Function at 0x40158f
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get common file path
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x427967
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1c70
call fcn.0040c3d0
push ebx
push esi
mov dword [esp + 0x48], 0x328d3878
mov dword [esp + 0x20], 0x2523dd1e
mov dword [esp + 0x34], 0x21307855
mov dword [esp + 0x14], 0x672ea8fa
mov dword [esp + 0x30], 0x4761876
mov dword [esp + 0x28], 0x40fa9378
mov dword [esp + 0x40], 0x47733440
mov dword [esp + 0xc], 0x156c28ae
mov dword [esp + 0x3c], 0x5433e283
mov dword [esp + 0x44], 0x3749241f
mov dword [esp + 0x54], 0x10d349db
mov dword [esp + 0x4c], 0x2349306c
mov dword [esp + 0x18], 0x6c8ebbf
mov dword [esp + 0x2c], 0x54fd690e
mov dword [esp + 0x50], 0x56ad2bed
mov dword [esp + 0x24], 0x7a196881
mov dword [esp + 0x1c], 0x59187543
mov dword [esp + 0x10], 0x1b7f058
mov dword [esp + 0x38], 0x5ba95b85
sub dword [esp + 0x48], 0x7ccf609f
mov eax, 0x2ba11503
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x12808ccd
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x34], 0x12e5929c
sub dword [esp + 0x30], 0x9c25915
sub dword [esp + 0x20], 0x47a1bfbd
sub dword [esp + 0x34], 0x2842ac9
sub dword [esp + 0x48], 0x610d82d9
mov eax, 0x79d6fb54
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x40], 0x19f8cb55
mov eax, 0x2d6c5cce
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x20], 0x34be3447
mov eax, 0x44d75561
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x624fde5b
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x48], 0xed2dabb
sub dword [esp + 0x44], 0x7e3a5591
mov eax, 0x43237d36
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x30], 0x4771ff42
sub dword [esp + 0x44], 0x56f129ec
sub dword [esp + 0x18], 0x41e1947e
mov eax, 0x3816ab6f
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
mov eax, 0x38f235a9
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add dword [esp + 0x44], 0x35957de7
sub dword [esp + 0x18], 0x20e00206
mov eax, 0x6a29d5c6
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x54], 0x7f736a21
sub dword [esp + 0x4c], 0x73a23c8e
mov eax, 0x57ff1c72
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x30], 0x67efe02a
sub dword [esp + 0x24], 0x19343085
sub dword [esp + 0xc], 0x2a647022
xor ebx, ebx
cmp dword [0x1a2020c], 0x400
jne 0x4018a5
push ebx
lea eax, [esp + 0x107c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push ebx
lea eax, [esp + 0x87c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push ebx
push ebx
lea eax, [esp + 0x80]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
lea eax, [esp + 0x1478]
push eax
push ebx
push str.cegekeseroharupajatizijiyimagumipimazivagaxibejogomeyodiziveruxinalezixusipeconohah
push str.ramodavekufazihodejexedexosevimexahovokusadaxedepigujeg
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
push str.hexufutarojizizacekalumici
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
push ebx
mov dword [esp + 0x1c88], ebx
call fcn.0040235a
pop ecx
push ebx
call fcn.004026b2
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401a40
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401c00
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.0040287a
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401d30
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004028b0
fstp st(0)
push ebx
call fcn.00402cc0
add esp, 0xc
push ebx
call fcn.00402b10
pop ecx
push ebx
push ebx
call fcn.004021ff
push ebx
push ebx
call fcn.00401fd4
pop ecx
pop ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401030
or dword [esp + 0x1c84], 0xffffffff
fstp st(0)
cmp dword [esp + 0x74], 0x10
jb 0x4018a5
push dword [esp + 0x60]
call fcn.004028a0
pop ecx
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x207138
jg 0x4018cb
inc esi
cmp esi, 0x4f672
jl 0x4018a7
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp esi, 0x2b157b
jg 0x4018e5
inc esi
cmp esi, 0x116bd
jl 0x4018cd
xor esi, esi
push ebx
lea eax, [esp + 0x7c]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc14
jle 0x40190f
cmp dword [esp + 0x58], 0x7a45f535
jne 0x401918
inc esi
cmp esi, 0xe154
jl 0x4018e7
mov eax, dword [0x436dbc]
mov dword [0x1a2020c], eax
call fcn.00401283
mov esi, 0x3078f
cmp dword [0x1a2020c], 0x51f
jne 0x401948
push ebx
lea eax, [esp + 0x47c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
dec esi
jne 0x40192c
mov ecx, dword [esp + 0x1c7c]
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10