Function at 0x436f57
Capabilities:
Contain obfuscated stackstrings
Create thread
Extract resource via kernel32 functions
Initialize winsock library

Disassembly:
push 0x2dc
mov eax, 0x5ca622
call fcn.0058ecca
mov edi, ecx
mov dword [ebp - 0x1f8], edi
mov dword [edi], vtable.CNet.0
lea esi, [edi + 4]
mov dword [ebp - 0x200], esi
xor ebx, ebx
push ebx
push 1
call fcn.0040e968
pop ecx
pop ecx
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x436fa0
mov dword [eax], esi
jmp 0x436fa2
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
mov dword [ebp - 4], 5
call fcn.004360f0
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], 7
lea eax, [edi + 0x24]
push eax
call fcn.00401138
mov byte [ebp - 4], 8
lea eax, [edi + 0x5c]
push eax
call fcn.00434d85
mov byte [ebp - 4], 9
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], 1
lea eax, [edi + 0x84]
push eax
call fcn.0040fdb0
mov byte [ebp - 4], 0xa
lea eax, [edi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0xb
mov dword [edi + 0xb4], ebx
lea eax, [edi + 0xb8]
push eax
call fcn.004378cb
mov byte [ebp - 4], 0xc
lea eax, [edi + 0x110]
push eax
call fcn.00401138
mov byte [ebp - 4], 0xd
lea esi, [edi + 0x148]
mov dword [ebp - 0x1e4], esi
push ebx
push 1
call fcn.0040e968
pop ecx
pop ecx
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0xe
cmp eax, ebx
je 0x437071
mov dword [eax], esi
jmp 0x437073
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [esi], eax
mov byte [ebp - 4], 0x13
call fcn.0044009c
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0xb9], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov byte [ebp - 4], 0x15
lea eax, [edi + 0x168]
push eax
call fcn.00401138
mov byte [ebp - 4], 0x16
lea esi, [edi + 0x1a0]
mov dword [ebp - 0x1e4], esi
push ebx
push 1
call fcn.0040e968
pop ecx
pop ecx
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0x17
cmp eax, ebx
je 0x4370e1
mov dword [eax], esi
jmp 0x4370e3
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [esi], eax
mov byte [ebp - 4], 0x1c
call fcn.0044048c
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x39], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov byte [ebp - 4], 0x1e
lea eax, [edi + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x1f
lea esi, [edi + 0x1d8]
mov dword [ebp - 0x1e4], esi
push ecx
mov dword [ebp - 0x1ec], esp
mov dword [ebp - 0x1ec], esp
call fcn.00418e05
mov byte [ebp - 4], 0x23
call fcn.0043e1ae
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov byte [ebp - 4], 0x24
lea eax, [edi + 0x1f4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x25
lea esi, [edi + 0x20c]
mov dword [ebp - 0x1e4], esi
push ebx
push 1
call fcn.0040e968
pop ecx
pop ecx
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0x26
cmp eax, ebx
je 0x437191
mov dword [eax], esi
jmp 0x437193
xor eax, eax
mov byte [ebp - 4], 0x25
mov dword [esi], eax
mov byte [ebp - 4], 0x2b
call fcn.00440543
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x21], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov byte [ebp - 4], 0x2d
lea eax, [edi + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x2e
lea esi, [edi + 0x244]
mov dword [ebp - 0x1e4], esi
push esi
call fcn.00441351
mov byte [ebp - 4], 0x2f
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [ebp - 4], 0x30
lea esi, [edi + 0x274]
mov dword [ebp - 0x1e4], esi
push ebx
push 1
call fcn.0040e968
pop ecx
pop ecx
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0x31
cmp eax, ebx
je 0x437225
mov dword [eax], esi
jmp 0x437227
xor eax, eax
mov byte [ebp - 4], 0x30
mov dword [esi], eax
mov byte [ebp - 4], 0x36
call fcn.0044059b
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x2bd], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov byte [ebp - 4], 0x38
lea eax, [edi + 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x39
xor eax, eax
mov word [ebp - 0x1e0], ax
push 0x18e
push ebx
lea eax, [ebp - 0x1de]
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x1e0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push ebx
push 0x437c2d
push ebx
push ebx
call fcn.00583186
add esp, 0x18
push 0x689234
push 0x7d0
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
call esi
mov dword [ebp - 0x1f0], eax
cmp eax, ebx
je 0x437330
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x437330
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1ec], eax
push dword [ebp - 0x1f0]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1f0], eax
inc eax
push eax
call fcn.005807c3
pop ecx
mov dword [ebp - 0x1e4], eax
push dword [ebp - 0x1f0]
push dword [ebp - 0x1ec]
push eax
call fcn.00584dd0
add esp, 0xc
mov eax, dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0x1f0]
mov byte [eax + ecx], bl
push eax
push 0x6ddf5c
call fcn.00408519
push 0x689234
push 0x4e4b
push ebx
call esi
mov esi, eax
cmp esi, ebx
je 0x43739a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x43739a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1e4], eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.005807c3
pop ecx
mov dword [ebp - 0x1ec], eax
push esi
push dword [ebp - 0x1e4]
push eax
call fcn.00584dd0
add esp, 0xc
mov eax, dword [ebp - 0x1ec]
mov byte [eax + esi], bl
push eax
push 0x6ddf40
call fcn.00408519
push ecx
mov eax, esp
mov dword [ebp - 0x1e4], esp
push 0x6810b8
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x3a
push ecx
mov eax, esp
mov dword [ebp - 0x1ec], esp
push 0x68923c
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x3b
push 0x6def68
mov byte [ebp - 4], 0x39
lea esi, [ebp - 0x208]
call fcn.0043263f
mov byte [ebp - 4], 0x3c
mov eax, esi
push eax
mov ecx, edi
call fcn.00438e74
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x1e4], esp
push str.FilteringEnabled
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3c
call fcn.004326bd
mov dword [edi + 0xb4], eax
push 0x4e41
push 0x6de000
call fcn.00482d96
push 0x4e42
push 0x6ddf60
call fcn.00482d96
push 0x4e44
push 0x6ddfb0
call fcn.00482d96
push 0x4e43
push 0x6de0d8
call fcn.00482d96
push 0x4e45
push 0x6de070
call fcn.00482d96
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x204], ebx
lea eax, [ebp - 0x200]
push eax
call fcn.00487d50
mov byte [ebp - 4], 0x3f
mov dword [esp], 0x689280
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, eax
call fcn.004116ea
mov byte [ebp - 4], 0x40
mov eax, dword [eax]
push 0x68927c
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00584a8b
add esp, 0x14
neg eax
sbb al, al
inc al
mov byte [ebp - 0x1f1], al
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x20c]
call fcn.004085f6
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x200]
call fcn.004085f6
cmp byte [ebp - 0x1f1], bl
je 0x43761a
lea eax, [ebp - 0x1e8]
push eax
call fcn.0040844d
mov byte [ebp - 4], 0x41
mov esi, 0x448
lea eax, [ebp - 0x50]
call fcn.004117ca
mov byte [ebp - 4], 0x42
push dword [ebp - 0x204]
push dword [ebp - 0x3c]
push ebx
lea ecx, [ebp - 0x50]
call fcn.00407d97
push eax
call fcn.00584ef4
add esp, 0xc
test eax, eax
je 0x4375f0
cmp dword [ebp - 0x38], 0x10
mov eax, dword [ebp - 0x4c]
jae 0x437530
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.00408519
push 0x687e8c
lea ebx, [ebp - 0x1e8]
call fcn.0040ff38
push str._r_nt
lea eax, [ebp - 0x210]
push eax
call fcn.00408474
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0x210]
push eax
push 0x6892a4
mov eax, ebx
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00489f20
add esp, 0x10
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x210]
call fcn.004084b5
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x234]
and eax, 0xfffffffc
cmp eax, 8
jne 0x4375d9
xor edi, edi
inc edi
lea esi, [ebp - 0x240]
call fcn.0041e10a
mov ebx, eax
xor edi, edi
call fcn.0041e10a
push eax
mov eax, dword [ebp - 0x1f8]
add eax, 0x5c
push eax
call fcn.00434dee
mov edi, eax
mov eax, ebx
call fcn.004084d8
mov edi, dword [ebp - 0x1f8]
mov byte [ebp - 4], 0x42
lea eax, [ebp - 0x240]
push eax
call fcn.0040fde8
xor ebx, ebx
jmp 0x437501
push dword [ebp - 0x204]
call fcn.005850b3
pop ecx
mov byte [ebp - 4], 0x41
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.004098e5
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x1e8]
call fcn.004084b5
mov dword [ebp - 4], 0x3c
jmp 0x437638
lea eax, [ebp - 0x34]
push eax
call fcn.00410c73
mov byte [ebp - 4], 0x47
push ebx
lea ecx, [ebp - 0x34]
call fcn.00411be7
test al, al
je 0x4377b9
lea edx, [edi + 0x274]
lea ecx, [ebp - 0x34]
call fcn.004133c0
lea eax, [edi + 0xb8]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004135c2
lea eax, [ebp - 0x228]
push eax
call fcn.00416bd4
mov byte [ebp - 4], 0x48
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0041387d
mov dword [ebp - 0x1e8], ebx
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x21c]
sar eax, 2
test eax, eax
jbe 0x437779
mov dword [ebp - 0x1fc], ebx
mov edi, dword [ebp - 0x1e8]
lea esi, [ebp - 0x228]
call fcn.0041e10a
push dword [eax]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1fc]
call fcn.004137b5
mov dword [ebp - 0x200], eax
cmp eax, ebx
je 0x437752
mov eax, 0xa8
cmp dword [ebp - 0x1fc], eax
jne 0x437752
push eax
push ebx
lea eax, [ebp - 0x2e8]
push eax
call fcn.00586790
add esp, 0xc
mov ebx, dword [ebp - 0x1f8]
add ebx, 0x148
call fcn.0041e10a
push eax
call fcn.0043cea3
push 0x2a
pop ecx
lea esi, [ebp - 0x2e8]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 0xa8
push dword [ebp - 0x200]
mov edi, dword [ebp - 0x1e8]
lea esi, [ebp - 0x228]
call fcn.0041e10a
push eax
call fcn.0043cea3
push eax
call fcn.00586840
add esp, 0xc
xor ebx, ebx
inc dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x21c]
sar eax, 2
cmp dword [ebp - 0x1e8], eax
jb 0x4376b1
mov edi, dword [ebp - 0x1f8]
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004138f0
lea eax, [edi + 0x1d8]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00413c9d
lea eax, [edi + 0x20c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004166a0
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x228]
push eax
call fcn.00416d1e
mov dword [ebp - 0x1fc], ebx
mov esi, 0x6892a8
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
jne 0x4377da
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
je 0x4377ec
push str._pf_init_ProtocolFilters__YAHPAVPFEvents_1_PB_W_Z
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1fc], eax
push str.c:_netfilter2
push edi
call dword [ebp - 0x1fc]
pop ecx
pop ecx
test eax, eax
je 0x437832
call dword [sym.imp.protocolfilters.dll_class_nfapi::NF_EventHandler____cdecl_ProtocolFilters::pf_getNFEventHandler_void_]
push eax
push str.netfilter2
call dword [sym.imp.nfapi.dll_enum__NF_STATUS___cdecl_nfapi::nf_init_char_const___class_nfapi::NF_EventHandler__]
pop ecx
pop ecx
test eax, eax
jne 0x43784f
push str.NetFilterSDK
call dword [sym.imp.protocolfilters.dll_void___cdecl_ProtocolFilters::pf_setRootSSLCertSubject_char_const__]
pop ecx
cmp dword [0x6c438c], 1
jl 0x43784f
push str.nf_init:_OK
jmp 0x437840
cmp dword [0x6c438c], 1
jl 0x43784f
push str.nf_init:_ERROR
push str.CNet::CNet
push 1
call fcn.00540a02
add esp, 0xc
lea eax, [edi + 0x244]
mov dword [eax + 0x20], 0x437bb1
mov dword [eax + 0x24], 0x437bf9
mov dword [eax + 0x28], 0x437c16
mov dword [eax + 0x2c], 0x43c141
push ebx
push ebx
push eax
push 0x441177
push ebx
push ebx
call fcn.00583186
add esp, 0x18
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x34]
push eax
call fcn.00410c9f
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x208]
call fcn.004085f6
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.0058ed26
ret