Function at 0x44cf6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, 0xd4d4
lea ebp, [esp - 0x70]
call fcn.0047bd30
push ebx
lea eax, [ebp + 0x78]
push esi
push eax
call fcn.0042ebab
mov esi, dword [ebp + 0x78]
xor ebx, ebx
cmp word [esi], bx
pop ecx
jne 0x44cf99
xor eax, eax
jmp 0x44d439
push edi
mov edi, 0x496134
push edi
lea ecx, [ebp + 0x60]
call fcn.0043ddc9
push edi
lea ecx, [ebp + 0x5c]
call fcn.0043ddc9
mov byte [ebp + 0x6e], 0
mov byte [ebp + 0x6f], 8
jmp 0x44d0ac
push 2
push esi
push 0x49342c
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x44cfe7
lea ecx, [esi + 4]
mov ax, word [ecx]
call fcn.00402b47
test al, al
je 0x44cfe7
mov byte [ebp + 0x6e], 1
jmp 0x44d060
push 2
push esi
push 0x493284
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x44d010
lea ecx, [esi + 4]
mov ax, word [ecx]
call fcn.00402b47
test al, al
je 0x44d010
mov byte [ebp + 0x6f], 2
jmp 0x44d060
push 2
push esi
push 0x496be4
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x44d039
lea ecx, [esi + 4]
mov ax, word [ecx]
call fcn.00402b47
test al, al
je 0x44d039
mov byte [ebp + 0x6f], 1
jmp 0x44d060
push 2
push esi
push 0x496be0
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x44d06e
lea ecx, [esi + 4]
mov ax, word [ecx]
call fcn.00402b47
test al, al
je 0x44d06e
mov byte [ebp + 0x6f], 0x10
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], ecx
call fcn.0042ebab
jmp 0x44d0a8
push 2
push esi
push 0x48ffec
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x44d08f
mov ax, word [esi + 4]
call fcn.00402b47
test al, al
jne 0x44d0ba
cmp di, 0x2d
jne 0x44d0cd
lea eax, [ebp + 0x78]
push eax
call fcn.00404167
lea eax, [ebp + 0x78]
push eax
call fcn.0042ebab
pop ecx
mov esi, dword [ebp + 0x78]
pop ecx
mov di, word [esi]
cmp di, bx
jne 0x44cfbe
jmp 0x44d0cd
lea eax, [ebp + 0x78]
add esi, 4
push eax
mov dword [ebp + 0x78], esi
call fcn.0042ebab
mov esi, dword [ebp + 0x78]
pop ecx
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x64], esi
call fcn.004364f8
push dword [ebp + 0x60]
call fcn.0040ec9c
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x78]
add esp, 0x10
cmp word [eax], 0x2c
lea eax, [ebp + 0x78]
jne 0x44d11f
add dword [ebp + 0x78], 2
push eax
call fcn.0042ebab
push 0x2c
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004364f8
push dword [ebp + 0x5c]
call fcn.0040ec9c
add esp, 0x14
jmp 0x44d175
push 1
push eax
lea eax, [ebp + 0x64]
push eax
mov dword [ebp + 0x78], ebx
call fcn.00414faa
add esp, 0xc
push dword [ebp + 0x78]
lea ecx, [ebp + 0x60]
push dword [ebp + 0x64]
mov esi, eax
call fcn.00433d4a
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x64]
push eax
mov dword [ebp + 0x64], esi
call fcn.0042ebab
push ebx
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.00414faa
add esp, 0x10
push dword [ebp + 0x78]
lea ecx, [ebp + 0x5c]
push dword [ebp + 0x64]
call fcn.00433d4a
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
mov dword [ebp + 0x58], eax
je 0x44d423
mov edi, dword [ebp + 0x68]
cmp word [edi], bx
je 0x44d423
cmp byte [ebp + 0x6f], 2
je 0x44d1db
push 0
call fcn.0047d792
pop ecx
mov ebx, eax
call fcn.004308d6
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
mov eax, dword [0x4a7a38]
shl eax, 4
add ebx, eax
xor dword [0x4a7a38], ebx
mov eax, ebx
and eax, 3
cmp al, 3
mov dword [ebp + 0x78], ebx
jne 0x44d193
test bh, bh
je 0x44d193
cmp byte [ebp + 0x7a], 0
je 0x44d193
mov al, byte [ebp + 0x7b]
and al, 0x88
cmp al, 0x80
jne 0x44d193
cmp byte [ebp + 0x6f], 0x10
je 0x44d394
lea ecx, [ebp - 0x28]
call fcn.004371aa
lea ecx, [ebp + 0x38]
call fcn.004371aa
xor edi, edi
push edi
mov esi, 0x80
push esi
push 3
push edi
push 7
push 1
push dword [ebp + 0x68]
lea ecx, [ebp - 0x24]
call fcn.004041e7
cmp dword [ebp - 0x24], edi
jne 0x44d230
mov ebx, 0x495bd0
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x38], ebx
call fcn.0043717d
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x24]
jmp 0x44d41e
push edi
push esi
push 2
push edi
push 7
push 0x40000001
push dword [ebp + 0x58]
lea ecx, [ebp + 0x3c]
call fcn.004041e7
cmp dword [ebp + 0x3c], edi
je 0x44d215
push edi
push edi
lea ecx, [ebp - 0xd464]
mov byte [ebp + 0x4c], 1
call fcn.0042f35e
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 0x2c], eax
mov esi, 0x494698
mov dword [ebp + 0x68], 7
mov al, byte [esi]
inc dword [ebp + 0x54]
mov byte [ebp + 0x7b], al
push 1
lea eax, [ebp + 0x7b]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00431287
inc esi
dec dword [ebp + 0x68]
jne 0x44d275
cmp byte [ebp + 0x6f], 8
mov al, 0x53
jne 0x44d29b
add al, 0xee
inc dword [ebp + 0x54]
mov byte [ebp + 0x7b], al
push 1
lea eax, [ebp + 0x7b]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00431287
push 8
mov ecx, ebx
and ecx, 0xfffffff
cmp ebx, edi
pop eax
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x50], ecx
je 0x44d2ca
xor ebx, 0x5aa59669
cmp byte [ebp + 0x6f], 8
mov dword [ebp + 0x68], ebx
jne 0x44d2d9
xor ebx, eax
mov word [ebp + 0x68], bx
push 4
lea esi, [ebp + 0x68]
pop edi
mov al, byte [esi]
inc dword [ebp + 0x54]
mov byte [ebp + 0x7b], al
push 1
lea eax, [ebp + 0x7b]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00431287
inc esi
dec edi
jne 0x44d2df
xor eax, eax
lea edi, [ebp - 0xc46a]
mov dword [ebp + 0x54], 0xc
stosd dword es:[edi], eax
xor esi, esi
lea ecx, [ebp - 0x28]
call fcn.00431327
cmp eax, 0xffffffff
je 0x44d32f
movsx ecx, si
inc esi
mov byte [ebp + ecx - 0xc46a], al
inc byte [ebp - 0xc447]
cmp si, 4
jl 0x44d30b
push 4
lea esi, [ebp - 0xc46a]
pop edi
cmp byte [ebp + 0x6e], 0
je 0x44d345
mov al, byte [esi]
mov byte [ebp + 0x7b], al
jmp 0x44d349
mov byte [ebp + 0x7b], 0
inc dword [ebp + 0x54]
push 1
lea eax, [ebp + 0x7b]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00431287
inc esi
dec edi
jne 0x44d338
lea ecx, [ebp - 0xd464]
mov dword [ebp + 0x54], 0x10
call fcn.0042f598
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebx, 0x495bd0
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x38], ebx
call fcn.0043717d
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x24]
jmp 0x44d4a3
xor esi, esi
lea ecx, [ebp + 0x18]
mov dword [ebp + 0x78], esi
call fcn.00437206
lea ecx, [ebp - 8]
call fcn.00437206
push esi
mov ebx, 0x80
push ebx
push 3
push esi
push 7
push 1
push edi
lea ecx, [ebp + 0x1c]
call fcn.004041e7
cmp dword [ebp + 0x1c], esi
je 0x44d408
push 8
pop edi
lea ecx, [ebp + 0x18]
call fcn.0043137a
dec edi
jne 0x44d3c8
xor edi, edi
lea ecx, [ebp + 0x18]
call fcn.0043137a
mov byte [ebp + edi + 0x78], al
inc edi
cmp edi, 4
jl 0x44d3d5
cmp dword [ebp + 0x78], esi
jne 0x44d408
push esi
push ebx
push 2
push esi
push 7
push 0x40000001
push dword [ebp + 0x58]
lea ecx, [ebp - 4]
call fcn.004041e7
cmp dword [ebp - 4], esi
jne 0x44d442
mov esi, 0x495be0
lea ecx, [ebp - 4]
mov dword [ebp - 8], esi
call fcn.0043717d
mov dword [ebp + 0x18], esi
lea ecx, [ebp + 0x1c]
call fcn.0043717d
xor esi, esi
inc esi
lea ecx, [ebp + 0x5c]
call fcn.0042eb98
lea ecx, [ebp + 0x60]
call fcn.0042eb98
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8
push esi
push esi
lea ecx, [ebp - 0xd464]
mov byte [ebp + 0xc], 1
call fcn.0042f35e
cmp dword [ebp + 0x30], esi
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x2c], eax
je 0x44d46b
xor dword [ebp + 0x30], 0x5aa59669
push 4
pop esi
lea ecx, [ebp + 0x18]
call fcn.0043137a
dec esi
jne 0x44d46e
lea ecx, [ebp - 0xd464]
call fcn.0042f7fb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, 0x495be0
lea ecx, [ebp - 4]
mov dword [ebp - 8], esi
call fcn.0043717d
mov dword [ebp + 0x18], esi
lea ecx, [ebp + 0x1c]
call fcn.0043717d
xor esi, esi
jmp 0x44d426