Function at 0x100b561
Capabilities:
Check os version
Get geographical location
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x940
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x800
mov word [ebp - 0x81c], ax
xor edi, edi
lea eax, [ebp - 0x81a]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0x641
mov dword [ebp - 0x93c], edi
mov esi, 0x401
jb 0x100b5ce
push edi
push esi
lea eax, [ebp - 0x81c]
push eax
push dword [ebp + 8]
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
mov dword [ebp - 0x940], eax
cmp eax, edi
jne 0x100b67f
call dword [sym.imp.KERNEL32.DLL_GetACP]
push 0x1003d70
mov dword [ebp - 0x940], eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x100b62f
push 0x100b7c8
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, edi
je 0x100b628
call eax
movzx eax, ax
push 0xa
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x93c], eax
push ecx
movzx eax, ax
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x100b628
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x940], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push edi
push esi
lea eax, [ebp - 0x81c]
push eax
movzx eax, word [ebp - 0x93c]
push eax
push dword [ebp + 8]
push edi
push 0x1000
call dword [sym.imp.KERNEL32.DLL_FormatMessageW]
cmp eax, edi
je 0x100b65f
xor ecx, ecx
mov word [ebp + eax*2 - 0x820], cx
jmp 0x100b67f
push dword [ebp + 8]
lea eax, [ebp - 0x81c]
push 0x100b7a4
push esi
push eax
call fcn.01008f12
add esp, 0x10
test eax, eax
jl 0x100b791
mov eax, dword [0x100e030]
cmp dword [0x100fe58], edi
jne 0x100b744
cmp eax, edi
je 0x100b69d
cmp eax, 0xffffffff
jne 0x100b744
lea eax, [ebp - 8]
mov esi, 0x11c
push esi
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp - 0x938]
push edi
inc ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x938]
push eax
mov dword [ebp - 0x938], esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x100b723
cmp dword [ebp - 0x934], 6
jb 0x100b723
push edi
push 0x100
lea ecx, [ebp - 0x14]
call fcn.01008b11
test al, al
je 0x100b723
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x1c
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
test eax, eax
je 0x100b723
push edi
push 0xfffe
push ebx
push edi
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x14]
push edi
push edi
call dword [0x100e0d8]
test eax, eax
jge 0x100b73a
push edi
push dword [ebp - 0x940]
lea eax, [ebp - 0x81c]
push 0x10
push edi
push eax
push edi
call sub.msi.dll_MsiProvideQualifiedComponentExW
lea ecx, [ebp - 0x14]
call fcn.01001e0b
jmp 0x100b791
cmp eax, edi
je 0x100b791
cmp eax, 0xffffffff
je 0x100b791
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
lea ecx, [ebp - 0x93c]
push ecx
add eax, eax
push eax
lea eax, [ebp - 0x81c]
push eax
push dword [0x100e030]
call esi
push edi
lea eax, [ebp - 0x93c]
push eax
push 4
push 0x100b7a0
push dword [0x100e030]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret