Function at 0x324375e8
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
sub ebx, ebx
cmp dword [0x3243ab84], ebx
jne 0x3243762f
push 0x468
push dword [0x3243a378]
call fcn.32436bf8
cmp eax, ebx
mov dword [0x3243ab84], eax
jne 0x32437619
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push eax
call fcn.32437308
cmp eax, ebx
mov dword [0x3243ab80], eax
jne 0x3243762f
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push esi
push edi
mov eax, dword [0x3243ab98]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x32437677
push 0xffffffffffffffff
push ebx
call fcn.32436bf8
mov esi, eax
cmp esi, ebx
je 0x32437660
push esi
call fcn.32437308
push esi
mov dword [ebp - 4], eax
call fcn.32438368
cmp dword [ebp - 4], ebx
pop ecx
jne 0x32437674
mov eax, dword [0x3243ab80]
push ebx
push dword [0x3243ab84]
mov dword [ebp - 4], eax
call fcn.32436ab0
mov eax, dword [ebp - 4]
cmp dword [eax], 5
je 0x324376b4
add eax, 4
cmp byte [eax], bl
je 0x324376b4
cmp byte [0x3243ab90], bl
jne 0x324376b4
lea ecx, [ebp - 8]
mov byte [0x3243ab90], 1
push ecx
push ebx
push eax
call fcn.32438472
pop ecx
push eax
push dword [str.xkC2]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.3243843a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov esi, dword [0x3243a464]
mov edi, dword [ebp - 0x10]
push 0xd
pop ecx
lodsb al, byte [esi]
sub al, 0xe0
add al, 6
stosb byte es:[edi], al
dec ecx
jne 0x324376ce
lea eax, [ebp - 0x20]
push eax
call fcn.32435ecc
cmp eax, dword [0x3243aba0]
ja 0x324376ed
mov eax, dword [0x3243aba0]
cmp eax, dword [ebp - 0xc]
jae 0x32437701
mov ecx, dword [ebp - 0xc]
sub ecx, eax
cmp ecx, 0x1fa40
jb 0x3243774a
jmp 0x3243770d
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.32434908
mov eax, dword [ebp - 4]
add eax, 0xbd
cmp byte [eax], bl
je 0x3243774a
cmp byte [0x3243ab8c], bl
jne 0x3243774a
lea ecx, [ebp - 8]
mov byte [0x3243ab8c], 1
push ecx
push ebx
push eax
call fcn.32438472
pop ecx
push eax
push dword [0x3243a430]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
push 0x3243a4a0
pop esi
mov edi, dword [ebp - 0x10]
push 0x10
pop ecx
lodsb al, byte [esi]
add al, 0x75
xor al, 0x6a
stosb byte es:[edi], al
dec ecx
jne 0x3243775c
lea eax, [ebp - 0x30]
push eax
call fcn.32435ecc
pop edi
pop esi
cmp dword [0x3243ab9c], ebx
jne 0x3243777f
mov dword [0x3243ab9c], eax
jmp 0x3243778e
cmp eax, dword [0x3243ab9c]
ja 0x3243778e
push dword [0x3243ab9c]
pop eax
push dword [ebp - 0xc]
pop ecx
cmp eax, ecx
jae 0x324377a2
sub ecx, eax
cmp ecx, 0xa8c0
jb 0x324377d6
jmp 0x324377ac
lea eax, [ebp - 0x30]
push ecx
push eax
call fcn.32434908
cmp byte [0x3243ab88], bl
jne 0x324377d6
lea eax, [ebp - 8]
mov byte [0x3243ab88], 1
push eax
push ebx
push ebx
push dword [str._nC2_6HI]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [0x3243ab94], ebx
je 0x3243780a
mov eax, dword [0x3243ab94]
cmp eax, dword [0x3243ab80]
je 0x3243780a
push dword [0x3243ab94]
pop eax
cmp eax, dword [ebp - 4]
je 0x3243780a
push dword [0x3243ab94]
pop eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.32438368
pop ecx
mov eax, dword [ebp - 4]
mov dword [0x3243ab94], eax
pop ebx
leave
ret