Function at 0x444640
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x294
mov ebx, dword [esp + 0x2b4]
mov dword [esp + 0x7b], 0xe48040
mov dword [esp + 0x78], 0x4010ec83
mov dword [esp + 0x74], 0x48e78948
mov dword [esp + 0x70], 0xce8948fc
lea edi, [esp + 0x94]
lea eax, [esp + 0x70]
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa0]
lea eax, [esp + 0x7c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x7e]
mov byte [esp + 0xa2], al
mov dword [esp], ebx
cmp ebx, 4
jb 0x4446b5
mov dword [esp], 4
lea esi, [esp + 0xa3]
test ebx, ebx
je 0x444aaa
xor ebp, ebp
jmp 0x4446da
inc ebp
cmp ebp, dword [esp]
je 0x4448e9
cmp ebp, 3
ja case.default.0x4446df
jmp dword [ebp*4 + 0x449af0]
mov dword [esp + 8], 0x6998e6ac
mov dword [esp + 0xc], 0
mov eax, 0xcfb3ed17
mov ecx, 0x304c12e8
movzx edi, byte [esp + eax + 0x304c12f1]
mov edx, eax
and edx, edi
add edx, edx
mov ebx, edx
sub ebx, edi
add ebx, ecx
or ebx, 0xf17c5e8c
add ebx, edi
sub edi, edx
add edi, eax
sub ebx, edx
lea edx, [eax + ebx]
inc edx
or edi, 0xf17c5e8c
mov ebx, edx
and ebx, edi
xor edi, edx
lea edx, [edi + ebx*2]
inc dl
mov byte [esp + eax + 0x304c12f1], dl
inc eax
dec ecx
cmp eax, 0xcfb3ed1f
jne 0x444700
lea edx, [esp + 8]
mov eax, edx
xor ecx, ecx
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, edx
mov ecx, 1
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0xa]
mov byte [esi + 2], al
add esi, 3
mov ebx, dword [esp + 0x2b4]
jmp case.default.0x4446df
mov dword [esp + 8], 0x276cae6c
mov byte [esp + 0xc], 0x34
lea eax, [esp + 0xc]
mov byte [eax + 3], 0
mov word [eax + 1], 0
xor eax, eax
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov ecx, eax
xor ecx, 0xdf3d3449
mov edi, eax
or edi, 0x20c2cbb6
and ecx, edi
add ecx, edi
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
add cl, 0x72
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jne 0x4447a0
lea eax, [esp + 8]
mov ecx, 1
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add esi, 4
lea eax, [esp + 0xc]
xor ecx, ecx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp case.default.0x4446df
mov dword [esp + 8], 0x9408240
mov byte [esp + 0xc], 0x70
lea eax, [esp + 0xc]
mov byte [eax + 3], 0
mov word [eax + 1], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x3d
xor cl, byte [esp + eax + 8]
add cl, 0xcf
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jne 0x444820
lea eax, [esp + 8]
mov ecx, 1
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add esi, 4
lea eax, [esp + 0xc]
xor ecx, ecx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp case.default.0x4446df
mov dword [esp + 8], 0x1d086bc
mov byte [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 0xd], 0
mov edx, 0x3f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x37]
mov ebx, eax
mov edi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x7d
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0xc5
mov byte [esp + edx - 0x37], al
inc edx
cmp edx, 0x48
jne 0x444880
lea eax, [esp + 8]
mov ecx, 1
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add esi, 4
lea eax, [esp + 0xc]
xor ecx, ecx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ebx, dword [esp + 0x2b4]
jmp case.default.0x4446df
cmp ebx, 3
jbe 0x444aaa
test bl, 1
je 0x44491a
mov eax, 0x44a025
mov edx, 0x44a025
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, esi
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
add esi, 2
mov eax, ebx
and eax, 8
mov ecx, ebx
or ecx, 8
imul ecx, eax
xor eax, 8
mov edx, ebx
and edx, 0xfffffff7
imul edx, eax
add ecx, edx
mov eax, 0xffffffff
mov edi, 0xffffffff
cmp ecx, 0x7ffffffe
ja 0x444fa5
dec ebx
cmp ebx, 4
jb 0x444aaa
lea ebp, [esp + 0x10]
jmp 0x44496d
mov ebx, dword [esp]
dec ebx
cmp ebx, 3
jbe 0x444aaa
mov eax, ebx
and eax, 0xfffffff7
mov ecx, ebx
and ecx, 8
mov edx, ebx
or edx, 8
imul edx, ecx
xor ecx, 8
imul ecx, eax
