Function at 0x10003500
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.1000d6a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x808]
mov esi, edx
push eax
mov edi, ecx
mov dword [ebp - 0x100c], 0
call fcn.10003ba0
add esp, 4
test edi, edi
je 0x10003568
lea ecx, [ebp - 0x1008]
push ecx
mov esi, edi
call fcn.10003ba0
add esp, 4
test eax, eax
je 0x10003568
lea edx, [ebp - 0x100c]
push edx
push 4
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x1008]
push ecx
jmp 0x1000357a
lea edx, [ebp - 0x100c]
push edx
push 4
lea eax, [ebp - 0x808]
push eax
push 0
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x100038a9
mov eax, dword [ebp - 0x100c]
test eax, eax
je 0x100038cc
mov ecx, dword [eax]
push ecx
push 0x100119a8
push 0x100119bc
push 0x10017ae0
call fcn.10001110
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx + 0x24]
push eax
push str.Full_Name
push 0x100119bc
push 0x10017ae0
call fcn.10001110
mov ecx, dword [ebp - 0x100c]
mov edx, dword [ecx + 0x14]
push edx
push str.Comment
push 0x100119bc
push 0x10017ae0
call fcn.10001110
mov eax, dword [ebp - 0x100c]
mov ecx, dword [eax + 0x28]
push ecx
push str.Users_Comment
push 0x100119bc
push 0x10017ae0
call fcn.10001110
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx + 0x58]
add esp, 0x40
push eax
push str.Country_code
push str.__28s__d_n
mov esi, 0x10017ae0
call fcn.100010b0
mov ecx, dword [ebp - 0x100c]
add esp, 0xc
test byte [ecx + 0x18], 2
je 0x1000363d
push 0x10011a30
jmp 0x10003642
push 0x10011a50
push str.Account_active
push str.__28s__s_n
call fcn.100010b0
mov eax, dword [ebp - 0x100c]
mov edi, 0x10000
add esp, 0xc
test dword [eax + 0x18], edi
jne 0x10003679
mov eax, dword [eax + 0x3c]
cmp eax, 0xffffffff
je 0x10003679
push eax
push str.Account_expires
push str.__28s__d_n
jmp 0x10003688
push str.Never
push str.Account_expires
push str.__28s__s_n
mov esi, 0x10017ae0
call fcn.100010b0
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx + 0xc]
add esp, 0xc
test al, 2
je 0x100036a9
push str.Admin
jmp 0x100036b9
test al, 1
je 0x100036b4
push str.User
jmp 0x100036b9
push str.Guest
push str.Account_type
push str.__28s__s_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 0xc
push 0x100119a4
call fcn.100010b0
mov ecx, dword [ebp - 0x100c]
mov eax, 0x91a2b3c5
mul dword [ecx + 8]
add esp, 4
shr edx, 0xb
push edx
push str.Password_last_set
push str.__28s__d_hours_ago_n
call fcn.100010b0
mov edx, dword [ebp - 0x100c]
add esp, 0xc
test dword [edx + 0x18], edi
je 0x10003713
push str.Never
jmp 0x10003718
push 0x10011a50
push str.Password_expires
push str.__28s__s_n
call fcn.100010b0
mov eax, dword [ebp - 0x100c]
add esp, 0xc
test byte [eax + 0x18], 0x40
mov esi, 0x10017ae0
je 0x10003742
push 0x10011a30
jmp 0x10003747
push 0x10011a50
push str.Password_changeable
push str.__28s__s_n
call fcn.100010b0
mov ecx, dword [ebp - 0x100c]
add esp, 0xc
test byte [ecx + 0x18], 0x20
mov esi, 0x10017ae0
je 0x10003771
push 0x10011a30
jmp 0x10003776
push 0x10011a50
push str.Password_required
push str.__28s__s_n
call fcn.100010b0
mov edx, dword [ebp - 0x100c]
add esp, 0xc
test byte [edx + 0x18], 0x40
mov esi, 0x10017ae0
je 0x100037a0
push 0x10011a30
jmp 0x100037a5
push 0x10011a50
push str.User_may_change_password
push str.__28s__s_n
call fcn.100010b0
add esp, 0xc
push 0x100119a4
mov esi, 0x10017ae0
call fcn.100010b0
mov eax, dword [ebp - 0x100c]
mov ecx, dword [eax + 0x30]
add esp, 4
push ecx
push str.Workstations_allowed
push 0x100119bc
push esi
call fcn.10001110
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx + 0x1c]
push eax
push str.Logon_script
push 0x100119bc
push esi
call fcn.10001110
mov ecx, dword [ebp - 0x100c]
mov edx, dword [ecx + 0x68]
push edx
push str.User_profile
push 0x100119bc
push esi
call fcn.10001110
mov eax, dword [ebp - 0x100c]
mov ecx, dword [eax + 0x10]
push ecx
push str.Home_directory
push 0x100119bc
push esi
call fcn.10001110
mov eax, dword [ebp - 0x100c]
mov ecx, dword [eax + 0x34]
add esp, 0x40
lea edx, [ebp - 0x102c]
push edx
push 0
push ecx
call fcn.10003c20
add esp, 0xc
lea edx, [ebp - 0x101c]
push edx
lea eax, [ebp - 0x102c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx ecx, word [ebp - 0x1010]
movzx edx, word [ebp - 0x1012]
movzx eax, word [ebp - 0x1014]
push ecx
movzx ecx, word [ebp - 0x101c]
push edx
movzx edx, word [ebp - 0x1016]
push eax
movzx eax, word [ebp - 0x101a]
push ecx
push edx
push eax
push str.Last_logon
push str.__28s__02d__02d__02d__02d:_02d:_02d_n
call fcn.100010b0
add esp, 0x20
jmp 0x100038bc
push eax
push str.____Error:__d_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 8
mov eax, dword [ebp - 0x100c]
test eax, eax
je 0x100038cc
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003ead
mov esp, ebp
pop ebp
ret