Function at 0x406de0
Capabilities:
Get file attributes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bacb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x528
mov dword [ebp - 0x510], 0x430b50
mov eax, dword [ebp - 0x510]
add eax, 1
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x510]
mov dl, byte [ecx]
mov byte [ebp - 0x515], dl
add dword [ebp - 0x510], 1
cmp byte [ebp - 0x515], 0
jne 0x406e17
mov eax, dword [ebp - 0x510]
sub eax, dword [ebp - 0x514]
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0x117a58
jne 0x406eea
cmp dword [0x4d5f514], 0xc8b
jne 0x406e7b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x403708
push 0x403710
push 0x430b50
call fcn.0040b379
add esp, 0xc
push 0x403728
push 0x40372c
call fcn.0040b7e1
add esp, 8
mov dword [ebp - 0x98], eax
push 3
lea ecx, [ebp - 0xe4]
call fcn.00407a30
mov dword [ebp - 4], 0
push 1
push 3
lea ecx, [ebp - 0x94]
call fcn.00408340
lea ecx, [ebp - 0x94]
call fcn.00407200
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4]
call fcn.00407ab0
mov ecx, dword [0x42fea8]
mov dword [0x4d5f514], ecx
mov dword [ebp - 0x520], 0x430b50
mov edx, dword [ebp - 0x520]
add edx, 1
mov dword [ebp - 0x524], edx
mov eax, dword [ebp - 0x520]
mov cl, byte [eax]
mov byte [ebp - 0x525], cl
add dword [ebp - 0x520], 1
cmp byte [ebp - 0x525], 0
jne 0x406f0f
mov edx, dword [ebp - 0x520]
sub edx, dword [ebp - 0x524]
mov dword [ebp - 0x52c], edx
cmp dword [ebp - 0x52c], 0xd27
jne 0x406f93
cmp dword [0x4d5f514], 0x1286
jne 0x406f7a
push 0
call sub.KERNEL32.dll_GetSystemPowerStatus
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
call dword [sym.imp.KERNEL32.dll_GetACP]
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.004053e0
fstp st(0)
mov dword [ebp - 0xe8], 0
jmp 0x406fae
mov eax, dword [ebp - 0xe8]
add eax, 1
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x66d056
jge 0x406fd8
cmp dword [ebp - 0xe8], 0x656671
jne 0x406fd6
push 0x403734
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4d3c5bc], eax
jmp 0x406f9f
mov ecx, dword [0x4d5f514]
add ecx, 0xb2d3b
mov dword [0x4d5f514], ecx
mov dword [ebp - 0xec], 0
jmp 0x407005
mov edx, dword [ebp - 0xec]
add edx, 1
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0xec]
cdq
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x530], edx
cmp dword [ebp - 0x530], 0xd
jg 0x407045
jl 0x40702f
cmp dword [ebp - 0x534], 0x4fe88704
jae 0x407045
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [ebp - 0xec], 0x279ce1b5
jle 0x407043
jmp 0x407045
jmp 0x406ff6
mov eax, dword [0x403744]
mov dword [0x430b50], eax
mov ecx, dword [0x403748]
mov dword [0x430b54], ecx
mov edx, dword [0x40374c]
mov dword [0x430b58], edx
mov ax, word [0x403750]
mov word [0x430b5c], ax
mov cl, byte [0x403752]
mov byte [0x430b5e], cl
call fcn.00406d60
mov edx, dword [0x42f888]
mov dword [0x4dcd66c], edx
mov dword [ebp - 0xfc], 0
jmp 0x4070ab
mov eax, dword [ebp - 0xfc]
add eax, 1
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0xfc]
cmp ecx, dword [0x4d5f514]
jae 0x4070d3
mov edx, dword [ebp - 0xfc]
push edx
mov edx, dword [0x4dcd66c]
mov ecx, dword [0x4d3c5b8]
call fcn.00405750
jmp 0x40709c
mov dword [ebp - 0x100], 0
jmp 0x4070ee
mov eax, dword [ebp - 0x100]
add eax, 1
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x10a9
jge 0x407155
cmp dword [ebp - 0x100], 0x1a6
jne 0x40710b
call fcn.00406d90
mov ecx, dword [ebp - 0x100]
add ecx, dword [0x4d5f514]
cmp ecx, 0x5e
jne 0x407153
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
lea edx, [ebp - 0x504]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
jmp 0x4070df
push 0x42f890
mov edx, dword [0x4d5f514]
mov ecx, dword [0x4d3c5b8]
call fcn.00405690
mov dword [ebp - 0x508], 0
jmp 0x407186
mov eax, dword [ebp - 0x508]
add eax, 1
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0x356d83
jge 0x4071ab
cmp dword [ebp - 0x508], 0x59d8
jne 0x4071a9
mov ecx, dword [0x4d3c5b8]
call fcn.00405730
jmp 0x407177
mov dword [ebp - 0x50c], 0
jmp 0x4071c6
mov ecx, dword [ebp - 0x50c]
add ecx, 1
mov dword [ebp - 0x50c], ecx
cmp dword [ebp - 0x50c], 0x7b
jge 0x4071df
cmp dword [ebp - 0x50c], 0x79
jne 0x4071dd
call fcn.00406d80
jmp 0x4071b7
mov edx, dword [0x4d3c5b8]
mov dword [0x4d5f508], edx
call dword [0x4d5f508]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret