Function at 0x1001c000
Capabilities:
Get common file path
Get geographical location
Get hostname
Get session user name
Parse credit card information
Query environment variable

Disassembly:
enter 0x4b4, 0
push ecx
push edx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x1001c26a
lodsb al, byte [esi]
cmp al, 0
je 0x1001c26a
cmp al, byte [ebp + 0x14]
jne 0x1001c244
lodsb al, byte [esi]
cmp al, 0x45
jne 0x1001bbb6
xor bl, 1
jmp 0x1001bb9a
cmp al, 0x55
jne 0x1001bbbf
xor bl, 2
jmp 0x1001bb9a
cmp al, 0x43
jne 0x1001bbc8
xor bl, 4
jmp 0x1001bb9a
cmp al, 0x6e
jne 0x1001bbd3
mov al, 0xa
jmp 0x1001c244
cmp al, 0x72
jne 0x1001bbde
mov al, 0xd
jmp 0x1001c244
cmp al, 0x61
jne 0x1001bbf7
push esi
mov esi, 0x100217c0
lodsb al, byte [esi]
stosb byte es:[edi], al
dec dword [ebp + 0xc]
je 0x1001bbf3
or al, al
jne 0x1001bbe8
dec edi
pop esi
jmp 0x1001bb90
cmp al, 0x65
jne 0x1001bc43
mov ecx, esi
lodsb al, byte [esi]
cmp al, 0x24
je 0x1001bc0b
or al, al
jne 0x1001bbfd
jmp 0x1001c26a
mov byte [esi - 1], 0
push ecx
call fcn.1000f10d
or eax, eax
je 0x1001bc3a
push esi
push edi
mov eax, dword [eax + 8]
mov esi, dword [eax + 4]
or esi, esi
je 0x1001bc32
inc esi
lodsb al, byte [esi]
stosb byte es:[edi], al
dec dword [ebp + 0xc]
je 0x1001bc31
or al, al
jne 0x1001bc26
dec edi
pop eax
sub edi, eax
xchg edi, eax
pop esi
add dword [ebp + 0xc], eax
mov byte [esi - 1], 0x24
jmp 0x1001c0f8
cmp al, 0x4f
jne 0x1001bccb
cmp dword [ebp + 0xc], 0x18
jb 0x1001bb90
push edi
push esi
cmp byte [0x100217ac], 0
jne 0x1001bc6c
mov ecx, 6
mov esi, 0x1002501b
jmp 0x1001bc8b
cmp byte [0x100217ac], 1
jne 0x1001bc81
mov ecx, 5
mov esi, 0x10025022
jmp 0x1001bc8b
mov ecx, 5
mov esi, 0x10025028
rep movsb byte es:[edi], byte [esi]
pop esi
movzx eax, byte [0x100217ad]
push eax
push edi
call fcn.1000d549
add edi, eax
mov al, 0x2e
stosb byte es:[edi], al
movzx eax, byte [0x100217ae]
push eax
push edi
call fcn.1000d549
add edi, eax
mov al, 0x2d
stosb byte es:[edi], al
mov eax, dword [0x100217a8]
push eax
push edi
call fcn.1000d549
add edi, eax
xchg edi, eax
pop edi
sub eax, edi
jmp 0x1001c0f8
cmp al, 0x52
jne 0x1001bd43
xor edx, edx
push edi
mov edi, esi
jmp 0x1001bcea
cmp al, 0x21
jne 0x1001bce1
lodsb al, byte [esi]
or al, al
je 0x1001bcef
jmp 0x1001bcea
cmp al, 0x24
jne 0x1001bce6
inc edx
cmp al, 0x60
je 0x1001bcf0
lodsb al, byte [esi]
or al, al
jne 0x1001bcd6
dec esi
push esi
mov esi, edi
lea edi, [ebp - 0x400]
push edx
push 0
call fcn.10010eb8
je 0x1001bd23
mov ecx, eax
lodsb al, byte [esi]
cmp al, 0x21
jne 0x1001bd11
lodsb al, byte [esi]
cmp al, 0
je 0x1001bd30
