Function at 0x437580
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
push esi
push 0
call fcn.004635bd
add esp, 4
push eax
call fcn.00461f3d
add esp, 4
mov esi, 0xa
call fcn.00436150
mov byte [esp + 0x90], al
mov ecx, 0x4b2278
push dword [esp + 0x90]
call fcn.00439c90
call fcn.00436150
mov byte [esp + 0x94], al
mov ecx, 0x4b2150
push dword [esp + 0x94]
call fcn.00439c90
call fcn.00436150
mov byte [esp + 8], al
mov ecx, 0x4b2208
push dword [esp + 8]
call fcn.00439c90
sub esi, 1
jne 0x4375a5
mov dword [esp + 8], 0xa7d0d293
xor ecx, ecx
mov word [esp + 0xc], 0x100
nop dword [eax]
mov al, cl
sub al, 0x43
xor byte [esp + ecx + 8], al
inc ecx
cmp ecx, 4
jb 0x437610
lea eax, [esp + 8]
mov byte [esp + 0xd], 0
push eax
mov ecx, 0x4b2150
call fcn.00438570
cmp dword [0x4b228c], 0x10
mov eax, 0x4b2278
cmovae eax, dword [0x4b2278]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.00436320
test al, al
jne 0x43776d
push 0
push 0
push 0
push 0x429d20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00436230
movaps xmm0, xmmword [0x491d80]
movups xmmword [esp + 0x10], xmm0
push ecx
movaps xmm0, xmmword [0x491fe0]
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x54], 0x688b918f
movaps xmm0, xmmword [0x491c80]
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x58], 0x70666c2f
movaps xmm0, xmmword [0x491ca0]
movups xmmword [esp + 0x44], xmm0
mov word [esp + 0x5c], 0x58
mov byte [esp + 0x5e], 1
call fcn.00437520
push ecx
mov edx, eax
call fcn.0043aae0
add esp, 4
mov ecx, eax
call fcn.00439360
movaps xmm0, xmmword [0x490f70]
mov ecx, 0x4b2278
movups xmmword [esp + 0x10], xmm0
push 0x10
movaps xmm0, xmmword [0x490f90]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x74], 0xf787933
movaps xmm0, xmmword [0x4917f0]
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x78], 0x76444349
movaps xmm0, xmmword [0x4912b0]
movups xmmword [esp + 0x44], xmm0
mov dword [esp + 0x7c], 0x6c426247
movaps xmm0, xmmword [str.Guqplpm_im]
movups xmmword [esp + 0x54], xmm0
mov dword [esp + 0x80], 0x100607e
movaps xmm0, xmmword [0x491be0]
movups xmmword [esp + 0x64], xmm0
call fcn.00438560
push eax
lea ecx, [esp + 0x18]
call fcn.00437550
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 8], 0xb0fefced
xor ecx, ecx
mov word [esp + 0xc], 0xb1
mov byte [esp + 0xe], 1
mov al, cl
sub al, 0x43
xor byte [esp + ecx + 8], al
inc ecx
cmp ecx, 5
jb 0x437783
push 0
lea eax, [esp + 0xc]
mov byte [esp + 0x12], 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push 0x4b4e38
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x437851
call fcn.00438240
mov dword [eax + 0x10], esi
lea eax, [esp + 0x80]
push eax
call fcn.00438240
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x88]
sub esi, dword [esp + 0x80]
call fcn.00438240
mov dword [eax + 0x1c], esi
mov esi, dword [esp + 0x8c]
sub esi, dword [esp + 0x84]
call fcn.00438240
mov dword [eax + 0x18], esi
call fcn.00438240
mov ecx, dword [esp + 0x80]
mov dword [eax + 0x20], ecx
call fcn.00438240
mov ecx, dword [esp + 0x88]
mov dword [eax + 0x24], ecx
call fcn.00438240
mov ecx, dword [esp + 0x84]
mov dword [eax + 0x28], ecx
call fcn.00438240
mov ecx, dword [esp + 0x8c]
mov dword [eax + 0x2c], ecx
call fcn.0042a230
call fcn.00436450
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x491ec0]
lea ecx, [esp + 0x10]
push 5
movups xmmword [esp + 0x14], xmm0
push 0
movaps xmm0, xmmword [0x491f80]
push 0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], 0xa7a9aebc
mov dword [esp + 0x40], 0xd7afd6a0
mov dword [esp + 0x44], 0x8ca9d0
mov byte [esp + 0x48], 1
mov dword [esp + 0x14], 0xaedaced2
mov word [esp + 0x18], 0x100
call fcn.0042e400
push eax
lea ecx, [esp + 0x18]
call fcn.00429cf0
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push 0x429d20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x490f50]
mov ecx, 0x4b2278
movups xmmword [esp + 0x10], xmm0
push 0x10
movaps xmm0, xmmword [0x491cb0]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x44], 0x9fa3ce83
movaps xmm0, xmmword [0x491d50]
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x48], 0x8a9093
mov byte [esp + 0x4c], 1
call fcn.00438560
push eax
lea ecx, [esp + 0x18]
call fcn.004362f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
push 0x64
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Beep]
push 0xa
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]