add edx, ecx
cmp edx, 0x7e
mov dword [esp], ebx
ja 0x444a20
mov dword [esp + 8], 0x29509e54
mov word [esp + 0xc], 0x758
mov byte [ebp], 0
mov word [ebp - 2], 0
mov eax, 0x7c
lea ecx, [esp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
lea ebx, [eax - 0x296f800]
or ebx, edi
not ebx
and edi, eax
or edi, ebx
mov ebx, edi
and ebx, 0x70
add ebx, ebx
xor edi, 0x8f
sub ebx, edi
mov byte [ecx], bl
inc ecx
dec eax
cmp eax, 0x73
jne 0x4449c0
lea eax, [esp + 8]
mov edi, esi
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esi + 4]
lea eax, [esp + 0xc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0xc]
mov byte [esi + 4], al
mov byte [esi + 3], dl
add esi, 5
jmp 0x444960
mov dword [esp + 8], 0xc1c8b20c
mov dword [esp + 0xc], 0xfd424340
mov byte [esp + 0x10], 0x4c
mov dword [esp + 0x11], 0
mov edi, 0x4c939a8e
lea ecx, [esp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx]
mov eax, edi
or eax, ebx
lea ebp, [edi - 0x4c939a00]
and ebp, ebx
not eax
or eax, ebp
mov ebx, eax
xor ebx, 0x36
and eax, 0x49
add eax, eax
sub eax, ebx
inc al
mov byte [ecx], al
inc ecx
dec edi
cmp edi, 0x4c939a81
jne 0x444a50
lea eax, [esp + 8]
mov edi, esi
mov ecx, 2
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea eax, [esi + 8]
lea ebp, [esp + 0x10]
mov ebx, ebp
xor ecx, ecx
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov dword [esi + 3], edx
mov esi, eax
jmp 0x444960
mov dword [esp + 8], 0x7f329e50
lea ebx, [esp + 0xc]
mov byte [esp + 0xc], 0x1c
mov dword [esp + 0xd], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edi, eax
and edi, 8
mov ebp, eax
and ebp, 2
mov edx, ebp
xor edx, 2
imul edx, edi
or edi, 2
imul edi, ebp
mov ebp, eax
xor ebp, 0x812a0f3a
add ebp, edx
add ebp, edi
xor ebp, ecx
mov ecx, ebp
and ecx, 0x5d
xor ebp, 0xdd
lea ecx, [ecx*2]
add ecx, ebp
inc cl
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 9
jne 0x444ad0
lea eax, [esp + 8]
mov edi, esi
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea eax, [esi + 4]
xor ecx, ecx
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov dword [esp + 0x8f], 0xc3fc8948
mov dword [esp + 0x8c], 0x48d2ff41
mov dword [esp + 0x80], 0xba49c031
mov ecx, dword [esp + 0x2a8]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x2ac]
mov dword [esp + 0x88], ecx
lea edx, [esp + 0x80]
mov edi, eax
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esi + 0x14]
lea eax, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x92]
mov byte [esi + 0x16], al
lea ecx, [esp + 0x94]
mov eax, ecx
neg eax
lea ebx, [esi + eax]
add ebx, 0x17
sub esi, ecx
add esi, 0x71
mov dword [esp + 0x6c], esi
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x20272625
mov word [esp + 0xc], 0
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x89
xor cl, byte [esp + eax + 8]
add cl, 0x53
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 6
jne 0x444be0
mov eax, dword [esp + 8]
mov ecx, dword [0x452b74]
test ecx, ecx
je 0x444c4e
xor edx, edx
mov esi, dword [0x452b78]
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x3e416e49
je 0x444c20
inc edx
cmp ecx, edx
jne 0x444c10
jmp 0x444c4e
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x444c4e
lea eax, [esp + 0x6c]
lea edx, [esp + 4]
push 0x40
push 0x3000
push eax
push 0
push edx
push 0xffffffffffffffff
push 6
push ecx
push dword [0x452b7c]
call fcn.00442710
add esp, 0x24
test eax, eax
js 0x444f70
mov dword [esp + 8], 0x7301a47f
mov dword [esp + 0xc], 0x2595a271
mov dword [esp + 0x10], 0x193e60a1
mov dword [esp + 0x14], 0x35363730
mov dword [esp + 0x18], 0x57fabe6c
mov dword [esp + 0x1c], 0xb23613bd
mov dword [esp + 0x20], 0x544ca1a
mov dword [esp + 0x24], 0x5060775
mov dword [esp + 0x28], 0x1b220d8b
mov dword [esp + 0x2c], 0xa70e0f08
mov dword [esp + 0x30], 0xc680cc80
mov dword [esp + 0x34], 0xb402d395
mov dword [esp + 0x38], 0x11dcb8b6
mov dword [esp + 0x3c], 0x79629218
mov dword [esp + 0x40], 0x162a0d1d
mov dword [esp + 0x44], 0xbf673ea0
mov dword [esp + 0x48], 0x2da33bc5
mov dword [esp + 0x4c], 0x6d0b6b0c
mov dword [esp + 0x50], 0xdfd736c
mov dword [esp + 0x54], 0xb3f93f14
mov dword [esp + 0x58], 0xbe32bb13
mov dword [esp + 0x5c], 0x117f1f56
lea edx, [esp + 0x60]
mov word [esp + 0x60], 0x4318
mov dword [esp + 0x62], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 8]
mov ecx, eax
xor ecx, 0x4e6cf8f8
mov edi, eax
or edi, 7
and edi, ecx
mov ecx, eax
xor ecx, 0xb1930707
lea ecx, [ecx + edi*2]
xor ecx, esi
mov esi, ecx
or esi, 0x29
and ecx, 0x29
add ecx, esi
add cl, 0xb4
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0x5e
jne 0x444d20
mov eax, dword [esp + 4]
lea esi, [esp + 8]
mov edi, eax
mov ecx, 0x16
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [eax + 0x58]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x60]
mov byte [eax + 0x58], cl
mov eax, dword [esp + 4]
mov dword [esp + 8], 0xf7f6f951
mov byte [esp + 0xc], 0
mov ecx, 0x56
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x4e]
mov esi, edx
not esi
mov edi, esi
and edi, 0x3f
or esi, 0xc0
add edx, esi
inc edx
or edx, edi
xor edx, ecx
xor dl, 0x3f
add dl, 0x52
mov byte [esp + ecx - 0x4e], dl
inc ecx
cmp ecx, 0x5b
jne 0x444da0
add eax, dword [esp + 8]
mov ecx, ebx
shr ecx, 2
lea edx, [esp + 0x94]
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
and ecx, 0xfffffffc
add eax, ecx
lea edx, [esp + ecx]
add edx, 0x94
mov ecx, ebx
and ecx, 3
mov esi, ecx
not esi
or esi, 1
add esi, ecx
shr ecx, 1
mov dword [esp], ebx
mov ebx, edx
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebp, esi
inc ebp
je 0x444e9d
mov ecx, dword [esp]
and ecx, 2
add edx, ecx
add eax, ecx
mov ebx, ebp
and ebx, 7
je 0x444e42
xor edi, edi
nop
nop
nop
movzx ecx, byte [edx + edi]
mov byte [eax + edi], cl
inc edi
cmp ebx, edi
jne 0x444e30
add edx, edi
add eax, edi
sub ebp, edi
cmp esi, 7
jb 0x444e9d
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
movzx ecx, byte [edx + esi + 1]
mov byte [eax + esi + 1], cl
movzx ecx, byte [edx + esi + 2]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edx + esi + 3]
mov byte [eax + esi + 3], cl
movzx ecx, byte [edx + esi + 4]
mov byte [eax + esi + 4], cl
movzx ecx, byte [edx + esi + 5]
mov byte [eax + esi + 5], cl
movzx ecx, byte [edx + esi + 6]
mov byte [eax + esi + 6], cl
movzx ecx, byte [edx + esi + 7]
mov byte [eax + esi + 7], cl
add esi, 8
cmp ebp, esi
jne 0x444e50
mov eax, dword [esp + 4]
mov dword [esp + 8], 0xc1c6c7bf
mov dword [esp + 0xc], 0
mov ecx, 0xd1
mov edx, 0xe9cf382e
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0xc9]
mov esi, edx
or esi, edi
xor edi, 0xff
or edi, ecx
xor edi, 0xff
mov ebx, esi
not ebx
add ebx, edi
sub esi, edi
not esi
or esi, ebx
and esi, 0x6a
xor ebx, 0xea
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + ecx - 0xc9], bl
inc ecx
dec edx
cmp ecx, 0xd9
jne 0x444ec0
mov ecx, dword [esp + 8]
add ecx, eax
push dword [esp + 0x2b0]
push ecx
call eax
mov edi, edx
mov dword [esp + 0x68], 0
mov dword [esp + 8], 0x20272625
mov word [esp + 0xc], 0
xor ecx, ecx
mov edx, ecx
add dl, 0x89
xor dl, byte [esp + ecx + 8]
add dl, 0x53
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 6
jne 0x444f30
mov ecx, dword [0x452b74]
test ecx, ecx
je 0x444fa5
mov edx, dword [esp + 8]
xor esi, esi
mov ebx, dword [0x452b78]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x16194952
je 0x444f77
inc esi
cmp ecx, esi
jne 0x444f60
jmp 0x444fa5
mov edi, eax
sar edi, 0x1f
jmp 0x444fa5
mov ecx, dword [ebx + esi*8 + 4]
cmp ecx, edx
je 0x444fa5
lea edx, [esp + 0x68]
lea esi, [esp + 4]
push 0x8000
push edx
push esi
push 0xffffffffffffffff
push 4
push ecx
push dword [0x452b7c]
mov esi, eax
call fcn.00442710
mov eax, esi
add esp, 0x1c
mov edx, edi
add esp, 0x294
pop esi
pop edi
pop ebx
pop ebp
ret 0x10