jmp 0x1001bd05
cmp al, 0x24
jne 0x1001bd05
loop 0x1001bd05
jmp 0x1001bd23
cmp al, 0x21
jne 0x1001bd22
lodsb al, byte [esi]
cmp al, 0
je 0x1001bd30
stosb byte es:[edi], al
lodsb al, byte [esi]
or al, al
je 0x1001bd30
cmp al, 0x24
je 0x1001bd30
cmp al, 0x60
jne 0x1001bd19
pop esi
lodsb al, byte [esi]
stosb byte es:[edi], al
or al, al
jne 0x1001bd31
lea esi, [ebp - 0x400]
pop edi
jmp 0x1001bb90
cmp al, 0x46
jne 0x1001bdab
push 0x2710
push 1
call fcn.10010eb8
xchg edx, eax
xor ecx, ecx
push edi
lea edi, [ebp - 0x400]
jmp 0x1001bd77
cmp al, 0x21
jne 0x1001bd6a
lodsb al, byte [esi]
or al, al
je 0x1001bd98
jmp 0x1001bd8e
cmp al, 0x24
jne 0x1001bd8a
cmp edx, ecx
ja 0x1001bd77
mov edx, 0xffffffff
push esi
call fcn.1000d4ca
add eax, ecx
xchg ecx, eax
lodsb al, byte [esi]
cmp al, 0x25
je 0x1001bd93
or al, al
jne 0x1001bd80
dec esi
cmp al, 0x60
je 0x1001bd99
cmp edx, ecx
ja 0x1001bd93
stosb byte es:[edi], al
lodsb al, byte [esi]
or al, al
jne 0x1001bd5f
dec esi
lodsb al, byte [esi]
stosb byte es:[edi], al
or al, al
jne 0x1001bd99
lea esi, [ebp - 0x400]
pop edi
jmp 0x1001bb90
cmp al, 0x57
jne 0x1001bdcd
cmp dword [ebp + 0xc], 0xb
jb 0x1001bb9a
push 0xb
push 6
push edi
call fcn.1001d354
add edi, eax
sub dword [ebp + 0xc], eax
jmp 0x1001bb90
cmp al, 0x4c
jne 0x1001bdff
lodsb al, byte [esi]
cmp al, 0
je 0x1001c26a
sub al, 0x30
jb 0x1001bb90
cmp al, 9
ja 0x1001bb90
movzx eax, al
push eax
push 9
call fcn.10010e14
push 0x1001bb90
jmp fcn.10010e41
cmp al, 0x50
jne 0x1001be2c
lodsb al, byte [esi]
cmp al, 0
je 0x1001c26a
sub al, 0x32
jb 0x1001bb90
cmp al, 7
ja 0x1001bb90
movzx eax, al
inc eax
inc eax
push eax
push 0x1001bb90
jmp fcn.10010e24
cmp al, 0x53
jne 0x1001be46
push 0xa
push 1
push 0xc
push 2
push dword [ebp + 0xc]
push edi
call fcn.1001d3e3
jmp 0x1001c0f8
cmp al, 0x54
jne 0x1001be64
push 0xa
push 1
push 0xc
push 2
push 0xc
push 2
push dword [ebp + 0xc]
push edi
call fcn.1001d4e8
jmp 0x1001c0f8
cmp al, 0x4e
jne 0x1001beae
push esi
call fcn.1000d4ca
xchg ecx, eax
lodsb al, byte [esi]
cmp al, 0x24
je 0x1001be7d
or al, al
jne 0x1001be6f
jmp 0x1001c26a
cmp dword [ebp + 0xc], 0xa
jb 0x1001be9c
push esi
call fcn.1000d4ca
push eax
push ecx
call fcn.10010eb8
push eax
push edi
call fcn.1000d549
add edi, eax
sub dword [ebp + 0xc], eax
lodsb al, byte [esi]
cmp al, 0x24
je 0x1001bb90
or al, al
jne 0x1001be9c
jmp 0x1001c26a
cmp al, 0x59
jne 0x1001bef5
lea eax, [ebp - 0x4ac]
push eax
call sub.kernel32.dll_GetTimeZoneInformation
cmp eax, 1
jne 0x1001becb
mov eax, dword [ebp - 0x458]
jmp 0x1001bedc
cmp eax, 2
jne 0x1001bed8
mov eax, dword [ebp - 0x404]
jmp 0x1001bedc
xor eax, eax
jmp 0x1001bf04
add eax, dword [ebp - 0x4ac]
jns 0x1001bf04
dec dword [ebp + 0xc]
je 0x1001c26a
neg eax
mov byte [edi], 0x2d
inc edi
jmp 0x1001bf04
cmp al, 0x23
jne 0x1001bf1f
mov eax, dword [0x10025010]
inc dword [0x10025010]
cmp dword [ebp + 0xc], 0xa
jb 0x1001bb90
push eax
push edi
call fcn.1000d549
add edi, eax
sub dword [ebp + 0xc], eax
jmp 0x1001bb90
cmp al, 0x41
jne 0x1001bf2a
mov eax, 0xc28
jmp 0x1001bf04
cmp al, 0x69
jne 0x1001bf35
call fcn.1001bb55
jmp 0x1001bf04
cmp al, 0x4b
jne 0x1001bf5c
mov dword [ebp - 0x4b4], 8
lea eax, [ebp - 0x4b4]
push eax
call sub.user32.dll_GetLastInputInfo
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x4b0]
jmp 0x1001bf04
cmp al, 0x4d
jne 0x1001bf73
call sub.kernel32.dll_GetTickCount
mov ecx, dword [0x10027568]
sub eax, dword [ecx + 0x120]
jmp 0x1001bf04
cmp al, 0x64
jne 0x1001bf7e
mov eax, dword [0x10023dac]
jmp 0x1001bf04
cmp al, 0x62
jne 0x1001bf8c
mov eax, dword [0x10023da8]
jmp 0x1001bf04
cmp al, 0x71
jne 0x1001bfbc
mov ecx, esi
lodsb al, byte [esi]
cmp al, 0x24
je 0x1001bfa0
or al, al
jne 0x1001bf92
jmp 0x1001c26a
mov byte [esi - 1], 0
push ecx
call fcn.1000ab60
mov byte [esi - 1], 0x24
cmp eax, 0xffffffff
jne 0x1001bf04
jmp 0x1001bb90
cmp al, 0x5a
jne section.UPX1
cmp dword [ebp + 0xc], 0x15
jb 0x1001bb90
mov eax, dword [0x10022260]
sub eax, dword [0x100211d4]
mov dword [ebp - 0x4ac], eax
mov eax, dword [0x10022264]
sbb eax, 0
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4ac]
push eax
push edi
call fcn.1000d4f4
add edi, eax
sub dword [ebp + 0xc], eax
jmp 0x1001bb90
cmp al, 0x44
jne 0x1001c02d
cmp dword [ebp + 0xc], 0x20
jb 0x1001bb90
lea eax, [ebp - 0x4ac]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x4ac]
push eax
push edi
call fcn.1000e388
dec eax
jmp 0x1001c0f8
cmp al, 0x48
jne 0x1001c052
push dword [ebp + 0xc]
push edi
call sub.ws2_32.dll_gethostname
or eax, eax
jne 0x1001bb90
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
xchg edi, eax
pop edi
sub eax, edi
jmp 0x1001c0f8
cmp al, 0x70
jne 0x1001c07a
cmp dword [0x1002446c], 0
je 0x1001bb90
cmp dword [ebp + 0xc], 0x16
jb 0x1001bb90
push 0x10024480
push edi
call fcn.1000d5c7
jmp 0x1001c0f8
cmp al, 0x68
jne 0x1001c0ba
cmp dword [ebp + 0xc], 0x16
jb 0x1001bb90
mov eax, dword [0x10024348]
or eax, eax
je 0x1001bb90
mov eax, dword [eax + 4]
or eax, eax
je 0x1001bb90
test dword [eax + 0xc], 2
je 0x1001c0b5
lea eax, [eax + 0x30]
push eax
push edi
call fcn.1000d5c7
jmp 0x1001c0f8
mov eax, dword [eax - 4]
jmp 0x1001c098
cmp al, 0x42
jne 0x1001c0e2
lodsb al, byte [esi]
cmp al, 0
