Function at 0x6726e130
Capabilities:
Check os version
Get geographical location
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov ecx, 0x2b
push esi
push ebx
xor ebx, ebx
mov eax, ebx
sub esp, 0x26c
lea edx, [esp + 0x1b4]
mov dword [esp + 0x38], 0
mov edi, edx
rep stosd dword es:[edi], eax
lea edi, [esp + 0xc8]
mov cl, 0xb
rep stosd dword es:[edi], eax
lea edi, [esp + 0xf4]
mov cl, 0xb
rep stosd dword es:[edi], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
sub esp, 4
mov ecx, 0xa
mov eax, dword [esp + 0x1b4]
lea edi, [esp + 0x50]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x1f8]
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0x200]
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0x204]
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x24c]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x250]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x254]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x258]
mov dword [esp + 0xf0], eax
mov eax, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1b8]
mov dword [esp + 8], 0x28
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
mov dword [esp], eax
call sym._wcstombs
mov byte [esp + 0xa0], 0
mov dword [esp], 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
sub esp, 4
lea esi, [esp + 0x4a]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 3
mov dword [esp + 4], 4
mov dword [esp], eax
mov dword [esp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
sub esp, 0x14
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x35]
mov dword [esp + 4], 3
mov dword [esp], eax
call sym.icuuc54.dll_u_strToUTF8_54
lea eax, [esp + 0x38]
mov dword [esp + 4], str.windowsZones
mov dword [esp], 0
mov dword [esp + 8], eax
call sym.icuuc54.dll_ures_openDirect_54
mov ebp, eax
lea eax, [esp + 0x38]
mov dword [esp + 4], str.mapTimezones
mov dword [esp + 8], ebp
mov dword [esp], ebp
mov dword [esp + 0xc], eax
call sym.icuuc54.dll_ures_getByKey_54
lea edx, [esp + 0x120]
mov eax, ebx
mov ecx, 0x25
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp], edx
mov dword [esp + 0x120], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
sub esp, 4
cmp dword [esp + 0x124], 5
mov edx, dword [esp + 0x38]
jbe 0x6726e32c
jmp 0x6726e480
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov dword [esp], ebx
call sym.icuuc54.dll_ures_close_54
mov edx, dword [esp + 0x38]
test edx, edx
jg 0x6726e560
mov dword [esp], ebp
call sym.icuuc54.dll_ures_hasNext_54
test al, al
je 0x6726e560
lea eax, [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym.icuuc54.dll_ures_getNextResource_54
mov ecx, dword [esp + 0x38]
mov ebx, eax
test ecx, ecx
jg 0x6726e560
mov dword [esp], eax
call sym.icuuc54.dll_ures_getKey_54
mov edx, eax
mov esi, eax
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 0x2c
call sym._openTZRegKey
test eax, eax
jne 0x6726e310
lea eax, [esp + 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x672d8484
mov dword [esp + 0x14], eax
lea eax, [esp + 0xf4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x28], eax
call eax
sub esp, 0x18
mov edi, eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], eax
call eax
sub esp, 4
test edi, edi
jne 0x6726e470
mov eax, dword [esp + 0xf8]
mov dword [esp + 8], 0x2c
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xfc]
mov dword [esp + 0xd0], eax
lea eax, [esp + 0xf4]
mov dword [esp + 4], eax
lea eax, [esp + 0xc8]
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x6726e470
mov edx, dword [esp + 0x20]
test edx, edx
jne 0x6726e5e3
lea edi, [esp + 0x3c]
lea eax, [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x672d83fe
mov dword [esp], ebx
mov dword [esp + 0x38], 0
mov dword [esp + 0xc], eax
call sym.icuuc54.dll_ures_getStringByKey_54
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
test eax, eax
jle 0x6726e61b
mov dword [esp], ebx
call sym.icuuc54.dll_ures_close_54
jmp 0x6726e328
lea eax, [esp + 0x40]
mov dword [esp + 0x44], 0x28
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlTimeZoneInformation_
mov dword [esp + 0x10], eax
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x6726e680
lea eax, [esp + 0x38]
mov dword [esp + 8], 0
mov dword [esp], ebp
mov dword [esp + 0xc], eax
lea eax, [esp + 0x78]
mov dword [esp + 4], eax
call sym.icuuc54.dll_ures_getByKey_54
mov edx, dword [esp + 0x38]
mov esi, eax
test edx, edx
jg 0x6726e32c
mov ebx, dword [esp + 0x20]
test ebx, ebx
jne 0x6726e780
lea edi, [esp + 0x3c]
lea eax, [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x672d83fe
mov dword [esp], esi
mov dword [esp + 0x38], 0
mov dword [esp + 0xc], eax
call sym.icuuc54.dll_ures_getStringByKey_54
mov ebx, eax
mov edx, dword [esp + 0x38]
test edx, edx
jg 0x6726e32c
movzx ecx, word [ebx]
xor edx, edx
test cx, 0xffdf
je 0x6726e554
lea eax, [esp + 0x9f]
add edx, 1
mov byte [eax + edx], cl
movzx ecx, word [ebx + edx*2]
test cx, 0xffdf
jne 0x6726e543
mov byte [esp + edx + 0xa0], 0
lea esi, [esi]
xor esi, esi
cmp byte [esp + 0xa0], 0
je 0x6726e5ce
lea ebx, [esp + 0xa0]
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x6726e575
mov ecx, eax
mov dword [esp + 4], 1
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
sub edx, ebx
mov dword [esp + 0x3c], edx
add edx, 1
mov dword [esp], edx
call sym.icuuc54.dll_uprv_calloc_54
test eax, eax
mov esi, eax
je 0x6726e5ce
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._strcpy
mov dword [esp], ebp
call sym.icuuc54.dll_ures_close_54
add esp, 0x26c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x38]
lea edi, [esp + 0x3c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x35]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call sym.icuuc54.dll_ures_getStringByKey_54
test eax, eax
mov dword [esp + 0x2c], eax
je 0x6726e43c
mov eax, dword [esp + 0x38]
test eax, eax
jg 0x6726e470
lea edi, [esp + 0x78]
xor eax, eax
mov ecx, 0xa
mov edx, esi
mov dword [esp + 0x40], 0x28
rep stosd dword es:[edi], eax
lea eax, [esp + 0x44]
call sym._openTZRegKey
test eax, eax
je 0x6726e6c5
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [esp + 0x24]
sub esp, 4
cmp byte [esp + 0xa0], 0
jne 0x6726e470
mov eax, dword [esp + 0x2c]
xor esi, esi
movzx edx, word [eax]
test dx, 0xffdf
jne 0x6726e742
mov byte [esp + 0xa0], 0
jmp 0x6726e470
lea eax, [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.TimeZoneKeyName
mov dword [esp + 0x14], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x6726e328
jmp 0x6726e4c0
lea eax, [esp + 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x672d8480
mov dword [esp + 0x14], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [esp + 0x28]
sub esp, 0x18
mov esi, eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [esp + 0x24]
sub esp, 4
test esi, esi
jne 0x6726e651
lea eax, [esp + 0x78]
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x6726e651
mov eax, dword [esp + 0x2c]
mov esi, 1
movzx edx, word [eax]
test dx, 0xffdf
je 0x6726e7af
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x9f]
xor eax, eax
nop
add eax, 1
mov byte [ecx + eax], dl
movzx edx, word [edi + eax*2]
test dx, 0xffdf
jne 0x6726e750
mov byte [esp + eax + 0xa0], 0
mov dword [esp], ebx
call sym.icuuc54.dll_ures_close_54
mov eax, esi
test al, al
je 0x6726e328
jmp 0x6726e560
lea eax, [esp + 0x38]
lea edi, [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x35]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call sym.icuuc54.dll_ures_getStringByKey_54
test eax, eax
mov ebx, eax
jne 0x6726e524
jmp 0x6726e4fe
mov dword [esp], ebx
mov byte [esp + 0xa0], 0
call sym.icuuc54.dll_ures_close_54
jmp 0x6726e560