Function at 0x436120
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x31c
mov eax, dword [0x4c66b8]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x334]
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
call fcn.0042fbb0
xor ebx, ebx
mov eax, 7
push 0x206
mov dword [esp + 0x114], eax
mov dword [esp + 0xf8], eax
lea eax, [esp + 0x122]
push ebx
push eax
mov dword [esp + 0x118], ebx
mov word [esp + 0x108], bx
mov dword [esp + 0xfc], ebx
mov word [esp + 0xec], bx
mov word [esp + 0x128], bx
call fcn.004714e0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x11c]
lea edx, [eax + 2]
jmp 0x4361c0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4361c0
sub eax, edx
push esi
sar eax, 1
push eax
lea edx, [esp + 0x124]
push edx
lea ecx, [esp + 0xe8]
call fcn.00409d00
mov eax, dword [esp + 0xf4]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4361f8
call fcn.00471437
mov eax, dword [esp + 0xe4]
mov ebp, 8
cmp dword [esp + 0xf8], ebp
jae 0x436214
lea eax, [esp + 0xe4]
cmp word [eax + esi*2], 0x5c
je 0x436278
push 1
push 0x4ae764
lea ecx, [esp + 0x94]
mov dword [esp + 0xac], 7
mov dword [esp + 0xa8], ebx
mov word [esp + 0x98], bx
call fcn.00409d00
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0xec]
call fcn.00409b00
cmp dword [esp + 0xa4], ebp
jb 0x436278
mov ecx, dword [esp + 0x90]
push ecx
call fcn.00470fc9
add esp, 4
push str.Kernel32.dll
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0xb0]
push eax
call fcn.0040a3f0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x108]
call fcn.00409c10
cmp dword [esp + 0xc0], ebp
jb 0x4362be
mov ecx, dword [esp + 0xac]
push ecx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x114], ebp
mov eax, dword [esp + 0x100]
jae 0x4362d5
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x436300
push str.SetDllDirectoryA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4362f9
push 0x4ae6a3
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x4afc10]
mov ax, word [0x4afc14]
lea ecx, [esp + 0x118]
push ecx
push edi
xor ebp, ebp
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x120], edx
mov word [esp + 0x124], ax
call fcn.0042f7c0
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4365b3
push str.RegServer
push esi
call fcn.0042f810
add esp, 8
test eax, eax
jne 0x43635a
lea ebp, [eax + 1]
jmp 0x4365b3
push str.UnregServer
push esi
call fcn.0042f810
add esp, 8
test eax, eax
jne 0x436374
lea ebp, [eax + 2]
jmp 0x4365b3
push str.Embedding
push esi
call fcn.0042f810
add esp, 8
test eax, eax
jne 0x43638e
lea ebp, [eax + 3]
jmp 0x4365b3
push 0x4afd80
push esi
call fcn.0042f810
add esp, 8
test eax, eax
jne 0x4365b3
push esi
lea ecx, [esp + 0x90]
lea ebp, [eax + 4]
call fcn.0040a3b0
push 0x4af938
lea ecx, [esp + 0xc8]
call fcn.0040a3b0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x90]
call fcn.004316d0
mov esi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x90]
call fcn.00420f20
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x90]
mov edi, eax
call fcn.004316d0
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push fcn.00473332
push edx
mov edx, dword [edi + 4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00431970
add esp, 0x20
push ebx
push 0x4afd78
lea ecx, [esp + 0x94]
call fcn.00414630
cmp eax, 0xffffffff
je 0x4364e4
mov edx, dword [esp + 0xa0]
push edx
push ebx
push 0x4afd78
lea ecx, [esp + 0x98]
call fcn.00414630
push eax
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x98]
call fcn.00422400
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409c10
lea ecx, [esp + 0xa8]
call fcn.00421300
push ebx
push 0x4b51cc
lea ecx, [esp + 0xcc]
call fcn.00430f40
cmp eax, 0xffffffff
je 0x4364e4
push ebx
push 0x4b51cc
lea ecx, [esp + 0xcc]
call fcn.00430f40
push eax
push ebx
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0xd0]
call fcn.00422400
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd0]
call fcn.00409c10
lea ecx, [esp + 0xa8]
call fcn.00421300
cmp dword [esp + 0xd8], ebx
je 0x43659b
push 0x4ae6a3
lea ecx, [esp + 0x74]
mov byte [esp + 0x18], 1
call fcn.00404650
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0xc8]
push eax
call fcn.00449c00
add esp, 8
push 3
push ebx
lea ecx, [esp + 0x78]
call fcn.00403750
push ebx
push 0x4afd74
lea ecx, [esp + 0x78]
call fcn.00430db0
cmp eax, 0xffffffff
je 0x436562
lea esp, [esp]
push 1
push eax
lea ecx, [esp + 0x78]
call fcn.00403750
push 1
push ebx
push 0x4afd74
lea ecx, [esp + 0x7c]
call fcn.00430590
cmp eax, 0xffffffff
jne 0x436540
lea ecx, [esp + 0x70]
push ecx
call fcn.0043b3e0
add esp, 4
test al, al
je 0x436592
cmp dword [esp + 0x88], 0x10
mov eax, dword [esp + 0x74]
jae 0x436585
lea eax, [esp + 0x74]
push eax
call fcn.0047164e
add esp, 4
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x70]
call fcn.00418c00
lea ecx, [esp + 0xc4]
call fcn.00421300
lea ecx, [esp + 0x8c]
call fcn.00421300
lea eax, [ebp - 1]
xor edi, edi
cmp eax, 3
ja case.default.0x4365c1
jmp dword [eax*4 + 0x436960]
mov edx, dword [esp + 0x33c]
push edx
mov ecx, 0x4c8ca8
call fcn.00432600
mov edi, eax
lea eax, [esp + 0x70]
push ebx
push eax
call fcn.0043c600
lea ecx, [esp + 0xcc]
push ebx
push ecx
call fcn.0043c6b0
push str.DownloadProxyPS.dll
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0xa4]
push eax
call fcn.0040a3f0
add esp, 0x1c
cmp dword [esp + 0x84], ebx
je 0x4367ae
cmp ebp, 1
mov eax, dword [esp + 0x74]
jne 0x43671c
mov ebp, 8
cmp dword [esp + 0x88], ebp
jae 0x43663e
lea eax, [esp + 0x74]
mov ecx, dword [0x4c60a8]
push ecx
push eax
call fcn.00438000
mov eax, dword [esp + 0x7c]
add esp, 8
cmp dword [esp + 0x88], ebp
jae 0x43665f
lea eax, [esp + 0x74]
mov edx, dword [0x4c60a8]
push edx
push eax
call fcn.00437da0
add esp, 8
push 0x4afc18
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
push str._s__
push ecx
call fcn.00431e70
add esp, 0xc
push eax
lea edx, [esp + 0xb0]
push edx
call fcn.0040a3f0
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.00421300
cmp dword [esp + 0xc0], ebp
mov eax, dword [esp + 0xac]
jae 0x4366bf
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2b4
call fcn.00470fce
add esp, 4
cmp eax, ebx
je 0x43670b
mov ecx, eax
call fcn.0044cae0
mov esi, eax
cmp esi, ebx
je 0x43670b
mov ecx, esi
call fcn.00450720
mov ecx, esi
call fcn.004511c0
mov ecx, esi
call fcn.0044b190
push esi
call fcn.00470fc9
add esp, 4
lea ecx, [esp + 0xa8]
call fcn.00421300
jmp 0x4367b3
mov esi, 8
cmp dword [esp + 0x88], esi
jae 0x43672e
lea eax, [esp + 0x74]
mov ecx, dword [0x4c60a8]
push ecx
push eax
call fcn.00438000
add esp, 8
push 0x4afc18
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x40]
push str._u__s__
push eax
call fcn.00431e70
add esp, 0xc
push eax
lea ecx, [esp + 0xb0]
push ecx
call fcn.0040a3f0
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.00421300
cmp dword [esp + 0xc0], esi
mov eax, dword [esp + 0xac]
jae 0x43678e
lea eax, [esp + 0xac]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xa8]
call fcn.00421300
mov ebp, esi
jmp 0x4367b3
mov ebp, 8
cmp dword [esp + 0xa4], ebp
jb 0x4367cc
mov edx, dword [esp + 0x90]
push edx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0xdc], ebp
mov esi, 7
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], ebx
mov word [esp + 0x90], bx
jb 0x436800
mov eax, dword [esp + 0xc8]
push eax
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x88], ebp
mov dword [esp + 0xdc], esi
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], bx
jb 0x4368ed
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00470fc9
add esp, 4
jmp 0x4368ed
lea edx, [esp + 0x18]
push edx
call fcn.0042f1c0
mov ecx, dword [eax]
add esp, 4
call fcn.0042f2e0
lea ecx, [esp + 0x18]
call fcn.00420080
mov eax, dword [esp + 0x33c]
push eax
mov ecx, 0x4c8ca8
call fcn.00432600
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
call fcn.0042f1c0
mov ecx, dword [eax]
add esp, 4
call fcn.0042bad0
lea ecx, [esp + 0x20]
call fcn.00420080
call fcn.00428b10
jmp case.default.0x4365c1
push 0x2b4
call fcn.00470fce
add esp, 4
cmp eax, ebx
je 0x436956
mov ecx, eax
call fcn.0044cae0
mov esi, eax
cmp esi, ebx
je 0x4368cb
mov ecx, esi
call fcn.0044cf80
mov ecx, esi
call fcn.0044da00
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.0044b720
push esi
call fcn.004355a0
add esp, 4
cmp esi, ebx
je case.default.0x4365c1
mov ecx, esi
call fcn.0044b190
push esi
call fcn.00470fc9
add esp, 4
mov ebp, 8
cmp dword [esp + 0xf8], ebp
pop esi
jb 0x436907
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x110], ebp
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], ebx
mov word [esp + 0xe0], bx
jb 0x43693a
mov edx, dword [esp + 0xfc]
push edx
call fcn.00470fc9
add esp, 4
mov ecx, dword [esp + 0x324]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00470f90
add esp, 0x31c
ret 0x10
xor esi, esi
jmp 0x4368cb