Function at 0x4353d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46765b
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x4760c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00435390
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x761e
mov word [ebp - 0x25c], cx
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x25c]
movzx edx, cx
mov eax, 2
imul ecx, eax, 0
movzx eax, word [ecx + str.shell32.dll]
xor eax, edx
mov word [ebp - 0x25a], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 1
movzx ecx, ax
mov edx, 2
shl edx, 0
movzx eax, word [edx + str.shell32.dll]
xor eax, ecx
mov word [ebp - 0x258], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 2
movzx ecx, ax
mov edx, 2
shl edx, 1
movzx eax, word [edx + str.shell32.dll]
xor eax, ecx
mov word [ebp - 0x256], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 3
movzx ecx, ax
mov edx, 2
imul eax, edx, 3
movzx edx, word [eax + str.shell32.dll]
xor edx, ecx
mov word [ebp - 0x254], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 4
movzx eax, dx
mov ecx, 2
shl ecx, 2
movzx edx, word [ecx + str.shell32.dll]
xor edx, eax
mov word [ebp - 0x252], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 5
movzx eax, dx
mov ecx, 2
imul edx, ecx, 5
movzx ecx, word [edx + str.shell32.dll]
xor ecx, eax
mov word [ebp - 0x250], cx
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x25c]
add ecx, 6
movzx edx, cx
mov eax, 2
imul ecx, eax, 6
movzx eax, word [ecx + str.shell32.dll]
xor eax, edx
mov word [ebp - 0x24e], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 7
movzx ecx, ax
mov edx, 2
imul eax, edx, 7
movzx edx, word [eax + str.shell32.dll]
xor edx, ecx
mov word [ebp - 0x24c], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 8
movzx eax, dx
mov ecx, 2
shl ecx, 3
movzx edx, word [ecx + str.shell32.dll]
xor edx, eax
mov word [ebp - 0x24a], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 9
movzx eax, dx
mov ecx, 2
imul edx, ecx, 9
movzx ecx, word [edx + str.shell32.dll]
xor ecx, eax
mov word [ebp - 0x248], cx
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x25c]
add ecx, 0xa
movzx edx, cx
mov eax, 2
imul ecx, eax, 0xa
movzx eax, word [ecx + str.shell32.dll]
xor eax, edx
mov word [ebp - 0x246], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 0xb
movzx ecx, ax
mov edx, 2
imul eax, edx, 0xb
movzx edx, word [eax + str.shell32.dll]
xor edx, ecx
mov word [ebp - 0x244], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 0xc
movzx eax, dx
mov ecx, 2
imul edx, ecx, 0xc
movzx ecx, word [edx + str.shell32.dll]
xor ecx, eax
mov word [ebp - 0x242], cx
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x25c]
add ecx, 0xd
movzx edx, cx
mov eax, 2
imul ecx, eax, 0xd
movzx eax, word [ecx + str.shell32.dll]
xor eax, edx
mov word [ebp - 0x240], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 0xe
movzx ecx, ax
mov edx, 2
imul eax, edx, 0xe
movzx edx, word [eax + str.shell32.dll]
xor edx, ecx
mov word [ebp - 0x23e], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 0xf
movzx eax, dx
mov ecx, 2
imul edx, ecx, 0xf
movzx ecx, word [edx + str.shell32.dll]
xor ecx, eax
mov word [ebp - 0x23c], cx
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x25c]
add ecx, 0x10
movzx edx, cx
mov eax, 2
shl eax, 4
movzx ecx, word [eax + str.shell32.dll]
xor ecx, edx
mov word [ebp - 0x23a], cx
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x25c]
add ecx, 0x11
movzx edx, cx
mov eax, 2
imul ecx, eax, 0x11
movzx eax, word [ecx + str.shell32.dll]
xor eax, edx
mov word [ebp - 0x238], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 0x12
movzx ecx, ax
mov edx, 2
imul eax, edx, 0x12
movzx edx, word [eax + str.shell32.dll]
xor edx, ecx
mov word [ebp - 0x236], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 0x13
movzx eax, dx
mov ecx, 2
imul edx, ecx, 0x13
movzx ecx, word [edx + str.shell32.dll]
xor ecx, eax
mov word [ebp - 0x234], cx
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x25c]
add ecx, 0x14
movzx edx, cx
mov eax, 2
imul ecx, eax, 0x14
movzx eax, word [ecx + str.shell32.dll]
xor eax, edx
mov word [ebp - 0x232], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x25c]
add eax, 0x15
movzx ecx, ax
mov edx, 2
imul eax, edx, 0x15
movzx edx, word [eax + str.shell32.dll]
xor edx, ecx
mov word [ebp - 0x230], dx
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x25c]
add edx, 0x16
movzx eax, dx
mov ecx, 2
imul edx, ecx, 0x16
movzx ecx, word [edx + str.shell32.dll]
xor ecx, eax
mov word [ebp - 0x22e], cx
xor edx, edx
mov word [ebp - 0x22c], dx
lea ecx, [ebp - 0x25c]
call fcn.0042d210
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x47848c], eax
cmp dword [0x47848c], 0
jne 0x435871
mov eax, 1
jmp 0x435bdd
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 0
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x228], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
shl eax, 0
movsx ecx, byte [eax + str.IsUserAnAdmin]
add ecx, edx
mov byte [ebp - 0x227], cl
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
shl eax, 1
movsx ecx, byte [eax + str.IsUserAnAdmin]
add ecx, edx
mov byte [ebp - 0x226], cl
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 3
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x225], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
shl eax, 2
movsx ecx, byte [eax + str.IsUserAnAdmin]
add ecx, edx
mov byte [ebp - 0x224], cl
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 5
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x223], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 6
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x222], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 7
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x221], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
shl eax, 3
movsx ecx, byte [eax + str.IsUserAnAdmin]
add ecx, edx
mov byte [ebp - 0x220], cl
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 9
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x21f], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 0xa
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x21e], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 0xb
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x21d], al
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, 1
imul ecx, eax, 0xc
movsx eax, byte [ecx + str.IsUserAnAdmin]
add eax, edx
mov byte [ebp - 0x21c], al
mov byte [ebp - 0x21b], 0
mov dword [ebp - 0x290], 0
jmp 0x435a8d
mov ecx, dword [ebp - 0x290]
add ecx, 1
mov dword [ebp - 0x290], ecx
cmp dword [ebp - 0x290], 0xd
jae 0x435ac5
mov eax, 0x17
cdq
mov ecx, 0xd
idiv ecx
movsx edx, dl
mov eax, dword [ebp - 0x290]
movsx ecx, byte [ebp + eax - 0x228]
sub ecx, edx
mov edx, dword [ebp - 0x290]
mov byte [ebp + edx - 0x228], cl
jmp 0x435a7e
lea eax, [ebp - 0x228]
mov dword [ebp - 0x298], eax
mov ecx, dword [0x47848c]
mov dword [ebp - 0x29c], ecx
mov edx, dword [ebp - 0x298]
push edx
mov eax, dword [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2a0], eax
call dword [ebp - 0x2a0]
test eax, eax
jne 0x435b69
push 0x468e3c
lea ecx, [ebp - 0x28c]
call fcn.0041d1c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x274]
call fcn.0041d1c0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x28c]
push edx
lea eax, [ebp - 0x274]
push eax
call fcn.00437d00
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x274]
call fcn.0042bd30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28c]
call fcn.0042bd30
xor eax, eax
jmp 0x435bdd
push 0
push 0
push 0
push 0x433500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x294], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x294]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x294]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x478490], 0
je 0x435bb5
mov eax, dword [0x478490]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x477050]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x47848c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x478440]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448a1c
mov esp, ebp
pop ebp
ret