Function at 0x10299d9
Capabilities:
Check internet connectivity via wininet
Create process on windows
Get common file path
Get geographical location
Identify system language via api

Disassembly:
mov eax, 0x107c953
call fcn.01032938
sub esp, 0x9c8
mov eax, dword [0x109126c]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x990], eax
mov dword [ebp - 0x994], edi
mov dword [ebp - 0x998], edi
mov dword [ebp - 0x980], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x988], edi
mov dword [ebp - 0x984], edi
push edi
mov byte [ebp - 4], 2
mov byte [ebp - 0x95d], 0
mov byte [ebp - 0x965], 0
mov byte [ebp - 0x966], 0
call fcn.0102ab5b
cmp eax, edi
jl 0x1029a85
push edi
call fcn.01034492
cmp eax, edi
jl 0x1029a85
push edi
call fcn.01062ae6
cmp eax, edi
jl 0x1029a85
call fcn.0103fe2a
cmp eax, edi
jl 0x1029a85
call fcn.010474b2
cmp eax, edi
jl 0x1029a85
call fcn.01041ac9
cmp eax, edi
jl 0x1029a85
call fcn.01040e4a
cmp eax, edi
jl 0x1029a85
call fcn.01039c27
cmp eax, edi
jl 0x1029a85
xor eax, eax
cmp eax, edi
mov ebx, eax
jl 0x102a521
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
push esi
mov dword [ebp - 0x97c], eax
jle 0x1029b52
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
mov ecx, dword [ebp - 0x990]
mov esi, dword [ecx + eax*4]
mov ax, word [esi]
cmp ax, 0x2d
je 0x1029ac0
cmp ax, 0x2f
jne 0x1029b01
inc esi
inc esi
push 0x1003894
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1029ad7
mov byte [ebp - 0x95d], 1
push 0x100387c
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1029aec
mov byte [ebp - 0x965], 1
push 0x100386c
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1029b01
mov byte [ebp - 0x966], 1
mov eax, dword [ebp - 0x97c]
inc eax
cmp eax, dword [ebp + 8]
mov dword [ebp - 0x97c], eax
jl 0x1029aa8
cmp byte [ebp - 0x966], 0
je 0x1029b38
cmp byte [ebp - 0x95d], 0
jne 0x1029b2e
cmp byte [ebp - 0x965], 0
je 0x1029b52
mov ebx, 0x80070057
jmp 0x102a520
cmp byte [ebp - 0x95d], 0
jne 0x102a44d
cmp byte [ebp - 0x965], 0
jne 0x102a44d
lea ecx, [ebp - 0x9d4]
call fcn.0102fc8e
push edi
push 0x20019
push 0x80000002
lea ecx, [ebp - 0x9d4]
mov byte [ebp - 4], 4
call fcn.0102f72e
test eax, eax
jl 0x1029c9f
push 0x1003818
lea ecx, [ebp - 0x9d4]
call fcn.01030090
test eax, eax
jl 0x1029c9f
lea eax, [ebp - 0x95d]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.0102f8a7
test eax, eax
jl 0x1029c9f
cmp byte [ebp - 0x95d], 0
je 0x1029c9f
mov word [ebp - 0x978], di
push 0x10037fc
lea eax, [ebp - 0x95d]
push eax
lea eax, [ebp - 0x978]
push eax
lea ecx, [ebp - 0x9d4]
mov byte [ebp - 4], 5
call fcn.0102f9fb
test eax, eax
jl 0x1029c0c
cmp byte [ebp - 0x95d], 0
je 0x1029c0c
cmp word [ebp - 0x978], 3
jne 0x1029c0c
cmp dword [ebp - 0x970], edi
setne al
mov byte [0x108f1ec], al
push 0x10037e4
lea eax, [ebp - 0x95d]
push eax
lea eax, [ebp - 0x978]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.0102f9fb
test eax, eax
jl 0x1029c4f
cmp byte [ebp - 0x95d], 0
je 0x1029c4f
cmp word [ebp - 0x978], 3
jne 0x1029c4f
cmp dword [ebp - 0x970], edi
setne al
mov byte [0x10974e0], al
push 0x10037d0
lea eax, [ebp - 0x95d]
push eax
lea eax, [ebp - 0x978]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.0102f9fb
test eax, eax
jl 0x1029c92
cmp byte [ebp - 0x95d], 0
je 0x1029c92
cmp word [ebp - 0x978], 3
jne 0x1029c92
cmp dword [ebp - 0x970], edi
setne al
mov byte [0x10974e1], al
lea eax, [ebp - 0x978]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x9d4]
mov byte [ebp - 4], 2
call fcn.0102fcbf
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x102a21d
xor edx, edx
xor eax, eax
mov word [ebp - 0x640], dx
mov ecx, 0x81
lea edi, [ebp - 0x63e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x95c], edx
mov ecx, 0x86
lea edi, [ebp - 0x958]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x964], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x80
lea ecx, [ebp - 0x740]
movzx eax, ax
push ecx
push 0x1001
push eax
mov dword [ebp - 0x98c], eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x10037c0
lea eax, [ebp - 0x740]
push eax
call edi
test eax, eax
push 0xc
pop ebx
je 0x1029d4e
push 0x10037b8
push ebx
lea eax, [ebp - 0x28]
push eax
call fcn.01021e48
mov dword [ebp - 0x964], eax
jmp 0x1029d6c
push 0x10037a0
lea eax, [ebp - 0x740]
push eax
call edi
test eax, eax
je 0x1029d67
push 0x1003798
jmp 0x1029d3c
and word [ebp - 0x28], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x28]
push eax
call edi
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp + eax*2 - 0x28]
push eax
push 0x59
push dword [ebp - 0x98c]
call esi
push 0x1003794
push ebx
lea eax, [ebp - 0x28]
push eax
call fcn.01023a83
mov dword [ebp - 0x96c], eax
lea eax, [ebp - 0x28]
push eax
call edi
sub ebx, eax
push ebx
lea eax, [ebp + eax*2 - 0x28]
push eax
push 0x5a
push dword [ebp - 0x98c]
call esi
push 0x1003784
mov esi, 0x208
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01021e48
or eax, dword [ebp - 0x96c]
or dword [ebp - 0x964], eax
lea eax, [ebp - 0x438]
push eax
call edi
lea ebx, [ebp + eax*2 - 0x438]
lea eax, [ebp - 0x438]
push eax
call edi
mov ecx, esi
sub ecx, eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0x100376c
mov eax, 0x1003768
push eax
push dword [ebp - 0x98c]
mov edi, 0x100374c
push edi
push eax
push ebx
push 0x100372c
lea eax, [ebp - 0x640]
push 0x104
push eax
call fcn.01023a46
add esp, 0x24
jmp 0x1029e46
mov ax, word [ebx]
cmp ax, 0x5c
jne 0x1029e41
push 0x2f
pop eax
mov word [ebx], ax
inc ebx
inc ebx
cmp word [ebx], 0
jne 0x1029e35
cmp word [ebx - 2], 0x2f
je 0x1029e5e
mov word [ebx], 0x2f
inc ebx
inc ebx
and word [ebx], 0
cmp word [ebp - 0x640], 0
lea eax, [ebp - 0x640]
je 0x1029e85
mov cx, word [eax]
cmp cx, 0x2f
jne 0x1029e7a
push 0x5c
pop ecx
mov word [eax], cx
inc eax
inc eax
cmp word [eax], 0
jne 0x1029e6e
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.msvcrt.dll__wfindfirst]
cmp eax, 0xffffffff
pop ecx
pop ecx
jne 0x1029eb4
push edi
push 0x104
lea eax, [ebp - 0x640]
push eax
call fcn.01021e48
jmp 0x1029ee2
push eax
call dword [sym.imp.msvcrt.dll__findclose]
mov dword [esp], 0x1003728
push dword [ebp - 0x98c]
lea eax, [ebp - 0x640]
push edi
push 0x1003714
push 0x104
push eax
call fcn.01023a46
add esp, 0x18
lea eax, [ebp - 0x640]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
or dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x990]
mov ecx, dword [ebp + 8]
mov edi, dword [eax + ecx*4 - 4]
push 0x10036dc
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x102a21d
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x10036a4
push edi
call ebx
test eax, eax
je 0x1029f72
push 0x1003670
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1003610
mov ebx, eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1003604
jmp 0x102a1ce
push 0x10035c0
push edi
call ebx
test eax, eax
jne 0x102a190
push 0x10034e0
push edi
call ebx
test eax, eax
jne 0x102a190
push 0x1003498
push edi
call ebx
test eax, eax
je 0x1029fa8
push 0x1003468
jmp 0x102a13e
push 0x1003390
push edi
call ebx
test eax, eax
je 0x1029ff7
push 0x1003670
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1003610
mov ebx, eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1003388
jmp 0x102a1ce
push 0x1003374
push edi
call ebx
test eax, eax
jne 0x102a150
push 0x100335c
push edi
call ebx
test eax, eax
jne 0x102a150
push 0x1003348
push edi
call ebx
test eax, eax
jne 0x102a150
push 0x1003314
push edi
call ebx
test eax, eax
je 0x102a03a
push 0x10032b8
jmp 0x102a05e
push 0x1003290
push edi
call ebx
test eax, eax
je 0x102a04d
push 0x1003238
jmp 0x102a05e
push 0x10030c8
push edi
call ebx
test eax, eax
je 0x102a066
push 0x1003068
lea eax, [ebp - 0x438]
jmp 0x102a0e3
push 0x100302c
push edi
call ebx
test eax, eax
je 0x102a0b5
push 0x1003670
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1003610
mov ebx, eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1003028
jmp 0x102a1ce
push 0x1002fd8
push edi
call ebx
test eax, eax
je 0x102a0ef
push 0
lea eax, [ebp - 0x998]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
lea eax, [ebp - 0x438]
je 0x102a196
push 0x1002f90
push esi
push eax
call fcn.01021e48
jmp 0x102a1eb
push 0x1002f68
push edi
call ebx
test eax, eax
jne 0x102a139
push 0x1002e90
push edi
call ebx
test eax, eax
jne 0x102a139
push 0x1002e5c
push edi
call ebx
test eax, eax
jne 0x102a132
push 0x1002e00
push edi
call ebx
test eax, eax
jne 0x102a132
push 0x1002dd0
push edi
call ebx
test eax, eax
jne 0x102a132
push 0x100376c
jmp 0x102a13e
push 0x1002db4
jmp 0x102a13e
push 0x1002d98
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
jmp 0x102a1eb
push 0x1003670
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1003610
mov ebx, eax
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.01023a83
push 0x1002d90
jmp 0x102a1ce
lea eax, [ebp - 0x438]
push 0x1003670
push esi
push eax
call fcn.01023a83
mov edi, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x438]
push esi
push eax
call fcn.01023a83
push 0x1003610
mov ebx, eax
lea eax, [ebp - 0x438]
push esi
push eax
call fcn.01023a83
push 0x1002d8c
mov dword [ebp - 0x96c], eax
lea eax, [ebp - 0x438]
push esi
push eax
call fcn.01023a83
or eax, dword [ebp - 0x96c]
or eax, ebx
or eax, edi
or dword [ebp - 0x964], eax
xor ebx, ebx
cmp dword [ebp - 0x964], ebx
jl 0x102a216
push 3
push ebx
lea eax, [ebp - 0x438]
push eax
push 0x1002d7c
push 0x1002d70
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
jmp 0x102a520
lea eax, [ebp - 0x984]
push eax
lea eax, [ebp - 0x980]
push eax
lea ecx, [ebp - 0x988]
call fcn.01026d47
mov ebx, eax
xor edi, edi
cmp ebx, edi
jl 0x102a520
mov ecx, dword [0x109772c]
call fcn.01046ab8
mov ebx, eax
cmp ebx, edi
jl 0x102a520
mov ecx, dword [0x109772c]
call fcn.010428c8
cmp eax, edi
jne 0x102a27d
push edi
push 0x8a4
push 0x898
call fcn.0102aeeb
xor ebx, ebx
jmp 0x102a520
cmp eax, 0xffffffff
jne 0x102a35f
mov ecx, dword [0x109772c]
call fcn.01042ee3
test al, al
jne 0x102a35f
mov esi, 0x105
push esi
lea eax, [ebp - 0x94c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x102a2ba
mov ebx, 0x80004005
jmp 0x102a520
push 0x1001d98
push esi
lea eax, [ebp - 0x94c]
push eax
call fcn.01023a83
cmp eax, edi
jl 0x102a2b0
push 2
push edi
lea eax, [ebp - 0x94c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, edi
je 0x102a2b0
push 0x104
lea ecx, [ebp - 0x640]
push ecx
push 0x35ea
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102a2b0
mov dword [ebp - 0x974], edi
mov dword [ebp - 0x970], edi
mov dword [ebp - 0x96c], edi
push edi
lea eax, [ebp - 0x978]
push eax
push 0x898
mov byte [ebp - 4], 6
call fcn.0102ae93
mov eax, dword [ebp - 0x974]
cmp eax, edi
jne 0x102a337
mov eax, 0x1003ac8
push edi
push eax
lea eax, [ebp - 0x640]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
