Function at 0x44fdb1
Capabilities:
Check os version
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x24d0
call fcn.00465d30
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
add eax, 0x14
cmp dword [eax], 0
push esi
push edi
mov ebx, 0x80004005
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
je 0x44fdea
xor eax, eax
jmp 0x4500d7
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.00444ef5
test eax, eax
je 0x4500d5
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
xor eax, eax
push 0x420c44
mov word [ebp - 0x24bc], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x44fe84
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor bl, bl
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x44fe5b
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
jne 0x44fe59
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 6
jb 0x44fe59
mov bl, al
jmp 0x44fe5b
xor bl, bl
push 0x824
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
test bl, bl
setne al
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ebx, 0x1048
cmp ax, word [ebp - 0x24bc]
je 0x44fea9
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x5b
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x44febb
mov edx, reloc.KERNEL32.dll_EnterCriticalSection
mov eax, ebx
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c8be
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov esi, 0x401c18
call fcn.004445ca
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
movzx eax, word [ebp - 0x24c0]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x420c60
mov eax, ebx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c99c
add esp, 0x14
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x44ff3b
push eax
push 0x420cac
mov eax, 0x105
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
test eax, eax
js 0x44ff3b
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov eax, ebx
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c924
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
push 0x402a50
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45007f
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x420cc0
push dword [ebp - 0x24c8]
xor esi, esi
inc esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x450007
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
jne 0x450007
mov ebx, dword [sym.imp.msvcrt.dll_wcstok]
push 0x401fd8
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call ebx
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x450002
cmp word [esi], 0x2d
jne 0x44ffcd
add esi, 2
push esi
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
test eax, eax
je 0x44fff9
push 0x420cdc
mov eax, 0x1048
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c924
push esi
mov eax, 0x1048
call fcn.0042c924
push 0x401fd8
push 0
jmp 0x44ffba
mov ebx, 0x1048
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
push 4
pop esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x420cec
push dword [ebp - 0x24c8]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x450073
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
jne 0x450073
push dword [ebp - 0x24cc]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x420cfc
mov eax, ebx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c99c
add esp, 0xc
push dword [ebp - 0x24c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0044eae9
test eax, eax
lea edi, reloc.ADVAPI32.dll_TraceMessage
mov eax, ebx
je 0x450097
push 0x420d1c
jmp 0x45009c
push 0x420d44
call fcn.0042c924
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov edi, esi
call fcn.0044056c
mov ebx, eax
test ebx, ebx
js 0x4500c5
push dword [esi]
push 0x420d6c
push 4
jmp 0x4500cd
push ebx
push 0x420d94
push 2
pop esi
call fcn.00440126
pop ecx
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4