Function at 0x1000e3cd
Capabilities:
Get common file path
Get geographical location

Disassembly:
mov eax, 0x100573c2
call fcn.10056a88
sub esp, 0xf4
push ebx
mov dword [ebp - 0x4c], ecx
xor ebx, ebx
mov dword [ebp - 0x48], ebx
xor ecx, ecx
push esi
push edi
inc ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], 0xb09f
mov dword [ebp - 0x1c], 0xa10dd664
mov dword [ebp - 0x28], 5
push 2
mov dword [ebp - 0x20], 0x89c089ce
pop esi
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], esi
jmp 0x1000e430
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x78], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000e422
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x18]
sub eax, 9
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
test eax, eax
sets cl
mov dword [ebp - 0x28], ecx
call fcn.1000ab98
push ecx
push eax
lea ecx, [ebp - 0x64]
call fcn.1000edc7
mov dword [ebp - 4], ebx
mov edi, 0x100711f8
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x3c], 0x44ad
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0xb6f9b691
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x3c], 0xbfe6b87c
mov dword [ebp - 0x20], 0x6eb3e198
mov dword [ebp - 0x18], 0x4434
cmp dword [ebp - 0x18], 0x47c2
jle 0x1000e500
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x3b65
mov eax, ebx
mov ecx, edi
cdq
push edx
push eax
call fcn.10003fa2
add ebx, esi
dec dword [ebp - 0x20]
jne 0x1000e4e1
inc esi
push 0
pop ebx
cmp esi, 0x66ed
jl 0x1000e4d7
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0x41f8
jge 0x1000e519
mov edx, str.bogpdn_fuknthqa_guohvoeow_gocrbjfse
mov ecx, edi
call fcn.1000634f
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x20], 0x5c60
cmp dword [ebp - 0x20], 0x5f68
jle 0x1000e55e
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov eax, esi
mov ecx, edi
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10003fa2
inc ebx
cmp ebx, 0x7239
jl 0x1000e538
inc esi
push 0
pop ebx
cmp esi, 0x22cd
jl 0x1000e535
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 4], 3
cmp dword [ebp - 0x20], 0x5960
jge 0x1000e57e
mov edx, str.apybg_sjfzigjej_rsol_pwxci_mwuzes_mizzcco_pdonnhf_mmnrwnw_aulqngxi_jjh_fnympby_kqpplq
mov ecx, edi
call fcn.1000634f
push 2
mov dword [ebp - 4], ebx
pop edx
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x1000e5f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000e5e7
mov dword [ebp - 0x14], ebx
jmp 0x1000e610
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], 0xa53aa9ac
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000e602
mov dword [ebp - 0x14], ebx
jmp 0x1000e62b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000e61a
mov dword [ebp - 0x14], ebx
jmp 0x1000e646
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], 0x2b293353
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000e635
mov dword [ebp - 0x14], ebx
jmp 0x1000e661
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], 0xe4bcb816
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000e650
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], 0x5412
cmp dword [ebp - 0x20], ebx
je 0x1000e67b
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x64]
mov edx, esi
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x44]
add eax, 0xffffb368
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1000e6f2
mov esi, dword [ebp - 0x30]
cmp dword [eax + 0x10], esi
jge 0x1000e6d1
mov eax, dword [eax + 8]
jmp 0x1000e6d5
mov edx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1000e6c7
mov esi, dword [ebp - 0x64]
cmp edx, esi
je 0x1000e6f2
mov eax, dword [ebp - 0x30]
cmp eax, dword [edx + 0x10]
jl 0x1000e6f2
mov dword [ebp - 0x70], edx
lea eax, [ebp - 0x70]
jmp 0x1000e6f8
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10444e64]
test al, 1
jne 0x1000e730
or eax, ecx
mov dword [0x10444e5c], 7
mov dword [0x10444e64], eax
xor eax, eax
push 0x10057f88
mov dword [0x10444e58], ebx
mov word [0x10444e48], ax
call fcn.1003e732
pop ecx
mov dword [ebp - 0x18], 0xa80e3580
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x1c], 0x29cbc21b
mov dword [ebp - 0x14], ebx
jmp 0x1000e758
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0x3b372ba2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000e74a
mov dword [ebp - 0x14], ebx
jmp 0x1000e774
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000e763
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1000e78f
push 0xa8d
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x18], ebx
je 0x1000e7c0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x1000e7c0
cmp dword [ebp - 0x5c], ebx
je 0x1000e7af
xor ecx, ecx
mov dword [ebp - 0x50], 1
inc ecx
jmp 0x1000e7b4
mov dword [ebp - 0x50], ebx
mov ecx, ebx
mov eax, dword [ebp - 0x18]
sub ecx, eax
je 0x1000e7c0
xor eax, eax
inc eax
jmp 0x1000e7c2
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jg 0x1000e7ca
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], 0x7153
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp - 0x1c]
imul ecx, eax, 0xc0e0
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x18]
test edx, edx
je 0x1000e7fb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0x7a35da77
je 0x1000e9a9
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x21], bl
mov dword [ebp - 0x18], 0x376b
cmp dword [ebp - 0x18], 0x39f4
jle 0x1000e8b4
push ebx
push 0x52b
push 0xdbe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov esi, ebx
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], esi
mov eax, esi
mov dword [ebp - 0x20], 0x75f6
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and eax, ebx
mov ecx, edi
and eax, esi
cdq
push edx
push eax
call fcn.10003fa2
mov eax, dword [ebp - 0x30]
dec eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
jne 0x1000e866
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2db4
jl 0x1000e857
inc ebx
push 0
mov dword [ebp - 0x30], ebx
cmp ebx, 0x7afc
pop ebx
jl 0x1000e84f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x6a47
jl 0x1000e84c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommState]
cmp byte [ebp - 0x21], 0
je 0x1000e95b
mov dword [ebp - 0x1c], 0x696e
cmp dword [ebp - 0x1c], 0x69e0
jle 0x1000e936
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov eax, esi
mov dword [ebp - 0x30], 0x340e
mov dword [ebp - 0x2c], eax
mov esi, ebx
mov ecx, esi
sar eax, cl
lea ecx, [ebp - 0xe8]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e8fd
mov eax, dword [eax]
push eax
call fcn.1003e75c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000460a
mov eax, dword [ebp - 0x2c]
inc esi
cmp esi, 0x763d
jl 0x1000e8e1
dec eax
dec dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
jne 0x1000e8df
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x65e9
jl 0x1000e8d3
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebp - 0x1c], 0x65c0
jge 0x1000e958
push str.sbrwmqa_hqqelq_rnek_flbyhxcnv_xslilxt_xmaflelnf_qhpxrpir_pxhgmhhid_aoutbagt_jaclj
call fcn.1003e75c
pop ecx
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 7
cmp dword [ebp - 0x18], 0x34c8
jge 0x1000e974
mov edx, str.makljsb_hxoqxr_kbvpr_zgrmcyr_ijijkbjt
mov ecx, edi
call fcn.1000634f
push 2
mov dword [ebp - 4], ebx
pop esi
inc dword [ebp - 0x14]
jmp 0x1000ec7a
mov dword [ebp - 0x2c], 0xf12afbca
mov dword [ebp - 0x28], 0x2ba6
cmp dword [ebp - 0x28], 0x2eae
jle 0x1000ea31
push 0x114d
push 0xc6a
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0x20], 0x57ef
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
lea eax, [ebx + ecx]
mov ecx, edx
shl eax, cl
mov ecx, edi
cdq
push edx
push eax
call fcn.10003fa2
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
add edx, esi
dec dword [ebp - 0x20]
mov dword [ebp - 0x30], edx
jne 0x1000e9ea
inc esi
push 0
pop ebx
cmp esi, 0x2204
jl 0x1000e9db
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x6414
jl 0x1000e9d9
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x7a57
jl 0x1000e9d6
mov byte [ebp - 4], 9
cmp dword [ebp - 0x28], 0x281a
jge 0x1000ea4a
mov edx, str.arhcu_jihklos_iwkgwmpu_xzb_mrmgij_abbyrtjb
mov ecx, edi
call fcn.1000634f
push 2
mov dword [ebp - 4], ebx
pop esi
mov dword [ebp - 0x28], 0xbd0c7f12
mov dword [ebp - 0x28], 0xf7cfeb45
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x28], 0x730d
cmp dword [ebp - 0x28], 0x741e
jle 0x1000eabb
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x100711f8
cdq
push edx
push eax
call fcn.10003fa2
inc esi
cmp esi, 0x532a
jl 0x1000ea80
inc edi
cmp edi, 0x797b
jl 0x1000ea7e
push 0x1931
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 2
pop esi
mov edi, 0x100711f8
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x28], 0x721f
jge 0x1000ead4
mov edx, str.krkamx_ludskyvmn_qutjnsddu_ifnibyv_otsa_vxdc_lqcwa_hxkix_pynpjv_tnizs_ujw_iqsfmc_out
mov ecx, edi
call fcn.1000634f
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1000eb43
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0x559c29c8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000eb32
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1000eb6f
push 0x25c5
push 0x1c19
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x18], 0xffffffe2
jmp 0x1000ec70
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xa1fb9d33
mov dword [ebp - 0x14], ebx
jmp 0x1000eb98
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 0xddd8d7cd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1000eb8a
mov dword [ebp - 0x14], ebx
jmp 0x1000ebb4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 0xc011945b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000eba3
mov dword [ebp - 0x14], ebx
jmp 0x1000ebcd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0xf7bd129a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1000ebbf
cmp dword [ebp - 0x2c], ebx
je 0x1000ec43
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
imul ecx, edx, 0xfffffffd
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
sub edx, eax
mov dword [ebp - 0x40], edx
cmp edx, dword [ebp - 0x20]
jne 0x1000ec05
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x80]
cmp eax, 0x13d06461
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x1c]
jl 0x1000ec68
cmp dword [ebp - 0xb0], ebx
je 0x1000ec68
xor eax, eax
inc eax
jmp 0x1000ec6a
mov eax, ebx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff8
je 0x1000eb7b
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x64]
je 0x1000eca0
push dword [edx + 0x18]
mov edx, dword [edx + 0x14]
lea ecx, [ebp - 0x100]
call fcn.100088ae
pop ecx
xor esi, esi
mov byte [ebp - 4], 0xd
inc esi
mov dword [ebp - 0x34], esi
jmp 0x1000ecb7
push 0x10444e48
lea ecx, [ebp - 0xd0]
call fcn.10006f05
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x4c]
push eax
mov dword [ebp - 0x48], esi
call fcn.10006f05
mov eax, dword [ebp - 0x34]
or eax, 4
test al, 2
je 0x1000ece4
push ebx
and eax, 0xfffffffd
lea ecx, [ebp - 0xd0]
push 1
mov dword [ebp - 0x34], eax
call fcn.100046d6
mov eax, dword [ebp - 0x34]
test al, 1
je 0x1000ecf6
push ebx
push 1
lea ecx, [ebp - 0x100]
call fcn.100046d6
lea ecx, [ebp - 0x64]
call fcn.1000ed95
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret