Function at 0x100d619
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
cmp ebx, eax
je 0x100d62d
mov dword [ebx], eax
cmp dword [0x1020240], eax
mov dword [ebp - 8], eax
je 0x100db3f
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
mov esi, 0x1020240
push 0x101d8a4
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
je 0x100db27
push str._ADD
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d684
cmp dword [ebp + 0xc], 1
je 0x100db27
push 0xdad
call fcn.0101004c
jmp 0x100db27
push str._ACTIVE
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d69f
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0xffffffed
jmp 0x100db27
push 0x101d8c0
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d6c5
cmp dword [ebp + 0x14], eax
je 0x100db27
mov eax, dword [ebp + 0x14]
mov dword [eax], 8
jmp 0x100db27
push str._FPNW
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d6e7
test ebx, ebx
je 0x100db27
mov dword [ebx], 1
jmp 0x100db27
push dword [esi]
call fcn.0100f88d
mov ebx, eax
test ebx, ebx
jne 0x100d6fe
push 0xdb1
call fcn.0101004c
push str._FULLNAME
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d734
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x30
pop ecx
jbe 0x100d729
push str._FULLNAME
push 0xf70
call fcn.0100ff1c
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], ebx
jmp 0x100db1e
push str._ENABLESCRIPT
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d76d
push str._ENABLESCRIPT
push ebx
call fcn.0100c422
test eax, eax
je 0x100d75e
mov eax, dword [ebp + 8]
or dword [eax + 0x18], 1
jmp 0x100db1e
push 0xebb
call fcn.0101004c
jmp 0x100db1e
push str._HOMEDIR
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d7d5
cmp word [ebx], ax
je 0x100d7ca
push eax
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
je 0x100d7a0
push str._HOMEDIR
push 0xf70
call fcn.0100ff1c
cmp dword [ebp - 4], 0x2006
je 0x100d7ca
cmp dword [ebp - 4], 0x2000
je 0x100d7ca
cmp dword [ebp - 4], 0x1000
je 0x100d7ca
push str._HOMEDIR
push 0xf70
call fcn.0100ff1c
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
jmp 0x100db1e
push str._PARMS
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d7ef
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], ebx
jmp 0x100db1e
push str._COMMENT
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d825
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x30
pop ecx
jbe 0x100d81a
push str._COMMENT
push 0xf70
call fcn.0100ff1c
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], ebx
jmp 0x100db1e
push str._USERCOMMENT
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d85b
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x30
pop ecx
jbe 0x100d850
push str._USERCOMMENT
push 0xf70
call fcn.0100ff1c
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], ebx
jmp 0x100db1e
push str._SCRIPTPATH
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d8a8
cmp ebx, eax
je 0x100d87e
cmp word [ebx], ax
jne 0x100d87e
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], ebx
jmp 0x100db1e
push eax
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
jne 0x100d897
cmp dword [ebp - 4], 0x2000
je 0x100d873
push str._SCRIPTPATH
push 0xf70
call fcn.0100ff1c
jmp 0x100d873
push str._PROFILEPATH
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d8fe
cmp ebx, eax
je 0x100d8cb
cmp word [ebx], ax
jne 0x100d8cb
mov eax, dword [ebp + 8]
mov dword [eax + 0x68], ebx
jmp 0x100db1e
push eax
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
jne 0x100d8ed
cmp dword [ebp - 4], 0x2006
je 0x100d8c0
cmp dword [ebp - 4], 0x1000
je 0x100d8c0
push str._PROFILEPATH
push 0xf70
call fcn.0100ff1c
jmp 0x100d8c0
push str._ACTIVE
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d931
push str._ACTIVE
push ebx
call fcn.0100c422
test eax, eax
mov eax, dword [ebp + 8]
je 0x100d928
and dword [eax + 0x18], 0xffffffed
jmp 0x100db1e
or dword [eax + 0x18], 2
jmp 0x100db1e
push str._FPNW
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d97f
push str._FPNW
push ebx
call fcn.0100c422
test eax, eax
je 0x100d967
cmp dword [ebp + 0x10], 0
je 0x100db1e
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x100db1e
cmp dword [ebp + 0x10], 0
je 0x100db1e
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
jmp 0x100db1e
push str._PASSWORDREQ
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d9b2
push str._PASSWORDREQ
push ebx
call fcn.0100c422
test eax, eax
mov eax, dword [ebp + 8]
je 0x100d9a9
and dword [eax + 0x18], 0xffffffdf
jmp 0x100db1e
or dword [eax + 0x18], 0x20
jmp 0x100db1e
push str._PASSWORDCHG
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100d9e5
push str._PASSWORDCHG
push ebx
call fcn.0100c422
test eax, eax
mov eax, dword [ebp + 8]
je 0x100d9dc
and dword [eax + 0x18], 0xffffffbf
jmp 0x100db1e
or dword [eax + 0x18], 0x40
jmp 0x100db1e
push str._TIMES
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100da0c
push ebx
call fcn.0100c4f7
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x44], 0xa8
jmp 0x100db1e
push str._WORKSTATIONS
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100da2c
push ebx
call fcn.0100cc4d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x30], eax
jmp 0x100db1e
push str._COUNTRYCODE
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100da6c
push str._COUNTRYCODE
push 0xf70
push ebx
call fcn.0100f9a4
mov esi, eax
push esi
call fcn.0100c58b
test eax, eax
jne 0x100da61
push 0xebd
call fcn.0101004c
mov eax, dword [ebp + 8]
mov dword [eax + 0x58], esi
jmp 0x100db1e
push 0x101d8c0
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100dab4
cmp dword [ebp + 0x14], eax
je 0x100db1e
push 0x101d8c0
push 0xf70
push ebx
call fcn.0100f96f
mov ecx, dword [ebp + 0x14]
movzx eax, ax
cmp eax, 0x100
mov dword [ecx], eax
jle 0x100db1e
push 0x101d8c0
push 0xf70
call fcn.0100ff1c
jmp 0x100db1e
push str._EXPIRES
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100db1e
push str.NEVER
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x100dade
mov eax, dword [ebp + 8]
or dword [eax + 0x3c], 0xffffffff
jmp 0x100db1e
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.01013fe6
test eax, eax
jne 0x100daff
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
cmp dword [ebp - 0xc], eax
pop ecx
je 0x100db09
push 0xeb7
call fcn.0101004c
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call fcn.010148ca
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3c], eax
mov word [ebx - 2], 0x3a
mov ebx, dword [ebp + 0x10]
inc dword [ebp - 8]
mov esi, dword [ebp - 8]
lea esi, [esi*4 + 0x1020240]
cmp dword [esi], 0
jne 0x100d649
pop edi
pop esi
pop ebx
leave
ret 0x10