Function at 0x402320
Capabilities:
Contain obfuscated stackstrings
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc4c
call fcn.00401a70
mov edx, 0xa
mov dword [ebp - 0xc1e], 0x206f6f66
mov dword [ebp - 0xc3c], eax
lea eax, [ebp - 0x40c]
mov dword [ebp - 0xc1a], 0xd726162
mov dword [ebp - 0xc16], 0xd0d0d0a
mov dword [ebp - 0xc12], 0x7261620a
mov word [ebp - 0xc0e], dx
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x58
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x4023a7
mov ebx, dword [ebp - 0x400]
shr ebx, 0x1b
and ebx, 1
lea eax, [ebp - 0xc1e]
mov dword [esp + 8], 0
mov esi, dword [sym.imp.user32.dll_SendMessageA]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xc
mov edi, dword [ebp - 0xc3c]
mov dword [esp], edi
mov dword [ebp - 0xc40], esi
call esi
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xba
mov dword [esp], edi
call esi
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0xc38], eax
sub esp, 0x10
cmp eax, 4
je 0x402800
mov eax, 0xbbbbbbbb
mov ecx, 0x100
lea edi, [ebp - 0x80c]
xor ebx, 1
rep stosd dword es:[edi], eax
mov eax, ebx
mov dword [ebp - 0xc28], 0x40b980
mov dword [ebp - 0xc24], 0
and eax, 1
mov byte [ebp - 0xc41], al
lea esi, [esi]
nop
mov eax, dword [ebp - 0xc28]
mov esi, dword [eax]
mov eax, dword [ebp - 0xc38]
cmp esi, eax
jge 0x402630
mov eax, dword [ebp - 0xc2c]
test eax, eax
je 0x402670
mov eax, dword [ebp - 0xc28]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x402670
mov dword [esp + 4], eax
lea eax, [ebp - 0x40c]
lea edi, [ebp - 0xc0c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strcpy]
mov eax, dword [ebp - 0xc28]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strlen]
mov ecx, dword [ebp - 0xc2c]
cmp ebx, eax
mov edx, eax
cmovbe edx, ebx
xor ecx, 1
add eax, ecx
mov ecx, 0x100
cmp ebx, eax
mov dword [ebp - 0xc34], edx
cmovbe eax, ebx
mov dword [ebp - 0xc30], eax
mov eax, 0xbbbbbbbb
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc0c]
mov word [ebp - 0xc0c], bx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xc4
mov eax, dword [ebp - 0xc3c]
mov dword [esp], eax
mov eax, dword [ebp - 0xc40]
call eax
sub esp, 0x10
mov esi, eax
call fcn.00406c60
mov edx, dword [ebp - 0xc34]
mov dword [eax], 0x40a147
mov dword [eax + 4], 0x1b5
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
mov eax, dword [ebp - 0xc24]
mov dword [esp + 4], str._d:__d__d_n
mov dword [esp + 8], eax
xor eax, eax
cmp edx, esi
sete al
mov dword [esp], eax
call fcn.004017f0
test ebx, ebx
je 0x402680
cmp ebx, 1
je 0x402750
call fcn.00406c60
mov esi, dword [sym.imp.msvcrt.dll_strncmp]
mov dword [eax], 0x40a147
mov edi, dword [ebp - 0xc30]
mov dword [eax + 4], 0x1c0
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
lea eax, [ebp - 0xc0c]
mov dword [esp + 8], edi
mov dword [esp], eax
call esi
mov dword [esp + 0xc], edi
mov ecx, dword [ebp - 0xc24]
test eax, eax
mov dword [esp + 4], str._d:_expected_bytes_written_d_n
sete al
mov dword [esp + 8], ecx
movzx eax, al
mov dword [esp], eax
call fcn.004017f0
cmp byte [ebp - 0xc41], 0
jne 0x4026e0
cmp ebx, edi
je 0x4026e0
call fcn.00406c60
mov dword [eax], 0x40a147
mov ecx, dword [ebp - 0xc30]
mov dword [eax + 4], 0x1c7
xor eax, eax
cmp byte [ebp + ecx - 0xc0c], 0
je 0x402790
mov edx, dword [ebp - 0xc30]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xc24]
mov dword [esp + 4], str._d:_expected_bytes_written_d_n
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.004017f0
lea esi, [esi]
nop
add dword [ebp - 0xc24], 1
mov eax, dword [ebp - 0xc24]
add dword [ebp - 0xc28], 0x10
cmp eax, 8
jne 0x402450
mov eax, dword [ebp - 0xc3c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_DestroyWindow]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0xc28]
mov eax, dword [eax + 8]
jmp 0x402485
call fcn.00406c60
xor edx, edx
mov dword [eax], 0x40a147
mov dword [eax + 4], 0x1b9
movzx eax, byte [ebp - 0xc0c]
or al, byte [ebp - 0xc0b]
jne 0x4026cb
lea eax, [ebp - 0x80a]
mov dword [esp + 8], 0x3fe
mov dword [esp + 4], eax
lea eax, [ebp - 0xc0a]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strncmp]
xor edx, edx
test eax, eax
sete dl
mov dword [esp + 4], str.buffer_len0_n
mov dword [esp], edx
call fcn.004017f0
jmp 0x402630
call fcn.00406c60
mov dword [eax], 0x40a147
mov ebx, dword [ebp - 0xc30]
mov dword [eax + 4], 0x1c3
mov eax, 0x400
sub eax, ebx
mov dword [esp + 8], eax
lea eax, [ebp - 0x80c]
add eax, ebx
mov dword [esp + 4], eax
lea eax, [ebp - 0xc0c]
add eax, ebx
mov dword [esp], eax
call esi
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp - 0xc24]
test eax, eax
mov dword [esp + 4], str._d:_expected_bytes_written_d_n
sete al
mov dword [esp + 8], ecx
movzx eax, al
mov dword [esp], eax
call fcn.004017f0
jmp 0x402630
call fcn.00406c60
mov dword [eax], 0x40a147
mov dword [eax + 4], 0x1bc
xor eax, eax
movzx ecx, byte [ebp - 0x40c]
cmp byte [ebp - 0xc0c], cl
je 0x4027c8
mov dword [esp + 4], str.buffer_len1_n
mov dword [esp], eax
call fcn.004017f0
jmp 0x402630
mov eax, 0x3ff
lea edx, [ecx + 1]
sub eax, ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0x80c]
add eax, edx
mov dword [esp + 4], eax
lea eax, [ebp - 0xc0c]
add eax, edx
mov dword [esp], eax
call esi
test eax, eax
sete al
movzx eax, al
jmp 0x402604
cmp byte [ebp - 0xc0b], 0
jne 0x402773
lea eax, [ebp - 0x80a]
mov dword [esp + 8], 0x3fe
mov dword [esp + 4], eax
lea eax, [ebp - 0xc0a]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
sete al
movzx eax, al
jmp 0x402773
call fcn.00406c60
mov dword [eax], 0x40a147
mov dword [eax + 4], 0x199
mov dword [esp], str.Win9x__WinME_and_NT4_handle__r_only_differently_n
call fcn.004020f0
mov dword [ebp - 0xc2c], 1
jmp 0x402414