Function at 0x401445
Capabilities:
Check for time delay via gettickcount
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a33e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1064
call fcn.0040b1a0
push ebx
push esi
push edi
mov dword [esp + 0x38], 0x5f3efe09
mov dword [esp + 0x44], 0x4caf35fc
mov dword [esp + 0x48], 0x370830b3
mov dword [esp + 0x24], 0x68abbd98
mov dword [esp + 0x4c], 0x5047b96a
mov dword [esp + 0x18], 0x9ab31f1
mov dword [esp + 0x3c], 0x708747d8
mov dword [esp + 0x14], 0x232c2153
mov dword [esp + 0x34], 0x391e9dd9
mov dword [esp + 0x30], 0x125d2dd9
mov dword [esp + 0x2c], 0x5b563d62
mov dword [esp + 0x40], 0x113fa2fc
mov dword [esp + 0x28], 0x1e4a4687
mov dword [esp + 0x20], 0x5a6144d
mov dword [esp + 0x1c], 0x17292a97
mov dword [esp + 0x10], 0x2e1f4ba0
add dword [esp + 0x44], 0x6728a132
sub dword [esp + 0x48], 0x17fb61d1
add dword [esp + 0x44], 0x405cf8bd
sub dword [esp + 0x24], 0x700d5636
sub dword [esp + 0x38], 0x6b7567b0
add dword [esp + 0x48], 0x565b5924
sub dword [esp + 0x48], 0x34ebbc0c
mov eax, 0x28dc03d
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x4c], 0x50dea75b
mov eax, 0x65c41845
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, 0xb55e868
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x739c85bb
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x48], 0x3794524
mov eax, 0x1e01654a
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x24], 0x49e511f1
sub dword [esp + 0x38], 0x6d691a9a
add dword [esp + 0x34], 0x5f9990e6
mov eax, 0x131ba678
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x44], 0x61cc16b9
sub dword [esp + 0x2c], 0xe8c0683
add dword [esp + 0x18], 0xadfdf25
mov eax, 0x3c2d6bc0
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
add dword [esp + 0x3c], 0x897b4b6
sub dword [esp + 0x3c], 0x5500ef97
mov eax, 0xf23eb83
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
add dword [esp + 0x34], 0x612e4c51
sub dword [esp + 0x38], 0x710cf6bc
sub dword [esp + 0x28], 0x1e8b14cc
mov eax, 0x1c854510
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, 0x44197f9c
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
add dword [esp + 0x28], 0x2d90e7f9
mov eax, 0x2895f882
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x3c], 0x3b4101c2
sub dword [esp + 0x34], 0x237bbcb6
xor ebx, ebx
cmp dword [0x2da7014], 0x400
jne 0x4016fb
push ebx
lea eax, [esp + 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push ebx
lea eax, [esp + 0x74]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push ebx
push ebx
lea eax, [esp + 0x478]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
push ebx
mov dword [esp + 0x1080], ebx
call fcn.00401e1e
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.004017e0
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401b2a
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004018c0
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401b60
fstp st(0)
or dword [esp + 0x1084], 0xffffffff
add esp, 8
cmp dword [esp + 0x6c], 0x10
jb 0x4016fb
push dword [esp + 0x58]
call fcn.00401b50
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x207138
jg 0x401725
inc edi
cmp edi, 0x4f672
jl 0x401703
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp esi, 0x2b257f
jg 0x40173f
inc esi
cmp esi, 0x118bb
jl 0x401727
xor esi, esi
push ebx
lea eax, [esp + 0xc74]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp esi, 0x58bc1e
jle 0x40176e
cmp dword [esp + 0x50], 0x7a45e595
jne 0x401777
inc esi
cmp esi, 0xe154
jl 0x401741
mov eax, dword [0x4aaf2c]
mov dword [0x2da7014], eax
call fcn.004011d9
mov esi, 0x3078f
cmp dword [0x2da7014], 0x51f
jne 0x40179e
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
dec esi
jne 0x40178b
mov ecx, dword [esp + 0x1074]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10