Function at 0x44defd
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff44c
push ebx
push esi
push edi
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov ebx, 0x49e0bc
lea eax, [ebx + 0x1f]
call fcn.00465cac
mov dword [ebp - 0xc], eax
cmp edi, 0xffffffff
jne 0x44df83
mov edi, dword [ebp - 0xc]
xor esi, esi
cmp edi, esi
jle 0x44df83
push esi
lea eax, [ebx + 0x1f]
push eax
lea edx, [ebp - 0x2b0]
push edx
call fcn.004908b8
add esp, 0xc
lea ecx, [ebx + 0xb]
lea edx, [ebx + 0x2b]
lea eax, [ebp - 0x2b0]
push ecx
lea ecx, [ebp - 0x260]
push pe_nt_image_headers32
call fcn.00465984
push dword [ebp + 8]
lea eax, [ebp - 0x260]
push eax
call fcn.0048d89c
add esp, 8
test eax, eax
jne 0x44df7e
mov edi, esi
jmp 0x44df83
inc esi
cmp edi, esi
jg 0x44df33
cmp edi, 0xfffffffe
jne 0x44df9a
lea eax, [ebx + 0x6e]
push eax
lea edx, [ebp - 0x60]
push edx
call fcn.004908b8
add esp, 8
jmp 0x44dfab
push edi
lea ecx, [ebx + 0x1f]
push ecx
lea eax, [ebp - 0x60]
push eax
call fcn.004908b8
add esp, 0xc
lea edx, [ebx + 0x2b]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 8]
call fcn.004657a8
cmp byte [ebp - 6], 0
je 0x44dff0
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x44dff0
push esi
lea eax, [ebx + 0x1f]
push eax
lea edx, [ebp - 0x300]
push edx
call fcn.004908b8
add esp, 0xc
lea edx, [ebx + 0x30]
lea eax, [ebp - 0x300]
xor ecx, ecx
call fcn.004658b0
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x44dfc6
xor ecx, ecx
mov cl, byte [ebp - 6]
lea edx, [ebx + 0x30]
lea eax, [ebp - 0x60]
call fcn.004658b0
lea edx, [ebx + 0x38]
lea eax, [ebp - 0x60]
call fcn.00465c48
lea edx, [ebx + 0x40]
lea eax, [ebp - 0x60]
call fcn.00465c48
lea edx, [ebx + 0x4a]
lea eax, [ebp - 0x60]
xor ecx, ecx
call fcn.004658b0
cmp dword [ebp - 4], 0
je 0x44e10b
push 0x6b
push dword [ebp - 4]
call sub.USER32.DLL_IsDlgButtonChecked
mov ecx, eax
lea edx, [ebx + 0x4a]
lea eax, [ebp - 0x60]
call fcn.004658b0
push 0x66
push dword [ebp - 4]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x44e079
push 0x400
lea eax, [ebp - 0x700]
push eax
push 0x67
push dword [ebp - 4]
call sub.USER32.DLL_GetDlgItemTextA
lea ecx, [ebp - 0x700]
lea edx, [ebx + 0x38]
lea eax, [ebp - 0x60]
call fcn.004657a8
push 0x68
push dword [ebp - 4]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x44e10b
push 0x69
push dword [ebp - 4]
call sub.USER32.DLL_GetDlgItem
mov edi, eax
push edi
call sub.USER32.DLL_GetWindowTextLengthA
add eax, 0xa
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, eax
push eax
call fcn.0048c0c4
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
mov edx, esi
mov eax, edi
call fcn.00467bc4
lea edx, [ebx + 0x40]
lea eax, [ebp - 0x60]
mov ecx, esi
call fcn.004657f4
push esi
call fcn.0048befc
cmp byte [ebp - 5], 0
pop ecx
je 0x44e0e6
lea eax, [ebx + 0x89]
call fcn.00465e04
test al, al
jne 0x44e10b
lea edx, [ebp - 0xb00]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0xb00]
lea edx, [ebx + 0x89]
lea eax, [ebp - 0x60]
call fcn.004657a8
cmp byte [ebp - 5], 0
jne 0x44e679
mov eax, dword [0x4b3338]
call fcn.0044c96c
mov esi, eax
mov eax, esi
call fcn.0040e5c4
mov ecx, eax
lea edx, [ebx + 0x90]
lea eax, [ebp - 0x60]
call fcn.004657a8
push esi
call fcn.0048befc
pop ecx
mov eax, dword [0x4b3344]
call fcn.0044c96c
mov esi, eax
mov eax, esi
call fcn.0040e5c4
mov ecx, eax
lea edx, [ebx + 0x9a]
lea eax, [ebp - 0x60]
call fcn.004657a8
push esi
call fcn.0048befc
pop ecx
cmp dword [0x4b12ec], 0
sete cl
and ecx, 1
lea edx, [ebx + 0x128]
lea eax, [ebp - 0x60]
call fcn.004658b0
mov ecx, 0x4aec6c
lea edx, [ebx + 0x12f]
lea eax, [ebp - 0x60]
call fcn.004657a8
lea edx, [ebx + 0x139]
lea eax, [ebp - 0x60]
call fcn.00465c48
mov ecx, 0x4b12f1
lea edx, [ebx + 0x13d]
lea eax, [ebp - 0x60]
call fcn.004657a8
mov ecx, 0x4b16f1
lea edx, [ebx + 0x151]
lea eax, [ebp - 0x60]
call fcn.004657a8
mov ecx, 0x4afc6c
lea edx, [ebx + 0x159]
lea eax, [ebp - 0x60]
call fcn.004657a8
cmp byte [0x4afc6c], 0
je 0x44e1ec
lea ecx, [ebx + 0xb]
jmp 0x44e1f8
mov eax, dword [0x4bf13c]
call fcn.0040e5c4
mov ecx, eax
lea edx, [ebx + 0x161]
lea eax, [ebp - 0x60]
call fcn.004657a8
cmp dword [0x4b0928], 0x80000000
jne 0x44e233
cmp dword [0x4b0924], 0
jne 0x44e233
lea edx, [ebx + 0x375]
push edx
lea ecx, [ebp - 0xb34]
push ecx
call fcn.0048d8e8
add esp, 8
jmp 0x44e24a
push dword [0x4b0928]
push dword [0x4b0924]
lea eax, [ebp - 0xb34]
call fcn.0040b48c
lea ecx, [ebp - 0xb34]
lea edx, [ebx + 0x169]
lea eax, [ebp - 0x60]
call fcn.004657a8
xor ecx, ecx
mov cl, byte [0x4b0a13]
lea edx, [ebx + 0x17c]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0a10]
lea edx, [ebx + 0x185]
lea eax, [ebp - 0x60]
call fcn.004658b0
lea edx, [ebx + 0x191]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b0904]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0919]
lea edx, [ebx + 0x19e]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0918]
lea edx, [ebx + 0x1a5]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0959]
lea edx, [ebx + 0x1ab]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0958]
lea edx, [ebx + 0x1b5]
lea eax, [ebp - 0x60]
call fcn.004658b0
lea edx, [ebx + 0x1ba]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b090c]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0916]
lea edx, [ebx + 0x1c0]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0a12]
lea edx, [ebx + 0x1c3]
lea eax, [ebp - 0x60]
call fcn.004658b0
lea edx, [ebx + 0x1c8]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b0900]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0955]
lea edx, [ebx + 0x1d1]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0915]
lea edx, [ebx + 0x1db]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0914]
lea edx, [ebx + 0x1e6]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0a11]
lea edx, [ebx + 0x1ef]
lea eax, [ebp - 0x60]
call fcn.004658b0
lea edx, [ebx + 0x1f4]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b08fc]
call fcn.004658b0
lea edx, [ebx + 0x1fb]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4ae868]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b1af1]
lea edx, [ebx + 0x243]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b1af2]
lea edx, [ebx + 0x24e]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0eda]
lea edx, [ebx + 0x25b]
lea eax, [ebp - 0x60]
call fcn.004658b0
push 0x4b046c
lea eax, [ebp - 0xbb4]
push eax
call fcn.0048d8e8
add esp, 8
lea edx, [ebp - 0xbb4]
push edx
call fcn.0048d918
pop ecx
mov edx, eax
inc edx
xor eax, eax
cmp edx, eax
jle 0x44e447
mov ecx, eax
add cl, 0x49
xor byte [ebp + eax - 0xbb4], cl
inc eax
cmp edx, eax
jg 0x44e436
push edx
lea ecx, [ebp - 0xbb4]
lea eax, [ebp - 0x60]
lea edx, [ebx + 0x206]
call fcn.004658f0
xor ecx, ecx
mov cl, byte [0x4b04ec]
lea edx, [ebx + 0x20f]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0956]
lea edx, [ebx + 0x21e]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b0948]
lea edx, [ebx + 0x229]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b09ac]
lea edx, [ebx + 0x237]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4b095a]
lea edx, [ebx + 0x264]
lea eax, [ebp - 0x60]
call fcn.004658b0
lea edx, [ebx + 0x274]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b0ed4]
call fcn.004658b0
mov ecx, 0x4b095b
lea edx, [ebx + 0x283]
lea eax, [ebp - 0x60]
call fcn.004657a8
lea edx, [ebx + 0x2ae]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4bf144]
call fcn.004658b0
lea edx, [ebx + 0x2bb]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4bf148]
call fcn.004658b0
lea edx, [ebx + 0x2c4]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4bf14c]
call fcn.004658b0
lea edx, [ebx + 0x2ce]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4bf150]
call fcn.004658b0
mov eax, 0x4b09b8
call fcn.004130a0
mov ecx, eax
lea edx, [ebx + 0x2e4]
lea eax, [ebp - 0x60]
call fcn.004658b0
mov eax, 0x4b09e4
call fcn.004130a0
mov ecx, eax
lea edx, [ebx + 0x2f3]
lea eax, [ebp - 0x60]
call fcn.004658b0
cmp dword [0x4b0940], 1
sete cl
and ecx, 1
lea edx, [ebx + 0x301]
lea eax, [ebp - 0x60]
call fcn.004658b0
cmp dword [0x4b0940], 2
sete cl
and ecx, 1
lea edx, [ebx + 0x311]
lea eax, [ebp - 0x60]
call fcn.004658b0
lea edx, [ebx + 0x31f]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b0edc]
call fcn.004658b0
lea edx, [ebx + 0x325]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b0ee0]
call fcn.004658b0
lea edx, [ebx + 0x32b]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4b0ee4]
call fcn.004658b0
cmp dword [0x4b091c], 3
sete cl
and ecx, 1
lea edx, [ebx + 0x331]
lea eax, [ebp - 0x60]
call fcn.004658b0
cmp dword [0x4b091c], 2
sete cl
and ecx, 1
lea edx, [ebx + 0x33a]
lea eax, [ebp - 0x60]
call fcn.004658b0
cmp dword [0x4b091c], 5
sete cl
and ecx, 1
lea edx, [ebx + 0x344]
lea eax, [ebp - 0x60]
call fcn.004658b0
xor ecx, ecx
mov cl, byte [0x4bf156]
lea edx, [ebx + 0x352]
lea eax, [ebp - 0x60]
call fcn.004658b0
mov ecx, 0x4b0ad4
lea edx, [ebx + 0x35e]
lea eax, [ebp - 0x60]
call fcn.004657a8
push 0xc0
mov ecx, 0x4b0a14
lea edx, [ebx + 0x369]
lea eax, [ebp - 0x60]
call fcn.004658f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8