Function at 0x42e6b4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x26e0
call fcn.004419d0
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea edi, [ecx + 0x14]
xor ebx, ebx
mov esi, 0x80004005
mov dword [ebp - 0x26e0], edi
cmp dword [edi], ebx
je 0x42e6eb
xor eax, eax
jmp 0x42ea16
push 0x105
lea eax, [ebp - 0x42c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42ea14
lea ecx, [ebp - 0x42c]
call fcn.00420348
push edx
push eax
mov edx, 0x105
lea ecx, [ebp - 0x63c]
call fcn.0041ed98
test eax, eax
js 0x42ea14
xor eax, eax
mov dword [ebp - 0x26d4], ebx
push 0x407c04
mov word [ebp - 0x26d0], ax
mov word [ebp - 0x26cc], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42e771
push 0x824
lea eax, [ebp - 0x26cc]
push eax
push 0x126b
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp ax, word [ebp - 0x26cc]
je 0x42e791
lea eax, [ebp - 0x26cc]
push 0x5b
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x42e7a8
push ecx
push 0x408780
push ecx
mov edx, 0x824
lea ecx, [ebp - 0x26cc]
call fcn.0040c1c3
lea edx, [ebp - 0x26d0]
mov ecx, 0x405550
call fcn.00422618
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
movzx eax, word [ebp - 0x26d0]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x26cc]
push eax
push 0x407c20
lea eax, [ebp - 0x1684]
push 0x1048
push eax
call fcn.0040c125
add esp, 0x1c
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
cmp eax, 0xffffffff
je 0x42e830
push eax
push 0x407c6c
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.0040c0e1
add esp, 0x10
test eax, eax
js 0x42e830
lea eax, [ebp - 0x21c]
mov edx, 0x1048
push eax
lea ecx, [ebp - 0x1684]
call fcn.0040c0a9
lea eax, [ebp - 0x26d4]
push eax
push 0x20019
push ebx
push 0x4021e0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 2
pop esi
test eax, eax
jne 0x42e98c
lea eax, [ebp - 0x26d8]
mov dword [ebp - 0x26d8], 0x20a
push eax
lea eax, [ebp - 0x21c]
xor esi, esi
push eax
lea eax, [ebp - 0x26d0]
inc esi
push eax
push ebx
push 0x407c80
push dword [ebp - 0x26d4]
mov dword [ebp - 0x26d0], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e90f
cmp dword [ebp - 0x26d0], esi
jne 0x42e90f
lea eax, [ebp - 0x21c]
push 0x407c9c
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42e90f
push 2
pop edi
cmp word [esi], 0x2d
jne 0x42e8c3
add esi, edi
push esi
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
test eax, eax
je 0x42e8f5
push 0x407ca0
mov edx, 0x1048
lea ecx, [ebp - 0x1684]
call fcn.0040c0a9
push esi
mov edx, 0x1048
lea ecx, [ebp - 0x1684]
call fcn.0040c0a9
push 0x407c9c
push ebx
call dword [sym.imp.msvcrt.dll_wcstok]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x42e8bb
mov edi, dword [ebp - 0x26e0]
lea eax, [ebp - 0x26d8]
mov dword [ebp - 0x26d0], 4
push eax
lea eax, [ebp - 0x26dc]
mov dword [ebp - 0x26dc], ebx
push eax
lea eax, [ebp - 0x26d0]
mov dword [ebp - 0x26d8], 4
push eax
push ebx
push 0x407cb0
push dword [ebp - 0x26d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e97d
cmp dword [ebp - 0x26d0], 4
jne 0x42e97d
push dword [ebp - 0x26dc]
lea eax, [ebp - 0x1684]
push eax
push 0x407cc0
push 0x1048
push eax
call fcn.0040c125
add esp, 0x14
push dword [ebp - 0x26d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop esi
call fcn.0042d4bd
test eax, eax
mov eax, 0x407ce0
jne 0x42e99f
mov eax, 0x407d08
push eax
mov edx, 0x1048
lea ecx, [ebp - 0x1684]
call fcn.0040c0a9
test edi, edi
je 0x42ea4d
cmp dword [edi], ebx
je 0x42e9c6
push dword [edi]
call fcn.00440db7
pop ecx
mov dword [edi], ebx
lea ecx, [ebp - 0x1684]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
ret
jne 0x42e9cf
sub ecx, edx
sar ecx, 1
push 2
pop edx
lea esi, [ecx + 1]
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov dword [edi], eax
pop ecx
test eax, eax
jne 0x42ea27
mov esi, 0x8007000e
push esi
push 0x407d58
push 2
pop eax
push eax
call fcn.0041e83a
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret 4
lea ecx, [ebp - 0x1684]
mov edx, esi
push ecx
mov ecx, eax
call fcn.0040c040
mov esi, eax
test esi, esi
jns 0x42ea56
cmp dword [edi], ebx
je 0x42ea52
push dword [edi]
call fcn.00440db7
pop ecx
mov dword [edi], ebx
jmp 0x42ea52
mov esi, 0x80004003
test esi, esi
js 0x42ea02
push dword [edi]
push 0x407d30
push 4
jmp 0x42ea0c