Function at 0x4015cd
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount
Get common file path
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4279e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2064
call fcn.0040c420
push ebx
push esi
push edi
mov dword [esp + 0x4c], 0xf3c5330
mov dword [esp + 0x38], 0x3b75bfba
mov dword [esp + 0x14], 0x1c51a43b
mov dword [esp + 0x18], 0x1779cab
mov dword [esp + 0x34], 0x17e64f24
mov dword [esp + 0x3c], 0x5624055a
mov dword [esp + 0xc], 0x2576165d
mov dword [esp + 0x30], 0x6a533323
mov dword [esp + 0x10], 0xea150a0
mov dword [esp + 0x24], 0x493b78fc
mov dword [esp + 0x44], 0x7a7fad6c
mov dword [esp + 0x40], 0x561dcf9d
mov dword [esp + 0x1c], 0x4c78adb1
mov dword [esp + 0x48], 0x72ab3459
mov dword [esp + 0x2c], 0x3976269a
mov dword [esp + 0x20], 0x341ecb75
mov dword [esp + 0x28], 0x456aea96
mov eax, 0x61943193
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
mov eax, 0x70b3eb01
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x14], 0x31964cbb
mov eax, 0x56d780d9
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub dword [esp + 0x38], 0x4caa51e8
sub dword [esp + 0x30], 0x1ce6adf
add dword [esp + 0x18], 0x7817183c
sub dword [esp + 0x4c], 0x5ecfc96f
sub dword [esp + 0x34], 0x41afddf6
add dword [esp + 0x3c], 0x44e7eb54
mov eax, 0x3caeb853
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add dword [esp + 0x38], 0x229fa79f
mov eax, 0x29cf4fb4
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x38], 0x3b39fcbb
sub dword [esp + 0x14], 0x7f4928a6
mov eax, 0xe2de19a
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, 0x49b5f337
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
sub dword [esp + 0x44], 0x46db133b
add dword [esp + 0x14], 0x2d3025d3
mov eax, 0x7d5b55c6
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub dword [esp + 0xc], 0x77d9679f
add dword [esp + 0x1c], 0x401cfec2
sub dword [esp + 0x30], 0x7f053d7e
mov eax, 0x21b4d10b
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x4a939d08
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x24], 0x4ce728e6
sub dword [esp + 0x18], 0x48ca7784
sub dword [esp + 0x48], 0x2960da57
add dword [esp + 0x38], 0x665a4564
sub dword [esp + 0x10], 0x692724a6
mov eax, 0x6415f74b
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, 0x3c6f5ad7
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, 0x318e2697
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor ebx, ebx
cmp dword [0x1a2020c], 0x400
jne 0x4018ee
push ebx
lea eax, [esp + 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push ebx
lea eax, [esp + 0xc74]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push ebx
push ebx
lea eax, [esp + 0x1878]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
lea eax, [esp + 0x1470]
push eax
push ebx
push str.xudisopozifuro_citoyogizaretusope_nirerugakiyezumosohajo_lakiwacuzube_kucupuvufukax
push str.lidetuhowayipuvoyuzamusub_yeresanuhuhazusuxusoboduguwed
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebx
push str.hexufutarojizizacekalumici
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
push ebx
mov dword [esp + 0x2080], ebx
call fcn.004023aa
pop ecx
push ebx
call fcn.00402702
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401a90
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401c50
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004028ca
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401d80
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00402900
fstp st(0)
push ebx
call fcn.00402d10
add esp, 0xc
push ebx
call fcn.00402b60
pop ecx
push ebx
push ebx
call fcn.0040224f
push ebx
push ebx
call fcn.00402024
pop ecx
pop ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401030
or dword [esp + 0x207c], 0xffffffff
fstp st(0)
cmp dword [esp + 0x6c], 0x10
jb 0x4018ee
push dword [esp + 0x58]
call fcn.004028f0
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x207138
jg 0x401918
inc edi
cmp edi, 0x4f672
jl 0x4018f6
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp esi, 0x2b157b
jg 0x401932
inc esi
cmp esi, 0x116bd
jl 0x40191a
xor esi, esi
push ebx
lea eax, [esp + 0x1874]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc14
jle 0x40195f
cmp dword [esp + 0x50], 0x7a45f535
jne 0x401968
inc esi
cmp esi, 0xe154
jl 0x401934
mov eax, dword [0x436dbc]
mov dword [0x1a2020c], eax
call fcn.0040128e
mov esi, 0x3078f
cmp dword [0x1a2020c], 0x51f
jne 0x401995
push ebx
lea eax, [esp + 0x74]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
dec esi
jne 0x40197c
mov ecx, dword [esp + 0x2074]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10