
lea esi, [ebp - 4]
push esi
push 0x20019
push 0
push dword [0x8d948c]
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x7efc1f
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x8d9488]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x7efc1f
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push dword [0x8d9484]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x7efcc2
push 0x104
lea ecx, [ebp - 0x228]
push ecx
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea esi, [ebp - 8]
push esi
push 0
push 0
push 0
lea eax, [ebp - 0x228]
call fcn.007ef9b9
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x7efc7e
push dword [ebp - 8]
call fcn.007f6b45
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x228]
call fcn.007ef9b9
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
jmp 0x7efcba
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
push 0x8da136
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x7efcba
push dword [ebp - 8]
call fcn.007f6b45
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push 0x8da137
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x104
lea edx, [ebp - 0x124]
push edx
push dword [0x8d947c]
call sub.kernel32.dll_GetModuleFileNameA
cmp byte [ebp - 0x124], 0
je 0x7eff6a
lea ecx, [ebp - 0x124]
push ecx
call sub.msvcrt.dll_strlen
pop ecx
mov esi, eax
lea eax, [ebp - 0x124]
add esi, eax
jmp 0x7efd00
dec esi
movsx edx, byte [esi]
cmp edx, 0x2e
je 0x7efd12
lea ecx, [ebp - 0x124]
cmp esi, ecx
jne 0x7efcff
lea eax, [ebp - 0x124]
cmp esi, eax
je 0x7eff6a
inc esi
lea edx, [ebp - 0x124]
mov ecx, esi
sub ecx, edx
mov ebx, 0x104
sub ebx, ecx
mov dword [ebp - 0xc], ebx
test edi, edi
je 0x7efd9b
cmp byte [edi], 0
je 0x7efd9b
mov eax, edi
jmp 0x7efd84
mov ebx, eax
jmp 0x7efd47
inc ebx
movsx edx, byte [ebx]
cmp edx, 0x2c
je 0x7efd54
cmp byte [ebx], 0
jne 0x7efd46
movsx ecx, byte [ebx]
cmp ecx, 0x2c
jne 0x7efd60
mov byte [ebx], 0
inc ebx
push dword [ebp - 0xc]
push eax
push esi
call sub.msvcrt.dll_strncpy
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x8d9480], eax
mov eax, ebx
cmp dword [0x8d9480], 0
jne 0x7eff6a
cmp byte [eax], 0
jne 0x7efd42
jmp 0x7eff6a
xor ebx, ebx
push str.kernel32.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x7efdb8
push str.GetThreadPreferredUILanguages
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x7efe58
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x10]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x38
call ebx
test eax, eax
je 0x7efef7
mov eax, dword [ebp - 0x10]
add eax, eax
push eax
call fcn.007f6b45
pop ecx
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x10]
push edx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ecx
push 0x38
call ebx
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
je 0x7efef7
jmp 0x7efe3b
push dword [ebp - 0xc]
push ebx
push esi
call sub.msvcrt.dll_wcstombs
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x8d9480], eax
push ebx
call sub.msvcrt.dll_wcslen
pop ecx
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
je 0x7efe4a
cmp dword [0x8d9480], 0
je 0x7efe0d
push dword [ebp - 0x18]
call fcn.007f6b57
pop ecx
jmp 0x7efef7
push 0x55
lea edx, [ebp - 0x280]
push edx
push 0x59
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
dec eax
mov dword [ebp - 0x1c], eax
lea ebx, [ebp - 0x280]
add ebx, dword [ebp - 0x1c]
mov byte [ebx], 0x2d
mov eax, dword [ebp - 0x1c]
inc eax
mov edx, 0x55
sub edx, eax
push edx
lea ecx, [ebx + 1]
push ecx
push 0x5a
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
push dword [ebp - 0xc]
lea ecx, [ebp - 0x280]
push ecx
push esi
call sub.msvcrt.dll_strncpy
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x8d9480], eax
cmp dword [0x8d9480], 0
jne 0x7efef7
mov byte [ebx], 0
push dword [ebp - 0xc]
lea edx, [ebp - 0x280]
push edx
push esi
call sub.msvcrt.dll_strncpy
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x8d9480], eax
cmp dword [0x8d9480], 0
jne 0x7eff6a
push 4
lea edx, [ebp - 0x20]
push edx
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
push dword [ebp - 0xc]
lea ecx, [ebp - 0x20]
push ecx
push esi
call sub.msvcrt.dll_strncpy
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x8d9480], eax
cmp dword [0x8d9480], 0
jne 0x7eff6a
mov byte [ebp - 0x1e], 0
push dword [ebp - 0xc]
lea edx, [ebp - 0x20]
push edx
push esi
call sub.msvcrt.dll_strncpy
add esp, 0xc
push 2
push 0
lea ecx, [ebp - 0x124]
push ecx
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x8d9480], eax
test edi, edi
je 0x7eff75
push edi
call fcn.007f6b57
pop ecx
cmp dword [0x8d9480], 0
jne 0x7eff88
mov eax, dword [0x8d947c]
mov dword [0x8d9480], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret