Function at 0x4345b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x31c
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x334]
call fcn.0048ca96
xor ebx, ebx
mov eax, 7
push 0x206
mov dword [esp + 0x114], eax
mov dword [esp + 0xf8], eax
lea eax, [esp + 0x122]
push ebx
push eax
mov dword [esp + 0x118], ebx
mov word [esp + 0x108], bx
mov dword [esp + 0xfc], ebx
mov word [esp + 0xec], bx
mov word [esp + 0x128], bx
call fcn.004700e0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x11c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x434641
sub eax, edx
push esi
sar eax, 1
push eax
lea edx, [esp + 0x124]
push edx
lea ecx, [esp + 0xe8]
call fcn.00409bb0
mov eax, dword [esp + 0xf4]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x434679
call fcn.00470037
mov eax, dword [esp + 0xe4]
mov ebp, 8
cmp dword [esp + 0xf8], ebp
jae 0x434695
lea eax, [esp + 0xe4]
cmp word [eax + esi*2], 0x5c
je 0x4346ed
push 1
push 0x4af774
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
call fcn.00409bb0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0xec]
call fcn.004099b0
cmp dword [esp + 0x88], ebp
jb 0x4346ed
mov ecx, dword [esp + 0x74]
push ecx
call fcn.0046fbc9
add esp, 4
push str.Kernel32.dll
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0xb0]
push eax
call fcn.0040a2a0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x108]
call fcn.00409ac0
cmp dword [esp + 0xc0], ebp
jb 0x434733
mov ecx, dword [esp + 0xac]
push ecx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x114], ebp
mov eax, dword [esp + 0x100]
jae 0x43474a
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x434775
push str.SetDllDirectoryA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43476e
push 0x4af6b3
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x4b0a90]
mov ax, word [0x4b0a94]
lea ecx, [esp + 0x118]
push ecx
push edi
xor ebp, ebp
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x120], edx
mov word [esp + 0x124], ax
call fcn.0042ddd0
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x434a27
push str.RegServer
push esi
call fcn.0042de20
add esp, 8
test eax, eax
jne 0x4347cf
lea ebp, [eax + 1]
jmp 0x434a27
push str.UnregServer
push esi
call fcn.0042de20
add esp, 8
test eax, eax
jne 0x4347e9
lea ebp, [eax + 2]
jmp 0x434a27
push str.Embedding
push esi
call fcn.0042de20
add esp, 8
test eax, eax
jne 0x434803
lea ebp, [eax + 3]
jmp 0x434a27
push 0x4b0c08
push esi
call fcn.0042de20
add esp, 8
test eax, eax
jne 0x434a27
push esi
lea ecx, [esp + 0x74]
lea ebp, [eax + 4]
call fcn.0040a260
push 0x4b0828
lea ecx, [esp + 0xc8]
call fcn.0040a260
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x74]
call fcn.0042fc60
mov esi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x74]
call fcn.0041fd60
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x74]
mov edi, eax
call fcn.0042fc60
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push fcn.00471e82
push edx
mov edx, dword [edi + 4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.0042ff00
add esp, 0x20
push ebx
push 0x4b0c00
lea ecx, [esp + 0x78]
call fcn.00414120
cmp eax, 0xffffffff
je 0x434944
mov edx, dword [esp + 0x84]
push edx
push ebx
push 0x4b0c00
lea ecx, [esp + 0x7c]
call fcn.00414120
push eax
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x7c]
call fcn.004211b0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409ac0
lea ecx, [esp + 0xa8]
call fcn.0041f9a0
push ebx
push 0x4b6484
lea ecx, [esp + 0xcc]
call fcn.0042f4d0
cmp eax, 0xffffffff
je 0x434944
push ebx
push 0x4b6484
lea ecx, [esp + 0xcc]
call fcn.0042f4d0
push eax
push ebx
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0xd0]
call fcn.004211b0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409ac0
lea ecx, [esp + 0xa8]
call fcn.0041f9a0
cmp dword [esp + 0xd8], ebx
je 0x434a12
push 0x4af6b3
lea ecx, [esp + 0x90]
mov byte [esp + 0x18], 1
call fcn.004045b0
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xc8]
push eax
call fcn.00448820
add esp, 8
push 3
push ebx
lea ecx, [esp + 0x94]
call fcn.00403690
push ebx
push 0x4b0bfc
lea ecx, [esp + 0x94]
call fcn.0042f340
cmp eax, 0xffffffff
je 0x4349cd
push 1
push eax
lea ecx, [esp + 0x94]
