Function at 0x401520
Capabilities:
Encode data using xor
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov ecx, dword [ebp - 8]
push edx
push ebx
push 8
push 0xef
call fcn.00401060
add esp, 8
pop ebx
pop edx
push edx
push ebx
push 0xb5
push 0xd8
call fcn.00401480
add esp, 8
pop ebx
pop edx
push edx
push ebx
push 0x8b
push 0xd0
call fcn.00401480
add esp, 8
pop ebx
pop edx
sub dword [0x405074], eax
push edx
push ebx
push 0xc8
call fcn.004012b0
add esp, 4
pop ebx
pop edx
add dword [0x405026], eax
push edx
push ebx
push 0x66
call fcn.004014e0
add esp, 4
pop ebx
pop edx
test edi, edi
jl 0x4015c2
xor dword [ebp - 0x34], edi
sub edi, edx
xor edi, dword [ebp - 0x34]
sub esi, edx
mov dword [0x4050e4], esi
push edx
push ebx
push 0x45
call sub.user32.dll_GetSystemMetrics
pop ebx
pop edx
mov esi, dword [0x4050e8]
mov edi, ebp
mov esi, ebx
mov edx, section..data_1
xor ebx, ebx
mov ecx, dword [0x4050ec]
push edx
push ebx
push 0x38
call sub.user32.dll_GetSystemMetrics
pop ebx
pop edx
push edx
push ebx
push 0xdc
call fcn.004012b0
add esp, 4
pop ebx
pop edx
mov edi, ecx
push edx
push ebx
push 0x64
call fcn.00401000
add esp, 4
pop ebx
pop edx
push edx
push ebx
push 0x4050f0
call sub.kernel32.dll_GetLocalTime
pop ebx
pop edx
add dword [edx + ebx*4], 0xf8b7cd31
push edx
push ebx
push 0
push 0
push 0xe8
push 0xe7
call sub.kernel32.dll_GetLocaleInfoA
pop ebx
pop edx
mov dword [ebp - 0x1c], esi
mov edi, dword [0x405106]
mov eax, ebp
test ebx, ebx
jp 0x4016c6
sub eax, ebx
push edx
push ebx
push 0x32
push 0x40510a
push 0x3b
push 0
call sub.user32.dll_LoadStringA
pop ebx
pop edx
mov dword [0x40513c], esi
mov dword [ebp - 0x14], esi
xor eax, ecx
xor ecx, ecx
add edi, dword [section..data]
push ecx
push edx
push ebx
push 0
push 0
push 0x5a
push 0xea
call sub.kernel32.dll_GetLocaleInfoA
pop ebx
pop edx
pop ecx
push ecx
push edx
push ebx
push 0x8f
call sub.user32.dll_GetSystemMetrics
pop ebx
pop edx
pop ecx
push ecx
push edx
push ebx
push 0x405140
call sub.kernel32.dll_GetSystemTime
pop ebx
pop edx
pop ecx
mov dword [ebp - 0xc], esi
add ecx, 1
cmp ecx, 0xa4c
jb 0x401670
jmp 0x4016ef
push edx
push ebx
push 0xbf
call fcn.004012b0
add esp, 4
pop ebx
pop edx
mov ecx, dword [0x405156]
mov dword [ebp - 8], eax
add dword [0x405078], eax
xor edi, dword [ebp - 0x14]
mov eax, dword [0x40510a]
add ebx, 1
cmp ebx, 0x72a
jb 0x401619
push 0x32
push 0x40515a
push 0x2f
push 0
call sub.user32.dll_LoadStringA
mov eax, edi
push 0xfe
call fcn.004012b0
add esp, 4
mov dword [0x405078], ebx
mov dword [0x405080], eax
mov esi, ebx
leave
sub ecx, dword [0x40518c]
mov esi, esp
mov dword [0x405074], edi
mov edx, dword [0x405190]
xor ebx, ebx
xor esi, esp
xor ecx, dword [0x4050f0]
mov ecx, edi
xor dword [0x4050f0], esi
add ebx, 1
cmp ebx, 0x716
jb 0x401745
push eax
push 0x65
push 0xd9
call fcn.00401060
add esp, 8
pop eax
mov eax, 0x407a62
mov dword [0x405004], ecx
sub esi, eax
add ecx, ebp
sub ebx, ebp
push eax
push 0xf0
push 0xab
call fcn.00401060
add esp, 8
pop eax
push eax
push 0x405194
call sub.kernel32.dll_GetSystemTime
pop eax
push eax
sub edx, dword [0x405074]
sub ecx, esp
mov dword [0x4050f0], edi
push eax
push 0xf3
call fcn.004014e0
add esp, 4
pop eax
mov edx, esi
mov ebx, ecx
ret 4