Function at 0x485264
Capabilities:
Get disk information
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x485986
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4852cc
inc ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov edx, esi
call fcn.00420f3c
mov edi, eax
mov edx, dword [ebp - 8]
mov eax, dword [edi + 4]
call dword [edi]
test al, al
je 0x4852c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48599b
inc esi
dec ebx
jne 0x48529d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004850d8
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
mov eax, ebx
cmp eax, 0x53
jg 0x48538e
je 0x485861
cmp eax, 0x11
jg 0x48534c
je 0x485673
cmp eax, 0x10
ja case.0x485301.1
jmp dword [eax*4 + 0x485308]
cmp eax, 0x1c
jg 0x485377
je 0x48550e
sub eax, 0x14
je 0x4854c2
sub eax, 2
je 0x485653
sub eax, 4
je 0x4858e5
jmp case.0x485301.1
sub eax, 0x1d
je 0x48590b
sub eax, 0x1a
je 0x4854d7
jmp case.0x485301.1
cmp eax, 0xb017
jg 0x4853e4
je 0x4856c5
cmp eax, 0xb000
jg 0x4853cb
je 0x48575e
sub eax, 0x112
je 0x485426
add eax, 0xffffffe0
sub eax, 7
jb 0x485627
sub eax, 0x1e1
je 0x48591e
jmp case.0x485301.1
sub eax, 0xb001
je 0x4857dd
sub eax, 0x15
je 0x4856a3
jmp case.0x485301.1
cmp eax, 0xb020
jg 0x48540a
je 0x48587b
sub eax, 0xb01a
je 0x48581d
sub eax, 5
je 0x485861
jmp case.0x485301.1
sub eax, 0xb031
je 0x4858b4
add eax, 0xfffffff2
sub eax, 2
jb 0x485682
jmp case.0x485301.1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
and eax, 0xfff0
sub eax, 0xf020
je 0x485441
sub eax, 0x100
je 0x48544e
jmp 0x48545b
mov eax, dword [ebp - 4]
call fcn.004859c0
jmp 0x48597c
mov eax, dword [ebp - 4]
call fcn.00485ac4
jmp 0x48597c
push ebp
call fcn.004851d4
pop ecx
jmp 0x48597c
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
jne 0x48597c
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 1
jmp 0x48597c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x48597c
call fcn.00481cc8
jmp 0x48597c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
call fcn.0047a984
test eax, eax
je 0x4854b6
push ebp
call fcn.00485214
pop ecx
jmp 0x48597c
push ebp
call fcn.004851d4
pop ecx
jmp 0x48597c
mov eax, dword [ebp - 8]
mov dword [eax], 0x27
push ebp
call fcn.004851d4
pop ecx
jmp 0x48597c
mov eax, dword [ebp - 4]
call fcn.004859a4
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x48597c
push 0
push 0
push 0xb01a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
push ebp
call fcn.004851d4
pop ecx
jmp 0x48597c
push ebp
call fcn.004851d4
pop ecx
mov eax, dword [ebp - 8]
mov esi, eax
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x24], 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0xa1], al
test al, al
je 0x485576
mov eax, dword [ebp - 4]
cmp byte [eax + 0xcf], 0
je 0x485551
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x485551
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 4]
call fcn.00484ddc
push 0
push 0
push 0xb000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
jmp 0x48597c
mov eax, dword [ebp - 4]
call fcn.00484d7c
push 0
push 0
push 0xb001
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
jmp 0x48597c
mov eax, dword [ebp - 8]
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x34], 0
je 0x4855e7
cmp byte [0x568ccc], 0
jne 0x4855db
mov eax, dword [ebp - 4]
call fcn.00484ddc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x4855db
call fcn.0047ac18
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xb0], edx
push ebp
call fcn.004851d4
pop ecx
jmp 0x48597c
push ebp
call fcn.004851d4
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], 0
jne 0x48561a
cmp byte [0x568ccc], 0
jne 0x48561a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
call fcn.0047ab54
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0], eax
mov eax, dword [ebp - 4]
call fcn.00484d84
jmp 0x48597c
mov esi, dword [ebp - 8]
mov esi, dword [esi + 8]
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 8]
add ebx, 0xbc00
push ebx
mov eax, dword [ebp - 8]
push esi
call sub.KERNEL32.DLL_GetVolumeInformationW
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x48597c
mov eax, dword [ebp - 8]
mov esi, eax
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x44], 0
je 0x48597c
call fcn.00405288
jmp 0x48597c
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x48597c
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov eax, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00487b28
and eax, 0x7f
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x48597c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00485f00
test al, al
je 0x48597c
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x48597c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x48597c
mov ebx, eax
mov eax, ebx
call fcn.0046d87c
test eax, eax
je 0x48597c
mov eax, ebx
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_InterlockedCompareExchange
test eax, eax
je 0x48597c
mov eax, ebx
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_InterlockedExchange
test eax, eax
je 0x48597c
mov byte [0x568cb8], 0
call fcn.00409214
mov esi, eax
mov eax, ebx
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_GlobalLock
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
mov edx, 0x112
mov eax, ebx
call fcn.0046628c
push esi
call sub.KERNEL32.DLL_GlobalLock
mov byte [0x568cb8], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x48597c
mov eax, dword [ebp - 4]
cmp word [eax + 0x142], 0
je 0x48577d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x144]
call dword [ebx + 0x140]
mov eax, dword [0x5711c4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4857cd
mov eax, dword [0x5711c4]
cmp byte [eax + 0xcf], 0
je 0x4857cd
mov eax, ebx
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_InterlockedCompareExchange
test eax, eax
jne 0x4857cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.0046d87c
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0xd0]
je 0x4857cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xd0], edx
jmp 0x48597c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call fcn.0040925c
mov edx, dword [ebp - 4]
mov dword [edx + 0xd0], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x13a], 0
je 0x48597c
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x13c]
call dword [ebx + 0x138]
jmp 0x48597c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
call fcn.0047a984
test eax, eax
jne 0x48597c
call fcn.00409214
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x170]
jne 0x48597c
xor eax, eax
call fcn.0047acb0
test eax, eax
je 0x48597c
push eax
call sub.KERNEL32.DLL_GlobalLock
jmp 0x48597c
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 8]
movzx edx, word [edx + 4]
mov eax, dword [ebp - 4]
call fcn.00486874
jmp 0x48597c
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x48589c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
call fcn.00486158
jmp 0x48597c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
call fcn.004861b8
jmp 0x48597c
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
jne 0x4858d1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x48597c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb4], eax
jmp 0x48597c
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov eax, dword [0x56bad0]
mov eax, dword [eax]
call fcn.00472f1c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00485158
push ebp
call fcn.004851d4
pop ecx
jmp 0x48597c
mov eax, dword [0x5711c8]
call fcn.00484224
push ebp
call fcn.004851d4
pop ecx
jmp 0x48597c
call fcn.00474d38
call fcn.00474ea0
mov dword [ebp - 0x18], 0xb051
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x5711c8]
call fcn.00483568
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x48597c
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x5711c8]
call fcn.00483554
lea edx, [ebp - 0x18]
call fcn.00469530
inc esi
dec ebx
jne 0x485952
jmp 0x48597c
xor eax, eax
call fcn.00428758
jmp 0x48597c
push ebp
call fcn.004851d4
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48599b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret