Function at 0x41e9f0
Capabilities:
Encrypt data using rc4 ksa
Get geographical location

Disassembly:
sub esp, 0x348
mov eax, dword [0x4660c0]
xor eax, esp
mov dword [esp + 0x344], eax
cmp dword [0x466eac], 0
jne 0x41eb5a
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41ea2d
mov ecx, eax
call fcn.00407c20
mov dword [0x466eac], eax
jmp 0x41ea37
mov dword [0x466eac], 0
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41ea53
mov ecx, eax
call fcn.00407c20
mov dword [0x466eb0], eax
jmp 0x41ea5d
mov dword [0x466eb0], 0
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41ea79
mov ecx, eax
call fcn.00407c20
mov dword [0x466eb4], eax
jmp 0x41ea83
mov dword [0x466eb4], 0
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41ea9f
mov ecx, eax
call fcn.00407c20
mov dword [0x466eb8], eax
jmp 0x41eaa9
mov dword [0x466eb8], 0
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41eac5
mov ecx, eax
call fcn.00407c20
mov dword [0x466ebc], eax
jmp 0x41eacf
mov dword [0x466ebc], 0
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41eaeb
mov ecx, eax
call fcn.00407c20
mov dword [0x466ec0], eax
jmp 0x41eaf5
mov dword [0x466ec0], 0
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41eb11
mov ecx, eax
call fcn.00407c20
mov dword [0x466ec4], eax
jmp 0x41eb1b
mov dword [0x466ec4], 0
push 0xc
call fcn.00427927
add esp, 4
test eax, eax
je 0x41eb37
mov ecx, eax
call fcn.00407c20
mov dword [0x466ec8], eax
jmp 0x41eb41
mov dword [0x466ec8], 0
mov word [0x466e98], 0xbbef
mov byte [0x466e9a], 0xbf
mov word [0x466e9c], 0xfeff
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
mov esi, 0x38
mov dword [esp + 0x10], 0xc
xor ebp, ebp
nop dword [eax + eax]
push 0xff
lea eax, [esp + 0x158]
push eax
lea eax, [esi + 0xc]
push eax
push edi
call ebx
lea eax, [esp + 0x154]
push eax
lea ecx, [ebp + 0x466ed0]
call fcn.00403ec0
push 0xff
lea eax, [esp + 0x158]
push eax
push esi
push edi
call ebx
lea eax, [esp + 0x154]
push eax
lea ecx, [ebp + 0x467028]
call fcn.00403ec0
inc esi
lea ebp, [ebp + 0xc]
sub dword [esp + 0x10], 1
jne 0x41eb90
xor eax, eax
mov ecx, 7
mov dword [esp + 0x10], eax
xor ebp, ebp
add eax, 6
cdq
idiv ecx
push 0xff
mov esi, edx
lea eax, [esp + 0x158]
push eax
lea eax, [esi + 0x31]
push eax
push edi
call ebx
lea eax, [esp + 0x154]
push eax
lea ecx, [ebp + 0x466fd0]
call fcn.00403ec0
push 0xff
lea eax, [esp + 0x158]
push eax
lea eax, [esi + 0x2a]
push eax
push edi
call ebx
lea eax, [esp + 0x154]
push eax
lea ecx, [ebp + 0x466f60]
call fcn.00403ec0
mov eax, dword [esp + 0x10]
add ebp, 0xc
inc eax
mov ecx, 7
mov dword [esp + 0x10], eax
cmp ebp, 0x54
jl 0x41ebf3
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x14
push edi
call ebx
mov ecx, dword [0x466eac]
lea eax, [esp + 0x154]
push eax
call fcn.00403ec0
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x28
push edi
call ebx
mov ecx, 0x44e590
lea eax, [esp + 0x154]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ecc8
test dx, dx
je 0x41ecc4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ecc8
add eax, 4
add ecx, 4
test dx, dx
jne 0x41eca2
xor eax, eax
jmp 0x41eccd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41ece9
mov eax, 0x61
mov dword [esp + 0x156], 0x6d
mov word [esp + 0x154], ax
mov ecx, dword [0x466eb8]
lea eax, [esp + 0x154]
push eax
call fcn.00403ec0
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x29
push edi
call ebx
mov ecx, 0x44e590
lea eax, [esp + 0x154]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ed46
test dx, dx
je 0x41ed42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ed46
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ed20
xor eax, eax
jmp 0x41ed4b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41ed67