lea ecx, [ebp - 0x978]
xor ebx, ebx
mov byte [ebp - 4], 2
call fcn.01025782
jmp 0x102a520
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
mov dword [ebp - 0x97c], eax
jle 0x102a3c0
mov esi, dword [ebp - 0x990]
mov eax, dword [ebp - 0x97c]
mov eax, dword [esi + eax*4]
mov cx, word [eax]
cmp cx, 0x2d
je 0x102a38b
cmp cx, 0x2f
jne 0x102a3af
mov ecx, dword [0x109772c]
push esi
push dword [ebp + 8]
add eax, 2
push eax
lea eax, [ebp - 0x97c]
push eax
call fcn.010471cb
mov ebx, eax
cmp ebx, edi
jl 0x102a520
inc dword [ebp - 0x97c]
mov eax, dword [ebp - 0x97c]
cmp eax, dword [ebp + 8]
jl 0x102a373
mov ecx, dword [0x109772c]
call fcn.010438fa
test al, al
je 0x102a446
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push edi
lea eax, [ebp - 0x20]
push eax
push 0x800
mov byte [ebp - 4], 7
call fcn.0102ae93
lea eax, [ebp - 0x970]
push eax
mov dword [ebp - 0x970], 8
mov dword [ebp - 0x96c], 0x3e00
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea eax, [ebp - 0x998]
push eax
lea eax, [ebp - 0x994]
push eax
call fcn.010221e6
test al, al
je 0x102a438
push dword [ebp - 0x998]
mov ecx, dword [0x109772c]
lea eax, [ebp - 0x20]
push eax
call fcn.01046e89
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.01025782
xor ebx, ebx
jmp 0x102a50c
lea eax, [ebp - 0x966]
push eax
push 0x1002d28
lea ecx, [ebp - 0x978]
call fcn.010293e8
lea eax, [ebp - 0x978]
push eax
mov byte [ebp - 4], 3
call fcn.0102e867
mov eax, dword [ebp - 0x974]
cmp eax, edi
mov dword [ebp - 0x20], 0x1002d10
mov dword [ebp - 0x1c], 0x1003ac8
je 0x102a48f
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
cmp byte [ebp - 0x95d], al
mov dword [ebp - 0x18], edi
setne al
mov dword [ebp - 0x14], edi
push eax
push 0x65
push 0x109758c
call fcn.01026fde
cmp byte [ebp - 0x95d], 0
mov ebx, 0x1002d08
mov esi, 0x1002d00
je 0x102a4da
push ebx
push 0x109758c
call fcn.01024334
push esi
push 0x109758c
call fcn.01024334
cmp byte [ebp - 0x965], 0
je 0x102a4f9
push ebx
push 0x109758c
call fcn.0102426d
push esi
push 0x109758c
call fcn.0102426d
push 1
lea ecx, [ebp - 0x978]
xor ebx, ebx
mov byte [ebp - 4], 2
call fcn.01025782
cmp dword [ebp - 0x994], edi
je 0x102a520
push dword [ebp - 0x994]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, dword [ebp - 0x980]
cmp eax, edi
je 0x102a5b1
cmp dword [ebp - 0x988], edi
je 0x102a562
mov ecx, dword [eax]
push 0x1001d80
push dword [ebp - 0x988]
push eax
call dword [ecx + 0x10]
cmp eax, edi
jl 0x102a5bb
mov eax, dword [ebp - 0x988]
cmp eax, edi
je 0x102a562
mov dword [ebp - 0x988], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x984], edi
je 0x102a59b
mov eax, dword [ebp - 0x980]
mov ecx, dword [eax]
push 0x1001d88
push dword [ebp - 0x984]
push eax
call dword [ecx + 0x10]
cmp eax, edi
jl 0x102a5bb
mov eax, dword [ebp - 0x984]
cmp eax, edi
je 0x102a59b
mov dword [ebp - 0x984], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x980]
cmp eax, edi
je 0x102a5b1
mov dword [ebp - 0x980], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x109758c
call fcn.01022af2
call fcn.01039af3
call fcn.01040e77
call fcn.01040279
call fcn.010428ac
call fcn.0103fe83
call fcn.01062368
call fcn.010345ea
mov eax, dword [ebp - 0x984]
cmp eax, edi
mov byte [ebp - 4], 1
je 0x102a5f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x988]
cmp eax, edi
mov byte [ebp - 4], 0
je 0x102a606
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x980]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x102a61a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, ebx
pop ebx
call fcn.0102a8ee
leave
ret 8