Function at 0x410a0b
Capabilities:
Get disk information
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440537
mov eax, dword fs:[0]
push eax
mov eax, 0x3494
call fcn.00438db0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xfff
lea eax, [ebp - 0x340f]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x341c], ebx
mov byte [ebp - 0x3410], 0
call fcn.00431920
add esp, 0xc
lea eax, [ebp - 0x3410]
push eax
mov edi, 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x410c06
cmp eax, edi
ja 0x410c06
lea ebx, [ebp - 0x3410]
mov esi, 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x410b71
push 0xfff
lea eax, [ebp - 0x140f]
push 0
push eax
mov byte [ebp - 0x1410], 0
call fcn.00431920
add esp, 0xc
call fcn.0040965a
dec eax
jne 0x410af1
push 4
lea eax, [ebp - 0x3424]
push eax
push 0x20001009
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x3444]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call fcn.0040a6eb
push 0xfff
lea eax, [ebp - 0x240f]
push 0
push eax
mov byte [ebp - 0x2410], 0
call fcn.00431920
and dword [ebp - 0x3414], 0
add esp, 0xc
call fcn.0040965a
test eax, eax
je 0x410b4a
call fcn.0040a771
push 4
lea eax, [ebp - 0x3420]
push eax
push 0x20001009
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x3444]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
lea eax, [ebp - 0x2410]
push eax
push 0
push 0
lea eax, [ebp - 0x3414]
push eax
push edi
lea eax, [ebp - 0x1410]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
je 0x410ba0
mov eax, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410b76
sub eax, ecx
or dword [ebp - 4], 0xffffffff
lea ebx, [ebx + eax + 1]
mov eax, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410b8c
sub eax, ecx
jne 0x410a90
jmp 0x410c82
push 0x3ff
lea eax, [ebp - 0x40f]
push 0
push eax
mov byte [ebp - 0x410], 0
call fcn.00431920
add esp, 0xc
push 0
call fcn.0042a8e7
pop ecx
push 0xa
push esi
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x3414]
call fcn.0042b0d2
mov esi, dword [ebp - 0x341c]
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
lea ecx, [esi + 0x1d8]
call fcn.00403575
mov eax, dword [ebp - 0x3414]
mov dword [esi + 0x1d4], eax
jmp 0x410d53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x3440]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x3418], esp
push 0x25
push 0x448c74
call fcn.004081ed
lea edi, [ebp - 0x349c]
call fcn.00427366
and dword [ebp - 4], 0
call fcn.004273d9
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 0x10
jb 0x410c4e
mov eax, dword [eax + 4]
jmp 0x410c51
add eax, 4
push eax
push 1
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x3440]
call fcn.004035bd
lea esi, [ebp - 0x349c]
call fcn.00404654
push 0
call fcn.0042a8e7
or dword [ebp - 4], 0xffffffff
pop ecx
lea eax, [ebp - 0x3440]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x3418], esp
push 0x19
push str.ee__Rgri_v
call fcn.004081ed
lea edi, [ebp - 0x349c]
call fcn.00427366
mov dword [ebp - 4], 6
call fcn.004274a1
mov byte [ebp - 4], 7
cmp dword [eax + 0x18], 0x10
jb 0x410cc6
mov eax, dword [eax + 4]
jmp 0x410cc9
add eax, 4
mov ebx, dword [ebp - 0x341c]
push eax
push 1
call fcn.0040eded
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3440]
call fcn.004035bd
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x349c]
call fcn.00404654
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x410d0e
dec eax
dec eax
je 0x410d0e
sub eax, 4
je 0x410d0e
xor eax, eax
jmp 0x410d17
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
inc eax
dec eax
jne 0x410d31
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.0040a7e2
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x1f8]
push eax
lea ecx, [ebx + 0x1d8]
call fcn.004034e3
mov eax, dword [ebx + 0x1f4]
mov dword [ebx + 0x1d4], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428d2e
leave
ret