Function at 0x44b370
Capabilities:
Encode data using xor
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x6e0
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x6c4], ebx
mov esi, dword [0x4af2c0]
mov ecx, 0x18
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
mov byte [ebp - 0x6ad], 0
cmp edx, 1
jne 0x44b407
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
sub esi, eax
xor ecx, ecx
lea eax, [esi + 0x141]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004601e0
push eax
call fcn.0046208f
mov esi, dword [0x4af2c0]
add esp, 8
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, 0xd
idiv ecx
cmp edx, 2
jne 0x44b4a5
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x44b422
mov dword [0x4af2c0], esi
call fcn.0044d010
test al, al
jne 0x44b4d0
mov eax, 0x74
mov esi, 0xf
test esi, esi
je 0x44b4c9
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x44b4b8
add eax, esi
mov dword [0x4af2c0], eax
cmp byte [ebx + 0x6c], 0
je 0x44bd03
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x6ac], esi
mov eax, str.IEFrame
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x44b524
movzx edi, ax
push 0
push edi
call fcn.00403750
add esp, 8
test eax, eax
je 0x44b53c
push edi
push eax
lea ecx, [ebp - 0x6ac]
call fcn.00405c50
jmp 0x44b536
push 7
push str.IEFrame
lea ecx, [ebp - 0x6ac]
call fcn.00408620
mov esi, dword [ebp - 0x6ac]
mov ebx, dword [ebx + 0x38]
mov dword [ebp - 4], 1
mov edi, dword [ebx + 4]
cmp byte [edi + 0xd], 0
jne 0x44b58e
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0x6a8], eax
lea esp, [esp]
test eax, eax
je 0x44b5a7
push esi
push dword [edi + 0x10]
call fcn.0046236e
add esp, 8
test eax, eax
sets al
test al, al
je 0x44b57e
mov edi, dword [edi + 8]
jmp 0x44b582
mov ebx, edi
mov edi, dword [edi]
cmp byte [edi + 0xd], 0
mov eax, dword [ebp - 0x6a8]
je 0x44b560
mov eax, dword [ebp - 0x6c4]
cmp ebx, dword [eax + 0x38]
je 0x44b5d2
mov ecx, dword [ebx + 0x10]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x44b5b1
push 0x80004005
call fcn.00403930
push ecx
push esi
call fcn.0046236e
add esp, 8
test eax, eax
sets al
test al, al
jne 0x44b5d2
mov dword [ebp - 0x6a8], ebx
mov ebx, dword [ebp - 0x6c4]
jmp 0x44b5e1
mov ebx, dword [ebp - 0x6c4]
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x6a8], eax
lea edi, [ebp - 0x6a8]
add esi, 0xfffffff0
mov edi, dword [edi]
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x44b60a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, dword [ebx + 0x38]
je 0x44bd03
call fcn.0044cff0
test al, al
jne 0x44b622
inc dword [0x4af2c0]
mov eax, dword [edi + 0x14]
mov ecx, 0x4adbb8
mov eax, dword [eax]
mov dword [ebp - 0x6ec], eax
mov eax, dword [0x4adbb8]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x6ac], esi
mov eax, str.ToolbarWindow32
mov dword [ebp - 4], 2
test eax, 0xffff0000
jne 0x44b677
movzx edi, ax
push 0
push edi
call fcn.00403750
add esp, 8
test eax, eax
je 0x44b68f
push edi
push eax
lea ecx, [ebp - 0x6ac]
call fcn.00405c50
jmp 0x44b689
push 0xf
push str.ToolbarWindow32
lea ecx, [ebp - 0x6ac]
call fcn.00408620
mov esi, dword [ebp - 0x6ac]
mov eax, dword [ebx + 0x38]
mov dword [ebp - 4], 3
mov edi, dword [eax + 4]
mov dword [ebp - 0x6bc], eax
cmp byte [edi + 0xd], 0
jne 0x44b6f3
xor ecx, ecx
test esi, esi
setne cl
mov dword [ebp - 0x6a8], ecx
test ecx, ecx
je 0x44b5a7
push esi
push dword [edi + 0x10]
call fcn.0046236e
add esp, 8
test eax, eax
sets al
test al, al
je 0x44b6dd
mov edi, dword [edi + 8]
mov eax, dword [ebp - 0x6bc]
jmp 0x44b6e7
mov eax, edi
mov edi, dword [edi]
mov dword [ebp - 0x6bc], eax
cmp byte [edi + 0xd], 0
mov ecx, dword [ebp - 0x6a8]
je 0x44b6b5
cmp eax, dword [ebx + 0x38]
je 0x44b729
mov ecx, dword [eax + 0x10]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x44b710
push 0x80004005
call fcn.00403930
push ecx
push esi
call fcn.0046236e
add esp, 8
test eax, eax
sets al
test al, al
mov eax, dword [ebp - 0x6bc]
je 0x44b72c
mov eax, dword [ebx + 0x38]
lea edx, [esi - 0x10]
lea edi, [ebp - 0x6a8]
mov dword [ebp - 0x6a8], eax
mov edi, dword [edi]
or esi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44b75d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4af2c0]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 0x8000000f
jns 0x44b775
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xf
jne 0x44b7ee
xor eax, eax
push 0x690
push eax
mov word [ebp - 0x6a4], ax
lea eax, [ebp - 0x6a2]
push eax
call fcn.00462e00
add esp, 0xc
xor ebx, ebx
xor esi, esi
lea esp, [esp]
xor edx, edx
test ebx, ebx
je 0x44b7ca
test edx, edx
je 0x44b7ca
lea eax, [esi + edx]
lea ecx, [ebp - 0x6a4]
lea ecx, [ecx + eax*2]
lea eax, [esi + edx]
mov ax, word [ebp + eax*2 - 0x6de]
inc ax
add ax, word [ecx - 2]
mov word [ecx], ax
inc edx
cmp edx, 0x1d
jl 0x44b7a2
add esi, 0x1d
inc ebx
cmp esi, 0x349
jl 0x44b7a0
movsx eax, word [ebp - 0x14]
mov ebx, dword [ebp - 0x6c4]
mov dword [0x4af2c0], eax
or esi, 0xffffffff
cmp edi, dword [ebx + 0x38]
je 0x44bd03
mov eax, dword [edi + 0x14]
mov ecx, 0x4adbb8
movq xmm0, qword [eax + 4]
movq qword [ebp - 0x6e8], xmm0
movq xmm0, qword [eax + 0xc]
mov eax, dword [0x4adbb8]
movq qword [ebp - 0x6e0], xmm0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6d0], eax
mov eax, str._Class
mov dword [ebp - 4], 4
test eax, 0xffff0000
jne 0x44b85e
movzx edi, ax
push 0
push edi
call fcn.00403750
add esp, 8
test eax, eax
je 0x44b870
push edi
push eax
lea ecx, [ebp - 0x6d0]
call fcn.00405c50
jmp 0x44b870
push 6
push str._Class
lea ecx, [ebp - 0x6d0]
call fcn.00408620
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
mov dword [ebp - 4], 5
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6ac], eax
mov edi, str.07462cf09e3b013003f40973f5b3301f0032850
shr edi, 0x10
mov byte [ebp - 4], 6
mov eax, str.07462cf09e3b013003f40973f5b3301f0032850
test edi, edi
jne 0x44b8ca
movzx eax, ax
push edi
push eax
call fcn.00403750
add esp, 8
test eax, eax
je 0x44b8dc
mov edx, str.07462cf09e3b013003f40973f5b3301f0032850
movzx ecx, dx
push ecx
push eax
lea ecx, [ebp - 0x6ac]
call fcn.00405c50
jmp 0x44b8dc
push 0x27
push str.07462cf09e3b013003f40973f5b3301f0032850
lea ecx, [ebp - 0x6ac]
call fcn.00408620
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x6b4]
push eax
mov byte [ebp - 4], 7
call fcn.0041c800
add esp, 0xc
mov edx, dword [ebp - 0x6ac]
add edx, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44b920
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6d0]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xa
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44b943
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6c8], eax
mov eax, str._LayeredPopup
mov byte [ebp - 4], 0xb
test eax, 0xffff0000
jne 0x44b992
movzx eax, ax
push 0
push eax
call fcn.00403750
add esp, 8
test eax, eax
je 0x44b9a4
mov edx, str._LayeredPopup
movzx ecx, dx
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00405c50
jmp 0x44b9a4
push 0xd
push str._LayeredPopup
lea ecx, [ebp - 0x6c8]
call fcn.00408620
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
mov byte [ebp - 4], 0xc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6cc], eax
mov byte [ebp - 4], 0xd
test edi, edi
jne 0x44b9ec
mov eax, str.07462cf09e3b013003f40973f5b3301f0032850
movzx edi, ax
push 0
push edi
call fcn.00403750
add esp, 8
test eax, eax
je 0x44b9fe
push edi
push eax
lea ecx, [ebp - 0x6cc]
call fcn.00405c50
jmp 0x44b9fe
push 0x27
push str.07462cf09e3b013003f40973f5b3301f0032850
lea ecx, [ebp - 0x6cc]
call fcn.00408620
lea eax, [ebp - 0x6c8]
push eax
lea eax, [ebp - 0x6cc]
push eax
lea eax, [ebp - 0x6b8]
push eax
mov byte [ebp - 4], 0xe
call fcn.0041c800
add esp, 0xc
mov edx, dword [ebp - 0x6cc]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x10
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44ba42
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6c8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x11
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44ba65
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0044d0d0
mov ecx, dword [0x4b0568]
test al, al
mov edx, 0xc60debaa
cmove ecx, edx
mov dword [0x4b0568], ecx
mov edi, dword [ebx + 0x54]
lea eax, [ebp - 0x6bc]
push eax
push dword [edi + 4]
mov dword [ebp - 0x6bc], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x44baa3
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x6dc]
mov ecx, dword [ebp - 0x6bc]
mov edi, dword [ebx + 0x54]
inc eax
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x6c0], 0
lea eax, [eax + ecx*2]
sub eax, dword [ebx + 0x10]
mov dword [ebp - 0x6d8], eax
lea eax, [ebp - 0x6c0]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x44bae8
mov dword [edi + 8], eax
mov edx, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x6c0]
shr eax, 1
lea ecx, [edx*4]
sub ecx, edx
neg ecx
sub ecx, eax
mov eax, dword [ebx + 0x10]
inc ecx
add eax, ecx
mov dword [ebx + 0x5c], eax
mov eax, dword [0x4af2c0]
imul eax, eax
and eax, 0x8000000f
jns 0x44bb20
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 3
jne 0x44bb35
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov edi, dword [ebp - 0x6b8]
mov edx, 1
mov eax, dword [edi - 8]
mov ecx, edx
sub ecx, dword [edi - 4]
or eax, ecx
jge 0x44bb64
push 0
lea ecx, [ebp - 0x6b8]
call fcn.00407d40
mov edi, dword [ebp - 0x6b8]
mov edx, 1
mov eax, dword [ebp - 0x6b4]
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x44bb87
push 0
lea ecx, [ebp - 0x6b4]
call fcn.00407d40
mov eax, dword [ebp - 0x6b4]
push 0
push dword [ebx + 0x2c]
push 0
push 0
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebp - 0x6a8]
push dword [ebp - 0x6d8]
push SysReAllocStringLen
push edi
push eax
push 0x80080
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x6b4]
push dword [eax - 8]
push eax
call fcn.00462113
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x44be17
mov eax, dword [ebp - 0x6b4]
cmp ecx, dword [eax - 8]
jg 0x44be17
mov dword [eax - 0xc], ecx
mov eax, dword [ebp - 0x6b4]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0x6b8]
push dword [eax - 8]
push eax
call fcn.00462113
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x44be17
mov eax, dword [ebp - 0x6b8]
cmp ecx, dword [eax - 8]
jg 0x44be17
mov dword [eax - 0xc], ecx
mov eax, dword [ebp - 0x6b8]
mov byte [ecx + eax], 0
call fcn.0044d0f0
test al, al
jne 0x44bcb0
xor ebx, ebx
lea esi, [ebp - 0x6a4]
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6d4], esi
mov edi, edi
mov esi, dword [0x4af2c0]
lea edi, [eax + 1]
mov eax, esi
cdq
lea ecx, [ebx + 1]
idiv ecx
mov eax, esi
sub eax, ebx
mov ecx, edx
imul ecx, eax
mov eax, esi
cdq
idiv edi
mov esi, dword [ebp - 0x6d4]
add ecx, eax
sub ecx, dword [ebp - 0x6c0]
push ecx
push 0x490f88
call fcn.004628cc
mov eax, edi
add esi, 4
add esp, 8
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6d4], esi
cmp eax, 0xe
jl 0x44bc50
inc ebx
cmp ebx, 0x1e
jl 0x44bc40
mov ebx, dword [ebp - 0x6c4]
or esi, 0xffffffff
cmp dword [ebx + 0x30], 0
jne 0x44bd25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x6b8]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
mov byte [ebp - 4], 0xa
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44bcdf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6b4]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x44bd03
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x6ad]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x6d8]
add eax, 4
add eax, ecx
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6a8]
add eax, 4
add eax, ecx
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebx + 0x10]
lea ecx, [ecx*2 + 8]
sub eax, ecx
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebx + 0x14]
sub eax, ecx
push 0x1e4
mov dword [ebp - 0x6dc], eax
call fcn.00460a63
mov ecx, eax
add esp, 4
mov dword [ebp - 0x6a8], ecx
mov byte [ebp - 4], 0x12
test ecx, ecx
je 0x44bd9b
push dword [ebx + 0x68]
lea eax, [ebx + 0x24]
push eax
lea eax, [ebx + 0x28]
push eax
call fcn.00446180
mov ecx, eax
jmp 0x44bd9d
xor ecx, ecx
mov byte [ebp - 4], 0x11
mov dword [ebx + 0x64], ecx
test ecx, ecx
je 0x44bcbc
movq xmm0, qword [ebp - 0x6e8]
sub esp, 0x10
mov eax, esp
push dword [ebp - 0x6ec]
movq qword [eax], xmm0
movq xmm0, qword [ebp - 0x6e0]
push dword [ebx + 0x30]
movq qword [eax + 8], xmm0
call fcn.00446c10
mov ecx, dword [0x4af2c0]
mov byte [ebp - 0x6ad], 1
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul eax, edx
imul eax, ecx
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 5
jne 0x44bcbc
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
jmp 0x44bcbc
push 0x80070057
call fcn.00403930
int3