Function at 0x4027d5
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x45190c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x456db4], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, dword [ebp + 8]
mov dword [0x456db0], eax
test si, si
je 0x402817
push esi
call fcn.00402987
test eax, eax
jne 0x40293a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx esi, ax
push esi
call fcn.00402987
test eax, eax
jne 0x40293a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
push esi
call fcn.00402987
test eax, eax
jne 0x40293a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx esi, ax
push esi
call fcn.00402987
test eax, eax
jne 0x40293a
movzx esi, word [0x456db4]
push esi
call fcn.00402987
test eax, eax
jne 0x40293a
mov esi, 0x409
push esi
call fcn.00402987
test eax, eax
jne 0x40293a
lea eax, [ebp - 0x80]
xor esi, esi
push eax
push 1
push esi
push str.SoftwareMicrosoftOffice12.0CommonLanguageResourcesInstalledUIs
push 0x80000002
mov dword [ebp - 0x80], esi
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40291e
lea eax, [ebp - 0x88]
mov dword [ebp - 0x90], 0xa
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x8c], esi
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x88], 0x64
push eax
push esi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
inc edi
test ebx, ebx
jne 0x40291e
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040d735
mov eax, dword [ebp - 0x84]
push eax
movzx esi, ax
call fcn.00402987
test eax, eax
jne 0x402931
xor esi, esi
test ebx, ebx
je 0x4028a6
cmp dword [ebp - 0x80], 0
je 0x40292d
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x402974
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x456db4]
cmp si, ax
je 0x402947
movzx eax, si
push eax
call fcn.0040c30a
push esi
mov word [0x456db8], si
call fcn.00412325
movzx ecx, word [0x456db8]
push ecx
mov byte [0x456dba], al
call fcn.00412343
mov dword [0x456dbc], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424816
mov esp, ebp
pop ebp
ret 4

Function at 0x402a9a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftShared
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402ae6
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push str.OfficeUILanguage
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret