Function at 0x109f6c3
Capabilities:
Get common file path
Get geographical location

Disassembly:
mov eax, 0x1278309
call fcn.01160458
mov eax, 0x21520
call fcn.01160620
mov eax, dword [0x12cf8c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 0x214f0], ecx
mov dword [ebp - 0x214c0], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x214cc], ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x214cc]
push eax
mov ecx, 0x12d2398
call fcn.0107dbed
mov esi, eax
cmp esi, ebx
jl 0x109f730
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f766
mov ecx, dword [eax]
lea edx, [ebp - 0x214c0]
push edx
push eax
call dword [ecx + 0x70]
mov esi, eax
cmp esi, ebx
jge 0x109f75e
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f743
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f757
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x10a02f3
cmp dword [ebp - 0x214c0], ebx
jne 0x109f797
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f779
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f78d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x10a02f3
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f7aa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x214d0], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x214c0]
mov ecx, dword [eax]
lea edx, [ebp - 0x214d0]
push edx
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f7d7
mov ecx, dword [eax]
push eax
call dword [ecx + 0x60]
push 4
lea eax, [ebp - 0x18]
push eax
push 0xc
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
jne 0x109f81f
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f801
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f815
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x10a02f3
push edi
mov esi, 0x10689bb
push esi
push fcn.01257cb5
push 3
pop edi
push edi
push 0xc
lea eax, [ebp - 0x2152c]
push eax
call fcn.01160662
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21514]
push eax
push 1
call fcn.01193301
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109f89f
mov byte [ebp - 4], 2
push esi
push edi
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011604ea
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f880
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f894
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x214c4]
jmp 0x10a02f2
lea eax, [ebp - 0x2152c]
push eax
push 2
call fcn.01193301
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f859
lea eax, [ebp - 0x21520]
push eax
push 4
call fcn.01193301
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f859
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214c8], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf086
push edi
lea eax, [ebp - 0x2152c]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010907a9
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109fa62
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf087
push 1
lea eax, [ebp - 0x2152c]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010907a9
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109fa62
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf089
push 1
lea eax, [ebp - 0x21520]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010907a9
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109fa62
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf088
push 1
lea eax, [ebp - 0x21514]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010907a9
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109fa62
mov dword [ebp - 0x214fc], ebx
mov dword [ebp - 0x214f8], ebx
mov dword [ebp - 0x214f4], ebx
mov byte [ebp - 4], 5
push 0x100a530
lea ecx, [ebp - 0x214d4]
call fcn.01077147
mov byte [ebp - 4], 6
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214fc]
call fcn.01091f5f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214d4]
call fcn.010328fe
push 0x100a52c
lea ecx, [ebp - 0x214d4]
call fcn.01077147
mov byte [ebp - 4], 7
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214fc]
call fcn.01091f5f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214d4]
call fcn.010328fe
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf51a
push 1
lea eax, [ebp - 0x214fc]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.010907a9
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109fa76
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066e23
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fe
jmp 0x109f859
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214e0], eax
mov byte [ebp - 4], 8
push 0xf08c
lea ecx, [ebp - 0x214e0]
call fcn.01032a72
cmp eax, ebx
jne 0x109fad1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fe
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066e23
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fe
mov byte [ebp - 4], 2
push esi
push edi
jmp 0x10a02b8
lea eax, [ebp - 0x214e0]
push eax
lea ecx, [ebp - 0x214c8]
call fcn.01044f22
mov edi, dword [ebp - 0x214c8]
cmp dword [edi - 8], ebx
mov dword [ebp - 0x214cc], ebx
jle 0x109fb25
mov eax, dword [ebp - 0x214cc]
cmp word [edi + eax*2], 0x5e
jne 0x109fb14
push ebx
push eax
lea ecx, [ebp - 0x214c8]
call fcn.01061c79
mov edi, dword [ebp - 0x214c8]
inc dword [ebp - 0x214cc]
mov eax, dword [ebp - 0x214cc]
cmp eax, dword [edi - 8]
jl 0x109faf4
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214e4], eax
mov byte [ebp - 4], 9
push 0xf08d
lea ecx, [ebp - 0x214e4]
call fcn.01032a72
cmp eax, ebx
je 0x10a0275
push ebx
push edi
push 0x1264
push ebx
push ebx
push 1
lea ecx, [ebp - 0x214bc]
call fcn.01091383
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x214e4]
mov dword [ebp - 0x21470], eax
lea eax, [ebp - 0x2103c]
mov dword [ebp - 0x21458], 0x11d
mov dword [ebp - 0x2145c], 0x108ede6
mov dword [ebp - 0x21460], eax
mov byte [ebp - 0x2103c], bl
mov dword [ebp - 0x214dc], ebx
mov byte [ebp - 4], 0xb
mov ecx, 0x12d2398
call fcn.0107cca6
push eax
lea ecx, [ebp - 0x214cc]
call fcn.01039a07
mov byte [ebp - 4], 0xc
mov eax, dword [0x12ce0a0]
mov byte [ebp - 0x214e5], bl
mov dword [ebp - 0x214d8], eax
mov byte [ebp - 4], 0xd
push 0xf003f
push dword [ebp - 0x214cc]
lea ecx, [ebp - 0x214dc]
push SysReAllocString
call fcn.01044c82
test eax, eax
mov edi, dword [ebp + 8]
jne 0x109fc7d
push 0x1001d74
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214dc]
mov byte [ebp - 0x214e5], 1
mov dword [ebp - 0x214d4], ebx
call fcn.01044cbe
test eax, eax
jne 0x109fc30
cmp dword [ebp - 0x214d4], ebx
setne al
mov byte [ebp - 0x2103c], al
jmp 0x109fc37
mov byte [ebp - 0x2103c], 1
lea eax, [ebp - 0x214c4]
push eax
mov ecx, 0x208
push edi
mov dword [ebp - 0x214c4], ecx
call fcn.0108ef0f
push eax
push ecx
lea ecx, [ebp - 0x214d8]
call fcn.0103297b
push eax
lea ecx, [ebp - 0x214dc]
call fcn.01044cf1
test eax, eax
je 0x109fd35
push 0xffffffffffffffff
lea ecx, [ebp - 0x214d8]
call fcn.010329e8
push 0x104
lea ecx, [ebp - 0x214d8]
call fcn.0103297b
push eax
push ebx
push ebx
push edi
call fcn.0108ef45
or eax, 0x8000
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109fd35
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fe
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fe
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044c64
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090781
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fe
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fe
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066e23
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fe
mov byte [ebp - 4], 2
push esi
push 3
jmp 0x109f85f
cmp edi, ebx
mov eax, dword [ebp - 0x214d8]
mov dword [ebp - 0x21474], eax
jl 0x10a0239
cmp edi, 2
jle 0x109fd63
cmp edi, 3
jne 0x10a0239
mov dword [ebp - 0x21488], 1
jmp 0x109fd6c
add edi, 2
mov dword [ebp - 0x21488], edi
push dword [0x12d24cc]
lea eax, [ebp - 0x21038]
lea ecx, [ebp - 0x214bc]
mov word [ebp - 0x21038], bx
mov dword [ebp - 0x21484], eax
mov dword [ebp - 0x21480], 0x10810
call fcn.0109021d
cmp eax, 1
jne 0x10a017e
mov dword [ebp - 0x21508], ebx
mov dword [ebp - 0x21504], ebx
mov dword [ebp - 0x21500], ebx
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x21038]
push eax
lea ecx, [ebp - 0x214ec]
call fcn.01046065
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214ec]
call fcn.01045236
mov edi, eax
cmp edi, ebx
jge 0x109febd
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.01045295
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.01066e23
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fe
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fe
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044c64
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090781
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fe
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fe
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066e23
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fe
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011604ea
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109fea2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109feb6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x10a02f2
lea edi, [ebp - 0x21038]
mov eax, edi
test eax, eax
jne 0x109ffa9
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.01045295
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.01066e23
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fe
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fe
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044c64
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090781
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fe
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fe
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066e23
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fe
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011604ea
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109ff8b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109ff9f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x10a02f2
cmp word [ebp - 0x21038], bx
je 0x109ffb9
inc edi
inc edi
cmp word [edi], bx
jne 0x109ffb2
inc edi
inc edi
je 0x109fecd
mov ax, word [edi]
cmp ax, bx
je 0x10a0068
mov cx, word [edi + 2]
cmp cx, 0x3a
je 0x10a0018
cmp ax, 0x5c
jne 0x109ffe2
cmp cx, ax
je 0x10a0018
push edi
lea eax, [ebp - 0x214ec]
push eax
lea eax, [ebp - 0x214d4]
push eax
call fcn.01045e48
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.01091f5f
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
jmp 0x10a0044
push edi
lea ecx, [ebp - 0x214c4]
call fcn.01039a07
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x214c4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.01091f5f
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214c4]
call fcn.010328fe
jmp 0x10a004d
inc edi
inc edi
cmp word [edi], bx
jne 0x10a004b
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x109ffcd
cmp dword [ebp - 0x21504], ebx
jne 0x10a00cb
lea eax, [ebp - 0x21038]
push eax
lea ecx, [ebp - 0x214d4]
call fcn.01046065
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x214ec]
push eax
lea ecx, [ebp - 0x214d4]
call fcn.01052dc4
mov edi, eax
cmp edi, ebx
jge 0x10a00aa
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
call fcn.01045295
jmp 0x109fde4
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.01091f5f
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
call fcn.01045295
mov eax, dword [ebp - 0x214f0]
mov ecx, dword [eax + 0xcc]
cmp ecx, ebx
je 0x109fecd
call fcn.010a5e35
mov edi, dword [ebp - 0x214f0]
push ebx
push 1
push dword [ebp - 0x2103c]
lea eax, [ebp - 0x21508]
push eax
mov ecx, edi
call fcn.0109ea9b
mov ecx, dword [edi + 0xcc]
mov dword [ebp - 0x214c4], eax
call fcn.010a5e54
cmp dword [ebp - 0x214c4], ebx
jge 0x10a0126
push dword [ebp - 0x214c4]
call fcn.0116f4d6
pop ecx
cmp byte [ebp - 0x214e5], bl
je 0x10a0160
movzx eax, byte [ebp - 0x2103c]
push 0x1001d74
push eax
lea ecx, [ebp - 0x214dc]
call fcn.01061afb
push dword [ebp + 8]
call fcn.0108ef0f
push eax
push dword [ebp - 0x214ec]
lea ecx, [ebp - 0x214dc]
call fcn.01044d1b
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.01045295
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.01066e23
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fe
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fe
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044c64
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090781
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fe
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fe
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066e23
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fe
mov byte [ebp - 4], 2
push esi
push 3
push 0xc
lea eax, [ebp - 0x2152c]
push eax
call fcn.011604ea
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x10a021e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x10a0232
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x10a02f2
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.010328fe
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.010328fe
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044c64
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.01090781
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.010328fe
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.010328fe
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.01066e23
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.010328fe
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011604ea
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x10a02d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x10a02ed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0116015a
leave
ret 4