Function at 0x109f16a
Capabilities:
Get common file path
Get geographical location

Disassembly:
mov eax, 0x12781bd
call fcn.01160168
mov eax, 0x21520
call fcn.01160330
mov eax, dword [0x12cf8c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 0x214f0], ecx
mov dword [ebp - 0x214c0], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x214cc], ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x214cc]
push eax
mov ecx, 0x12d2398
call fcn.0107d39e
mov esi, eax
cmp esi, ebx
jl 0x109f1d7
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f20d
mov ecx, dword [eax]
lea edx, [ebp - 0x214c0]
push edx
push eax
call dword [ecx + 0x70]
mov esi, eax
cmp esi, ebx
jge 0x109f205
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f1ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f1fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x109fd9a
cmp dword [ebp - 0x214c0], ebx
jne 0x109f23e
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f220
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f234
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x109fd9a
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f251
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x214d0], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x214c0]
mov ecx, dword [eax]
lea edx, [ebp - 0x214d0]
push edx
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f27e
mov ecx, dword [eax]
push eax
call dword [ecx + 0x60]
push 4
lea eax, [ebp - 0x18]
push eax
push 0xc
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
jne 0x109f2c6
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f2a8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f2bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x109fd9a
push edi
mov esi, 0x1068496
push esi
push fcn.0119568f
push 3
pop edi
push edi
push 0xc
lea eax, [ebp - 0x2152c]
push eax
call fcn.01160372
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21514]
push eax
push 1
call fcn.01192f5d
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109f346
mov byte [ebp - 4], 2
push esi
push edi
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601fa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f327
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f33b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x214c4]
jmp 0x109fd99
lea eax, [ebp - 0x2152c]
push eax
push 2
call fcn.01192f5d
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f300
lea eax, [ebp - 0x21520]
push eax
push 4
call fcn.01192f5d
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f300
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214c8], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf086
push edi
lea eax, [ebp - 0x2152c]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010900af
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f509
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf087
push 1
lea eax, [ebp - 0x2152c]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010900af
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f509
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf089
push 1
lea eax, [ebp - 0x21520]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010900af
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f509
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf088
push 1
lea eax, [ebp - 0x21514]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010900af
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f509
mov dword [ebp - 0x214fc], ebx
mov dword [ebp - 0x214f8], ebx
mov dword [ebp - 0x214f4], ebx
mov byte [ebp - 4], 5
push 0x100a530
lea ecx, [ebp - 0x214d4]
call fcn.01076840
mov byte [ebp - 4], 6
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214fc]
call fcn.010919b1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214d4]
call fcn.010328fa
push 0x100a52c
lea ecx, [ebp - 0x214d4]
call fcn.01076840
mov byte [ebp - 4], 7
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214fc]
call fcn.010919b1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214d4]
call fcn.010328fa
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf51a
push 1
lea eax, [ebp - 0x214fc]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010900af
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109f51d
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066942
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fa
jmp 0x109f300
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214e0], eax
mov byte [ebp - 4], 8
push 0xf08c
lea ecx, [ebp - 0x214e0]
call fcn.01032a95
cmp eax, ebx
jne 0x109f578
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066942
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fa
mov byte [ebp - 4], 2
push esi
push edi
jmp 0x109fd5f
lea eax, [ebp - 0x214e0]
push eax
lea ecx, [ebp - 0x214c8]
call fcn.01044c82
mov edi, dword [ebp - 0x214c8]
cmp dword [edi - 8], ebx
mov dword [ebp - 0x214cc], ebx
jle 0x109f5cc
mov eax, dword [ebp - 0x214cc]
cmp word [edi + eax*2], 0x5e
jne 0x109f5bb
push ebx
push eax
lea ecx, [ebp - 0x214c8]
call fcn.01061742
mov edi, dword [ebp - 0x214c8]
inc dword [ebp - 0x214cc]
mov eax, dword [ebp - 0x214cc]
cmp eax, dword [edi - 8]
jl 0x109f59b
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214e4], eax
mov byte [ebp - 4], 9
push 0xf08d
lea ecx, [ebp - 0x214e4]
call fcn.01032a95
cmp eax, ebx
je 0x109fd1c
push ebx
push edi
push 0x1264
push ebx
push ebx
push 1
lea ecx, [ebp - 0x214bc]
call fcn.01090dd5
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x214e4]
mov dword [ebp - 0x21470], eax
lea eax, [ebp - 0x2103c]
mov dword [ebp - 0x21458], 0x11d
mov dword [ebp - 0x2145c], 0x108e795
mov dword [ebp - 0x21460], eax
mov byte [ebp - 0x2103c], bl
mov dword [ebp - 0x214dc], ebx
mov byte [ebp - 4], 0xb
mov ecx, 0x12d2398
call fcn.0107c455
push eax
lea ecx, [ebp - 0x214cc]
call fcn.0103966b
mov byte [ebp - 4], 0xc
mov eax, dword [0x12ce0a0]
mov byte [ebp - 0x214e5], bl
mov dword [ebp - 0x214d8], eax
mov byte [ebp - 4], 0xd
push 0xf003f
push dword [ebp - 0x214cc]
lea ecx, [ebp - 0x214dc]
push 0x80000001
call fcn.010449e2
test eax, eax
mov edi, dword [ebp + 8]
jne 0x109f724
push 0x1001d74
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214dc]
mov byte [ebp - 0x214e5], 1
mov dword [ebp - 0x214d4], ebx
call fcn.01044a1e
test eax, eax
jne 0x109f6d7
cmp dword [ebp - 0x214d4], ebx
setne al
mov byte [ebp - 0x2103c], al
jmp 0x109f6de
mov byte [ebp - 0x2103c], 1
lea eax, [ebp - 0x214c4]
push eax
mov ecx, 0x208
push edi
mov dword [ebp - 0x214c4], ecx
