Function at 0x10019ca0
Capabilities:
Get geographical location
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x744
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1b0
xor ebx, ebx
lea eax, [ebp - 0x720]
push ebx
push eax
call fcn.100a9420
push 0x10
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.100a9420
add esp, 0x18
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.kernel32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
je 0x10019e25
cmp byte [ebp - 0x574], bl
je 0x10019dbb
push 0x10
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x6dc]
push eax
call fcn.100def98
add esp, 0xc
test eax, eax
jne 0x10019dbb
cmp word [ebp - 0x674], bx
je 0x10019d4f
push 0x10
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x6dc]
push eax
call fcn.100def98
add esp, 0xc
test eax, eax
je 0x10019d6b
mov ax, word [ebp - 0x674]
test ax, ax
jne 0x10019dc2
push 0x10
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x6dc]
push eax
call fcn.100def98
add esp, 0xc
test eax, eax
je 0x10019dbb
mov eax, dword [ebp - 0x720]
test eax, eax
jne 0x10019d85
push str.Etc_UTC
call fcn.100def98
pop ecx
jmp 0x10019e27
push 0x3c
pop ecx
cdq
idiv ecx
mov ecx, eax
test edx, edx
jne 0x10019dbb
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push ecx
push str.Etc_GMT_ld
push 0xb
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
call fcn.100def98
add esp, 0x10
dec eax
cmp eax, 9
ja 0x10019dbb
lea eax, [ebp - 0x18]
push eax
jmp 0x10019d7a
mov ax, word [ebp - 0x674]
lea edi, [ebp - 0x674]
test ax, ax
jne 0x10019fc6
lea eax, [ebp - 0x728]
mov dword [ebp - 0x728], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10019e25
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x740]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x10019e36
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
mov esi, ebx
mov dword [ebp - 0x72c], ebx
cmp dword [ebp - 0x740], ebx
jbe 0x10019fb2
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x734]
mov dword [ebp - 0x734], 0x100
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10019e19
lea eax, [ebp - 0x72c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10019e19
lea eax, [ebp - 0x734]
mov dword [ebp - 0x734], 0x200
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x73c]
push eax
push ebx
push 0x10100fa0
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001a159
cmp dword [ebp - 0x73c], 1
jne 0x1001a159
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.100def98
pop ecx
pop ecx
test eax, eax
jne 0x10019f93
push 0x2c
lea eax, [ebp - 0x4c4]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov dword [ebp - 0x744], 0x2c
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x73c]
push eax
push ebx
push 0x10100fa8
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10019f93
mov eax, dword [ebp - 0x720]
cmp eax, dword [ebp - 0x4c4]
jne 0x10019f93
push 0x10
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x6dc]
push eax
call fcn.100def98
add esp, 0xc
test eax, eax
jne 0x10019f93
push 0x10
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.100def98
add esp, 0xc
test eax, eax
je 0x1001a136
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
mov dword [ebp - 0x72c], ebx
cmp esi, dword [ebp - 0x740]
jb 0x10019e4a
cmp dword [ebp - 0x728], ebx
je 0x10019fc6
push dword [ebp - 0x728]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x28
pop esi
lea eax, [ebp - 0x457]
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x724]
push eax
push 0xffffffffffffffff
push ecx
mov eax, esp
mov word [ebp - 0x458], bx
mov dword [ebp - 0x42c], ebx
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 0x724], ebx
push 1
mov dword [eax], edi
call fcn.100def98
push eax
lea ecx, [ebp - 0x460]
call fcn.100def98
lea ecx, [ebp - 0x4d8]
call sym.icucnv69.dll_public_virtual:_void___thiscall_icu_69::UnicodeString::destructor_void_
lea ecx, [ebp - 0x570]
call sym.icucnv69.dll_public:_void___thiscall_icu_69::StackUResourceBundle::constructor_void_
lea eax, [ebp - 0x724]
push eax
push str.windowsZones
lea eax, [ebp - 0x570]
push ebx
push eax
call fcn.100def98
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x570]
push eax
push str.mapTimezones
push eax
call fcn.100def98
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x570]
push eax
push dword [ebp - 0x460]
push eax
call fcn.100def98
add esp, 0x30
cmp dword [ebp - 0x724], ebx
jg 0x1001a1cc
push 0x10
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], bx
mov word [ebp - 0x730], bx
mov byte [ebp - 0x72e], bl
call dword [sym.imp.kernel32.dll_GetUserGeoID]
push ebx
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.kernel32.dll_GetGeoInfoW]
mov dword [ebp - 0x738], ebx
test eax, eax
je 0x1001a0fd
mov ecx, ebx
mov al, byte [ebp + ecx*2 - 0xc]
mov byte [ebp + ecx - 0x730], al
inc ecx
cmp ecx, 3
jl 0x1001a0be
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.100def98
add esp, 0x10
mov ecx, eax
cmp dword [ebp - 0x724], ebx
jle 0x1001a127
lea eax, [ebp - 0x724]
mov dword [ebp - 0x724], ebx
push eax
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x570]
push 0x10100fd0
push eax
call fcn.100def98
add esp, 0x10
mov ecx, eax
mov eax, ebx
cmp dword [ebp - 0x738], eax
jle 0x1001a17a
movzx edx, word [ecx]
jmp 0x1001a175
lea edi, [ebp - 0x218]
cmp dword [ebp - 0x72c], ebx
je 0x10019fb2
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10019fb2
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10019e19
cmp dx, 0x20
je 0x1001a17a
inc eax
movzx edx, word [ecx + eax*2]
test dx, dx
jne 0x1001a16a
lea edx, [ebp - 0x48f]
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x498], edx
lea edx, [ebp - 0x724]
push edx
push edx
push eax
push ecx
lea ecx, [ebp - 0x498]
mov word [ebp - 0x490], bx
mov dword [ebp - 0x464], ebx
call fcn.100def98
mov ecx, eax
call fcn.100def98
cmp byte [ebp - 0x490], 0
mov ebx, eax
je 0x1001a1cc
push dword [ebp - 0x498]
call fcn.100def98
pop ecx
lea ecx, [ebp - 0x570]
call sym.icucnv69.dll_public:_void___thiscall_icu_69::StackUResourceBundle::destructor_void_
cmp byte [ebp - 0x458], 0
je 0x1001a1ec
push dword [ebp - 0x460]
call fcn.100def98
pop ecx
mov eax, ebx
jmp 0x10019e27