Function at 0x10001200
Capabilities:
Extract resource via kernel32 functions
Get geographical location
Identify system language via api
Terminate process

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push ebp
mov ebp, esp
call sym.imp.kernel32.dll_GetLocaleInfoW
call sym.imp.kernel32.dll_CreateFileW
cmp ebx, edx
jne 0x100015be
mov edx, edx
je 0x100015be
sbb eax, dword [eax - 0x775291f3]
sti
je 0x100011ef
ret
pop es
cmp eax, 0xdb4861d1
mov edx, ecx
xchg ebx, eax
mov dh, 0xc7
xor dword [esi], edx
and esi, dword [ecx]
xchg ebp, eax
mov edx, 0x710b3c43
dec ebx
push edi
call sym.imp.kernel32.dll_GetTickCount
call sym.imp.kernel32.dll_QueryPerformanceCounter
call sym.imp.kernel32.dll_RtlUnwind
call sym.imp.kernel32.dll_InterlockedCompareExchange
call sym.imp.kernel32.dll_Sleep
call sym.imp.kernel32.dll_InterlockedExchange
call sym.imp.kernel32.dll_CreateFileA
cmp ebx, edx
jne 0x100012f5
mov esi, esi
mov esi, esi
je 0x100012f5
mov ch, 0x72
arpl dx, bx
mov dword [0xb87b8112], eax
mov esp, 0x495f0379
fistp word [esi]
adc al, dh
shl bh, cl
mov edi, 0x5250fbd7
dec esi
aam 0x5b
dec ebp
mov dword [0x25e73981], eax
lahf
cmp al, 0xfe
inc ebx
push ss
jnp 0x10001323
adc eax, 0xe6c9adb2
mov dh, 0x4d
lodsb al, byte [esi]
cwde
jl 0x10001252
mov ah, 3
push edi
xlatb
mov esp, 0x860c9923
out 0x71, al
cmp al, byte [0xc881f850]
ret 0xbfaa
call sym.imp.kernel32.dll_GetLastError
call sym.imp.kernel32.dll_FormatMessageA
call sym.imp.kernel32.dll_LocalFree
call sym.imp.kernel32.dll_GetFileSize
call sym.imp.kernel32.dll_CloseHandle
call sym.imp.kernel32.dll_GetTempPathA
call sym.imp.kernel32.dll_GetFileTime
call sym.imp.kernel32.dll_GetSystemTimeAsFileTime
call sym.imp.kernel32.dll_MoveFileA
call sym.imp.kernel32.dll_SetFileAttributesA
call sym.imp.kernel32.dll_GetProcessHeap
call sym.imp.kernel32.dll_GetModuleFileNameA
call sym.imp.kernel32.dll_GetVersionExA
call sym.imp.kernel32.dll_lstrcmpA
call sym.imp.kernel32.dll_lstrlenA
call sym.imp.kernel32.dll_CompareStringA
call sym.imp.kernel32.dll_GetShortPathNameA
cmp edx, eax
jne 0x1000139e
std
cld
invalid
mov ecx, ecx
je 0x1000139e
stc
push edi
sub byte [ebx + 0x79], ah
wait
invalid
call sym.imp.kernel32.dll_HeapFree
call sym.imp.kernel32.dll_HeapAlloc
call sym.imp.USER32.dll_MessageBoxA
call sym.imp.USER32.dll_LoadStringA
cmp eax, edi
jne 0x100015ad
mov edx, edx
mov edx, edx
je 0x100015ad
xchg byte [edx + 0x14], cl
int1
cmp byte [edi - 0x2e], dh
int3
call sym.imp.kernel32.dll_LoadResource
call sym.imp.kernel32.dll_SetLastError
call sym.imp.kernel32.dll_GetVersionExW
call sym.imp.kernel32.dll_UnmapViewOfFile
call sym.imp.kernel32.dll_GetSystemDefaultUILanguage
call sym.imp.kernel32.dll_GetUserDefaultUILanguage
call sym.imp.kernel32.dll_FindResourceW
call sym.imp.kernel32.dll_SearchPathW
call sym.imp.kernel32.dll_MultiByteToWideChar
call sym.imp.kernel32.dll_MapViewOfFile
call sym.imp.kernel32.dll_SetUnhandledExceptionFilter
call sym.imp.kernel32.dll_UnhandledExceptionFilter
cmp edx, eax
jne 0x1000149c
mov edx, edx
mov edx, edx
je 0x1000149c
rcr dh, 1
sub dh, ah
mov byte [0x23434d3c], bh
add al, 0xd6
sub eax, 0x5c02942f
loopne 0x10001474
adc dword [eax + 0xd], eax
or eax, 0x77b0c1d6
mov cl, 0xae
outsb dx, byte ss:[esi]
mov bh, 0xca
retf 0x225b
salc
fldenv [edi]
nop
mov edx, 0x1cb733cc
nop
sub esp, dword [edx]
popfd
lea edx, [edi - 0x46b602b3]
lodsd eax, dword [esi]
pop ds
sar byte [edx + 0x7b4c1fff], cl
les ebx, [esp + edx*8]
or dh, bl
test al, 0xcb
dec eax
invalid
call sym.imp.kernel32.dll_GetCurrentProcess
call sym.imp.kernel32.dll_TerminateProcess
cmp edx, ebp
jne 0x10001543
mov ebp, ebp
mov ebp, ebp
je 0x10001543
in al, 0xa1
xchg edi, eax
xchg ebp, eax
cmp dword [edx], esp
and dl, byte [ebx + 7]
sahf
add ch, 0x8b
stosb byte es:[edi], al
xlatb
invalid
call sym.imp.kernel32.dll_GetCurrentThreadId
cmp esi, edi
jne 0x1000126a
mov eax, eax
je 0x1000126a
popfd
int1
ja 0x10001538
enter 0x4cfc, 0x2a
mov bl, 0xa1
arpl word [ecx], ax
jae 0x10001588
aam 0x7c
test dword [esi], edi
pop ecx
mov dword [esi - 0x36], 0x646e1745
cmp ch, bh
xchg ecx, eax
or dword [edi], eax
mov al, 0xa3
dec ecx
dec edi
in al, dx
int1
mov dword [0xf1ec4f49], eax
and byte [edx - 0xa], ah
pop ss
not byte [edi]
pop eax
clc
sar dh, cl
mov edi, 0x1ce2a03a
call sym.imp.kernel32.dll_GetCurrentProcessId
cmp edx, esi
jne 0x100014fc
mov edx, edx
je 0x100014fc
push ss
lea edx, [ebx + ecx*2 + 0x48]
ljmp 0x93f6
cmc
inc ebp
dec esp
jo 0x100015b8
sahf
out dx, eax
sub byte [esp + ebp*4], al
sbb eax, 0xe7a86901
mov bh, 0x55
mov byte [ecx + edx*4], bh
xor al, 0x95
jge 0x10001531
add byte [edi - 0x19b0751b], 0xef
adc ecx, ecx
salc
pop esp
and eax, 0xfb2ae8f5
invalid
call sym.imp.ole32.dll_CoCreateInstance
call sym.imp.ole32.dll_CoUninitialize
call sym.imp.ole32.dll_CoInitialize
pop ebp
ret
sbb al, 0xfb
invalid
call sym.imp.kernel32.dll_CreateFileMappingW
call sym.imp.kernel32.dll_FreeLibrary
call sym.imp.kernel32.dll_LoadLibraryExW
call sym.imp.kernel32.dll_FindResourceExW
cmp eax, edx
jne 0x100013fd
mov ebx, ebx
mov ebx, ebx
je 0x100013fd
dec ebx
dec eax
xchg dh, dl
popfd
add dword [esi - 0x24f15c6], ebp
ljmp 0xa97e