je 0x1001c26a
movzx ecx, al
lodsb al, byte [esi]
cmp al, 0
je 0x1001c26a
movzx eax, al
push eax
push ecx
call fcn.10010eb8
jmp 0x1001c244
cmp al, 0x74
jne 0x1001c111
push edi
push dword [ebp + 0xc]
call sub.kernel32.dll_GetTempPathA
cmp eax, dword [ebp + 0xc]
jae 0x1001bb90
or ebx, ebx
je 0x1001c107
push ebx
push eax
push edi
push dword [ebp + 0xc]
call fcn.1001baf0
add edi, eax
sub dword [ebp + 0xc], eax
jmp 0x1001bb90
cmp al, 0x77
jne 0x1001c129
push dword [ebp + 0xc]
push edi
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, dword [ebp + 0xc]
jae 0x1001bb90
jmp 0x1001c0f8
cmp al, 0x76
jne 0x1001c15a
mov ecx, esi
lodsb al, byte [esi]
cmp al, 0x3d
je 0x1001c13d
or al, al
jne 0x1001c12f
jmp 0x1001c26a
mov byte [esi - 1], 0
push dword [ebp + 0xc]
push edi
push ecx
call sub.kernel32.dll_GetEnvironmentVariableA
mov byte [esi - 1], 0x3d
cmp eax, dword [ebp + 0xc]
jae 0x1001bb90
jmp 0x1001c0f8
cmp al, 0x73
jne 0x1001c172
push dword [ebp + 0xc]
push edi
call sub.kernel32.dll_GetSystemDirectoryA
cmp eax, dword [ebp + 0xc]
jae 0x1001bb90
jmp 0x1001c0f8
cmp al, 0x75
jne 0x1001c197
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push edi
call sub.advapi32.dll_GetUserNameA
or eax, eax
je 0x1001bb90
mov eax, dword [ebp + 0x10]
dec eax
jmp 0x1001c0f8
cmp al, 0x6c
jne 0x1001c1bd
mov eax, 3
push dword [ebp + 0xc]
push edi
push eax
push 0x800
call sub.kernel32.dll_GetLocaleInfoA
or eax, eax
je 0x1001bb90
dec eax
jmp 0x1001c0f8
cmp al, 0x63
jne 0x1001c1c8
mov eax, 0x1002
jmp 0x1001c1a0
cmp al, 0x6a
jne 0x1001c204
push ebx
push esi
mov esi, dword [0x10027568]
add esi, 0x9228
mov ebx, 0xb
jmp 0x1001c1e7
mov al, 0x2c
stosb byte es:[edi], al
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0xb
jb 0x1001c1fd
lodsd eax, dword [esi]
push eax
push edi
call fcn.1000d549
add edi, eax
sub dword [ebp + 0xc], eax
dec ebx
jne 0x1001c1e1
pop esi
pop ebx
jmp 0x1001bb90
cmp al, 0x47
jne 0x1001c224
cmp dword [ebp + 0xc], 0x20
jb 0x1001bb90
push 1
push 3
push edi
call section.UPX0
add esp, 0xc
jmp 0x1001c0f8
cmp al, 0x78
jne 0x1001c244
lodsb al, byte [esi]
cmp al, 0
je 0x1001c26a
mov ah, al
lodsb al, byte [esi]
cmp al, 0
je 0x1001c26a
push ebx
mov ebx, 0x1002502e
xlatb
xchg ah, al
xlatb
shl al, 4
or al, ah
pop ebx
mov byte [edi], al
or ebx, ebx
je 0x1001c260
push ebx
push 1
push edi
push dword [ebp + 0xc]
call fcn.1001baf0
add edi, eax
sub dword [ebp + 0xc], eax
jmp 0x1001bb90
inc edi
dec dword [ebp + 0xc]
jne 0x1001bb9a
push 0
call fcn.10010e14
sub edi, dword [ebp + 8]
xchg edi, eax
pop edi
pop esi
pop ebx
pop edx
pop ecx
leave
ret 0x14