call fcn.00403690
push 1
push ebx
push 0x4b0bfc
lea ecx, [esp + 0x98]
call fcn.0042eb20
cmp eax, 0xffffffff
jne 0x4349a5
lea ecx, [esp + 0x8c]
push ecx
call fcn.004398c0
add esp, 4
test al, al
je 0x434a06
cmp dword [esp + 0xa4], 0x10
mov eax, dword [esp + 0x90]
jae 0x4349f9
lea eax, [esp + 0x90]
push eax
call fcn.0047024e
add esp, 4
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x8c]
call fcn.004141f0
lea ecx, [esp + 0xc4]
call fcn.0041f9a0
lea ecx, [esp + 0x70]
call fcn.0041f9a0
lea eax, [ebp - 1]
xor edi, edi
cmp eax, 3
ja case.default.0x434a35
jmp dword [eax*4 + 0x434db0]
mov edx, dword [esp + 0x33c]
push edx
mov ecx, 0x4cac68
call fcn.00430b80
mov edi, eax
lea eax, [esp + 0x8c]
push ebx
push eax
call fcn.0043aae0
lea ecx, [esp + 0xcc]
push ebx
push ecx
call fcn.0043ab90
push str.DownloadProxyPS.dll
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.0040a2a0
add esp, 0x1c
cmp dword [esp + 0xa0], ebx
je 0x434c03
cmp ebp, 1
mov eax, dword [esp + 0x90]
jne 0x434b73
mov ebp, 8
cmp dword [esp + 0xa4], ebp
jae 0x434abb
lea eax, [esp + 0x90]
push 0x4b0b34
push eax
call fcn.00436270
add esp, 8
push 0x4b0a98
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x40]
push str._s__
push edx
call fcn.00430400
add esp, 0xc
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0040a2a0
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.0041f9a0
cmp dword [esp + 0xc0], ebp
mov eax, dword [esp + 0xac]
jae 0x434b16
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2b4
call fcn.0046fbce
add esp, 4
cmp eax, ebx
je 0x434b62
mov ecx, eax
call fcn.0044b730
mov esi, eax
cmp esi, ebx
je 0x434b62
mov ecx, esi
call fcn.0044f370
mov ecx, esi
call fcn.0044fe10
mov ecx, esi
call fcn.00449df0
push esi
call fcn.0046fbc9
add esp, 4
lea ecx, [esp + 0xa8]
call fcn.0041f9a0
jmp 0x434c08
mov esi, 8
cmp dword [esp + 0xa4], esi
jae 0x434b88
lea eax, [esp + 0x90]
push 0x4b0b34
push eax
call fcn.004364d0
add esp, 8
push 0x4b0a98
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x5c]
push str._u__s__
push edx
call fcn.00430400
add esp, 0xc
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0040a2a0
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.0041f9a0
cmp dword [esp + 0xc0], esi
mov eax, dword [esp + 0xac]
jae 0x434be3
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xa8]
call fcn.0041f9a0
mov ebp, esi
jmp 0x434c08
mov ebp, 8
cmp dword [esp + 0x88], ebp
jb 0x434c1e
mov ecx, dword [esp + 0x74]
push ecx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0xdc], ebp
mov esi, 7
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov word [esp + 0x74], bx
jb 0x434c4f
mov edx, dword [esp + 0xc8]
push edx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0xa4], ebp
mov dword [esp + 0xdc], esi
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], bx
jb 0x434d3f
mov eax, dword [esp + 0x90]
push eax
call fcn.0046fbc9
add esp, 4
jmp 0x434d3f
lea ecx, [esp + 0x18]
push ecx
call fcn.0042d7d0
mov ecx, dword [eax]
add esp, 4
call fcn.0042d8f0
lea ecx, [esp + 0x18]
call fcn.0041ed60
mov edx, dword [esp + 0x33c]
push edx
mov ecx, 0x4cac68
call fcn.00430b80
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0042d7d0
mov ecx, dword [eax]
add esp, 4
call fcn.0042a0e0
lea ecx, [esp + 0x20]
call fcn.0041ed60
call fcn.00427290
jmp case.default.0x434a35
push 0x2b4
call fcn.0046fbce
add esp, 4
cmp eax, ebx
je 0x434da8
mov ecx, eax
call fcn.0044b730
mov esi, eax
cmp esi, ebx
je 0x434d1d
mov ecx, esi
call fcn.0044bbd0
mov ecx, esi
call fcn.0044c650
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044a380
push esi
call fcn.00433be0
add esp, 4
cmp esi, ebx
je case.default.0x434a35
mov ecx, esi
call fcn.00449df0
push esi
call fcn.0046fbc9
add esp, 4
mov ebp, 8
cmp dword [esp + 0xf8], ebp
pop esi
jb 0x434d59
mov eax, dword [esp + 0xe0]
push eax
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x110], ebp
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], ebx
mov word [esp + 0xe0], bx
jb 0x434d8c
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.0046fbc9
add esp, 4
mov ecx, dword [esp + 0x324]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046fb90
add esp, 0x31c
ret 0x10
xor esi, esi
jmp 0x434d1d