Function at 0x1004f2b
Capabilities:
Get common file path
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe58
mov eax, dword [0x1014004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0xe4c]
push eax
mov esi, 0x1001678
xor ebx, ebx
push esi
mov dword [ebp - 0xe44], ecx
mov dword [ebp - 0xe48], ebx
call fcn.010036f9
mov dword [ebp - 0xe40], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0xc34], ax
lea eax, [ebp - 0xc32]
push ebx
push eax
call fcn.010059c0
mov eax, dword [ebp - 0xe44]
push esi
add eax, 8
push eax
push 0x1001320
mov esi, 0x104
lea eax, [ebp - 0xc34]
push esi
push eax
call fcn.010034d3
add esp, 0x20
lea eax, [ebp - 0xe54]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xc34]
push eax
push 0x80000001
mov dword [ebp - 0xe54], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004ffe
push dword [ebp - 0xe54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xe44]
cmp dword [ebp - 0xe48], ebx
jbe 0x1004ff7
push ebx
jmp 0x1004ff9
push 1
call fcn.010046f6
cmp dword [ebp - 0xe40], ebx
jl 0x1005298
cmp dword [ebp - 0xe48], ebx
jbe 0x1005298
lea eax, [ebp - 0xe50]
push eax
push ebx
push ebx
push 0x1002b6c
mov dword [ebp - 0xe50], ebx
call sub.SHELL32.dll_SHGetKnownFolderPath
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x1005280
xor eax, eax
push edi
mov word [ebp - 0xa2c], ax
lea eax, [ebp - 0xa2a]
push ebx
push eax
call fcn.010059c0
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0xa2c]
push eax
mov eax, dword [ebp - 0xe44]
push 8
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
test eax, eax
je 0x100526a
xor eax, eax
push edi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push ebx
push eax
call fcn.010059c0
lea eax, [ebp - 0xa2c]
push eax
push 0x10016a4
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.010034d3
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x1005274
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.010059c0
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xe50]
lea eax, [ebp - 0x20c]
push 0x1001668
push esi
push eax
call fcn.010034d3
add esp, 0x20
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x1005274
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, ebx
je 0x100511e
cmp eax, 0xb7
jne 0x1005274
xor eax, eax
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.010059c0
mov eax, dword [ebp - 0xe4c]
add esp, 0xc
push dword [eax + 4]
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01003464
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x1005274
xor eax, eax
push edi
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push ebx
push eax
call fcn.010059c0
lea eax, [ebp - 0x61c]
push eax
push 0x1001694
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.010034d3
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x1005274
mov edi, dword [ebp - 0xe44]
push ebx
lea eax, [ebp - 0x824]
push eax
mov ecx, edi
call fcn.01003800
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x1005274
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x1005274
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xe48]
mov ecx, edi
push dword [ebp - 0xe4c]
call fcn.01004b26
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x1005253
lea eax, [ebp - 0xe58]
push eax
push esi
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHELL32.dll_SHGetLocalizedName]
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jl 0x100524a
push dword [ebp - 0xe58]
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebx
mov dword [ebp - 0xe40], eax
jge 0x1005274
mov ecx, edi
call fcn.0100341e
jmp 0x1005274
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.01003323
jmp 0x1005274
mov dword [ebp - 0xe40], 0x80004005
push dword [ebp - 0xe50]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0xe48]
mov ecx, dword [ebp - 0xe44]
lea eax, [ebp - 0xe4c]
push eax
call fcn.01002dc8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe40]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100597b
leave
ret