Function at 0x40158a
Capabilities:
Check for time delay via gettickcount
Get common file path
Get geographical location
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x431237
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2074
call fcn.0040c280
push ebx
push esi
push edi
mov dword [esp + 0x54], 0x53cd5dab
mov dword [esp + 0x4c], 0x31d30d07
mov dword [esp + 0x24], 0x7bcca6d8
mov dword [esp + 0x48], 0x252b20ea
mov dword [esp + 0x14], 0x67518adb
mov dword [esp + 0x10], 0x1ece51a3
mov dword [esp + 0x38], 0x4536f12d
mov dword [esp + 0x18], 0x27ac0f40
mov dword [esp + 0x40], 0x61ac39ed
mov dword [esp + 0x3c], 0x3272b32e
mov dword [esp + 0x20], 0x4390d5aa
mov dword [esp + 0x2c], 0x2b1214bb
mov dword [esp + 0x1c], 0x4bb6f72c
mov dword [esp + 0x30], 0x7976af9f
mov dword [esp + 0x5c], 0x1f2fc7df
mov dword [esp + 0x34], 0x16de1ada
mov dword [esp + 0x50], 0x6f8f3308
mov dword [esp + 0x44], 0x5ddceb1c
mov dword [esp + 0x28], 0x5fe2f1ca
mov dword [esp + 0x58], 0x2580f09c
add dword [esp + 0x4c], 0x1c26e3d3
sub dword [esp + 0x54], 0x6ccb2806
add dword [esp + 0x4c], 0x116a76e5
mov eax, 0x2291d5c9
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, 0x5974392a
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x24], 0x1d96eb7b
sub dword [esp + 0x24], 0xffd4c52
mov eax, 0x25ccaea4
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
add dword [esp + 0x48], 0x32cdbb26
mov eax, 0x6df74282
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x24], 0x387628af
add dword [esp + 0x14], 0x5504977a
mov eax, 0x7ec0a480
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, 0xf11f132
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
add dword [esp + 0x10], 0x58a372d5
sub dword [esp + 0x24], 0x7feb6f31
sub dword [esp + 0x40], 0x30e92472
add dword [esp + 0x3c], 0x39478f62
mov eax, 0x760ddf62
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x2c], 0x49657a9b
add dword [esp + 0x2c], 0x5011797f
mov eax, 0x1e10a085
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, 0x5b708f73
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], 0x60c3f124
add dword [esp + 0x54], 0x6b3fc6c5
mov eax, 0xbf04a71
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
add dword [esp + 0x14], 0x73b11890
mov eax, 0x786e149f
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
add dword [esp + 0x44], 0x275b075b
mov eax, 0x5151d170
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
xor ebx, ebx
cmp dword [0x1a2a1c4], 0x400
jne 0x40185c
push ebx
lea eax, [esp + 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push ebx
lea eax, [esp + 0xc84]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push ebx
push ebx
lea eax, [esp + 0x1888]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
lea eax, [esp + 0x1480]
push eax
push ebx
push str.nojikesaramumositeheyayopamowad_buladorid_bugitojofahebuto_rirukavafinefanovecinozoyo_zaweletawevibizonunu
push str.pinomagosetirazusajenadagusas_vobepivituba
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebx
push str.dewinatutegoyacatoxusivelesexuh
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
push ebx
push ebx
mov dword [esp + 0x2094], ebx
call fcn.00401e8b
push ebx
push ebx
push ebx
call fcn.0040245a
add esp, 0xc
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401bb0
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.0040213a
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00402170
fstp st(0)
or dword [esp + 0x2094], 0xffffffff
add esp, 8
cmp dword [esp + 0x7c], 0x10
jb 0x40185c
push dword [esp + 0x68]
call fcn.00402160
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, 0x207138
jg 0x401886
inc edi
cmp edi, 0x4f672
jl 0x401864
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp esi, 0x2b157b
jg 0x4018a0
inc esi
cmp esi, 0x116bd
jl 0x401888
xor esi, esi
push ebx
lea eax, [esp + 0x1884]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc1e
jle 0x4018cd
cmp dword [esp + 0x60], 0x7a45e595
jne 0x4018d6
inc esi
cmp esi, 0xe154
jl 0x4018a2
mov eax, dword [0x440d8c]
mov dword [0x1a2a1c4], eax
call fcn.0040126c
mov esi, 0x3078f
cmp dword [0x1a2a1c4], 0x51f
jne 0x401906
push ebx
lea eax, [esp + 0x84]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
dec esi
jne 0x4018ea
mov ecx, dword [esp + 0x2084]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10