mov eax, 0x70
mov dword [esp + 0x156], 0x6d
mov word [esp + 0x154], ax
mov ecx, dword [0x466ebc]
lea eax, [esp + 0x154]
push eax
call fcn.00403ec0
push 2
lea eax, [esp + 0x158]
push eax
push 0x1e
push edi
call ebx
movzx eax, word [esp + 0x154]
push 2
mov word [0x466ea8], ax
lea eax, [esp + 0x158]
push eax
push 0x1d
push edi
call ebx
movzx eax, word [esp + 0x154]
push 2
mov word [0x466eaa], ax
lea eax, [esp + 0x158]
push eax
push 0xf
push edi
call ebx
movzx eax, word [esp + 0x154]
push 2
mov word [0x466ea4], ax
lea eax, [esp + 0x158]
push eax
push 0xe
push edi
call ebx
movzx eax, word [esp + 0x154]
push 0xff
mov word [0x466ea6], ax
lea eax, [esp + 0x158]
push eax
push 0x19
push edi
call ebx
lea eax, [esp + 0x154]
push eax
call fcn.00436e46
add esp, 4
mov byte [0x466ea2], al
lea eax, [esp + 0x154]
push 0xff
push eax
push 0x20
push edi
call ebx
mov ecx, dword [0x466eb4]
lea eax, [esp + 0x154]
push eax
call fcn.00403ec0
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x1f
push edi
call ebx
mov ecx, dword [0x466eb0]
lea eax, [esp + 0x154]
push eax
call fcn.00403ec0
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x1b
push edi
call ebx
lea eax, [esp + 0x154]
push eax
call fcn.00436e46
add esp, 4
mov byte [0x466ea0], al
lea eax, [esp + 0x154]
push 0xff
push eax
push 0x1b
push edi
call ebx
lea eax, [esp + 0x154]
push eax
call fcn.00436e46
add esp, 4
mov byte [0x466ea1], al
lea ecx, [esp + 0x2c]
call fcn.00407c20
lea ecx, [esp + 0x14]
call fcn.00407c20
lea ecx, [esp + 0x20]
call fcn.00407c20
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x25
push edi
call ebx
lea eax, [esp + 0x154]
push eax
call fcn.00436e46
add esp, 4
mov edx, 0x44f664
test eax, eax
mov ecx, 0x44f668
cmovne ecx, edx
push ecx
lea ecx, [esp + 0x24]
call fcn.00408010
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x23
push edi
call ebx
lea eax, [esp + 0x154]
push eax
call fcn.00436e46
add esp, 4
test eax, eax
jne 0x41ef6b
push 0xff
lea eax, [esp + 0x158]
push eax
push 0x1005
push edi
call ebx
lea eax, [esp + 0x154]
push eax
call fcn.00436e46
add esp, 4
test eax, eax
jne 0x41ef5d
push str._AMPM
lea ecx, [esp + 0x18]
jmp 0x41ef66
push str.AMPM
lea ecx, [esp + 0x30]
call fcn.00408010
mov ecx, dword [0x466ec0]
lea eax, [esp + 0x2c]
push eax
call fcn.00408070
mov ecx, dword [0x466ec0]
lea eax, [esp + 0x20]
push eax
call fcn.00407dd0
push dword [0x466ec0]
mov ecx, dword [0x466ec4]
call fcn.00408070
mov ecx, dword [0x466ec0]
push 0x44f67c
call fcn.00407e50
mov ecx, dword [0x466ec0]
lea eax, [esp + 0x14]
push eax
call fcn.00407dd0
mov ecx, dword [0x466ec4]
push str.:mm:ss
call fcn.00407e50
mov ecx, dword [0x466ec4]
lea eax, [esp + 0x14]
push eax
call fcn.00407dd0
push dword [0x466eb0]
mov ecx, dword [0x466ec8]
call fcn.00408070
mov ecx, dword [0x466ec8]
push 0x44e720
call fcn.00407e50
push dword [0x466ec4]
mov ecx, dword [0x466ec8]
call fcn.00407dd0
cmp dword [0x466fb8], 0
pop edi
pop esi
pop ebp
pop ebx
jne 0x41f09b
push pe_nt_image_headers32
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00429190
add esp, 0xc
mov dword [esp + 0x28], 0x11c
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x2c]
mov dword [0x466fb8], eax
mov eax, dword [esp + 0x30]
mov dword [0x466fbc], eax
mov eax, dword [esp + 0x34]
mov dword [0x466fc0], eax
movzx eax, word [esp + 0x13c]
mov dword [0x466fc4], eax
movzx eax, word [esp + 0x13e]
push str.IsWow64Process
push str.kernel32.dll
mov dword [0x466fc8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
setne byte [0x466fb4]
lea ecx, [esp + 0x10]
call fcn.00407c80
lea ecx, [esp + 4]
call fcn.00407c80
lea ecx, [esp + 0x1c]
call fcn.00407c80
mov ecx, dword [esp + 0x344]
xor ecx, esp
call fcn.004277ff
add esp, 0x348
ret