Function at 0x423420
Capabilities:
Get common file path
Get disk information
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c658
mov eax, dword fs:[0]
push eax
sub esp, 0x5a4
mov eax, dword [0x458ac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x12c], 0
lea ecx, [ebp - 0x3c0]
call fcn.00421ba0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x124]
call fcn.00421ba0
mov byte [ebp - 4], 2
mov byte [ebp - 0x25c], 0
xor eax, eax
mov dword [ebp - 0x25b], eax
mov dword [ebp - 0x257], eax
mov dword [ebp - 0x253], eax
mov dword [ebp - 0x24f], eax
mov word [ebp - 0x24b], ax
mov byte [ebp - 0x249], al
mov byte [ebp - 0x248], 0
xor ecx, ecx
mov dword [ebp - 0x247], ecx
mov dword [ebp - 0x243], ecx
mov byte [ebp - 0x23f], cl
mov byte [ebp - 0x398], 0
xor edx, edx
mov dword [ebp - 0x397], edx
mov byte [ebp - 0x364], 0
push 0x103
push 0
lea eax, [ebp - 0x363]
push eax
call fcn.0043b2d0
add esp, 0xc
mov byte [ebp - 0x3cc], 0
xor ecx, ecx
mov word [ebp - 0x3cb], cx
mov byte [ebp - 0x3c9], cl
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea edx, [ebp - 0x11b]
push edx
call fcn.0043b2d0
add esp, 0xc
mov byte [ebp - 0x390], 0
xor eax, eax
mov word [ebp - 0x38f], ax
mov byte [ebp - 0x3c4], 0
xor ecx, ecx
mov word [ebp - 0x3c3], cx
mov byte [ebp - 0x38c], 0
xor edx, edx
mov word [ebp - 0x38b], dx
mov dword [ebp - 0x39c], 0
lea ecx, [ebp - 0x388]
call fcn.00421ba0
mov byte [ebp - 4], 3
push str.67F9158B
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x3f0]
push eax
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
mov edx, dword [ecx]
mov dword [ebp - 0x44c], edx
mov eax, dword [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x398]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [ebp - 0x3f0]
call fcn.00421430
push 0x44e6cc
lea edx, [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x3f4]
push edx
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov ecx, dword [eax]
mov dword [ebp - 0x458], ecx
mov edx, dword [ebp - 0x458]
push edx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [ebp - 0x3f4]
call fcn.00421430
push 0x104
lea ecx, [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov dword [ebp - 0x128], 0
jmp 0x423670
mov edx, dword [ebp - 0x128]
add edx, 1
mov dword [ebp - 0x128], edx
cmp dword [ebp - 0x128], 3
jge 0x423695
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x128]
mov dl, byte [ebp + ecx - 0x364]
mov byte [ebp + eax - 0x3cc], dl
jmp 0x423661
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x12c]
push eax
push 0
push 0
lea ecx, [ebp - 0x3cc]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
push 0x10
lea edx, [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x12c]
push eax
call fcn.00423230
add esp, 0xc
push str.67F9198B
lea ecx, [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edx, [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x3f8]
push ecx
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x460], eax
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov dword [ebp - 0x464], eax
mov ecx, dword [ebp - 0x464]
push ecx
lea edx, [ebp - 0x398]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [ebp - 0x3f8]
call fcn.00421430
mov eax, dword [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x398]
push ecx
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push str.0A887397A5F240675EEF4D35019B6883A6FA5D6C5EF8711536AC4C8FB1D67C5670CA643630A642B681C07D505E9B54180FA15B
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push reloc.OLEAUT32.dll_SysReAllocString
push 1
push 0
lea ecx, [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push ecx
mov edx, esp
mov dword [ebp - 0x3fc], esp
push eax
lea eax, [ebp - 0x23c]
push eax
push edx
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x588], eax
lea ecx, [ebp - 0x3ec]
call fcn.004220b0
mov dword [ebp - 0x58c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3ec]
call fcn.00422420
mov dword [ebp - 0x130], eax
push str.67F9158B
lea ecx, [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edx, [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x46c], eax
mov edx, dword [ebp - 0x46c]
mov eax, dword [edx]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
push ecx
lea edx, [ebp - 0x398]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [ebp - 0x400]
call fcn.00421430
mov eax, dword [ebp - 0x130]
push eax
lea ecx, [ebp - 0x398]
push ecx
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x44e650
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLCID]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x398]
push ecx
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x44e650
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push str.0A887397A5F240675EEF4D35019B6883A6FA5D6C5EF8711536AC4C8FA1CA615667C64A0F2DBA65B286D6
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x590], eax
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0x48c], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x48c]
push edx
lea ecx, [ebp - 0x388]
call fcn.00421c20
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x404]
call fcn.00421430
push reloc.OLEAUT32.dll_SysReAllocString
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x408], esp
push 0x44e4c3
call fcn.004210d0
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x598], eax
