Function at 0x10000addc
Capabilities:
Check os version
Get geographical location
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x9a0
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x990], rax
mov edi, ecx
lea rcx, [r11 - 0x836]
xor r12d, r12d
xor edx, edx
mov r8d, 0x800
mov word [r11 - 0x838], r12w
call sub.msvcrt.dll_memset
mov bp, r12w
cmp edi, 0x641
jb 0x10000ae5b
lea r8, [rsp + 0x180]
mov r9d, 0x401
mov edx, edi
or rcx, 0xffffffffffffffff
mov word [rsp + 0x20], r12w
call sub.msi.dll_MsiDecomposeDescriptorW
mov esi, eax
cmp eax, r12d
jne 0x10000af22
call qword [sym.imp.KERNEL32.dll_GetACP]
lea rcx, [0x100002a20]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp rax, r12
je 0x10000aebc
lea rdx, [0x100002a38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r12
je 0x10000aeb3
call rax
lea r8, [rsp + 0x48]
mov r9d, 0xa
movzx ecx, ax
mov edx, 0x20001004
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, r12d
cmovne esi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x30], r12
movzx r9d, bp
mov r8d, edi
xor edx, edx
mov ecx, 0x1000
mov dword [rsp + 0x28], 0x401
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp eax, r12d
je 0x10000aefd
add eax, 0xfffffffe
mov word [rsp + rax*2 + 0x180], r12w
jmp 0x10000af22
lea r8, [0x100002a58]
lea rcx, [rsp + 0x180]
mov r9d, edi
mov edx, 0x401
call fcn.100004f50
cmp eax, r12d
jl 0x10000b0ae
mov rax, qword [0x10001e010]
cmp dword [0x10001daec], r12d
jne 0x10000b04e
cmp rax, r12
je 0x10000af45
cmp rax, 0xffffffffffffffff
jne 0x10000b04e
lea rax, [rsp + 0x58]
mov ebx, 0x11c
lea rcx, [rsp + 0x60]
mov edi, 1
xor edx, edx
mov r8, rbx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], edi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r12d
je 0x10000b019
cmp dword [rsp + 0x64], 6
jb 0x10000b019
lea ecx, [rdi + 0x3f]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
cmp rax, r12
je 0x10000b019
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
cmp rcx, rax
je 0x10000afba
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r9d, 0x100
mov r8, rbx
mov edx, 0x1c
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x20], r12w
mov dword [rsp + 0x50], r9d
call sub.msi.dll_MsiDecomposeDescriptorW
cmp eax, r12d
je 0x10000b019
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0xfffe
lea r9, [rsp + 0x180]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call qword [0x10001a658]
cmp eax, r12d
jge 0x10000b03b
lea rdx, [rsp + 0x180]
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
mov word [rsp + 0x28], r12w
mov dword [rsp + 0x20], esi
call sub.msi.dll_MsiProvideQualifiedComponentExW
cmp dword [rsp + 0x50], edi
jle 0x10000b0ae
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000b0ae
cmp rax, r12
je 0x10000b0ae
cmp rax, 0xffffffffffffffff
je 0x10000b0ae
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x10001e010]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x180]
lea r8d, [rax + rax]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x10001e010]
lea r9, [rsp + 0x40]
lea rdx, [0x10000188c]
mov r8d, 4
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x990]
xor rcx, rsp
call fcn.100017040
lea r11, [rsp + 0x9a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret