Function at 0x1029439
Capabilities:
Identify system language via api
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8c8]
sub esp, 0x948
mov eax, dword [0x1067a40]
push ebx
xor ebx, ebx
cmp dword [ecx + 0x14], ebx
mov dword [ebp + 0x8c4], eax
mov dword [ebp - 0x68], ecx
je 0x102968a
cmp dword [0x1069390], ebx
je 0x102968a
cmp dword [0x1069394], ebx
je 0x102968a
lea eax, [ebp - 0x4c]
push eax
push 8
push ebx
push 0x1008738
push 0x80000002
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x102968a
cmp dword [ebp - 0x4c], ebx
je 0x102968a
or dword [ebp - 0x64], 0xffffffff
or dword [ebp - 0x60], 0xffffffff
push esi
push edi
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movzx eax, ax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x58], ebx
mov esi, 0x800
push ebx
jmp 0x1029652
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.010370cc
add esp, 0xc
cmp eax, dword [ebp - 0x70]
jne 0x102950e
mov dword [ebp - 0x5c], 0x400
jmp 0x1029523
xor ecx, ecx
cmp eax, dword [ebp - 0x6c]
mov eax, 0x100
setne cl
dec ecx
and ecx, eax
add ecx, eax
mov dword [ebp - 0x5c], ecx
lea eax, [ebp - 0x48]
push eax
push 9
push ebx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x102963d
cmp dword [ebp - 0x48], ebx
je 0x102963d
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x54], ebx
push ebx
jmp 0x1029621
lea eax, [ebp - 0x50]
push eax
push 1
push ebx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x102960c
cmp dword [ebp - 0x50], ebx
je 0x102960c
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push 0x10086bc
push dword [ebp - 0x50]
mov dword [ebp - 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1029600
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x7c4]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x50]
mov byte [ebp + 0x7c3], bl
mov dword [ebp - 0x40], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10295d4
mov byte [ebp + 0x8c3], bl
jmp 0x10295da
mov byte [ebp + 0x7c4], bl
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x7c4]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.01028ec0
mov byte [ebp - 0x41], 1
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x50], ebx
inc dword [ebp - 0x54]
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x48]
mov dword [ebp - 0x40], esi
call edi
test eax, eax
je 0x1029560
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], ebx
inc dword [ebp - 0x58]
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x58]
push dword [ebp - 0x4c]
mov dword [ebp - 0x40], esi
call edi
test eax, eax
je 0x10294f2
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x41], bl
mov dword [ebp - 0x4c], ebx
je 0x1029688
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
push eax
push eax
push eax
push esi
push 0x1008724
push ebx
call fcn.01028ec0
pop edi
pop esi
mov ecx, dword [ebp + 0x8c4]
pop ebx
call fcn.01032376
add ebp, 0x8c8
leave
ret