Function at 0x44d821
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x350
call fcn.004fc970
cmp dword [esp + 0x358], 0
mov eax, dword [esp + 0x354]
je 0x44de98
push ebx
push ebp
push esi
mov esi, ecx
push edi
add esi, 2
mov edx, dword [eax]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 0x2c]
sub dword [esp + 0x368], 1
mov dword [esp + 0x88], edx
mov dword [esp + 0x10], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x60], edx
mov dword [esp + 0x320], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x80], edx
mov dword [esp + 0x328], edx
mov edx, dword [eax + 0x18]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x14], edi
mov edi, dword [eax + 0xc]
mov dword [esp + 0x44], edx
mov dword [esp + 0x330], edx
mov edx, dword [eax + 0x24]
mov dword [esp + 0x64], edi
mov dword [esp + 0x324], edi
mov edi, dword [eax + 0x14]
mov dword [esp + 0x50], edx
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0x28]
mov dword [esp + 0x84], edi
mov dword [esp + 0x32c], edi
mov edi, dword [eax + 0x1c]
mov dword [esp + 0x58], edx
mov dword [esp + 0x340], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x48], edi
mov dword [esp + 0x334], edi
mov edi, dword [eax + 0x20]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x344], ebx
mov ebx, dword [eax + 0x34]
mov dword [esp + 0x68], edx
mov dword [esp + 0x348], edx
mov edx, dword [eax + 0x38]
mov eax, dword [eax + 0x3c]
lea ecx, [esp + 0x318]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x34c], ebx
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x350], edx
mov dword [esp + 0x354], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], esi
jmp 0x44d934
mov edi, dword [esp + 0x18]
movzx eax, byte [esi - 2]
cdq
shld edx, eax, 8
shl eax, 8
mov ebx, eax
movzx eax, byte [esi - 1]
mov ebp, edx
cdq
or ebx, eax
movzx eax, byte [esi]
or ebp, edx
shld ebp, ebx, 8
shl ebx, 8
cdq
or ebx, eax
movzx eax, byte [esi + 1]
or ebp, edx
shld ebp, ebx, 8
shl ebx, 8
cdq
or ebx, eax
movzx eax, byte [esi + 2]
or ebp, edx
shld ebp, ebx, 8
shl ebx, 8
cdq
or ebx, eax
movzx eax, byte [esi + 3]
or ebp, edx
shld ebp, ebx, 8
shl ebx, 8
cdq
or ebx, eax
movzx eax, byte [esi + 4]
or ebp, edx
shld ebp, ebx, 8
shl ebx, 8
cdq
or ebx, eax
movzx eax, byte [esi + 5]
or ebp, edx
shld ebp, ebx, 8
cdq
shl ebx, 8
or ebx, eax
mov eax, dword [esp + 0x10]
or ebp, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], ebx
mov dword [ecx], eax
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x40], ebx
mov dword [esp + 0x28], ebp
mov dword [ecx + 0x44], ebp
mov ebp, eax
mov ebx, edi
shld ebp, ebx, 0x17
mov dword [ecx + 4], edx
mov edx, eax
shl ebx, 0x17
shr edx, 9
or edx, ebx
mov dword [ecx + 0x24], eax
mov ebx, edi
mov dword [ecx + 0x20], edi
shrd edi, eax, 0x12
xor esi, esi
or esi, ebp
shl ebx, 0xe
shr eax, 0x12
xor ebp, ebp
or ebp, edi
or ebx, eax
mov eax, dword [esp + 0x18]
xor edx, ebp
mov ebp, dword [esp + 0x1c]
mov edi, eax
xor esi, ebx
xor ebx, ebx
shl edi, 0x12
shrd eax, ebp, 0xe
or ebx, eax
mov eax, dword [esp + 0x18]
xor edx, ebx
mov ebx, dword [esp + 0x1c]
shr ebp, 0xe
or edi, ebp
mov ebp, dword [ecx + 0x28]
xor esi, edi
and ebp, eax
not ebx
and ebx, dword [ecx + 0x34]
mov edi, eax
mov eax, dword [ecx + 0x2c]
and eax, dword [esp + 0x1c]
not edi
and edi, dword [ecx + 0x30]
mov ecx, dword [esp + 0x24]
xor edi, ebp
xor ebx, eax
mov eax, dword [esp + 0x2c]
add edx, edi
adc esi, ebx
add edx, dword [eax*8 + 0x54fe80]
adc esi, dword [eax*8 + 0x54fe84]
mov eax, dword [esp + 0x20]
add edx, dword [eax + 0x38]
adc esi, dword [eax + 0x3c]
add ecx, edx
mov edx, dword [esp + 0x28]
adc edx, esi
mov esi, dword [eax + 0x18]
add esi, ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x1c]
adc ecx, edx
mov dword [esp + 0x28], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x70], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x74], ecx
mov ecx, dword [esp + 0x10]
mov ebx, ecx
mov ebp, edx
shrd ebx, ebp, 0x1c
xor edi, edi
or edi, ebx
shr ebp, 0x1c
mov dword [esp + 0x18], esi
mov esi, ecx
mov ebx, edx
shld edx, ecx, 0x1e
shl esi, 4
or esi, ebp
xor ebp, ebp
or ebp, edx
shr ebx, 2
shl ecx, 0x1e
or ebx, ecx
mov ecx, dword [esp + 0x14]
xor esi, ebp
mov ebp, dword [esp + 0x10]
mov edx, ecx
shld ecx, ebp, 0x19
xor edi, ebx
xor ebx, ebx
shl ebp, 0x19
shr edx, 7
or edx, ebp
or ebx, ecx
mov ecx, dword [esp + 0x70]
xor esi, ebx
xor edi, edx
mov edx, dword [esp + 0x74]
mov ebx, ecx
xor ebx, dword [esp + 0x10]
mov ebp, edx
xor ebp, dword [esp + 0x14]
and ebx, dword [eax + 0x10]
and ebp, dword [eax + 0x14]
and ecx, dword [esp + 0x10]
and edx, dword [esp + 0x14]
xor ebx, ecx
mov ecx, dword [esp + 0x20]
xor ebp, edx
add edi, ebx
adc esi, ebp
add edi, dword [esp + 0x24]
adc esi, dword [esp + 0x28]
mov eax, edi
mov edi, dword [esp + 0x2c]
mov edx, esi
mov esi, dword [esp + 0x30]
add edi, 1
add esi, 8
sub ecx, 8
cmp edi, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x20], ecx
jl 0x44d930
cmp edi, 0x50
jge 0x44ddd4
lea eax, [edi*8 + 0x54fe80]
mov dword [esp + 0x2c], eax
jmp 0x44db70
mov eax, dword [ecx + 0xbc]
mov edx, dword [ecx + 0xb8]
mov dword [esp + 0x38], eax
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x34], edx
mov edx, eax
mov edi, eax
mov ebp, ecx
mov dword [esp + 0x90], eax
shld ebp, eax, 3
mov ebx, ecx
shrd edi, ebx, 0x13
xor esi, esi
or esi, edi
add eax, eax
add eax, eax
mov edi, ecx
add eax, eax
shr ebx, 0x13
shr edi, 0x1d
or edi, eax
mov eax, dword [esp + 0x90]
shrd eax, ecx, 6
xor esi, edi
shl edx, 0xd
or edx, ebx
xor esi, eax
mov eax, dword [esp + 0x34]
xor ebx, ebx
or ebx, ebp
xor edx, ebx
shr ecx, 6
xor edx, ecx
mov ecx, dword [esp + 0x38]
mov ebp, ecx
mov ebx, eax
shrd ebx, ebp, 8
xor edi, edi
or edi, ebx
mov dword [esp + 0x54], esi
mov esi, eax
shl esi, 0x18
mov ebx, eax
shrd eax, ecx, 1
shr ebp, 8
or esi, ebp
shr ecx, 1
xor ebp, ebp
or ebp, eax
mov eax, dword [esp + 0x38]
shl ebx, 0x1f
or ebx, ecx
mov ecx, dword [esp + 0x34]
shrd ecx, eax, 7
xor edi, ebp
xor esi, ebx
shr eax, 7
xor esi, eax
mov eax, dword [esp + 0x20]
xor edi, ecx
mov ecx, dword [esp + 0x54]
add ecx, edi
mov edi, dword [esp + 0x1c]
adc edx, esi
add ecx, dword [eax + 0xc0]
mov esi, dword [esp + 0x10]
adc edx, dword [eax + 0xc4]
add ecx, dword [eax + 0x78]
mov dword [eax], esi
adc edx, dword [eax + 0x7c]
mov esi, dword [esp + 0x14]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov dword [eax + 0x44], edx
mov dword [esp + 0x24], ecx
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], edi
mov dword [eax + 0x40], ecx
mov edx, edi
mov ecx, esi
mov ebp, edi
shld ebp, ecx, 0x17
shl ecx, 0x17
shr edx, 9
or edx, ecx
mov ecx, esi
shrd esi, edi, 0x12
xor ebx, ebx
or ebx, ebp
shl ecx, 0xe
xor ebp, ebp
or ebp, esi
xor edx, ebp
mov ebp, dword [esp + 0x1c]
shr edi, 0x12
or ecx, edi
xor ebx, ecx
mov ecx, dword [esp + 0x18]
mov esi, ecx
shrd ecx, ebp, 0xe
shl esi, 0x12
xor edi, edi
or edi, ecx
mov ecx, dword [esp + 0x18]
shr ebp, 0xe
or esi, ebp
mov ebp, dword [eax + 0x28]
xor ebx, esi
xor edx, edi
mov edi, dword [esp + 0x1c]
and ebp, ecx
mov esi, ecx
mov ecx, dword [esp + 0x2c]
not esi
and esi, dword [eax + 0x30]
not edi
and edi, dword [eax + 0x34]
mov eax, dword [eax + 0x2c]
and eax, dword [esp + 0x1c]
xor esi, ebp
xor edi, eax
mov eax, dword [esp + 0x20]
add edx, esi
adc ebx, edi
add edx, dword [eax + 0x38]
mov esi, dword [eax + 0x18]
adc ebx, dword [eax + 0x3c]
add edx, dword [ecx]
adc ebx, dword [ecx + 4]
mov ecx, dword [esp + 0x24]
add ecx, edx
mov edx, dword [esp + 0x28]
adc edx, ebx
add esi, ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x1c]
adc ecx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x14]
mov ebx, ecx
mov ebp, edx
shrd ebx, ebp, 0x1c
xor edi, edi
mov dword [esp + 0x18], esi
or edi, ebx
mov esi, ecx
mov ebx, edx
shr ebp, 0x1c
shl esi, 4
shld edx, ecx, 0x1e
or esi, ebp
shr ebx, 2
xor ebp, ebp
shl ecx, 0x1e
or ebp, edx
or ebx, ecx
mov ecx, dword [esp + 0x14]
xor esi, ebp
mov ebp, dword [esp + 0x10]
mov edx, ecx
shld ecx, ebp, 0x19
xor edi, ebx
shl ebp, 0x19
shr edx, 7
or edx, ebp
xor ebx, ebx
or ebx, ecx
mov ecx, dword [esp + 0x3c]
xor esi, ebx
xor edi, edx
mov edx, dword [esp + 0x40]
mov ebx, ecx
xor ebx, dword [esp + 0x10]
and ecx, dword [esp + 0x10]
and ebx, dword [eax + 0x10]
mov ebp, edx
xor ebp, dword [esp + 0x14]
and edx, dword [esp + 0x14]
and ebp, dword [eax + 0x14]
xor ebx, ecx
mov ecx, dword [esp + 0x20]
xor ebp, edx
add edi, ebx
adc esi, ebp
add edi, dword [esp + 0x24]
adc esi, dword [esp + 0x28]
sub ecx, 8
mov edx, esi
mov esi, dword [esp + 0x2c]
add esi, 8
cmp esi, 0x550100
mov eax, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], ecx
jl 0x44db70
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x88]
mov ebx, dword [esp + 0x8c]
add edi, eax
mov eax, dword [esp + 0x364]
adc ebx, edx
mov edx, dword [ecx + 8]
add edx, dword [esp + 0x60]
mov dword [eax], edi
mov edi, dword [ecx + 0xc]
adc edi, dword [esp + 0x64]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0x10]
add edx, dword [esp + 0x80]
mov dword [eax + 0xc], edi
mov edi, dword [ecx + 0x14]
adc edi, dword [esp + 0x84]
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 0x18]
add edx, dword [esp + 0x44]
mov dword [eax + 0x14], edi
mov edi, dword [ecx + 0x1c]
adc edi, dword [esp + 0x48]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x4c]
add edx, dword [esp + 0x18]
mov dword [eax + 0x1c], edi
mov edi, dword [esp + 0x50]
adc edi, dword [esp + 0x1c]
mov dword [eax + 0x20], edx
mov edx, dword [ecx + 0x28]
add edx, dword [esp + 0x58]
mov dword [eax + 0x24], edi
mov edi, dword [ecx + 0x2c]
adc edi, dword [esp + 0x5c]
mov dword [eax + 0x28], edx
mov edx, dword [ecx + 0x30]
add edx, dword [esp + 0x68]
mov dword [eax + 0x2c], edi
mov edi, dword [ecx + 0x34]
adc edi, dword [esp + 0x6c]
mov dword [eax + 0x30], edx
mov edx, dword [ecx + 0x38]
add edx, dword [esp + 0x78]
mov ecx, dword [ecx + 0x3c]
adc ecx, dword [esp + 0x7c]
cmp dword [esp + 0x368], 0
mov dword [eax + 4], ebx
mov dword [eax + 0x34], edi
mov dword [eax + 0x38], edx
mov dword [eax + 0x3c], ecx
jne 0x44d828
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret