Function at 0x32435c28
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Encrypt data using rc4 ksa
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x2c
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, 0x32439528
mov edi, dword [ebp - 4]
mov ecx, 0x2a
lodsb al, byte [esi]
xor al, 0x5a
sub al, 0xa0
stosb byte es:[edi], al
dec ecx
jne 0x32435c49
push esp
push 0
call fcn.32434924
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push eax
call ebx
push 0x28
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x324393fc]
pop esi
push dword [ebp - 4]
pop edi
mov ecx, 0x27
lodsb al, byte [esi]
sub al, 0x50
add al, 0x84
stosb byte es:[edi], al
dec ecx
jne 0x32435c7e
push esp
push 0
call fcn.32434924
push eax
call ebx
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439afc]
pop esi
push dword [ebp - 4]
pop edi
push 9
pop ecx
lodsb al, byte [esi]
add al, 0xa4
xor al, 0x65
stosb byte es:[edi], al
dec ecx
jne 0x32435cab
push esp
push 0
call fcn.32434924
push eax
call ebx
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439ac4]
pop esi
push dword [ebp - 4]
pop edi
push 0xd
pop ecx
lodsb al, byte [esi]
add al, 0x43
sub al, 0x1a
stosb byte es:[edi], al
dec ecx
jne 0x32435cd8
push esp
push 0
call fcn.32434924
push eax
call ebx
push 0x28
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, 0x3243958c
push dword [ebp - 4]
pop edi
push 0x27
pop ecx
lodsb al, byte [esi]
add al, 0xc4
sub al, 0x39
stosb byte es:[edi], al
dec ecx
jne 0x32435d03
push esp
push 0
call fcn.32434924
push eax
call ebx
push 0x28
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x32439818]
push dword [ebp - 4]
pop edi
mov ecx, 0x27
lodsb al, byte [esi]
sub al, 0xbe
xor al, 0xf3
stosb byte es:[edi], al
dec ecx
jne 0x32435d31
push esp
push 0
call fcn.32434924
push eax
call ebx
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439d14]
pop esi
mov edi, dword [ebp - 4]
push 0xc
pop ecx
lodsb al, byte [esi]
xor al, 0x73
add al, 0x5a
stosb byte es:[edi], al
dec ecx
jne 0x32435d5d
push esp
push 0
call fcn.32434924
push eax
call ebx
cmp byte [0x3243a67c], 0
je 0x32435d9f
push 0x18
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x32439e30]
push dword [ebp - 4]
pop edi
push 0x16
pop ecx
lodsb al, byte [esi]
sub al, 0xef
add al, 0xd8
stosb byte es:[edi], al
dec ecx
jne 0x32435d92
push esp
pop eax
jmp 0x32435dc1
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x32439e0c]
mov edi, dword [ebp - 4]
push 0xf
pop ecx
lodsb al, byte [esi]
add al, 0xd0
xor al, 0x72
stosb byte es:[edi], al
dec ecx
jne 0x32435db6
mov eax, esp
push eax
xor edi, edi
push 4
push edi
push 4
call fcn.32434924
push dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
pop ebx
push eax
push 0xffffffffffffffff
call ebx
cmp eax, edi
je 0x32435e03
push 4
push edi
push edi
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x32435e03
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
and eax, 0x7fffff00
add eax, 0xff
mov dword [esi], eax
cmp byte [0x3243a67c], 0
je 0x32435e32
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439518]
pop esi
push dword [ebp - 4]
pop edi
push 0xe
pop ecx
lodsb al, byte [esi]
xor al, 0x78
add al, 0x75
stosb byte es:[edi], al
dec ecx
jne 0x32435e25
push esp
pop eax
jmp 0x32435e53
push 8
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, 0x3243979c
mov edi, dword [ebp - 4]
push 7
pop ecx
lodsb al, byte [esi]
sub al, 0xde
add al, 0xe3
stosb byte es:[edi], al
dec ecx
jne 0x32435e48
push esp
pop eax
push eax
push 4
pop edi
sub esi, esi
push edi
push esi
push edi
call fcn.32434924
push eax
push 0xffffffffffffffff
call ebx
cmp eax, esi
je 0x32435e8e
push edi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov esi, eax
or esi, esi
je 0x32435e8e
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
and eax, 0x7fffff00
add eax, 0xff
mov dword [esi], eax
push dword [0x3243a684]
pop esi
sub ecx, ecx
push esi
pop eax
push 0x19
and eax, 0xff
xor edx, edx
pop ebx
div ebx
shr esi, 8
add dl, 0x61
mov byte [ecx + ebp - 0xc], dl
inc ecx
cmp ecx, edi
jl 0x32435e97
and byte [ecx + ebp - 0xc], 0
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.324367e4
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret