Function at 0x436370
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x31c
mov eax, dword [0x4c76b8]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x334]
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
call fcn.0042fe70
xor ebx, ebx
mov eax, 7
push 0x206
mov dword [esp + 0x114], eax
mov dword [esp + 0xf8], eax
lea eax, [esp + 0x122]
push ebx
push eax
mov dword [esp + 0x118], ebx
mov word [esp + 0x108], bx
mov dword [esp + 0xfc], ebx
mov word [esp + 0xec], bx
mov word [esp + 0x128], bx
call fcn.00471f70
add esp, 0xc
push 0x104
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x11c]
lea edx, [eax + 2]
jmp 0x436410
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x436410
sub eax, edx
push esi
sar eax, 1
push eax
lea edx, [esp + 0x124]
push edx
lea ecx, [esp + 0xe8]
call fcn.00409b30
mov eax, dword [esp + 0xf4]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x436448
call fcn.00471ec7
mov eax, dword [esp + 0xe4]
mov ebp, 8
cmp dword [esp + 0xf8], ebp
jae 0x436464
lea eax, [esp + 0xe4]
cmp word [eax + esi*2], 0x5c
je 0x4364bc
push 1
push 0x4af774
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
call fcn.00409b30
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0xec]
call fcn.00409930
cmp dword [esp + 0x88], ebp
jb 0x4364bc
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00471a59
add esp, 4
push str.Kernel32.dll
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0xb0]
push eax
call fcn.0040a220
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x108]
call fcn.00409a40
cmp dword [esp + 0xc0], ebp
jb 0x436502
mov ecx, dword [esp + 0xac]
push ecx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x114], ebp
mov eax, dword [esp + 0x100]
jae 0x436519
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x436544
push str.SetDllDirectoryA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43653d
push 0x4af6b3
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x4b0c60]
mov ax, word [0x4b0c64]
lea ecx, [esp + 0x118]
push ecx
push edi
xor ebp, ebp
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x120], edx
mov word [esp + 0x124], ax
call fcn.0042fa80
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4367f6
push str.RegServer
push esi
call fcn.0042fad0
add esp, 8
test eax, eax
jne 0x43659e
lea ebp, [eax + 1]
jmp 0x4367f6
push str.UnregServer
push esi
call fcn.0042fad0
add esp, 8
test eax, eax
jne 0x4365b8
lea ebp, [eax + 2]
jmp 0x4367f6
push str.Embedding
push esi
call fcn.0042fad0
add esp, 8
test eax, eax
jne 0x4365d2
lea ebp, [eax + 3]
jmp 0x4367f6
push 0x4b0d98
push esi
call fcn.0042fad0
add esp, 8
test eax, eax
jne 0x4367f6
push esi
lea ecx, [esp + 0x74]
lea ebp, [eax + 4]
call fcn.0040a1e0
push 0x4b09a8
lea ecx, [esp + 0xc8]
call fcn.0040a1e0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x74]
call fcn.00431a30
mov esi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x74]
call fcn.00421a20
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x74]
mov edi, eax
call fcn.00431a30
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push fcn.00473dc2
push edx
mov edx, dword [edi + 4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00431cd0
add esp, 0x20
push ebx
push 0x4b0d90
lea ecx, [esp + 0x78]
call fcn.004143e0
cmp eax, 0xffffffff
je 0x436713
mov edx, dword [esp + 0x84]
push edx
push ebx
push 0x4b0d90
lea ecx, [esp + 0x7c]
call fcn.004143e0
push eax
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x7c]
call fcn.00422ec0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409a40
lea ecx, [esp + 0xa8]
call fcn.00403980
push ebx
push 0x4b61dc
lea ecx, [esp + 0xcc]
call fcn.004312a0
cmp eax, 0xffffffff
je 0x436713
push ebx
push 0x4b61dc
lea ecx, [esp + 0xcc]
call fcn.004312a0
push eax
push ebx
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0xd0]
call fcn.00422ec0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409a40
lea ecx, [esp + 0xa8]
call fcn.00403980
cmp dword [esp + 0xd8], ebx
je 0x4367e1
push 0x4af6b3
lea ecx, [esp + 0x90]
mov byte [esp + 0x18], 1
call fcn.00404540
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xc8]
push eax
call fcn.0044a3b0
add esp, 8
push 3
push ebx
lea ecx, [esp + 0x94]
call fcn.00403610
push ebx
push 0x4b0d8c
lea ecx, [esp + 0x94]
call fcn.00431110
cmp eax, 0xffffffff
je 0x43679c
push 1
push eax
lea ecx, [esp + 0x94]
call fcn.00403610
push 1
push ebx
push 0x4b0d8c
lea ecx, [esp + 0x98]
call fcn.004308f0
cmp eax, 0xffffffff
jne 0x436774
lea ecx, [esp + 0x8c]
push ecx
call fcn.0043b5b0
add esp, 4
test al, al
je 0x4367d5
cmp dword [esp + 0xa4], 0x10
mov eax, dword [esp + 0x90]
jae 0x4367c8
lea eax, [esp + 0x90]
push eax
call fcn.004720de
add esp, 4
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x8c]
call fcn.00419310
lea ecx, [esp + 0xc4]
call fcn.00403980
lea ecx, [esp + 0x70]
call fcn.00403980
lea eax, [ebp - 1]
xor edi, edi
cmp eax, 3
ja case.default.0x436804
jmp dword [eax*4 + 0x436b80]
mov edx, dword [esp + 0x33c]
push edx
mov ecx, 0x4c9ca8
call fcn.00432960
mov edi, eax
lea eax, [esp + 0x8c]
push ebx
push eax
call fcn.0043c9c0
lea ecx, [esp + 0xcc]
push ebx
push ecx
call fcn.0043ca70
push str.DownloadProxyPS.dll
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.0040a220
add esp, 0x1c
cmp dword [esp + 0xa0], ebx
je 0x4369d2
cmp ebp, 1
mov eax, dword [esp + 0x90]
jne 0x436942
mov ebp, 8
cmp dword [esp + 0xa4], ebp
jae 0x43688a
lea eax, [esp + 0x90]
push 0x4b0cc4
push eax
call fcn.00437f70
add esp, 8
push 0x4b0c68
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x40]
push str._s__
push edx
call fcn.004321d0
add esp, 0xc
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0040a220
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.00403980
cmp dword [esp + 0xc0], ebp
mov eax, dword [esp + 0xac]
jae 0x4368e5
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2b4
call fcn.00471a5e
add esp, 4
cmp eax, ebx
je 0x436931
mov ecx, eax
call fcn.0044d290
mov esi, eax
cmp esi, ebx
je 0x436931
mov ecx, esi
call fcn.00450ed0
mov ecx, esi
call fcn.00451970
mov ecx, esi
call fcn.0044b940
push esi
call fcn.00471a59
add esp, 4
lea ecx, [esp + 0xa8]
call fcn.00403980
jmp 0x4369d7
mov esi, 8
cmp dword [esp + 0xa4], esi
jae 0x436957
lea eax, [esp + 0x90]
push 0x4b0cc4
push eax
call fcn.004381d0
add esp, 8
push 0x4b0c68
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x5c]
push str._u__s__
push edx
call fcn.004321d0
add esp, 0xc
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0040a220
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.00403980
cmp dword [esp + 0xc0], esi
mov eax, dword [esp + 0xac]
jae 0x4369b2
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xa8]
call fcn.00403980
mov ebp, esi
jmp 0x4369d7
mov ebp, 8
cmp dword [esp + 0x88], ebp
jb 0x4369ed
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0xdc], ebp
mov esi, 7
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov word [esp + 0x74], bx
jb 0x436a1e
mov edx, dword [esp + 0xc8]
push edx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0xa4], ebp
mov dword [esp + 0xdc], esi
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], bx
jb 0x436b0e
mov eax, dword [esp + 0x90]
push eax
call fcn.00471a59
add esp, 4
jmp 0x436b0e
lea ecx, [esp + 0x18]
push ecx
call fcn.0042f3e0
mov ecx, dword [eax]
add esp, 4
call fcn.0042f500
lea ecx, [esp + 0x18]
call fcn.00417ae0
mov edx, dword [esp + 0x33c]
push edx
mov ecx, 0x4c9ca8
call fcn.00432960
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0042f3e0
mov ecx, dword [eax]
add esp, 4
call fcn.0042bcf0
lea ecx, [esp + 0x20]
call fcn.00417ae0
call fcn.00428c90
jmp case.default.0x436804
push 0x2b4
call fcn.00471a5e
add esp, 4
cmp eax, ebx
je 0x436b77
mov ecx, eax
call fcn.0044d290
mov esi, eax
cmp esi, ebx
je 0x436aec
mov ecx, esi
call fcn.0044d730
mov ecx, esi
call fcn.0044e1b0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044bed0
push esi
call fcn.004359a0
add esp, 4
cmp esi, ebx
je case.default.0x436804
mov ecx, esi
call fcn.0044b940
push esi
call fcn.00471a59
add esp, 4
mov ebp, 8
cmp dword [esp + 0xf8], ebp
pop esi
jb 0x436b28
mov eax, dword [esp + 0xe0]
push eax
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x110], ebp
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], ebx
mov word [esp + 0xe0], bx
jb 0x436b5b
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.00471a59
add esp, 4
mov ecx, dword [esp + 0x324]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00471a20
add esp, 0x31c
ret 0x10
xor esi, esi
jmp 0x436aec