Function at 0x40106e
Capabilities:
Extract resource via kernel32 functions
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x890
push ebx
mov ebx, dword [eax + 4]
push esi
mov esi, dword [eax]
push edi
xor edi, edi
cmp dword [0x51a8ac], 0x134
jne 0x4010db
push edi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
lea eax, [ebp - 0x88c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
cmp dword [0x51a8ac], 0x114e
mov dword [ebp - 0x14], edi
jne 0x4010f7
push str.bihezinofoyudenosovamo_gep_misopimobutewafakiho_vomexepocab_masobetepilaxivapocenazedah
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [0x43a568]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43a56c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
call fcn.00401064
add dword [ebp - 0x14], 0x54
cmp dword [0x51a8ac], 0xb54
jne 0x401158
lea eax, [ebp - 0x8c]
push eax
push str.jehewerevahe_kudumopuretizexexelizo_ciruzapab_rukusezulamamehoxe
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_QueryActCtxW]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EraseTape]
push edi
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov eax, dword [0x43a570]
mov dword [ebp - 0x20], eax
mov eax, dword [0x43a574]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
lea ecx, [ebp - 8]
call fcn.00401054
mov eax, dword [ebp - 0x20]
mov edx, dword [0x51a8ac]
add dword [ebp - 8], eax
cmp edx, 0xfa9
jne 0x4011a2
mov dword [0x4b2c1c], 0xedeb2e40
mov ecx, dword [ebp - 0x18]
mov eax, esi
shr eax, cl
mov ecx, dword [ebp - 0x28]
mov dword [0x4b2c18], 0x9150ce2e
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
call fcn.0040106b
cmp edx, 0x3eb
jne 0x4011e2
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x4afa14], edi
mov edx, dword [ebp - 0x14]
lea eax, [edx + esi]
push eax
mov eax, dword [ebp - 8]
call fcn.0040105d
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], edi
sub ebx, eax
and eax, 0x5dc052bb
sub dword [ebp - 0xc], 0x5396dd36
add dword [ebp - 0xc], 0x5396dd3a
mov ecx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 5
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
call fcn.0040106b
mov ecx, dword [ebp - 0xc]
lea eax, [edx + ebx]
push eax
mov eax, ebx
shl eax, cl
add eax, dword [ebp - 0x2c]
call fcn.0040105d
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
call fcn.0040105a
sub esi, dword [ebp - 8]
add edx, 0x61c88647
dec dword [ebp - 0x1c]
mov dword [0x4573d0], edi
mov dword [ebp - 0x14], edx
jne 0x40116f
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebx
pop ebx
leave
ret 4