Function at 0x14001f380
Capabilities:
Check os version
Get common file path
Get geographical location

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x688]
sub rsp, 0x788
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rbp + 0x670], rax
mov rbx, rcx
mov byte [rcx + 5], 0
mov dword [rcx], reloc.ODBC32.dll_SQLAllocHandle
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x110
call fcn.1400c0ac0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14001f3f4
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14001f7ac
mov qword [rsp + 0x7a8], rsi
lea rcx, [rbp + 0x44]
mov qword [rsp + 0x7b0], rdi
xor edx, edx
mov qword [rsp + 0x7b8], r14
mov r8d, 0x118
mov qword [rsp + 0x780], r15
mov byte [rbx + 4], 0
call fcn.1400c0ac0
lea rcx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [rbp + 0x15a], 3
jne 0x14001f447
mov byte [rbx + 4], 1
mov eax, dword [rsp + 0x30]
mov r14d, 1
mov esi, 2
sub eax, r14d
je 0x14001f4f8
cmp eax, r14d
jne 0x14001f536
mov eax, dword [rsp + 0x24]
cmp eax, 4
ja 0x14001f477
mov dword [rbx], shutdown
cmp eax, 5
jne 0x14001f4b2
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14001f48f
mov dword [rbx], reloc.WS2_32.dll_select
jmp 0x14001f536
cmp eax, r14d
jne 0x14001f49f
mov dword [rbx], reloc.WS2_32.dll_send
jmp 0x14001f536
cmp eax, esi
jne 0x14001f536
mov dword [rbx], reloc.WS2_32.dll_sendto
jmp 0x14001f536
cmp eax, 6
jne 0x14001f4e4
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14001f4c7
mov dword [rbx], reloc.WS2_32.dll_setsockopt
jmp 0x14001f536
cmp eax, r14d
jne 0x14001f4d4
mov dword [rbx], reloc.WS2_32.dll_socket
jmp 0x14001f536
add eax, 0xfffffffe
cmp eax, r14d
ja 0x14001f536
mov dword [rbx], reloc.ODBC32.dll_SQLAllocHandle
jmp 0x14001f536
cmp eax, 7
jne 0x14001f536
cmp dword [rsp + 0x28], 0
jne 0x14001f536
mov dword [rbx], reloc.ODBC32.dll_SQLAllocHandle
jmp 0x14001f536
cmp dword [rsp + 0x24], 4
mov edx, 3
mov dword [rbx], edx
jne 0x14001f51d
mov ecx, dword [rsp + 0x28]
test ecx, ecx
jne 0x14001f513
mov dword [rbx], r14d
jmp 0x14001f51d
cmp ecx, 0xa
mov eax, edx
cmove eax, esi
mov dword [rbx], eax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x2c]
and eax, 0xffff0000
mov byte [rbx + 5], r14b
cmp eax, 0x45a0000
cmove ecx, edx
mov dword [rbx], ecx
xor edi, edi
mov byte [rbx + 0x628], 0
lea r8, [rbp + 0x270]
mov word [rbx + 0x72c], di
mov ecx, 0x400
lea r9d, [rdi + 0xa]
lea edx, [rdi + 9]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov r8, rsi
lea rdx, [rbp + 0x270]
lea rcx, [0x1401060b8]
call fcn.1400d18bc
mov ecx, edi
test eax, eax
jne 0x14001f5a0
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x272]
mov byte [rbp + rcx + 0x160], al
lea rcx, [rcx + 1]
test al, al
jne 0x14001f580
jmp 0x14001f5b7
movzx eax, byte [rbp + rcx + 0x270]
mov byte [rbp + rcx + 0x160], al
lea rcx, [rcx + 1]
test al, al
jne 0x14001f5a0
lea rax, [rbp + 0x160]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], dil
jne 0x14001f5c5
cmp esi, r14d
jl 0x14001f61b
lea rcx, [rbp + 0x160]
call fcn.1400d1bec
lea eax, [rsi - 1]
movsxd r8, eax
test eax, eax
js 0x14001f61b
mov r9d, 0xffffffd0
nop
movsx ecx, byte [rbp + r8 + 0x160]
mov edx, 0xffffffc9
lea eax, [rcx - 0x41]
cmp al, 5
cmova edx, r9d
add edx, ecx
imul edx, r14d
shl r14d, 4
add edx, edi
sub r8, 1
mov edi, edx
jns 0x14001f5f0
mov dword [rbx + 8], edi
cmp edi, 0x404
je 0x14001f66a
cmp edi, 0x804
je 0x14001f661
cmp edi, 0xc04
je 0x14001f658
cmp edi, 0x1004
je 0x14001f64f
cmp edi, 0x1404
jne 0x14001f671
mov dword [rbx + 8], 0x14c1
jmp 0x14001f671
mov dword [rbx + 8], 0x10c0
jmp 0x14001f671
mov dword [rbx + 8], 0xcc1
jmp 0x14001f671
mov dword [rbx + 8], 0x8c0
jmp 0x14001f671
mov dword [rbx + 8], 0x4c1
call qword [sym.imp.KERNEL32.dll_GetACP]
mov dword [rbx + 0xc], eax
movzx eax, byte [rbx + 8]
add eax, 0xfffffff8
cmp eax, 0xb9
ja case.0x14001f6a3.9
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x1f7e8]
mov ecx, dword [rdx + rax*4 + 0x1f7c8]
add rcx, rdx
jmp rcx
mov dword [rbx + 0xc], 0x3a4
jmp case.0x14001f6a3.9
mov dword [rbx + 0xc], 0x3a8
jmp case.0x14001f6a3.9
mov dword [rbx + 0xc], 0x3b6
jmp case.0x14001f6a3.9
mov dword [rbx + 0xc], 0x3b5
jmp case.0x14001f6a3.9
mov dword [rbx + 0xc], 0x4e3
jmp case.0x14001f6a3.9
mov dword [rbx + 0xc], 0x4e5
jmp case.0x14001f6a3.9
mov dword [rbx + 0xc], 0x4e9
cmp byte [rbx + 5], 0
mov edx, 0x104
je 0x14001f73c
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, 0x104
lea rcx, [rbx + 0x114]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r9d, dword [rbx + 0xc]
lea r8, [rbx + 0x10]
lea rdx, [rbx + 0x218]
mov rcx, rbx
call fcn.14001e680
mov r9d, dword [rbx + 0xc]
lea r8, [rbx + 0x114]
lea rdx, [rbx + 0x420]
mov rcx, rbx
call fcn.14001e680
jmp 0x14001f78c
lea rcx, [rbx + 0x218]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0x104
lea rcx, [rbx + 0x420]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, dword [rbx + 0xc]
lea r8, [rbx + 0x218]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call fcn.14001e5c0
mov r9d, dword [rbx + 0xc]
lea r8, [rbx + 0x420]
lea rdx, [rbx + 0x114]
mov rcx, rbx
call fcn.14001e5c0
mov r14, qword [rsp + 0x7b8]
mov rdi, qword [rsp + 0x7b0]
mov rsi, qword [rsp + 0x7a8]
mov r15, qword [rsp + 0x780]
xor eax, eax
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.140027790
add rsp, 0x788
pop rbx
pop rbp
ret