Function at 0x4015ed
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Get geographical location
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45ec57
push eax
mov dword fs:[0], esp
sub esp, 0xc78
push ebx
push esi
push edi
mov dword [esp + 0x58], 0x328d3878
mov dword [esp + 0x24], 0x2523dd1e
mov dword [esp + 0x40], 0x21307855
mov dword [esp + 0x20], 0x672ea8fa
mov dword [esp + 0x34], 0x4761876
mov dword [esp + 0x2c], 0x40fa9378
mov dword [esp + 0x4c], 0x47733440
mov dword [esp + 0x18], 0x156c28ae
mov dword [esp + 0x50], 0x5433e283
mov dword [esp + 0x44], 0x3749241f
mov dword [esp + 0x48], 0x10d349db
mov dword [esp + 0x54], 0x2349306c
mov dword [esp + 0x1c], 0x6c8ebbf
mov dword [esp + 0x38], 0x54fd690e
mov dword [esp + 0x10], 0x56ad2bed
mov dword [esp + 0x30], 0x7a196881
mov dword [esp + 0x28], 0x59187543
mov dword [esp + 0x14], 0x1b7f058
mov dword [esp + 0x3c], 0x5ba95b85
sub dword [esp + 0x58], 0x7ccf609f
mov eax, 0x2ba11503
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x12808ccd
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
sub dword [esp + 0x40], 0x12e5929c
sub dword [esp + 0x34], 0x9c25915
sub dword [esp + 0x24], 0x47a1bfbd
sub dword [esp + 0x40], 0x2842ac9
sub dword [esp + 0x58], 0x610d82d9
mov eax, 0x79d6fb54
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
add dword [esp + 0x4c], 0x19f8cb55
mov eax, 0x2d6c5cce
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x24], 0x34be3447
mov eax, 0x44d75561
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x624fde5b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x58], 0xed2dabb
sub dword [esp + 0x44], 0x7e3a5591
mov eax, 0x43237d36
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x34], 0x4771ff42
sub dword [esp + 0x44], 0x56f129ec
sub dword [esp + 0x1c], 0x41e1947e
mov eax, 0x3816ab6f
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, 0x38f235a9
mul dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add dword [esp + 0x44], 0x35957de7
sub dword [esp + 0x1c], 0x20e00206
mov eax, 0x6a29d5c6
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
add dword [esp + 0x48], 0x7f736a21
sub dword [esp + 0x54], 0x73a23c8e
mov eax, 0x57ff1c72
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x34], 0x67efe02a
sub dword [esp + 0x30], 0x19343085
sub dword [esp + 0x18], 0x2a647022
xor ebx, ebx
cmp dword [0x1a54fac], 0x400
jne 0x4018d2
push ebx
push ebx
push ebx
lea eax, [esp + 0x68]
push eax
push ebx
push ebx
push ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
lea eax, [esp + 0x84]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push str.vehigi
push str.felolamoriw
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push ebx
push str.libaworus
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
push ebx
mov dword [esp + 0xc90], ebx
call fcn.00401eb2
pop ecx
push ebx
call fcn.00402202
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401a80
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004024f0
fstp st(0)
push ebx
call fcn.004027d7
add esp, 0xc
push ebx
call fcn.00402627
pop ecx
push ebx
push ebx
call fcn.00401d57
push ebx
call fcn.00402627
pop ecx
mov eax, esp
mov dword [eax], ebx
push ecx
mov dword [eax + 4], ebx
push ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401030
fstp st(0)
or dword [esp + 0xc8c], 0xffffffff
cmp dword [esp + 0x7c], 0x10
jb 0x4018d2
push dword [esp + 0x68]
call fcn.004024d7
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x207138
jg 0x4018fa
inc edi
cmp edi, 0x4f672
jl 0x4018da
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp edi, 0x2b157b
jg 0x401914
inc edi
cmp edi, 0x116bd
jl 0x4018fc
xor edi, edi
push ebx
lea eax, [esp + 0x84]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58bc14
jle 0x401943
cmp dword [esp + 0x60], 0x7a45f535
jne 0x40194c
inc edi
cmp edi, 0xe154
jl 0x401916
mov eax, dword [0x46bb6c]
mov dword [0x1a54fac], eax
call fcn.00401299
mov esi, 0x3078f
cmp dword [0x1a54fac], 0x51f
jne 0x40197c
push ebx
lea eax, [esp + 0x484]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
dec esi
jne 0x401960
mov ecx, dword [esp + 0xc84]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10