Function at 0x109f3a1
Capabilities:
Get common file path
Get geographical location

Disassembly:
mov eax, 0x12783ab
call fcn.01160118
mov eax, 0x21520
call fcn.011602e0
mov eax, dword [0x12cf8c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 0x214f0], ecx
mov dword [ebp - 0x214c0], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x214cc], ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x214cc]
push eax
mov ecx, 0x12d2398
call fcn.0107d32f
mov esi, eax
cmp esi, ebx
jl 0x109f40e
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f444
mov ecx, dword [eax]
lea edx, [ebp - 0x214c0]
push edx
push eax
call dword [ecx + 0x70]
mov esi, eax
cmp esi, ebx
jge 0x109f43c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f421
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f435
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x109ffd1
cmp dword [ebp - 0x214c0], ebx
jne 0x109f475
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f457
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f46b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x109ffd1
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214cc]
cmp eax, ebx
je 0x109f488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x214d0], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x214c0]
mov ecx, dword [eax]
lea edx, [ebp - 0x214d0]
push edx
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f4b5
mov ecx, dword [eax]
push eax
call dword [ecx + 0x60]
push 4
lea eax, [ebp - 0x18]
push eax
push 0xc
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
jne 0x109f4fd
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f4df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f4f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x109ffd1
push edi
mov esi, 0x106808d
push esi
push fcn.0105d441
push 3
pop edi
push edi
push 0xc
lea eax, [ebp - 0x2152c]
push eax
call fcn.01160322
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21514]
push eax
push 1
call fcn.0119301a
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109f57d
mov byte [ebp - 4], 2
push esi
push edi
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601aa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109f55e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109f572
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x214c4]
jmp 0x109ffd0
lea eax, [ebp - 0x2152c]
push eax
push 2
call fcn.0119301a
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f537
lea eax, [ebp - 0x21520]
push eax
push 4
call fcn.0119301a
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f537
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214c8], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf086
push edi
lea eax, [ebp - 0x2152c]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.01090247
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f740
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf087
push 1
lea eax, [ebp - 0x2152c]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.01090247
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f740
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf089
push 1
lea eax, [ebp - 0x21520]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.01090247
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f740
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf088
push 1
lea eax, [ebp - 0x21514]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.01090247
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jl 0x109f740
mov dword [ebp - 0x214fc], ebx
mov dword [ebp - 0x214f8], ebx
mov dword [ebp - 0x214f4], ebx
mov byte [ebp - 4], 5
push 0x100a530
lea ecx, [ebp - 0x214d4]
call fcn.01076831
mov byte [ebp - 4], 6
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214fc]
call fcn.010919fd
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214d4]
call fcn.0103290a
push 0x100a52c
lea ecx, [ebp - 0x214d4]
call fcn.01076831
mov byte [ebp - 4], 7
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214fc]
call fcn.010919fd
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214d4]
call fcn.0103290a
mov ecx, dword [ebp - 0x214f0]
lea eax, [ebp - 0x18]
push eax
push 0xf51a
push 1
lea eax, [ebp - 0x214fc]
push eax
lea eax, [ebp - 0x214c8]
push eax
call fcn.01090247
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109f754
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.010666bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.0103290a
jmp 0x109f537
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214e0], eax
mov byte [ebp - 4], 8
push 0xf08c
lea ecx, [ebp - 0x214e0]
call fcn.01032a7e
cmp eax, ebx
jne 0x109f7af
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.0103290a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.010666bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.0103290a
mov byte [ebp - 4], 2
push esi
push edi
jmp 0x109ff96
lea eax, [ebp - 0x214e0]
push eax
lea ecx, [ebp - 0x214c8]
call fcn.01044d17
mov edi, dword [ebp - 0x214c8]
cmp dword [edi - 8], ebx
mov dword [ebp - 0x214cc], ebx
jle 0x109f803
mov eax, dword [ebp - 0x214cc]
cmp word [edi + eax*2], 0x5e
jne 0x109f7f2
push ebx
push eax
lea ecx, [ebp - 0x214c8]
call fcn.01061503
mov edi, dword [ebp - 0x214c8]
inc dword [ebp - 0x214cc]
mov eax, dword [ebp - 0x214cc]
cmp eax, dword [edi - 8]
jl 0x109f7d2
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x214e4], eax
mov byte [ebp - 4], 9
push 0xf08d
lea ecx, [ebp - 0x214e4]
call fcn.01032a7e
cmp eax, ebx
je 0x109ff53
push ebx
push edi
push 0x1264
push ebx
push ebx
push 1
lea ecx, [ebp - 0x214bc]
call fcn.01090e21
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x214e4]
mov dword [ebp - 0x21470], eax
lea eax, [ebp - 0x2103c]
mov dword [ebp - 0x21458], 0x11d
mov dword [ebp - 0x2145c], 0x108e78f
mov dword [ebp - 0x21460], eax
mov byte [ebp - 0x2103c], bl
mov dword [ebp - 0x214dc], ebx
mov byte [ebp - 4], 0xb
mov ecx, 0x12d2398
call fcn.0107c3e1
push eax
lea ecx, [ebp - 0x214cc]
call fcn.01039819
mov byte [ebp - 4], 0xc
mov eax, dword [0x12ce0a0]
mov byte [ebp - 0x214e5], bl
mov dword [ebp - 0x214d8], eax
mov byte [ebp - 4], 0xd
push 0xf003f
push dword [ebp - 0x214cc]
lea ecx, [ebp - 0x214dc]
push SysReAllocString
call fcn.01044a77
test eax, eax
mov edi, dword [ebp + 8]
jne 0x109f95b
push 0x1001d74
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x214dc]
mov byte [ebp - 0x214e5], 1
mov dword [ebp - 0x214d4], ebx
call fcn.01044ab3
test eax, eax
jne 0x109f90e
cmp dword [ebp - 0x214d4], ebx
setne al
mov byte [ebp - 0x2103c], al
jmp 0x109f915
mov byte [ebp - 0x2103c], 1
lea eax, [ebp - 0x214c4]
push eax
mov ecx, 0x208
push edi
mov dword [ebp - 0x214c4], ecx
call fcn.0108e8b8
push eax
push ecx
lea ecx, [ebp - 0x214d8]
call fcn.01032987
push eax
lea ecx, [ebp - 0x214dc]
call fcn.01044ae6
test eax, eax
je 0x109fa13
push 0xffffffffffffffff
lea ecx, [ebp - 0x214d8]
call fcn.010329f4
push 0x104
lea ecx, [ebp - 0x214d8]
call fcn.01032987
push eax
push ebx
push ebx
push edi
call fcn.0108e8ee
or eax, 0x8000
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
mov dword [ebp - 0x214c4], eax
jge 0x109fa13
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.0103290a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.0103290a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044a59
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.0109021f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.0103290a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.0103290a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.010666bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.0103290a
mov byte [ebp - 4], 2
push esi
push 3
jmp 0x109f53d
cmp edi, ebx
mov eax, dword [ebp - 0x214d8]
mov dword [ebp - 0x21474], eax
jl 0x109ff17
cmp edi, 2
jle 0x109fa41
cmp edi, 3
jne 0x109ff17
mov dword [ebp - 0x21488], 1
jmp 0x109fa4a
add edi, 2
mov dword [ebp - 0x21488], edi
push dword [0x12d24cc]
lea eax, [ebp - 0x21038]
lea ecx, [ebp - 0x214bc]
mov word [ebp - 0x21038], bx
mov dword [ebp - 0x21484], eax
mov dword [ebp - 0x21480], 0x10810
call fcn.0108fca8
cmp eax, 1
jne 0x109fe5c
mov dword [ebp - 0x21508], ebx
mov dword [ebp - 0x21504], ebx
mov dword [ebp - 0x21500], ebx
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x21038]
push eax
lea ecx, [ebp - 0x214ec]
call fcn.01045e8e
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214ec]
call fcn.0104502b
mov edi, eax
cmp edi, ebx
jge 0x109fb9b
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.0104508a
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.010666bc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.0103290a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.0103290a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044a59
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.0109021f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.0103290a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.0103290a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.010666bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.0103290a
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601aa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109fb80
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109fb94
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x109ffd0
lea edi, [ebp - 0x21038]
mov eax, edi
test eax, eax
jne 0x109fc87
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.0104508a
