Function at 0x403cf2
Capabilities:
Get common file path
Impersonate user

Disassembly:
mov eax, 0x42fe94
call fcn.0042fd98
mov eax, 0x1c50
call fcn.00410ae0
push ebx
push esi
xor esi, esi
cmp dword [0x4e3cc8], 0x5b1
push edi
jne 0x403db7
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ole32.dll_CoRegisterPSClsid]
call dword [sym.imp.WINHTTP.dll_WinHttpCheckPlatform]
push esi
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x145c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_ShellAboutW]
lea eax, [ebp - 0x5c]
call fcn.00404084
mov dword [ebp - 4], esi
call fcn.00404c2e
push 0x403060
lea ecx, [ebp - 0x20]
call fcn.00403770
lea ecx, [ebp - 0x20]
call fcn.0040378c
lea ecx, [ebp - 0x20]
call fcn.004037d2
lea ecx, [ebp - 0x20]
call fcn.004037eb
push esi
push esi
call fcn.0040529c
push esi
call fcn.0040526d
add esp, 0xc
push esi
call fcn.00405256
pop ecx
push esi
call fcn.0040564e
mov dword [esp], esi
call fcn.00403947
fstp st(0)
push esi
call fcn.004058fe
add dword [0x4e3cc8], 0x1134b
push dword [0x4e3cc8]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4e2c18], eax
call fcn.00403c3d
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x403e00
inc edi
cmp edi, 0x4f6a4
jl 0x403de0
xor edi, edi
cmp dword [0x4e3cc8], esi
jbe 0x403e46
cmp dword [0x4e3cc8], 0xa8
mov eax, dword [0x4e3ccc]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x4e2c18]
mov byte [ecx + edi], al
jne 0x403e3d
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
inc edi
cmp edi, dword [0x4e3cc8]
jb 0x403e0a
xor edi, edi
mov eax, dword [0x4e3cc8]
add eax, edi
cmp eax, 0xe
jne 0x403e94
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push esi
lea eax, [ebp - 0x105c]
push eax
push esi
push 0x403070
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x403088
push 0x4030f0
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0xc5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
inc edi
cmp edi, 0x39621
jl 0x403e48
call fcn.00403b3a
xor edi, edi
call ebx
cmp edi, 0x26
jne 0x403eb0
call fcn.00403c23
inc edi
cmp edi, 0x6753f
jl 0x403ea4
push 0x7b
pop edi
cmp dword [0x4e3cc8], 0x86
jne 0x403f03
push 0x4030cc
push 0x40317c
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push esi
push esi
call sub.KERNEL32.dll_Process32FirstW
push esi
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
lea eax, [ebp - 0x1c5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [0x4e3cc8], 0xf
jne 0x403f2c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0x4031b8
push 0x403200
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
dec edi
jne 0x403ebc
push 0x4031ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret