Function at 0x32434988
Capabilities:
Encode data using xor
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [0x32439bd8]
push dword [0x3243992c]
push dword fs:[0]
pop eax
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and byte [ebp - 0x1c], 0
and dword [ebp - 4], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x3243510b
lea eax, [ebp - 0x5c]
push eax
call fcn.324384a5
pop ecx
push 0xc
pop ebx
push ebx
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x6c], edx
push dword [0x324395b4]
pop esi
mov edi, dword [ebp - 0x6c]
push 0xb
pop ecx
lodsb al, byte [esi]
add al, 0xde
sub al, 0xe
stosb byte es:[edi], al
dec ecx
jne 0x324349fd
mov dword [ebp - 0x70], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push 8
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x74], edx
mov esi, dword [str.391_]
push dword [ebp - 0x74]
pop edi
mov ecx, 5
lodsb al, byte [esi]
add al, 0xd2
sub al, 0x9e
stosb byte es:[edi], al
dec ecx
jne 0x32434a3c
mov dword [ebp - 0x78], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
or eax, eax
jne 0x324350a9
push ebx
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x7c], edx
mov esi, str.nsyvivnqj
mov edi, dword [ebp - 0x7c]
mov ecx, 0xb
lodsb al, byte [esi]
sub al, 0x29
xor al, 0x24
stosb byte es:[edi], al
dec ecx
jne 0x32434a78
mov dword [ebp - 0x80], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
or eax, eax
jne 0x324350a9
push 8
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x84], edx
push dword [0x3243967c]
pop esi
push dword [ebp - 0x84]
pop edi
mov ecx, 8
lodsb al, byte [esi]
xor al, 0xaa
add al, 6
stosb byte es:[edi], al
dec ecx
jne 0x32434abe
mov dword [ebp - 0x88], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x8c], edx
mov esi, 0x32439d68
mov edi, dword [ebp - 0x8c]
mov ecx, 0xf
lodsb al, byte [esi]
sub al, 0xe5
xor al, 0xd8
stosb byte es:[edi], al
dec ecx
jne 0x32434b04
mov dword [ebp - 0x90], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
mov eax, ebx
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x94], edx
mov esi, 0x324398ec
mov edi, dword [ebp - 0x94]
push 0xc
pop ecx
lodsb al, byte [esi]
xor al, 0xdb
add al, 0x1c
stosb byte es:[edi], al
dec ecx
jne 0x32434b47
mov dword [ebp - 0x98], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x9c], edx
mov esi, dword [0x324399b0]
mov edi, dword [ebp - 0x9c]
mov ecx, 0x11
lodsb al, byte [esi]
add al, 0xcf
xor al, 0xcb
stosb byte es:[edi], al
dec ecx
jne 0x32434b8e
mov dword [ebp - 0xa0], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push 0x18
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0xa4], edx
push dword [0x32439a64]
pop esi
push dword [ebp - 0xa4]
pop edi
mov ecx, 0x17
lodsb al, byte [esi]
sub al, 0x1b
add al, 0x21
stosb byte es:[edi], al
dec ecx
jne 0x32434bd7
mov dword [ebp - 0xa8], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
push ebx
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0xac], edx
push dword [0x324396ec]
pop esi
push dword [ebp - 0xac]
pop edi
mov ecx, 0xb
lodsb al, byte [esi]
xor al, 0x41
sub al, 0x62
stosb byte es:[edi], al
dec ecx
jne 0x32434c1f
mov dword [ebp - 0xb0], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0xb4], edx
mov esi, 0x32439714
mov edi, dword [ebp - 0xb4]
mov ecx, 0xd
lodsb al, byte [esi]
add al, 0x56
sub al, 0x7b
stosb byte es:[edi], al
dec ecx
jne 0x32434c65
mov dword [ebp - 0xb8], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
mov eax, ebx
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0xbc], edx
mov esi, dword [0x3243998c]
mov edi, dword [ebp - 0xbc]
mov ecx, 0xa
lodsb al, byte [esi]
xor al, 0xf2
sub al, 0xe1
stosb byte es:[edi], al
dec ecx
jne 0x32434cab
mov dword [ebp - 0xc0], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push ebx
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0xc4], edx
push dword [0x32439628]
pop esi
mov edi, dword [ebp - 0xc4]
mov ecx, 9
lodsb al, byte [esi]
sub al, 0x36
xor al, 0x5f
stosb byte es:[edi], al
dec ecx
jne 0x32434cf2
mov dword [ebp - 0xc8], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push ebx
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0xcc], edx
push dword [0x3243983c]
pop esi
mov edi, dword [ebp - 0xcc]
mov ecx, 9
lodsb al, byte [esi]
add al, 0xb2
sub al, 0x8f
stosb byte es:[edi], al
dec ecx
jne 0x32434d39
mov dword [ebp - 0xd0], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
push 8
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0xd4], edx
push dword [0x324399e0]
pop esi
push dword [ebp - 0xd4]
pop edi
mov ecx, 6
lodsb al, byte [esi]
add al, 0
xor al, 0xda
stosb byte es:[edi], al
dec ecx
jne 0x32434d82
mov dword [ebp - 0xd8], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
push ebx
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0xdc], edx
push dword [0x32439dbc]
pop esi
push dword [ebp - 0xdc]
pop edi
mov ecx, 0xa
lodsb al, byte [esi]
sub al, 0x7c
add al, 0xcb
stosb byte es:[edi], al
dec ecx
jne 0x32434dca
mov dword [ebp - 0xe0], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0xe4], edx
push dword [0x324397b8]
pop esi
push dword [ebp - 0xe4]
pop edi
push 0x12
pop ecx
lodsb al, byte [esi]
add al, 0xeb
sub al, 0x2b
stosb byte es:[edi], al
dec ecx
jne 0x32434e11
mov dword [ebp - 0xe8], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
or eax, eax
jne 0x324350a9
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0xec], edx
mov esi, dword [0x32439bd4]
push dword [ebp - 0xec]
pop edi
mov ecx, 0x10
lodsb al, byte [esi]
xor al, 0x65
sub al, 0x43
stosb byte es:[edi], al
dec ecx
jne 0x32434e59
mov dword [ebp - 0xf0], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0xf4], edx
push dword [0x324395d4]
pop esi
mov edi, dword [ebp - 0xf4]
push 0xe
pop ecx
lodsb al, byte [esi]
add al, 0xe0
xor al, 0xf
stosb byte es:[edi], al
dec ecx
jne 0x32434e9f
mov dword [ebp - 0xf8], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
or eax, eax
jne 0x324350a9
push 8
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0xfc], edx
push str._2___
pop esi
push dword [ebp - 0xfc]
pop edi
mov ecx, 8
lodsb al, byte [esi]
xor al, 0xae
sub al, 0x28
stosb byte es:[edi], al
dec ecx
jne 0x32434ee7
mov dword [ebp - 0x100], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
mov eax, ebx
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x104], edx
mov esi, dword [0x32439424]
push dword [ebp - 0x104]
pop edi
mov ecx, 9
lodsb al, byte [esi]
add al, 0x31
xor al, 0x54
stosb byte es:[edi], al
dec ecx
jne 0x32434f2e
mov dword [ebp - 0x108], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
or eax, eax
jne 0x324350a9
push 8
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x10c], edx
push dword [0x32439e74]
pop esi
mov edi, dword [ebp - 0x10c]
push 6
pop ecx
lodsb al, byte [esi]
xor al, 0x68
sub al, 0x44
stosb byte es:[edi], al
dec ecx
jne 0x32434f74
mov dword [ebp - 0x110], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x114], edx
push 0x3243943c
pop esi
mov edi, dword [ebp - 0x114]
push 0xe
pop ecx
lodsb al, byte [esi]
add al, 2
xor al, 0xf2
stosb byte es:[edi], al
dec ecx
jne 0x32434fb9
mov dword [ebp - 0x118], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
mov eax, ebx
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x11c], edx
mov esi, dword [str.I54_:5__]
push dword [ebp - 0x11c]
pop edi
mov ecx, 9
lodsb al, byte [esi]
add al, 0xb4
xor al, 0x9c
stosb byte es:[edi], al
dec ecx
jne 0x32435000
mov dword [ebp - 0x120], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
test eax, eax
jne 0x324350a9
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x124], edx
mov esi, dword [0x32439764]
push dword [ebp - 0x124]
pop edi
mov ecx, 0x11
lodsb al, byte [esi]
xor al, 0xd2
add al, 0x1c
stosb byte es:[edi], al
dec ecx
jne 0x32435048
mov dword [ebp - 0x128], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
jne 0x324350a9
push ebx
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x12c], edx
push dword [0x32439de8]
pop esi
push dword [ebp - 0x12c]
pop edi
push 9
pop ecx
lodsb al, byte [esi]
add al, 0xc0
xor al, 5
stosb byte es:[edi], al
dec ecx
jne 0x3243508a
mov dword [ebp - 0x130], edx
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.3243829c
pop ecx
pop ecx
and eax, eax
je 0x3243510b
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
test eax, eax
je 0x324350fe
push dword [ebp - 0x60]
call fcn.324369bc
pop ecx
test al, al
jne 0x324350fe
push 2
push dword [ebp + 8]
call sub.USER32.dll_GetAncestor
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x68]
push ecx
push eax
call esi
or eax, eax
je 0x324350fe
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x60]
jne 0x324350fe
push 0
push 0xf060
push 0x112
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 0x1c], 1
jmp 0x3243510b
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4