Function at 0x4ad3f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x609f90
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov byte [ebp - 0x4d], 1
mov dword [ebp - 0x54], 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
push 0x657120
push 0x17
push 0
push 0x657130
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x4ad487
push dword [ebp - 0x58]
call dword [sym.imp.ole32.dll_OleRun]
mov esi, eax
test esi, esi
js 0x4ad47a
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
push edx
push 0x655f44
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
jns 0x4ad4bf
mov dword [ebp - 0x54], 0
test esi, esi
jns 0x4ad4bf
push esi
push str.could_not_create_instance__error_0x_08x_
push str.ReputationChecker::ParseIPReputationXML
push 1
call fcn.00587c13
add esp, 0x10
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4ad4b8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
jmp 0x4add85
push edi
lea ecx, [ebp - 0x2c]
call fcn.004347d0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.004a83f0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad4f8
push 0x80004003
call fcn.00586de0
mov byte [ebp - 4], 2
call fcn.004a88e0
test ax, ax
jne 0x4ad54b
push str.could_not_load_xml
push str.ReputationChecker::ParseIPReputationXML
push 1
call fcn.00587c13
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp eax, 8
jb 0x4ad52f
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], al
jmp 0x4ad4ab
push str.XPath
lea ecx, [ebp - 0x4c]
call fcn.004a8360
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.004a8500
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push str.SelectionLanguage
call fcn.004a8360
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad592
push 0x80004003
call fcn.00586de0
mov byte [ebp - 4], 5
call fcn.004a8970
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4ad5b1
call fcn.004a84b0
xor esi, esi
mov dword [ebp - 0x58], esi
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Resource
call fcn.004a8360
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad5df
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov ecx, dword [eax]
test ecx, ecx
je 0x4ad5fd
mov esi, ecx
mov dword [eax], 0
mov dword [ebp - 0x58], esi
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ad60a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4ad641
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 9
mov eax, dword [eax]
test eax, eax
je 0x4ad627
mov eax, dword [eax]
jmp 0x4ad629
xor eax, eax
push eax
mov ecx, ebx
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4ad641
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_ResponseCode
call fcn.004a8360
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad666
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4ad690
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4ad690
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ad69d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4ad70a
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
test eax, eax
je 0x4ad6ba
mov eax, dword [eax]
jmp 0x4ad6bc
xor eax, eax
push eax
lea ecx, [ebp - 0x48]
call fcn.004347d0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4ad6dc
call fcn.004a84b0
mov dword [ebp - 0x4c], 0
push str.FatalError
lea ecx, [ebp - 0x48]
call fcn.0041a910
test eax, eax
je 0x4ad72f
push str.TemporaryError
lea ecx, [ebp - 0x48]
call fcn.0041a910
test eax, eax
je 0x4ad72f
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 7
call fcn.00413860
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Classification
call fcn.004a8360
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad778
push 0x80004003
call fcn.00586de0
movups xmm0, xmmword [ebp - 0x48]
sub esp, 0x18
mov eax, esp
push str.URL_Response_code_error__ws
movups xmmword [eax], xmm0
push str.ReputationChecker::ParseIPReputationXML
movq xmm0, qword [ebp - 0x38]
push 1
movq qword [eax + 0x10], xmm0
call fcn.00587c13
add esp, 0x24
lea ecx, [ebp - 0x48]
call fcn.00413860
mov byte [ebp - 4], 2
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea ecx, [ebp - 0x2c]
call fcn.00413860
jmp 0x4ad4a7
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4ad7a2
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4ad7a2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ad7af
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4ad7e7
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
test eax, eax
je 0x4ad7cc
mov eax, dword [eax]
jmp 0x4ad7ce
xor eax, eax
push eax
lea ecx, [ebx + 0x18]
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4ad7e7
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Severity
call fcn.004a8360
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad80c
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4ad836
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4ad836
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ad843
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4ad87b
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x11
mov eax, dword [eax]
test eax, eax
je 0x4ad860
mov eax, dword [eax]
jmp 0x4ad862
xor eax, eax
push eax
lea ecx, [ebx + 0x30]
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4ad87b
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Confidence
call fcn.004a8360
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad8a0
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4ad8ca
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4ad8ca
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ad8d7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4ad90f
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x13
mov eax, dword [eax]
test eax, eax
je 0x4ad8f4
mov eax, dword [eax]
jmp 0x4ad8f6
xor eax, eax
push eax
lea ecx, [ebx + 0x48]
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4ad90f
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Risk
call fcn.004a8360
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad934
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4ad95e
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4ad95e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ad96b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4ad9a2
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov eax, dword [eax]
test eax, eax
je 0x4ad984
mov eax, dword [eax]
jmp 0x4ad986
xor eax, eax
push 0xa
push 0
push eax
call fcn.005ddccf
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
mov dword [ebx + 0x60], eax
test ecx, ecx
je 0x4ad9a2
call fcn.004a84b0
mov eax, dword [ebx + 0x60]
test eax, eax
js 0x4ad9ae
cmp eax, 0x64
jle 0x4ad9b5
mov dword [ebx + 0x60], 0x3e9
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_MalwareFamily
call fcn.004a8360
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ad9da
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4ada04
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4ada04
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ada11
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4ada49
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x16
mov eax, dword [eax]
test eax, eax
je 0x4ada2e
mov eax, dword [eax]
jmp 0x4ada30
xor eax, eax
push eax
lea ecx, [ebx + 0x64]
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4ada49
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Location_CountryCode
call fcn.004a8360
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4ada6e
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4ada98
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4ada98
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4adaa5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4adadd
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x18
mov eax, dword [eax]
test eax, eax
je 0x4adac2
mov eax, dword [eax]
jmp 0x4adac4
xor eax, eax
push eax
lea ecx, [ebx + 0x7c]
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4adadd
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Location_CountryName
call fcn.004a8360
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4adb02
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4adb2c
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4adb2c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4adb39
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4adb74
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x1a
mov eax, dword [eax]
test eax, eax
je 0x4adb56
mov eax, dword [eax]
jmp 0x4adb58
xor eax, eax
push eax
lea ecx, [ebx + 0x94]
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4adb74
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Location_City
call fcn.004a8360
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4adb99
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4adbc3
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4adbc3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4adbd0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4adc0b
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x1c
mov eax, dword [eax]
test eax, eax
je 0x4adbed
mov eax, dword [eax]
jmp 0x4adbef
xor eax, eax
push eax
lea ecx, [ebx + 0xac]
call fcn.00434220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4adc0b
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_Asn
call fcn.004a8360
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4adc30
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4adc5a
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4adc5a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4adc67
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4adca8
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov eax, dword [eax]
test eax, eax
je 0x4adc80
mov eax, dword [eax]
jmp 0x4adc82
xor eax, eax
push 0xa
push 0
push eax
call fcn.005ddccf
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
cdq
mov dword [ebx + 0xc8], eax
mov dword [ebx + 0xcc], edx
test ecx, ecx
je 0x4adca8
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.IPReputationInfo_AsOwner
call fcn.004a8360
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4adccd
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.004a8800
mov edx, dword [eax]
cmp esi, edx
je 0x4adcf7
mov ecx, esi
mov dword [eax], 0
mov esi, edx
mov dword [ebp - 0x58], esi
test ecx, ecx
je 0x4adcf7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4add04
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4add3b
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x1f
mov eax, dword [eax]
test eax, eax
je 0x4add21
mov eax, dword [eax]
jmp 0x4add23
xor eax, eax
push eax
lea ecx, [ebx + 0xd0]
call fcn.00434220
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4add3b
call fcn.004a84b0
mov byte [ebp - 4], 2
test esi, esi
je 0x4add49
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4add5e
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x4add82
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, byte [ebp - 0x4d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 8