Function at 0x401074
Capabilities:
Extract resource via kernel32 functions
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1088
call fcn.0040b8f0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
xor ebx, ebx
cmp dword [0x4bb9bc], 0x134
push edi
mov edi, dword [eax + 4]
jne 0x4010e3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea eax, [ebp - 0x884]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
cmp dword [0x4bb9bc], 0x114e
mov dword [ebp - 8], ebx
jne 0x401107
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
lea eax, [ebp - 0x484]
push eax
push ebx
call sub.KERNEL32.dll_VerLanguageNameA
mov eax, dword [0x4383e8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4383ec]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x20], 0x9e3779b9
call fcn.0040106a
add dword [ebp - 8], 0x54
cmp dword [0x4bb9bc], 0xb54
jne 0x401174
lea eax, [ebp - 0x84]
push eax
push str.derivinixiwo
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
push str.mugefozujihemizi_payocilobibewumuhavuzobaj
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EraseTape]
push ebx
lea eax, [ebp - 0x1084]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov eax, dword [0x4383f0]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4383f4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, esi
lea ecx, [ebp - 0xc]
call fcn.00401046
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [0x4bb9bc]
cmp eax, 0xfa9
jne 0x4011bc
mov dword [0x4b098c], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4011d9
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x4ad784], ebx
mov ecx, dword [ebp - 0x10]
mov eax, esi
shr eax, cl
mov ecx, dword [ebp - 0x1c]
mov dword [0x4b0988], 0x9150ce2e
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
call fcn.00401071
mov eax, dword [ebp - 8]
add eax, esi
push eax
mov eax, dword [ebp - 0xc]
call fcn.00401063
mov ecx, dword [ebp - 0x14]
xor ecx, eax
mov dword [ebp - 0xc], eax
sub edi, ecx
and eax, 0x5dc052bb
mov eax, edi
lea ecx, [ebp - 0xc]
call fcn.00401046
mov ecx, dword [ebp - 0x28]
mov eax, edi
shr eax, 5
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
call fcn.00401071
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
add eax, edi
push eax
mov eax, dword [ebp - 0xc]
add eax, ecx
call fcn.00401063
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.0040104c
sub esi, dword [ebp - 0xc]
mov dword [0x455140], ebx
mov eax, dword [ebp - 0x20]
sub dword [ebp - 8], eax
dec dword [ebp - 0x18]
jne 0x40118b
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
pop esi
pop ebx
leave
ret 4