Function at 0x42fc2c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x43de54]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x42fcba
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push dword [0x43de54]
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x42fcba
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push dword [0x43de50]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x42fcba
lea esi, [ebp - 4]
push esi
push 0x20019
push 0
push dword [0x43de4c]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x42fd5d
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x228]
call fcn.0042fa9a
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x42fd19
push dword [ebp - 8]
call fcn.00436a29
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x228]
call fcn.0042fa9a
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
jmp 0x42fd55
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
push 0x43eb18
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x42fd55
push dword [ebp - 8]
call fcn.00436a29
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push 0x43eb19
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x104
lea edx, [ebp - 0x124]
push edx
push dword [0x43de44]
call sub.kernel32.dll_GetModuleFileNameA
cmp byte [ebp - 0x124], 0
je 0x430005
lea ecx, [ebp - 0x124]
push ecx
call fcn.00401bf0
pop ecx
mov esi, eax
lea eax, [ebp - 0x124]
add esi, eax
jmp 0x42fd9b
dec esi
movsx edx, byte [esi]
cmp edx, 0x2e
je 0x42fdad
lea ecx, [ebp - 0x124]
cmp esi, ecx
jne 0x42fd9a
lea eax, [ebp - 0x124]
cmp esi, eax
je 0x430005
inc esi
lea edx, [ebp - 0x124]
mov ecx, esi
sub ecx, edx
mov ebx, 0x104
sub ebx, ecx
mov dword [ebp - 0xc], ebx
test edi, edi
je 0x42fe36
cmp byte [edi], 0
je 0x42fe36
mov eax, edi
jmp 0x42fe1f
mov ebx, eax
jmp 0x42fde2
inc ebx
movsx edx, byte [ebx]
cmp edx, 0x2c
je 0x42fdef
cmp byte [ebx], 0
jne 0x42fde1
movsx ecx, byte [ebx]
cmp ecx, 0x2c
jne 0x42fdfb
mov byte [ebx], 0
inc ebx
push dword [ebp - 0xc]
push eax
push esi
call fcn.00401c54
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x43de48], eax
mov eax, ebx
cmp dword [0x43de48], 0
jne 0x430005
cmp byte [eax], 0
jne 0x42fddd
jmp 0x430005
xor ebx, ebx
push str.kernel32.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x42fe53
push str.GetThreadPreferredUILanguages
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x42fef3
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x10]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x38
call ebx
test eax, eax
je 0x42ff92
mov eax, dword [ebp - 0x10]
add eax, eax
push eax
call fcn.00436a29
pop ecx
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x10]
push edx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ecx
push 0x38
call ebx
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
je 0x42ff92
jmp 0x42fed6
push dword [ebp - 0xc]
push ebx
push esi
call fcn.00404804
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x43de48], eax
push ebx
call fcn.00406488
pop ecx
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
je 0x42fee5
cmp dword [0x43de48], 0
je 0x42fea8
push dword [ebp - 0x18]
call fcn.00436a32
pop ecx
jmp 0x42ff92
push 0x55
lea edx, [ebp - 0x280]
push edx
push 0x59
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
dec eax
mov dword [ebp - 0x1c], eax
lea ebx, [ebp - 0x280]
add ebx, dword [ebp - 0x1c]
mov byte [ebx], 0x2d
mov eax, dword [ebp - 0x1c]
inc eax
mov edx, 0x55
sub edx, eax
push edx
lea ecx, [ebx + 1]
push ecx
push 0x5a
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
push dword [ebp - 0xc]
lea ecx, [ebp - 0x280]
push ecx
push esi
call fcn.00401c54
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x43de48], eax
cmp dword [0x43de48], 0
jne 0x42ff92
mov byte [ebx], 0
push dword [ebp - 0xc]
lea edx, [ebp - 0x280]
push edx
push esi
call fcn.00401c54
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x43de48], eax
cmp dword [0x43de48], 0
jne 0x430005
push 4
lea edx, [ebp - 0x20]
push edx
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
push dword [ebp - 0xc]
lea ecx, [ebp - 0x20]
push ecx
push esi
call fcn.00401c54
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x43de48], eax
cmp dword [0x43de48], 0
jne 0x430005
mov byte [ebp - 0x1e], 0
push dword [ebp - 0xc]
lea edx, [ebp - 0x20]
push edx
push esi
call fcn.00401c54
add esp, 0xc
push 2
push 0
lea ecx, [ebp - 0x124]
push ecx
call sub.kernel32.dll_LoadLibraryExA
mov dword [0x43de48], eax
test edi, edi
je 0x430010
push edi
call fcn.00436a32
pop ecx
cmp dword [0x43de48], 0
jne 0x430023
mov eax, dword [0x43de44]
mov dword [0x43de48], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret