Function at 0x406914
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [0x427130]
test eax, eax
je 0x406924
mov eax, dword [0x42712c]
ret
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp], 0x41e364
call sub.msvcrt.dll_getenv
test eax, eax
je 0x406c54
mov dword [esp], str.kernel32
call sub.KERNEL32.dll_GetModuleHandleA
push ebx
mov dword [ebp - 0x40], eax
test eax, eax
je 0x406b20
mov dword [esp + 4], str.GetUserPreferredUILanguages
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
test eax, eax
je 0x406aec
mov dword [ebp - 0x24], 0
lea edi, [ebp - 0x24]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
lea esi, [ebp - 0x28]
mov dword [esp + 4], esi
mov dword [esp], 8
call eax
sub esp, 0x10
test eax, eax
jne 0x406aec
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x80000005
jne 0x406aec
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x406aec
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x406aec
mov dword [esp + 0xc], edi
mov edi, eax
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 8
call ebx
sub esp, 0x10
test eax, eax
je 0x406ade
mov ebx, dword [ebp - 0x28]
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x24]
add edx, eax
lea eax, [edx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [ebp - 0x44], eax
test eax, eax
je 0x406ade
test ebx, ebx
je 0x406acd
mov ebx, edi
mov edx, eax
mov dword [ebp - 0x3c], 0
nop
mov ax, word [ebx]
test ax, ax
je 0x406c75
movzx ecx, al
cmp ax, cx
jne 0x406c5c
cmp ax, 0x3a
je 0x406c5c
mov ecx, esi
jmp 0x406a72
movzx edi, al
cmp ax, di
jne 0x406c5c
cmp ax, 0x3a
je 0x406c5c
inc ecx
mov byte [ecx - 1], al
add ebx, 2
mov ax, word [ebx]
test ax, ax
jne 0x406a5c
cmp edx, ecx
je 0x406c5c
mov byte [ecx], 0
mov dword [esp], esi
call fcn.00406c90
mov ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edx, [esi + ecx - 1]
add ebx, 2
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x28]
jae 0x406c5c
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x406c4c
lea esi, [edx + 1]
mov byte [edx], 0x3a
jmp 0x406a34
mov eax, dword [ebp - 0x44]
mov byte [eax], 0
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.0041ab20
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call fcn.0041ab20
lea esi, [esi]
mov dword [esp + 4], str.GetUserDefaultUILanguage
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x406b20
call eax
movzx eax, ax
mov dword [esp], eax
call fcn.00406ce4
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x406c30
nop
lea eax, [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x406bee
mov dword [ebp - 0x2c], 9
lea eax, [ebp - 0x2c]
mov dword [esp + 0x14], eax
lea ebx, [ebp - 0x24]
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov esi, eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
test esi, esi
jne 0x406bee
cmp dword [ebp - 0x30], 1
jne 0x406bee
mov eax, dword [ebp - 0x2c]
cmp eax, 9
ja 0x406bee
jne 0x406c85
cmp byte [ebp - 0x1c], 0
jne 0x406bee
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strtoul
mov edx, dword [ebp - 0x28]
cmp edx, ebx
jbe 0x406bee
cmp byte [edx], 0
jne 0x406bee
mov dword [esp], eax
call fcn.00408368
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x406c30
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x406c7c
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4068f4
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], edx
call sub.KERNEL32.dll_EnumResourceLanguagesA
sub esp, 0x14
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [0x42712c], eax
mov dword [0x427130], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, edx
jmp 0x406a34
mov eax, dword [0x42712c]
jmp 0x406c42
mov byte [edx], 0
cmp dword [ebp - 0x44], edx
jae 0x406ad3
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call fcn.0041ab20
jmp 0x406c30
mov ecx, esi
jmp 0x406a81
mov dword [ebp - 0x44], 0
jmp 0x406c30
mov byte [ebp + eax - 0x24], 0
jmp 0x406bbc