Function at 0x42ec7b
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x26e0
call fcn.00442470
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea edi, [ecx + 0x14]
xor ebx, ebx
mov esi, 0x80004005
mov dword [ebp - 0x26e0], edi
cmp dword [edi], ebx
je 0x42ecb2
xor eax, eax
jmp 0x42efdd
push 0x105
lea eax, [ebp - 0x42c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42efdb
lea ecx, [ebp - 0x42c]
call fcn.004205d3
push edx
push eax
mov edx, 0x105
lea ecx, [ebp - 0x63c]
call fcn.0041efe6
test eax, eax
js 0x42efdb
xor eax, eax
mov dword [ebp - 0x26d4], ebx
push 0x407bf4
mov word [ebp - 0x26d0], ax
mov word [ebp - 0x26cc], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42ed38
push 0x824
lea eax, [ebp - 0x26cc]
push eax
push 0x126b
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp ax, word [ebp - 0x26cc]
je 0x42ed58
lea eax, [ebp - 0x26cc]
push 0x5b
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x42ed6f
push ecx
push 0x408770
push ecx
mov edx, 0x824
lea ecx, [ebp - 0x26cc]
call fcn.0040c197
lea edx, [ebp - 0x26d0]
mov ecx, 0x405540
call fcn.00422900
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
movzx eax, word [ebp - 0x26d0]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x26cc]
push eax
push 0x407c10
lea eax, [ebp - 0x1684]
push 0x1048
push eax
call fcn.0040c0f9
add esp, 0x1c
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
cmp eax, 0xffffffff
je 0x42edf7
push eax
push 0x407c5c
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.0040c0b5
add esp, 0x10
test eax, eax
js 0x42edf7
lea eax, [ebp - 0x21c]
mov edx, 0x1048
push eax
lea ecx, [ebp - 0x1684]
call fcn.0040c07b
lea eax, [ebp - 0x26d4]
push eax
push 0x20019
push ebx
push 0x4021d0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 2
pop esi
test eax, eax
jne 0x42ef53
lea eax, [ebp - 0x26d8]
mov dword [ebp - 0x26d8], 0x20a
push eax
lea eax, [ebp - 0x21c]
xor esi, esi
push eax
lea eax, [ebp - 0x26d0]
inc esi
push eax
push ebx
push 0x407c70
push dword [ebp - 0x26d4]
mov dword [ebp - 0x26d0], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42eed6
cmp dword [ebp - 0x26d0], esi
jne 0x42eed6
lea eax, [ebp - 0x21c]
push 0x407c8c
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42eed6
push 2
pop edi
cmp word [esi], 0x2d
jne 0x42ee8a
add esi, edi
push esi
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
test eax, eax
je 0x42eebc
push 0x407c90
mov edx, 0x1048
lea ecx, [ebp - 0x1684]
call fcn.0040c07b
push esi
mov edx, 0x1048
lea ecx, [ebp - 0x1684]
call fcn.0040c07b
push 0x407c8c
push ebx
call dword [sym.imp.msvcrt.dll_wcstok]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x42ee82
mov edi, dword [ebp - 0x26e0]
lea eax, [ebp - 0x26d8]
mov dword [ebp - 0x26d0], 4
push eax
lea eax, [ebp - 0x26dc]
mov dword [ebp - 0x26dc], ebx
push eax
lea eax, [ebp - 0x26d0]
mov dword [ebp - 0x26d8], 4
push eax
push ebx
push 0x407ca0
push dword [ebp - 0x26d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ef44
cmp dword [ebp - 0x26d0], 4
jne 0x42ef44
push dword [ebp - 0x26dc]
lea eax, [ebp - 0x1684]
push eax
push 0x407cb0
push 0x1048
push eax
call fcn.0040c0f9
add esp, 0x14
push dword [ebp - 0x26d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop esi
call fcn.0042d9f9
test eax, eax
mov eax, 0x407cd0
jne 0x42ef66
mov eax, 0x407cf8
push eax
mov edx, 0x1048
lea ecx, [ebp - 0x1684]
call fcn.0040c07b
test edi, edi
je 0x42f016
cmp dword [edi], ebx
je 0x42ef8d
push dword [edi]
call fcn.00441807
pop ecx
mov dword [edi], ebx
lea ecx, [ebp - 0x1684]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x42ef96
sub ecx, edx
sar ecx, 1
push 2
pop edx
lea esi, [ecx + 1]
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov dword [edi], eax
pop ecx
test eax, eax
jne 0x42eff0
mov esi, 0x8007000e
push esi
push 0x407d48
push 2
pop eax
push eax
call fcn.0041ea5f
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x1684]
mov edx, esi
push ecx
mov ecx, eax
call fcn.0040c010
mov esi, eax
test esi, esi
jns 0x42f01f
cmp dword [edi], ebx
je 0x42f01b
push dword [edi]
call fcn.00441807
pop ecx
mov dword [edi], ebx
jmp 0x42f01b
mov esi, 0x80004003
test esi, esi
js 0x42efc9
push dword [edi]
push 0x407d20
push 4
jmp 0x42efd3