Function at 0x404d90
Capabilities:
Extract resource via kernel32 functions
Get geographical location
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0xc], 0x14b8d
mov dword [ebp - 0x10], 0x9a78
mov dword [ebp - 4], 0x1278e
mov dword [ebp - 0x20], 0x140b5
mov dword [ebp - 0x48], 0x11f7e
mov dword [ebp - 0x18], 0xd53e
mov dword [ebp - 8], 0x78c9
mov dword [ebp - 0x90], 0x10970
mov dword [ebp - 0x4c], 0xa345
mov dword [ebp - 0x34], 0x14786
mov dword [ebp - 0x1c], 0x1d8c
mov dword [ebp - 0x94], 0x13dc1
mov dword [ebp - 0x6c], 0x423d
mov dword [ebp - 0x80], 0x69f8
mov dword [ebp - 0x2c], 0x582d
mov dword [ebp - 0x14], 0x81e7
mov dword [ebp - 0x24], 0x9a69
mov dword [ebp - 0x28], 0x1004a
mov dword [ebp - 0x60], 0x8f9e
mov dword [ebp - 0x30], 0x12f74
mov dword [ebp - 0x8c], 0x1bb0
mov dword [ebp - 0x88], 0x3ade
mov dword [ebp - 0x7c], 0x1cbb
mov dword [ebp - 0x44], 0xec3a
mov dword [ebp - 0x38], 0
jmp 0x404e5f
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x88]
sub ecx, 0x3add
cmp dword [ebp - 0x38], ecx
jge 0x404e7b
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x404e56
mov dword [ebp - 0x3c], 0
jmp 0x404e8d
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 0x11f7d
cmp dword [ebp - 0x3c], ecx
jge 0x404f2d
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x28]
jge 0x404eb0
mov dword [ebp - 0x50], 1
jmp 0x404eb7
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x34]
or ecx, dword [ebp - 0x50]
je 0x404f28
mov edx, dword [ebp - 0x7c]
cmp edx, dword [ebp - 8]
jne 0x404f28
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x4c]
jne 0x404f28
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x404f28
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x20]
jne 0x404f28
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 8]
jne 0x404f28
push 0x95d2
push 0x2d23
push 0x5ff9
push 0xadc4
push 0x33e9
push 0x654a
push 0x49ea
call dword [sym.imp.KERNEL32.dll_LoadResource]
add esp, 0x1c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x404e84
mov edx, dword [ebp - 0x6c]
cmp edx, dword [ebp - 0x30]
jge 0x404f3e
mov dword [ebp - 0x54], 1
jmp 0x404f45
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xc]
jge 0x404f56
mov dword [ebp - 0x58], 1
jmp 0x404f5d
mov dword [ebp - 0x58], 0
mov ecx, dword [ebp - 0x28]
xor ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x2c]
jge 0x404f71
mov dword [ebp - 0x5c], 1
jmp 0x404f78
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x54]
and edx, dword [ebp - 0x58]
and edx, dword [ebp - 0x5c]
je 0x404fd3
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x1c]
jne 0x404fd3
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 4]
jne 0x404fd3
mov edx, dword [ebp - 0x60]
cmp edx, dword [ebp - 4]
jne 0x404fd3
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jne 0x404fd3
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
push 0x10567
push 0x13b6a
push 0x8936
push 0x91f2
push 0x7e9e
push 0x131ba
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesExW]
add esp, 0x18
mov dword [ebp - 0x40], 0
jmp 0x404fe5
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x18]
sub eax, 0xd53e
cmp dword [ebp - 0x40], eax
jge 0x40520b
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x10]
jge 0x405010
mov dword [ebp - 0x68], 1
jmp 0x405017
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x8c]
jge 0x40502e
mov dword [ebp - 0x64], 1
jmp 0x405035
mov dword [ebp - 0x64], 0
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
and edx, dword [ebp - 0x64]
or edx, dword [ebp - 0x68]
je 0x405206
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x48]
jge 0x405061
mov dword [ebp - 0x70], 1
jmp 0x405068
mov dword [ebp - 0x70], 0
mov ecx, dword [ebp - 0x44]
or ecx, dword [ebp - 0x6c]
or ecx, dword [ebp - 0x70]
je 0x405206
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0xc]
jne 0x405206
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x30]
jne 0x405206
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x34]
jne 0x405206
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 8]
jne 0x405206
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExA]
mov eax, dword [ebp - 0x20]
sub eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x94]
jge 0x4050d0
mov dword [ebp - 0x74], 1
jmp 0x4050d7
mov dword [ebp - 0x74], 0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x98]
cmp edx, dword [ebp - 0x9c]
jge 0x405109
mov dword [ebp - 0x78], 1
jmp 0x405110
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x74]
or eax, dword [ebp - 0x78]
je 0x4051da
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x4c]
jne 0x4051da
mov edx, dword [ebp - 0x7c]
cmp edx, dword [ebp - 0x48]
jne 0x4051da
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
jne 0x4051da
mov ecx, dword [ebp - 0x28]
and ecx, dword [ebp - 4]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [ebp - 0xa4]
jge 0x405178
mov dword [ebp - 0x84], 1
jmp 0x405182
mov dword [ebp - 0x84], 0
mov edx, dword [ebp - 0x2c]
xor edx, dword [ebp - 0x14]
or edx, dword [ebp - 0x84]
je 0x4051da
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jne 0x4051da
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x30]
jne 0x4051da
push 0x53b9
push 0x735c
push 0x2964
push 0xe398
push 0xb3bc
push 0x1519b
push 0x50b1
push 0x4d2a
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
add esp, 0x20
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
push 0x921c
push 0x18178
push 0x14fb4
push 0x11910
push 0xe2c
push 0x148f4
push 0x4b05
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
add esp, 0x1c
jmp 0x404fdc
mov esp, ebp
pop ebp
ret