Function at 0x100c423
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x20]
xor eax, eax
cmp edi, eax
je 0x100c433
mov dword [edi], eax
cmp dword [0x101d220], eax
mov dword [esp + 4], eax
je 0x100c92f
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcscmp]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, 0x101d220
push 0x101a884
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x100c914
push str._ADD
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c491
cmp dword [esp + 0x28], 1
je 0x100c914
push 0xdad
call fcn.0100e881
jmp 0x100c914
push str._ACTIVE
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c4a9
and dword [ebp + 0x18], 0xffffffed
jmp 0x100c914
push 0x101a8a0
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c4d1
cmp dword [esp + 0x30], eax
je 0x100c914
mov eax, dword [esp + 0x30]
mov dword [eax], 8
jmp 0x100c914
push str._FPNW
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c4f3
test edi, edi
je 0x100c914
mov dword [edi], 1
jmp 0x100c914
push dword [esi]
call fcn.0100e1b8
mov edi, eax
test edi, edi
jne 0x100c50a
push 0xdb1
call fcn.0100e881
push str._FULLNAME
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c53d
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x30
pop ecx
jbe 0x100c535
push str._FULLNAME
push 0xf70
call fcn.0100e791
mov dword [ebp + 0x24], edi
jmp 0x100c90a
push str._ENABLESCRIPT
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c573
push str._ENABLESCRIPT
push edi
call fcn.0100b497
test eax, eax
je 0x100c564
or dword [ebp + 0x18], 1
jmp 0x100c90a
push 0xebb
call fcn.0100e881
jmp 0x100c90a
push str._HOMEDIR
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c5d7
cmp word [edi], ax
je 0x100c5cf
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
push eax
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
je 0x100c5a7
push str._HOMEDIR
push 0xf70
call fcn.0100e791
mov eax, dword [esp + 0x24]
cmp eax, 0x2006
je 0x100c5cf
cmp eax, 0x2000
je 0x100c5cf
cmp eax, 0x1000
je 0x100c5cf
push str._HOMEDIR
push 0xf70
call fcn.0100e791
mov dword [ebp + 0x10], edi
jmp 0x100c90a
push str._PARMS
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c5ee
mov dword [ebp + 0x2c], edi
jmp 0x100c90a
push str._COMMENT
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c621
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x30
pop ecx
jbe 0x100c619
push str._COMMENT
push 0xf70
call fcn.0100e791
mov dword [ebp + 0x14], edi
jmp 0x100c90a
push str._USERCOMMENT
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c654
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x30
pop ecx
jbe 0x100c64c
push str._USERCOMMENT
push 0xf70
call fcn.0100e791
mov dword [ebp + 0x28], edi
jmp 0x100c90a
push str._SCRIPTPATH
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c6a0
cmp edi, eax
je 0x100c674
cmp word [edi], ax
jne 0x100c674
mov dword [ebp + 0x1c], edi
jmp 0x100c90a
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
push eax
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
jne 0x100c68f
cmp dword [esp + 0x24], 0x2000
je 0x100c66c
push str._SCRIPTPATH
push 0xf70
call fcn.0100e791
jmp 0x100c66c
push str._PROFILEPATH
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c6f6
cmp edi, eax
je 0x100c6c0
cmp word [edi], ax
jne 0x100c6c0
mov dword [ebp + 0x68], edi
jmp 0x100c90a
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
push eax
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
jne 0x100c6e5
cmp dword [esp + 0x24], 0x2006
je 0x100c6b8
cmp dword [esp + 0x24], 0x1000
je 0x100c6b8
push str._PROFILEPATH
push 0xf70
call fcn.0100e791
jmp 0x100c6b8
push str._ACTIVE
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c726
push str._ACTIVE
push edi
call fcn.0100b497
test eax, eax
je 0x100c71d
and dword [ebp + 0x18], 0xffffffed
jmp 0x100c90a
or dword [ebp + 0x18], 2
jmp 0x100c90a
push str._FPNW
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c778
push str._FPNW
push edi
call fcn.0100b497
test eax, eax
je 0x100c75e
cmp dword [esp + 0x2c], 0
je 0x100c90a
mov eax, dword [esp + 0x2c]
mov dword [eax], 1
jmp 0x100c90a
cmp dword [esp + 0x2c], 0
je 0x100c90a
mov eax, dword [esp + 0x2c]
mov dword [eax], 2
jmp 0x100c90a
push str._PASSWORDREQ
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c7a8
push str._PASSWORDREQ
push edi
call fcn.0100b497
test eax, eax
je 0x100c79f
and dword [ebp + 0x18], 0xffffffdf
jmp 0x100c90a
or dword [ebp + 0x18], 0x20
jmp 0x100c90a
push str._PASSWORDCHG
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c7d8
push str._PASSWORDCHG
push edi
call fcn.0100b497
test eax, eax
je 0x100c7cf
and dword [ebp + 0x18], 0xffffffbf
jmp 0x100c90a
or dword [ebp + 0x18], 0x40
jmp 0x100c90a
push str._TIMES
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c7fc
push edi
call fcn.0100b555
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x44], 0xa8
jmp 0x100c90a
push str._WORKSTATIONS
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c819
push edi
call fcn.0100bbcd
mov dword [ebp + 0x30], eax
jmp 0x100c90a
push str._COUNTRYCODE
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c856
push str._COUNTRYCODE
push 0xf70
push edi
call fcn.0100e2ae
mov esi, eax
push esi
call fcn.0100b5df
test eax, eax
jne 0x100c84e
push 0xebd
call fcn.0100e881
mov dword [ebp + 0x58], esi
jmp 0x100c90a
push 0x101a8a0
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c8a0
cmp dword [esp + 0x30], eax
je 0x100c90a
push 0x101a8a0
push 0xf70
push edi
call fcn.0100e280
mov ecx, dword [esp + 0x30]
movzx eax, ax
cmp eax, 0x100
mov dword [ecx], eax
jle 0x100c90a
push 0x101a8a0
push 0xf70
call fcn.0100e791
jmp 0x100c90a
push str._EXPIRES
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100c90a
push str.NEVER
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x100c8c7
or dword [ebp + 0x3c], 0xffffffff
jmp 0x100c90a
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push edi
call fcn.010122b3
test eax, eax
jne 0x100c8eb
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp dword [esp + 0x18], eax
pop ecx
je 0x100c8f5
push 0xeb7
call fcn.0100e881
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call fcn.01012b1e
mov eax, dword [esp + 0x1c]
mov dword [ebp + 0x3c], eax
mov word [edi - 2], 0x3a
mov edi, dword [esp + 0x2c]
inc dword [esp + 0x10]
mov esi, dword [esp + 0x10]
lea esi, [esi*4 + 0x101d220]
cmp dword [esi], 0
jne 0x100c455
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret 0x10