call fcn.0108e8be
push eax
push ecx
lea ecx, [ebp - 0x214d8]
call fcn.0103299e
push eax
lea ecx, [ebp - 0x214dc]
call fcn.01044a51
test eax, eax
je 0x109f7dc
push 0xffffffffffffffff
lea ecx, [ebp - 0x214d8]
call fcn.01032a0b
push 0x104
lea ecx, [ebp - 0x214d8]
call fcn.0103299e
push eax
push ebx
push ebx
push edi
call fcn.0108e8f4
or eax, 0x8000
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109f7dc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fa
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fa
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.010449c4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090d85
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066942
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fa
mov byte [ebp - 4], 2
push esi
push 3
jmp 0x109f306
cmp edi, ebx
mov eax, dword [ebp - 0x214d8]
mov dword [ebp - 0x21474], eax
jl 0x109fce0
cmp edi, 2
jle 0x109f80a
cmp edi, 3
jne 0x109fce0
mov dword [ebp - 0x21488], 1
jmp 0x109f813
add edi, 2
mov dword [ebp - 0x21488], edi
push dword [0x12d24cc]
lea eax, [ebp - 0x21038]
lea ecx, [ebp - 0x214bc]
mov word [ebp - 0x21038], bx
mov dword [ebp - 0x21484], eax
mov dword [ebp - 0x21480], 0x10810
call fcn.01065cb1
cmp eax, 1
jne 0x109fc25
mov dword [ebp - 0x21508], ebx
mov dword [ebp - 0x21504], ebx
mov dword [ebp - 0x21500], ebx
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x21038]
push eax
lea ecx, [ebp - 0x214ec]
call fcn.01045d3e
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214ec]
call fcn.01044f6f
mov edi, eax
cmp edi, ebx
jge 0x109f964
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.010454b8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.01066942
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fa
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fa
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.010449c4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090d85
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066942
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fa
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601fa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f949
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f95d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x109fd99
lea edi, [ebp - 0x21038]
mov eax, edi
test eax, eax
jne 0x109fa50
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.010454b8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.01066942
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fa
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fa
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.010449c4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090d85
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066942
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fa
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601fa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109fa32
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109fa46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x109fd99
cmp word [ebp - 0x21038], bx
je 0x109fa60
inc edi
inc edi
cmp word [edi], bx
jne 0x109fa59
inc edi
inc edi
je 0x109f974
mov ax, word [edi]
cmp ax, bx
je 0x109fb0f
mov cx, word [edi + 2]
cmp cx, 0x3a
je 0x109fabf
cmp ax, 0x5c
jne 0x109fa89
cmp cx, ax
je 0x109fabf
push edi
lea eax, [ebp - 0x214ec]
push eax
lea eax, [ebp - 0x214d4]
push eax
call fcn.01045b22
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.010919b1
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
jmp 0x109faeb
push edi
lea ecx, [ebp - 0x214c4]
call fcn.0103966b
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x214c4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.010919b1
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214c4]
call fcn.010328fa
jmp 0x109faf4
inc edi
inc edi
cmp word [edi], bx
jne 0x109faf2
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x109fa74
cmp dword [ebp - 0x21504], ebx
jne 0x109fb72
lea eax, [ebp - 0x21038]
push eax
lea ecx, [ebp - 0x214d4]
call fcn.01045d3e
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x214ec]
push eax
lea ecx, [ebp - 0x214d4]
call fcn.010527df
mov edi, eax
cmp edi, ebx
jge 0x109fb51
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
call fcn.010454b8
jmp 0x109f88b
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.010919b1
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
call fcn.010454b8
mov eax, dword [ebp - 0x214f0]
mov ecx, dword [eax + 0xcc]
cmp ecx, ebx
je 0x109f974
call fcn.010a58a6
mov edi, dword [ebp - 0x214f0]
push ebx
push 1
push dword [ebp - 0x2103c]
lea eax, [ebp - 0x21508]
push eax
mov ecx, edi
call fcn.0109e542
mov ecx, dword [edi + 0xcc]
mov dword [ebp - 0x214c4], eax
call fcn.010a58c5
cmp dword [ebp - 0x214c4], ebx
jge 0x109fbcd
push dword [ebp - 0x214c4]
call fcn.0116f1b4
pop ecx
cmp byte [ebp - 0x214e5], bl
je 0x109fc07
movzx eax, byte [ebp - 0x2103c]
push 0x1001d74
push eax
lea ecx, [ebp - 0x214dc]
call fcn.010615c4
push dword [ebp + 8]
call fcn.0108e8be
push eax
push dword [ebp - 0x214ec]
lea ecx, [ebp - 0x214dc]
call fcn.01044a7b
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.010454b8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.01066942
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fa
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fa
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.010449c4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090d85
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066942
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fa
mov byte [ebp - 4], 2
push esi
push 3
push 0xc
lea eax, [ebp - 0x2152c]
push eax
call fcn.011601fa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109fcc5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109fcd9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x109fd99
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fa
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fa
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.010449c4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090d85
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066942
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fa
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601fa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109fd80
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109fd94
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret 4