Function at 0x1000fe41
Capabilities:
Get geographical location
Get system information on windows

Disassembly:
push 0x1a4
mov eax, 0x100308a2
call fcn.1002b85a
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
push 0x118
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor edx, edx
push 8
xor eax, eax
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
lea edi, reloc.ADVAPI32.dll_TraceMessage
rep stosd dword es:[edi], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
lea edi, reloc.ADVAPI32.dll_TraceMessage
stosd dword es:[edi], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
lea edi, reloc.ADVAPI32.dll_TraceMessage
lea ecx, reloc.ADVAPI32.dll_TraceMessage
stosd dword es:[edi], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
call fcn.10004f6b
and dword [ebp - 4], 0
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.10004f6b
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov byte [ebp - 4], 1
call fcn.10004f6b
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov byte [ebp - 4], 2
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x11c
call dword [sym.imp.ntdll.dll_RtlGetVersion]
mov esi, eax
test esi, esi
jns 0x1000fef7
or esi, 0x10000000
jmp 0x10010392
push 1
xor eax, eax
push eax
push eax
push eax
push 0x100103c8
mov edi, 0x1000c458
push edi
push 0x80000002
call fcn.1001b260
mov esi, edx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
test eax, eax
jne 0x1000ff3a
test esi, esi
jne 0x1000ff3a
movzx eax, word [ebp - 0x1c]
cdq
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
push 1
push 0
push 0
push 0x100103d4
push edi
mov esi, 0x80000002
push esi
call fcn.1001afaf
mov edi, eax
test edi, edi
jne 0x1000ff6f
movzx eax, byte [ebp - 0x1a]
dec eax
je 0x1000ff6c
dec eax
je 0x1000ff68
dec eax
jne 0x1000ff6f
push 7
jmp 0x1000ff6e
push 0xa
jmp 0x1000ff6e
push 6
pop edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 1
push 0
push 0
push 0x100103dc
push 0x1000c458
push esi
call fcn.1001afaf
push 1
push 0
push 0
push 0x100103e4
push 0x10010408
push esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
call fcn.1001afaf
push 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
xor eax, eax
push eax
push eax
push eax
push 0x1001045c
push 0x10010498
push esi
call fcn.1001b260
push 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
xor eax, eax
push eax
push eax
push eax
push reloc.KERNEL32.dll_VerSetConditionMask
push 0x1000c4c4
push esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
call fcn.1001b260
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov esi, edx
test eax, eax
jne 0x1000fffe
test esi, esi
je 0x10010045
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp ecx, esi
jb 0x10010045
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
ja 0x10010027
cmp eax, edx
jbe 0x10010045
push 0
sub eax, edx
push 0x23c34600
sbb ecx, esi
push ecx
push eax
call fcn.100075cb
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
push 1
push 0
push 0
push 0x100104e4
push 0x1000c458
mov esi, 0x80000002
push esi
call fcn.1001afaf
push 1
push 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x10003170
push 0x100104f0
push 0x10010508
push esi
call fcn.1001b069
test eax, eax
js 0x100100de
push 1
push 1
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x10003170
push 0x10010554
push 0x10010508
push esi
call fcn.1001b069
test eax, eax
js 0x100100de
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.1000476f
push eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.1000476f
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x10010578
push eax
call fcn.1000598d
add esp, 0x10
test eax, eax
jns 0x100100e9
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.1001a04f
push 1
push 0
push 0
push 0x10010584
push 0x1000c458
push esi
call fcn.1001afaf
push 1
push 0
push 0
push 0x10010590
push 0x1000c458
push esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
call fcn.1001afaf
push dword [ebp - 0x130]
mov ecx, ebx
push 0x10010598
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x12c]
mov ecx, ebx
push 0x100105a8
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x128]
mov ecx, ebx
push 0x100105b8
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x13c]
mov ecx, ebx
push 0x100105c8
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x13c]
mov ecx, ebx
push 0x100105dc
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x13c]
mov ecx, ebx
push 0x100105ec
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
movzx eax, word [ebp - 0x20]
push eax
push 0x100105fc
mov ecx, ebx
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
movzx eax, word [ebp - 0x1b0]
push eax
push 0x1000c500
mov ecx, ebx
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push eax
push 0x10010608
mov ecx, ebx
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push eax
push 0x10010614
mov ecx, ebx
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push edi
push 0x10010620
mov ecx, ebx
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
xor eax, eax
cmp eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, ebx
sbb eax, eax
neg eax
push eax
push 0x10010628
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x148]
mov ecx, ebx
push dword [ebp - 0x144]
push 0x10010638
call fcn.1000d2a2
mov esi, eax
test esi, esi
js 0x10010392
movzx eax, byte [ebp - 0x1a]
push eax
push 0x1001064c
mov ecx, ebx
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x124]
mov ecx, ebx
push 0x10010664
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
jne 0x100102e5
test ecx, ecx
je 0x100102fd
push ecx
push eax
push 0x10010674
mov ecx, ebx
call fcn.1000d2a2
mov esi, eax
test esi, esi
js 0x10010392
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x1001031a
push eax
push 0x1001067c
mov ecx, ebx
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x138]
mov ecx, ebx
push 0x10010688
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.1001a029
test eax, eax
je 0x10010360
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.1000476f
push eax
push 0x10010698
lea ecx, [ebx + 4]
call fcn.1001a3dc
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x174]
mov ecx, ebx
push 0x100106a4
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
push dword [ebp - 0x150]
mov ecx, ebx
push 0x1000c50c
call fcn.1000d23d
mov esi, eax
test esi, esi
js 0x10010392
xor esi, esi
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov byte [ebp - 4], 1
call fcn.10004fde
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov byte [ebp - 4], 0
call fcn.10004fde
or dword [ebp - 4], 0xffffffff
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.10004fde
mov eax, esi
call fcn.1002b897
ret