Function at 0x100b5a1
Capabilities:
Check os version
Get geographical location
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x940
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x800
mov word [ebp - 0x81c], ax
xor edi, edi
lea eax, [ebp - 0x81a]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0x641
mov dword [ebp - 0x93c], edi
mov esi, 0x401
jb 0x100b60e
push edi
push esi
lea eax, [ebp - 0x81c]
push eax
push dword [ebp + 8]
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
mov dword [ebp - 0x940], eax
cmp eax, edi
jne 0x100b6bf
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0x1003d80
mov dword [ebp - 0x940], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x100b66f
push 0x100b808
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x100b668
call eax
movzx eax, ax
push 0xa
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x93c], eax
push ecx
movzx eax, ax
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100b668
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x940], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
push esi
lea eax, [ebp - 0x81c]
push eax
movzx eax, word [ebp - 0x93c]
push eax
push dword [ebp + 8]
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp eax, edi
je 0x100b69f
xor ecx, ecx
mov word [ebp + eax*2 - 0x820], cx
jmp 0x100b6bf
push dword [ebp + 8]
lea eax, [ebp - 0x81c]
push 0x100b7e4
push esi
push eax
call fcn.01008f52
add esp, 0x10
test eax, eax
jl 0x100b7d1
mov eax, dword [0x100e030]
cmp dword [0x100fe58], edi
jne 0x100b784
cmp eax, edi
je 0x100b6dd
cmp eax, 0xffffffff
jne 0x100b784
lea eax, [ebp - 8]
mov esi, 0x11c
push esi
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp - 0x938]
push edi
inc ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x938]
push eax
mov dword [ebp - 0x938], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100b763
cmp dword [ebp - 0x934], 6
jb 0x100b763
push edi
push 0x100
lea ecx, [ebp - 0x14]
call fcn.01008b51
test al, al
je 0x100b763
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x1c
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
test eax, eax
je 0x100b763
push edi
push 0xfffe
push ebx
push edi
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x14]
push edi
push edi
call dword [0x100e0d8]
test eax, eax
jge 0x100b77a
push edi
push dword [ebp - 0x940]
lea eax, [ebp - 0x81c]
push 0x10
push edi
push eax
push edi
call sub.msi.dll_MsiProvideQualifiedComponentExW
lea ecx, [ebp - 0x14]
call fcn.01001e1b
jmp 0x100b7d1
cmp eax, edi
je 0x100b7d1
cmp eax, 0xffffffff
je 0x100b7d1
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea ecx, [ebp - 0x93c]
push ecx
add eax, eax
push eax
lea eax, [ebp - 0x81c]
push eax
push dword [0x100e030]
call esi
push edi
lea eax, [ebp - 0x93c]
push eax
push 4
push 0x100b7e0
push dword [0x100e030]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d20
leave
ret