Function at 0x434b30
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x31c
mov eax, dword [0x4c8698]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x334]
call fcn.0048d086
xor ebx, ebx
mov eax, 7
push 0x206
mov dword [esp + 0x114], eax
mov dword [esp + 0xf8], eax
lea eax, [esp + 0x122]
push ebx
push eax
mov dword [esp + 0x118], ebx
mov word [esp + 0x108], bx
mov dword [esp + 0xfc], ebx
mov word [esp + 0xec], bx
mov word [esp + 0x128], bx
call fcn.00470770
add esp, 0xc
push 0x104
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x11c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x434bc1
sub eax, edx
push esi
sar eax, 1
push eax
lea edx, [esp + 0x124]
push edx
lea ecx, [esp + 0xe8]
call fcn.00409b40
mov eax, dword [esp + 0xf4]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x434bf9
call fcn.004706c7
mov eax, dword [esp + 0xe4]
mov ebp, 8
cmp dword [esp + 0xf8], ebp
jae 0x434c15
lea eax, [esp + 0xe4]
cmp word [eax + esi*2], 0x5c
je 0x434c6d
push 1
push 0x4af76c
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
call fcn.00409b40
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0xec]
call fcn.00409940
cmp dword [esp + 0x88], ebp
jb 0x434c6d
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00470259
add esp, 4
push str.Kernel32.dll
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0xb0]
push eax
call fcn.0040a230
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x108]
call fcn.00409a50
cmp dword [esp + 0xc0], ebp
jb 0x434cb3
mov ecx, dword [esp + 0xac]
push ecx
call fcn.00470259
add esp, 4
cmp dword [esp + 0x114], ebp
mov eax, dword [esp + 0x100]
jae 0x434cca
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x434cf5
push str.SetDllDirectoryA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x434cee
push 0x4af6ab
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x4b0ae0]
mov ax, word [0x4b0ae4]
lea ecx, [esp + 0x118]
push ecx
push edi
xor ebp, ebp
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x120], edx
mov word [esp + 0x124], ax
call fcn.0042e3b0
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x434fa7
push str.RegServer
push esi
call fcn.0042e400
add esp, 8
test eax, eax
jne 0x434d4f
lea ebp, [eax + 1]
jmp 0x434fa7
push str.UnregServer
push esi
call fcn.0042e400
add esp, 8
test eax, eax
jne 0x434d69
lea ebp, [eax + 2]
jmp 0x434fa7
push str.Embedding
push esi
call fcn.0042e400
add esp, 8
test eax, eax
jne 0x434d83
lea ebp, [eax + 3]
jmp 0x434fa7
push 0x4b0c60
push esi
call fcn.0042e400
add esp, 8
test eax, eax
jne 0x434fa7
push esi
lea ecx, [esp + 0x74]
lea ebp, [eax + 4]
call fcn.0040a1f0
push 0x4b0878
lea ecx, [esp + 0xc8]
call fcn.0040a1f0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x74]
call fcn.00430250
mov esi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x74]
call fcn.0041ffa0
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x74]
mov edi, eax
call fcn.00430250
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push fcn.00472512
push edx
mov edx, dword [edi + 4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.004304f0
add esp, 0x20
push ebx
push 0x4b0c58
lea ecx, [esp + 0x78]
call fcn.004140f0
cmp eax, 0xffffffff
je 0x434ec4
mov edx, dword [esp + 0x84]
push edx
push ebx
push 0x4b0c58
lea ecx, [esp + 0x7c]
call fcn.004140f0
push eax
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x7c]
call fcn.00421570
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409a50
lea ecx, [esp + 0xa8]
call fcn.00420370
push ebx
push 0x4b64f4
lea ecx, [esp + 0xcc]
call fcn.0042fac0
cmp eax, 0xffffffff
je 0x434ec4
push ebx
push 0x4b64f4
lea ecx, [esp + 0xcc]
call fcn.0042fac0
push eax
push ebx
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0xd0]
call fcn.00421570
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409a50
lea ecx, [esp + 0xa8]
call fcn.00420370
cmp dword [esp + 0xd8], ebx
je 0x434f92
push 0x4af6ab
lea ecx, [esp + 0x90]
mov byte [esp + 0x18], 1
call fcn.00404540
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xc8]
push eax
call fcn.00449110
add esp, 8
push 3
push ebx
lea ecx, [esp + 0x94]
call fcn.004035d0
push ebx
push 0x4b0c54
lea ecx, [esp + 0x94]
call fcn.0042f930
cmp eax, 0xffffffff
je 0x434f4d
push 1
push eax
lea ecx, [esp + 0x94]
call fcn.004035d0
push 1
push ebx
push 0x4b0c54
lea ecx, [esp + 0x98]
call fcn.0042f110
cmp eax, 0xffffffff
jne 0x434f25
lea ecx, [esp + 0x8c]
push ecx
call fcn.00439e10
add esp, 4
test al, al
je 0x434f86
cmp dword [esp + 0xa4], 0x10
mov eax, dword [esp + 0x90]
jae 0x434f79
lea eax, [esp + 0x90]
push eax
call fcn.004708de
add esp, 4
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x8c]
call fcn.004185b0
lea ecx, [esp + 0xc4]
call fcn.00420370
lea ecx, [esp + 0x70]
call fcn.00420370
lea eax, [ebp - 1]
xor edi, edi
cmp eax, 3
ja case.default.0x434fb5
jmp dword [eax*4 + 0x435330]
mov edx, dword [esp + 0x33c]
push edx
mov ecx, 0x4cac88
call fcn.00431170
mov edi, eax
lea eax, [esp + 0x8c]
push ebx
push eax
call fcn.0043b030
lea ecx, [esp + 0xcc]
push ebx
push ecx
call fcn.0043b0e0
push str.DownloadProxyPS.dll
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.0040a230
add esp, 0x1c
cmp dword [esp + 0xa0], ebx
je 0x435183
cmp ebp, 1
mov eax, dword [esp + 0x90]
jne 0x4350f3
mov ebp, 8
cmp dword [esp + 0xa4], ebp
jae 0x43503b
lea eax, [esp + 0x90]
push 0x4b0b8c
push eax
call fcn.004367f0
add esp, 8
push 0x4b0ae8
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x40]
push str._s__
push edx
call fcn.004309f0
add esp, 0xc
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0040a230
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.00420370
cmp dword [esp + 0xc0], ebp
mov eax, dword [esp + 0xac]
jae 0x435096
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2b4
call fcn.0047025e
add esp, 4
cmp eax, ebx
je 0x4350e2
mov ecx, eax
call fcn.0044c020
mov esi, eax
cmp esi, ebx
je 0x4350e2
mov ecx, esi
call fcn.0044fc60
mov ecx, esi
call fcn.00450700
mov ecx, esi
call fcn.0044a6e0
push esi
call fcn.00470259
add esp, 4
lea ecx, [esp + 0xa8]
call fcn.00420370
jmp 0x435188
mov esi, 8
cmp dword [esp + 0xa4], esi
jae 0x435108
lea eax, [esp + 0x90]
push 0x4b0b8c
push eax
call fcn.00436a50
add esp, 8
push 0x4b0ae8
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x5c]
push str._u__s__
push edx
call fcn.004309f0
add esp, 0xc
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0040a230
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.00420370
cmp dword [esp + 0xc0], esi
mov eax, dword [esp + 0xac]
jae 0x435163
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xa8]
call fcn.00420370
mov ebp, esi
jmp 0x435188
mov ebp, 8
cmp dword [esp + 0x88], ebp
jb 0x43519e
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00470259
add esp, 4
cmp dword [esp + 0xdc], ebp
mov esi, 7
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov word [esp + 0x74], bx
jb 0x4351cf
mov edx, dword [esp + 0xc8]
push edx
call fcn.00470259
add esp, 4
cmp dword [esp + 0xa4], ebp
mov dword [esp + 0xdc], esi
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], bx
jb 0x4352bf
mov eax, dword [esp + 0x90]
push eax
call fcn.00470259
add esp, 4
jmp 0x4352bf
lea ecx, [esp + 0x18]
push ecx
call fcn.0042dd10
mov ecx, dword [eax]
add esp, 4
call fcn.0042de30
lea ecx, [esp + 0x18]
call fcn.0041ef50
mov edx, dword [esp + 0x33c]
push edx
mov ecx, 0x4cac88
call fcn.00431170
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0042dd10
mov ecx, dword [eax]
add esp, 4
call fcn.0042a620
lea ecx, [esp + 0x20]
call fcn.0041ef50
call fcn.00427680
jmp case.default.0x434fb5
push 0x2b4
call fcn.0047025e
add esp, 4
cmp eax, ebx
je 0x435328
mov ecx, eax
call fcn.0044c020
mov esi, eax
cmp esi, ebx
je 0x43529d
mov ecx, esi
call fcn.0044c4c0
mov ecx, esi
call fcn.0044cf40
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044ac70
push esi
call fcn.00434160
add esp, 4
cmp esi, ebx
je case.default.0x434fb5
mov ecx, esi
call fcn.0044a6e0
push esi
call fcn.00470259
add esp, 4
mov ebp, 8
cmp dword [esp + 0xf8], ebp
pop esi
jb 0x4352d9
mov eax, dword [esp + 0xe0]
push eax
call fcn.00470259
add esp, 4
cmp dword [esp + 0x110], ebp
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], ebx
mov word [esp + 0xe0], bx
jb 0x43530c
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.00470259
add esp, 4
mov ecx, dword [esp + 0x324]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00470220
add esp, 0x31c
ret 0x10
xor esi, esi
jmp 0x43529d