Function at 0x100033f0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
push str.kernel32.dll
mov dword [ebp - 4], esi
call edi
mov ebx, eax
push str.GetUserDefaultUILanguage
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003488
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov dword [ebp - 4], eax
movzx eax, ax
mov edi, eax
and eax, 0xfc00
and edi, 0x3ff
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x54], eax
call esi
push str.GetSystemDefaultUILanguage
push ebx
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
movzx eax, ax
mov dword [ebp - 4], eax
movzx eax, ax
mov edi, eax
and eax, 0xfc00
and edi, 0x3ff
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x4c], eax
call esi
mov dword [ebp - 0x48], eax
mov esi, 4
jmp 0x10003593
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x10003540
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003593
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10003534
cmp dword [ebp - 0xc], 1
jne 0x10003534
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x64]
push 0x10005260
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
jne 0x10003534
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx ecx, ax
movzx eax, ax
mov esi, eax
and eax, 0xfc00
and esi, 0x3ff
or eax, esi
push eax
mov dword [ebp - 4], ecx
call ebx
push esi
mov dword [ebp - 0x54], eax
call ebx
mov dword [ebp - 0x50], eax
mov esi, 2
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10003593
push str.ntdll.dll
call edi
test eax, eax
je 0x10003593
lea ecx, [ebp - 4]
push ecx
push 0x100033d0
push 1
push 0x10
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
mov eax, dword [ebp - 4]
test ax, ax
je 0x10003593
mov ebx, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov esi, eax
and eax, 0xfc00
and esi, 0x3ff
or eax, esi
push eax
call ebx
push esi
mov dword [ebp - 0x54], eax
call ebx
mov dword [ebp - 0x50], eax
mov esi, 2
mov dword [ebp + esi*4 - 0x54], 0x800
mov dword [ebp + esi*4 - 0x50], 0x804
add esi, 2
xor edi, edi
test esi, esi
jle 0x10003602
mov ebx, dword [ebp + 8]
nop
mov eax, dword [ebp + edi*4 - 0x54]
cmp eax, 0x800
jne 0x100035c4
mov dword [ebp + 8], 0x434f4c
jmp 0x100035d7
push 4
lea edx, [ebp + 8]
push edx
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100035fd
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x178]
push ebx
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10003604
inc edi
cmp edi, esi
jl 0x100035b0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4