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.010666bc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.0103290a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.0103290a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044a59
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.0109021f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.0103290a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.0103290a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.010666bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.0103290a
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601aa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109fc69
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109fc7d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x109ffd0
cmp word [ebp - 0x21038], bx
je 0x109fc97
inc edi
inc edi
cmp word [edi], bx
jne 0x109fc90
inc edi
inc edi
je 0x109fbab
mov ax, word [edi]
cmp ax, bx
je 0x109fd46
mov cx, word [edi + 2]
cmp cx, 0x3a
je 0x109fcf6
cmp ax, 0x5c
jne 0x109fcc0
cmp cx, ax
je 0x109fcf6
push edi
lea eax, [ebp - 0x214ec]
push eax
lea eax, [ebp - 0x214d4]
push eax
call fcn.01045c7c
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.010919fd
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
jmp 0x109fd22
push edi
lea ecx, [ebp - 0x214c4]
call fcn.01039819
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x214c4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.010919fd
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214c4]
call fcn.0103290a
jmp 0x109fd2b
inc edi
inc edi
cmp word [edi], bx
jne 0x109fd29
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x109fcab
cmp dword [ebp - 0x21504], ebx
jne 0x109fda9
lea eax, [ebp - 0x21038]
push eax
lea ecx, [ebp - 0x214d4]
call fcn.01045e8e
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x214ec]
push eax
lea ecx, [ebp - 0x214d4]
call fcn.010527d5
mov edi, eax
cmp edi, ebx
jge 0x109fd88
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
call fcn.0104508a
jmp 0x109fac2
lea eax, [ebp - 0x214d4]
push eax
lea ecx, [ebp - 0x21508]
call fcn.010919fd
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x214d4]
call fcn.0104508a
mov eax, dword [ebp - 0x214f0]
mov ecx, dword [eax + 0xcc]
cmp ecx, ebx
je 0x109fbab
call fcn.010a5b37
mov edi, dword [ebp - 0x214f0]
push ebx
push 1
push dword [ebp - 0x2103c]
lea eax, [ebp - 0x21508]
push eax
mov ecx, edi
call fcn.0109e779
mov ecx, dword [edi + 0xcc]
mov dword [ebp - 0x214c4], eax
call fcn.010a5b56
cmp dword [ebp - 0x214c4], ebx
jge 0x109fe04
push dword [ebp - 0x214c4]
call fcn.0116f1dc
pop ecx
cmp byte [ebp - 0x214e5], bl
je 0x109fe3e
movzx eax, byte [ebp - 0x2103c]
push 0x1001d74
push eax
lea ecx, [ebp - 0x214dc]
call fcn.01061385
push dword [ebp + 8]
call fcn.0108e8b8
push eax
push dword [ebp - 0x214ec]
lea ecx, [ebp - 0x214dc]
call fcn.01044b10
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x214ec]
call fcn.0104508a
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x21508]
call fcn.010666bc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.0103290a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.0103290a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044a59
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.0109021f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.0103290a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.0103290a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.010666bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.0103290a
mov byte [ebp - 4], 2
push esi
push 3
push 0xc
lea eax, [ebp - 0x2152c]
push eax
call fcn.011601aa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109fefc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109ff10
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x109ffd0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x214d8]
call fcn.0103290a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x214cc]
call fcn.0103290a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x214dc]
call fcn.01044a59
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x214bc]
call fcn.0109021f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x214e4]
call fcn.0103290a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x214e0]
call fcn.0103290a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214fc]
call fcn.010666bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214c8]
call fcn.0103290a
mov byte [ebp - 4], 2
push esi
push 3
lea eax, [ebp - 0x2152c]
push 0xc
push eax
call fcn.011601aa
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x214d0]
cmp eax, ebx
je 0x109ffb7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x214c0]
cmp eax, ebx
je 0x109ffcb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe1a
leave
ret 4