Function at 0x41bba0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 8], 0
mov dword [ebp - 0x288], esi
jne 0x41c04b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
xor edi, edi
mov byte [esi + 8], 1
cmp dword [esi + 0xc], edi
je 0x41bdf5
push 0x104
lea eax, [ebp - 0x228]
push eax
push edi
call ebx
test eax, eax
je 0x41bdf5
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x260]
call fcn.00401f35
push 1
push 0xffffffffffffffff
lea edx, [ebp - 0x28c]
push edx
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x28c], 0x5c
call fcn.0041b570
push eax
xor ecx, ecx
push edi
lea edx, [ebp - 0x260]
mov word [ebp - 0x240], cx
push edx
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], edi
call fcn.00401c43
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x260]
call fcn.00401c43
lea ecx, [ebp - 0x244]
call fcn.0040198e
mov edx, dword [esi + 0xc]
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 3
push edx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41bddc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x244]
call fcn.00401f35
xor esi, esi
mov ecx, dword [esi*8 + 0x507c8c]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00491320
add esp, 8
test eax, eax
je 0x41bcc0
inc esi
cmp esi, 8
jb 0x41bca0
jmp 0x41bcec
mov esi, dword [esi*8 + 0x507c88]
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41bcd0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x244]
call fcn.00401cd6
mov esi, 0x4cff40
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bcf6
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x230]
push esi
push eax
push 0
lea ecx, [ebp - 0x244]
call fcn.0040129e
test eax, eax
je 0x41bd30
add esi, 0x1e
inc edi
cmp esi, 0x4d1368
jl 0x41bcf1
jmp 0x41bdb7
push 8
push str.Locale_
lea ecx, [ebp - 0x260]
call fcn.004027ed
mov ecx, edi
shl ecx, 4
sub ecx, edi
lea edx, [ecx*2 + str.de_de]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bd55
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x260]
call fcn.004027ed
push 0xb
push str._brdlang32.
lea ecx, [ebp - 0x260]
call fcn.004027ed
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x244]
push edx
lea ecx, [ebp - 0x260]
call fcn.00402744
cmp dword [ebp - 0x248], 8
mov eax, dword [ebp - 0x25c]
jae 0x41bdae
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp dword [ebp - 0x22c], 8
jb 0x41bdcf
mov eax, dword [ebp - 0x240]
push eax
call fcn.0048e006
add esp, 4
test ebx, ebx
je 0x41bddc
mov ecx, dword [ebp - 0x288]
mov dword [ecx + 4], ebx
cmp dword [ebp - 0x248], 8
jb 0x41c049
mov edx, dword [ebp - 0x25c]
push edx
jmp 0x41c041
push 0x2b
xor eax, eax
push str.SoftwareAdobeAcrobat_Reader10.0Language
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x264], 7
mov dword [ebp - 0x268], edi
mov word [ebp - 0x278], ax
call fcn.00401cd6
mov ecx, dword [0x50bcf8]
cmp byte [ecx + 0x31], 0
je 0x41be3e
push 0x2a
push str.SoftwareAdobeAdobe_Acrobat10.0Language
lea ecx, [ebp - 0x27c]
call fcn.00401cd6
push 9
push str.current_
lea ecx, [ebp - 0x27c]
call fcn.004027ed
mov eax, dword [ebp - 0x278]
mov edi, 8
cmp dword [ebp - 0x264], edi
jae 0x41be69
lea eax, [ebp - 0x278]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [ebp - 0x280]
push edx
push eax
push SysReAllocString
call esi
test eax, eax
je 0x41bec5
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x264], edi
jae 0x41be96
lea eax, [ebp - 0x278]
lea ecx, [ebp - 0x280]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x41bec5
lea ecx, [ebp - 0x27c]
call fcn.0040198e
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x280]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [ebp - 0x284]
push edx
push 0
push 0x4cdc24
push eax
mov dword [ebp - 0x284], 0
call edi
mov eax, dword [ebp - 0x284]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048d83c
mov ecx, dword [ebp - 0x280]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x284]
push eax
push esi
push 0x4cdc24
push ecx
call edi
test eax, eax
jne 0x41c01b
mov ecx, dword [ebp - 0x288]
push esi
call fcn.0041b830
test al, al
je 0x41c01b
push 0x104
lea edx, [ebp - 0x228]
push edx
push 0
call ebx
push esi
lea ecx, [ebp - 0x260]
call fcn.00401f35
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
push esi
call edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea ecx, [ebp - 0x228]
push ecx
call edi
push 0x4cfe38
lea ecx, [ebp - 0x244]
call fcn.00401f35
push 1
push 0xffffffffffffffff
push 0x4cfe34
lea ecx, [ebp - 0x260]
call fcn.0041b660
push 0xffffffffffffffff
push eax
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x260]
call fcn.00409c2e
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x244]
call fcn.00402744
lea ecx, [ebp - 0x20]
call fcn.0040198e
cmp dword [ebp - 0x22c], 8
mov eax, dword [ebp - 0x240]
jae 0x41bfe1
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x228]
push eax
call edi
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x41c005
mov edx, dword [ebp - 0x288]
mov dword [edx + 4], eax
lea ecx, [ebp - 0x244]
call fcn.0040198e
lea ecx, [ebp - 0x260]
call fcn.0040198e
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0048e006
add esp, 4
cmp dword [ebp - 0x264], 8
jb 0x41c049
mov ecx, dword [ebp - 0x278]
push ecx
call fcn.0048e006
add esp, 4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048e25d
mov esp, ebp
pop ebp
ret