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x40c], esp
mov dword [ebp - 0x4b4], ecx
mov edx, dword [ebp - 0x388]
sub edx, 0x10
mov dword [ebp - 0x4ac], edx
mov eax, dword [ebp - 0x4ac]
push eax
call fcn.00421ce0
add esp, 4
mov dword [ebp - 0x4b0], eax
mov ecx, dword [ebp - 0x4b0]
add ecx, 0x10
mov edx, dword [ebp - 0x4b4]
mov dword [edx], ecx
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x59c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x384]
call fcn.00422490
mov dword [ebp - 0x5a0], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x384]
call fcn.00422ad0
mov byte [ebp - 4], 8
lea edx, [ebp - 0x410]
push edx
lea ecx, [ebp - 0x124]
call fcn.00421c20
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x410]
call fcn.00421430
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x120], ecx
cmp dword [ebp - 0x120], 8
jge 0x423a68
mov dword [ebp - 0x39c], 0
push str._000
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push str.0_00
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
jmp 0x423b5b
mov ecx, dword [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x124]
call fcn.00429e30
mov dword [ebp - 0x39c], eax
mov edx, dword [ebp - 0x39c]
mov al, byte [edx]
mov byte [ebp - 0x390], al
mov ecx, dword [ebp - 0x39c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x38f], dl
mov byte [ebp - 0x38e], 0
mov eax, dword [ebp - 0x39c]
mov cl, byte [eax + 3]
mov byte [ebp - 0x3c4], cl
mov edx, dword [ebp - 0x39c]
mov al, byte [edx + 4]
mov byte [ebp - 0x3c3], al
mov byte [ebp - 0x3c2], 0
mov ecx, dword [ebp - 0x39c]
mov dl, byte [ecx + 6]
mov byte [ebp - 0x38c], dl
mov eax, dword [ebp - 0x39c]
mov cl, byte [eax + 7]
mov byte [ebp - 0x38b], cl
mov byte [ebp - 0x38a], 0
push 0x44e650
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x390]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0x3c4]
push edx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x44e650
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0x38c]
push edx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x124]
call fcn.00429e90
push str.0A887397A5F240675EEF4D35019B6883A6FA5D6C5EF8711536AC4C8FA4DA76476DE96109318D40A797
lea ecx, [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push reloc.OLEAUT32.dll_SysReAllocString
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x414], esp
push 0x44e4c3
call fcn.004210d0
mov dword [ebp - 0x5a4], eax
mov edx, dword [ebp - 0x5a4]
mov dword [ebp - 0x5a8], edx
mov byte [ebp - 4], 9
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push ecx
mov ecx, esp
mov dword [ebp - 0x418], esp
push eax
lea edx, [ebp - 0x23c]
push edx
push ecx
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x5ac], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3bc]
call fcn.00422490
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x3bc]
call fcn.00422ad0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x41c]
push ecx
lea ecx, [ebp - 0x3c0]
call fcn.00421c20
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x41c]
call fcn.00421430
mov edx, dword [ebp - 0x3c0]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jle 0x423d07
mov ecx, dword [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x3c0]
call fcn.00429e30
mov dword [ebp - 0x39c], eax
mov edx, dword [ebp - 0x39c]
mov al, byte [edx]
mov byte [ebp - 0x390], al
mov ecx, dword [ebp - 0x39c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x38f], dl
mov byte [ebp - 0x38e], 0
mov eax, dword [ebp - 0x39c]
mov cl, byte [eax + 3]
mov byte [ebp - 0x3c4], cl
mov edx, dword [ebp - 0x39c]
mov al, byte [edx + 4]
mov byte [ebp - 0x3c3], al
mov byte [ebp - 0x3c2], 0
mov ecx, dword [ebp - 0x39c]
mov dl, byte [ecx + 6]
mov byte [ebp - 0x38c], dl
mov eax, dword [ebp - 0x39c]
mov cl, byte [eax + 7]
mov byte [ebp - 0x38b], cl
mov byte [ebp - 0x38a], 0
lea edx, [ebp - 0x390]
push edx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [ebp - 0x3c4]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c0]
call fcn.00429e90
jmp 0x423d3a
push 0
mov edx, dword [ebp - 0x39c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x44e58c
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x44e588
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x104
lea edx, [ebp - 0x248]
push edx
push 5
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
lea eax, [ebp - 0x248]
push eax
call fcn.00423370
add esp, 4
mov dword [ebp - 0x3c8], eax
mov ecx, dword [ebp - 0x3c8]
push ecx
lea edx, [ebp - 0x398]
push edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x44e584
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
sub eax, 2
cmp eax, 0x24
je 0x423dd3
push str.notDef
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004210d0
mov ecx, dword [ebp - 0x420]
or ecx, 1
mov dword [ebp - 0x420], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3bc]
call fcn.00422790
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x384]
call fcn.00422790
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3ec]
call fcn.00422080
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x388]
call fcn.00421430
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x124]
call fcn.00421430
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c0]
call fcn.00421430
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b34a
mov esp, ebp
pop ebp
ret