Function at 0x435890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520d63
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x270], ecx
push 0x208
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
call fcn.00445180
push 0x104
lea edx, [ebp - 0x254]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x4c]
mov dword [ebp - 0x4c], 0x740055
mov dword [ebp - 0x48], 0x6c0069
mov dword [ebp - 0x44], 0x5c0073
mov dword [ebp - 0x40], 0x64006c
mov dword [ebp - 0x3c], 0x670073
mov dword [ebp - 0x38], 0x6d0061
mov dword [ebp - 0x34], 0x630065
mov dword [ebp - 0x30], 0x6e0065
mov dword [ebp - 0x2c], 0x650074
mov dword [ebp - 0x28], 0x5f0072
mov dword [ebp - 0x24], 0x690062
mov dword [ebp - 0x20], 0x68007a
mov dword [ebp - 0x1c], 0x2e0069
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x14], 0x6c
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x435c3b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x258]
test eax, 0xffff0000
jne 0x435999
movzx eax, ax
push eax
call fcn.00409590
jmp 0x43599f
push eax
call fcn.0040e660
mov esi, dword [ebp - 0x258]
lea eax, [ebp - 0x254]
push esi
push eax
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4359d2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x254]
push eax
call fcn.00468a00
add esp, 4
test eax, eax
je 0x435c12
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x435c12
push str.Start4RunDll
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x26c], eax
test eax, eax
je 0x435c12
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x435c45
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x258], eax
mov eax, str._S__NOSTARTMENU__BANAUTORUN__BANUNINSTREG__PIDbizhi__SUBPID
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x258]
test eax, 0xffff0000
jne 0x435a59
movzx eax, ax
push eax
call fcn.00409590
jmp 0x435a63
push str._S__NOSTARTMENU__BANAUTORUN__BANUNINSTREG__PIDbizhi__SUBPID
call fcn.0040e660
mov ecx, dword [0x583ddc]
mov dword [ebp - 4], 2
test ecx, ecx
jne 0x435ad1
push 0x57b310
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x583ddc], 0
jne 0x435ab8
push 0x1c
call fcn.004402f0
mov esi, eax
add esp, 4
mov dword [ebp - 0x25c], esi
test esi, esi
je 0x435ab0
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x435ab2
xor esi, esi
mov dword [0x583ddc], esi
push 0x57b310
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x583ddc]
test ecx, ecx
jne 0x435ad1
xor eax, eax
jmp 0x435b2d
mov eax, dword [0x583dd8]
test eax, eax
jne 0x435b2d
mov eax, dword [ecx]
push ecx
call dword [eax]
cmp dword [0x583dd8], 0
jne 0x435b1d
push 0x64
call fcn.004402f0
add esp, 4
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x435b0b
mov ecx, eax
call fcn.00420ae0
mov ecx, eax
jmp 0x435b0d
xor ecx, ecx
mov byte [ebp - 4], 2
xchg dword [ebp - 0x264], eax
mov dword [0x583dd8], ecx
mov eax, dword [0x583ddc]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [0x583dd8]
mov ecx, eax
call fcn.004212e0
mov esi, dword [ebp - 0x258]
mov ebx, dword [eax]
mov eax, ebx
mov edi, dword [esi - 0xc]
sub eax, esi
sar eax, 1
mov dword [ebp - 0x268], eax
mov ecx, dword [ebx - 0xc]
mov dword [ebp - 0x25c], edi
test ecx, ecx
js 0x435c4f
test ebx, ebx
jne 0x435b6a
xor edx, edx
mov dword [ebp - 0x260], edx
jmp 0x435b7c
push ecx
push ebx
call fcn.004c5c1b
add esp, 8
mov dword [ebp - 0x260], eax
mov edx, eax
mov ecx, SysReAllocString
sub ecx, edx
cmp ecx, edi
jl 0x435c59
add edi, edx
js 0x435c63
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x435bbc
push edi
lea ecx, [ebp - 0x258]
call fcn.0040a220
mov esi, dword [ebp - 0x258]
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x25c]
cmp eax, ecx
ja 0x435bcf
lea ebx, [esi + eax*2]
push edx
push ebx
push edx
lea eax, [esi + ecx*2]
push eax
call fcn.0040ade0
add esp, 0x10
cmp edi, dword [esi - 8]
jg 0x435c4f
xor eax, eax
mov dword [esi - 0xc], edi
push esi
mov word [esi + edi*2], ax
call dword [ebp - 0x26c]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x435c12
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x270]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80070057
call fcn.00408b70
push 0x80070057
call fcn.00408b70
push 0x80070057
call fcn.00408b70
int3