Function at 0x10035de0
Capabilities:
Get geographical location
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x748
mov eax, dword [0x10200c9c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1b0
lea eax, [ebp - 0x718]
push 0
push eax
call fcn.1010ca00
add esp, 0xc
lea eax, [ebp - 0x718]
xorps xmm0, xmm0
movaps xmmword [ebp - 0x420], xmm0
push eax
call dword [sym.imp.kernel32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
je 0x100362e3
cmp byte [ebp - 0x56c], 0
je 0x10035f8b
lea ecx, [ebp - 0x6d4]
mov esi, 0xc
lea edx, [ebp - 0x680]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10035f8b
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10035e60
mov di, word [ebp - 0x66c]
lea ecx, [ebp - 0x6d4]
lea edx, [ebp - 0x420]
mov esi, 0xc
test di, di
je 0x10035f00
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10035ea7
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10035e92
xor eax, eax
jmp 0x10035ecc
cmp al, byte [edx]
jne 0x10035ec7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10035ec7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10035ec7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x10035ec7
xor eax, eax
jmp 0x10035ecc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10035f92
mov ecx, dword [ebp - 0x718]
test ecx, ecx
jne 0x10035f13
push str.Etc_UTC
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10035ed4
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10035f00
jmp 0x10035f92
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, esi
shl eax, 4
sub eax, esi
shl eax, 2
sub ecx, eax
jne 0x10035f92
push esi
push str.Etc_GMT_ld
lea eax, [ebp - 0x41c]
mov word [ebp - 0x414], cx
xorps xmm0, xmm0
mov byte [ebp - 0x412], cl
push 0xb
push eax
movq qword [ebp - 0x41c], xmm0
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
dec eax
add esp, 0x10
cmp eax, 9
ja 0x10035f8b
lea eax, [ebp - 0x41c]
push eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov di, word [ebp - 0x66c]
lea esi, [ebp - 0x66c]
test di, di
jne 0x100361cd
lea eax, [ebp - 0x720]
mov dword [ebp - 0x720], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100362e3
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x738]
push eax
push 0
push 0
push 0
push dword [ebp - 0x720]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100362d7
xor edi, edi
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x738], edi
jbe 0x100361bc
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x72c]
mov dword [ebp - 0x72c], 0x100
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x720]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100362d7
lea eax, [ebp - 0x728]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x720]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100362d7
lea eax, [ebp - 0x72c]
mov dword [ebp - 0x72c], 0x200
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x734]
push eax
push 0
push 0x1016d630
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100362cb
cmp dword [ebp - 0x734], 1
jne 0x100362cb
lea ecx, [ebp - 0x714]
lea eax, [ebp - 0x410]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100360e7
test dx, dx
je 0x100360e3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100360e7
add eax, 4
add ecx, 4
test dx, dx
jne 0x100360c1
xor eax, eax
jmp 0x100360ec
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1003629d
push 0x2c
push eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.1010ca00
add esp, 0xc
mov dword [ebp - 0x73c], 0x2c
lea eax, [ebp - 0x73c]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x734]
push eax
push 0
push 0x1016d638
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003629d
mov eax, dword [ebp - 0x718]
cmp eax, dword [ebp - 0x4bc]
jne 0x1003629d
lea ecx, [ebp - 0x6d4]
mov esi, 0xc
lea edx, [ebp - 0x4b0]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003629d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10036163
lea ecx, [ebp - 0x680]
mov esi, 0xc
lea edx, [ebp - 0x4a0]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003629d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10036190
mov eax, dword [ebp - 0x728]
lea esi, [ebp - 0x210]
test eax, eax
je 0x100361bc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x720]
test eax, eax
je 0x100361cd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x44f]
mov dword [ebp - 0x454], 0x28
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x71c]
push eax
push 0xffffffffffffffff
push ecx
mov eax, esp
mov word [ebp - 0x450], 0
mov dword [ebp - 0x424], 0
lea ecx, [ebp - 0x4d0]
mov dword [ebp - 0x71c], 0
push 1
mov dword [eax], esi
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
push eax
lea ecx, [ebp - 0x458]
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
lea ecx, [ebp - 0x4d0]
call sym.icuuc69.dll_public_virtual:_void___thiscall_icu_69::UnicodeString::destructor_void_
lea ecx, [ebp - 0x568]
call sym.icuuc69.dll_public:_void___thiscall_icu_69::StackUResourceBundle::constructor_void_
lea eax, [ebp - 0x71c]
push eax
push str.windowsZones
lea eax, [ebp - 0x568]
push 0
push eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x568]
push eax
push str.mapTimezones
push eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x568]
push eax
push dword [ebp - 0x458]
push eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 0x30
cmp dword [ebp - 0x71c], 0
jle 0x100362f8
xor esi, esi
jmp 0x10036431
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov dword [ebp - 0x728], 0
cmp edi, dword [ebp - 0x738]
jb 0x10036010
lea esi, [ebp - 0x66c]
jmp 0x100361bc
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x720]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
push 0x10
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov word [ebp - 0x724], ax
mov byte [ebp - 0x722], al
call dword [sym.imp.kernel32.dll_GetUserGeoID]
push 0
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.kernel32.dll_GetGeoInfoW]
mov dword [ebp - 0x730], 0
test eax, eax
je 0x10036382
movzx eax, byte [ebp - 0xc]
mov byte [ebp - 0x724], al
movzx eax, byte [ebp - 0xa]
mov byte [ebp - 0x723], al
movzx eax, byte [ebp - 8]
mov byte [ebp - 0x722], al
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x568]
push eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 0x10
mov edx, eax
cmp dword [ebp - 0x71c], 0
jle 0x100363b0
lea eax, [ebp - 0x71c]
mov dword [ebp - 0x71c], 0
push eax
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x568]
push 0x1016d660
push eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 0x10
mov edx, eax
xor eax, eax
cmp dword [ebp - 0x730], eax
jle 0x100363d3
movzx ecx, word [edx]
test cx, cx
je 0x100363d3
cmp cx, 0x20
je 0x100363d3
movzx ecx, word [edx + eax*2 + 2]
inc eax
test cx, cx
jne 0x100363c2
lea ecx, [ebp - 0x487]
mov dword [ebp - 0x48c], 0x28
mov dword [ebp - 0x490], ecx
lea ecx, [ebp - 0x71c]
push ecx
push ecx
push eax
push edx
lea ecx, [ebp - 0x490]
mov word [ebp - 0x488], 0
mov dword [ebp - 0x45c], 0
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
mov ecx, eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
cmp byte [ebp - 0x488], 0
mov esi, eax
je 0x10036431
push dword [ebp - 0x490]
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 4
lea ecx, [ebp - 0x568]
call sym.icuuc69.dll_public:_void___thiscall_icu_69::StackUResourceBundle::destructor_void_
cmp byte [ebp - 0x450], 0
je 0x10036453
push dword [ebp - 0x458]
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100e9efb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret