Function at 0x44acdb
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff44c
push ebx
push esi
push edi
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov ebx, 0x496bb4
lea eax, [ebx + 0x1f]
call fcn.00460d8c
mov dword [ebp - 0xc], eax
cmp edi, 0xffffffff
jne 0x44ad61
mov edi, dword [ebp - 0xc]
xor esi, esi
cmp edi, esi
jle 0x44ad61
push esi
lea eax, [ebx + 0x1f]
push eax
lea edx, [ebp - 0x2b0]
push edx
call fcn.00486578
add esp, 0xc
lea ecx, [ebx + 0xb]
lea edx, [ebx + 0x2b]
lea eax, [ebp - 0x2b0]
push ecx
lea ecx, [ebp - 0x260]
push pe_nt_image_headers32
call fcn.00460a70
push dword [ebp + 8]
lea eax, [ebp - 0x260]
push eax
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x44ad5c
mov edi, esi
jmp 0x44ad61
inc esi
cmp edi, esi
jg 0x44ad11
cmp edi, 0xfffffffe
jne 0x44ad78
lea eax, [ebx + 0x6e]
push eax
lea edx, [ebp - 0x60]
push edx
call fcn.00486578
add esp, 8
jmp 0x44ad89
push edi
lea ecx, [ebx + 0x1f]
push ecx
lea eax, [ebp - 0x60]
push eax
call fcn.00486578
add esp, 0xc
lea edx, [ebx + 0x2b]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 8]
call fcn.004608a8
cmp byte [ebp - 6], 0
je 0x44adce
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x44adce
push esi
lea eax, [ebx + 0x1f]
push eax
lea edx, [ebp - 0x300]
push edx
call fcn.00486578
add esp, 0xc
lea edx, [ebx + 0x30]
lea eax, [ebp - 0x300]
xor ecx, ecx
call fcn.004609a8
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x44ada4
xor ecx, ecx
mov cl, byte [ebp - 6]
lea edx, [ebx + 0x30]
lea eax, [ebp - 0x60]
call fcn.004609a8
lea edx, [ebx + 0x38]
lea eax, [ebp - 0x60]
call fcn.00460d28
lea edx, [ebx + 0x40]
lea eax, [ebp - 0x60]
call fcn.00460d28
lea edx, [ebx + 0x4a]
lea eax, [ebp - 0x60]
xor ecx, ecx
call fcn.004609a8
cmp dword [ebp - 4], 0
je 0x44aee9
push 0x6b
push dword [ebp - 4]
call sub.USER32.DLL_IsDlgButtonChecked
mov ecx, eax
lea edx, [ebx + 0x4a]
lea eax, [ebp - 0x60]
call fcn.004609a8
push 0x66
push dword [ebp - 4]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x44ae57
push 0x400
lea eax, [ebp - 0x700]
push eax
push 0x67
push dword [ebp - 4]
call sub.USER32.DLL_GetDlgItemTextA
lea ecx, [ebp - 0x700]
lea edx, [ebx + 0x38]
lea eax, [ebp - 0x60]
call fcn.004608a8
push 0x68
push dword [ebp - 4]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x44aee9
push 0x69
push dword [ebp - 4]
call sub.USER32.DLL_GetDlgItem
mov edi, eax
push edi
call sub.USER32.DLL_GetWindowTextLengthA
add eax, 0xa
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, eax
push eax
call fcn.004811dc
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
mov edx, esi
mov eax, edi
call fcn.0046270c
lea edx, [ebx + 0x40]
lea eax, [ebp - 0x60]
mov ecx, esi
call fcn.004608f0
push esi
call fcn.00481014
cmp byte [ebp - 5], 0
pop ecx
je 0x44aec4
lea eax, [ebx + 0x89]
call fcn.00460ef0
test al, al
jne 0x44aee9
lea edx, [ebp - 0xb00]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0xb00]
lea edx, [ebx + 0x89]
lea eax, [ebp - 0x60]
call fcn.004608a8
cmp byte [ebp - 5], 0
jne 0x44b413
mov eax, dword [0x4a90bc]
call fcn.00450390
mov esi, eax
mov eax, esi
call fcn.0040d7bc
mov ecx, eax
lea edx, [ebx + 0x90]
lea eax, [ebp - 0x60]
call fcn.004608a8
push esi
call fcn.00481014
pop ecx
mov eax, dword [0x4a90c4]
call fcn.00450390
mov esi, eax
mov eax, esi
call fcn.0040d7bc
mov ecx, eax
lea edx, [ebx + 0x9a]
lea eax, [ebp - 0x60]
call fcn.004608a8
push esi
call fcn.00481014
pop ecx
cmp dword [0x4a7c9c], 0
sete cl
and ecx, 1
lea edx, [ebx + 0x128]
lea eax, [ebp - 0x60]
call fcn.004609a8
mov ecx, 0x4a623c
lea edx, [ebx + 0x12f]
lea eax, [ebp - 0x60]
call fcn.004608a8
lea edx, [ebx + 0x139]
lea eax, [ebp - 0x60]
call fcn.00460d28
mov ecx, 0x4a7ca1
lea edx, [ebx + 0x13d]
lea eax, [ebp - 0x60]
call fcn.004608a8
mov ecx, 0x4a6a3c
lea edx, [ebx + 0x151]
lea eax, [ebp - 0x60]
call fcn.004608a8
cmp byte [0x4a6a3c], 0
je 0x44afb7
lea ecx, [ebx + 0xb]
jmp 0x44afc3
mov eax, dword [0x4ba9fc]
call fcn.0040d7bc
mov ecx, eax
lea edx, [ebx + 0x159]
lea eax, [ebp - 0x60]
call fcn.004608a8
cmp dword [0x4a76f8], 0x80000000
jne 0x44affe
cmp dword [0x4a76f4], 0
jne 0x44affe
lea edx, [ebx + 0x352]
push edx
lea ecx, [ebp - 0xb34]
push ecx
call fcn.00482a00
add esp, 8
jmp 0x44b015
push dword [0x4a76f8]
push dword [0x4a76f4]
lea eax, [ebp - 0xb34]
call fcn.0040a838
lea ecx, [ebp - 0xb34]
lea edx, [ebx + 0x161]
lea eax, [ebp - 0x60]
call fcn.004608a8
xor ecx, ecx
mov cl, byte [0x4a77c3]
lea edx, [ebx + 0x174]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a77c0]
lea edx, [ebx + 0x17d]
lea eax, [ebp - 0x60]
call fcn.004609a8
lea edx, [ebx + 0x189]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a76d4]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a76e9]
lea edx, [ebx + 0x196]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a76e8]
lea edx, [ebx + 0x19d]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a7719]
lea edx, [ebx + 0x1a3]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a7718]
lea edx, [ebx + 0x1ad]
lea eax, [ebp - 0x60]
call fcn.004609a8
lea edx, [ebx + 0x1b2]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a76dc]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a76e6]
lea edx, [ebx + 0x1b8]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a77c2]
lea edx, [ebx + 0x1bb]
lea eax, [ebp - 0x60]
call fcn.004609a8
lea edx, [ebx + 0x1c0]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a76d0]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a7715]
lea edx, [ebx + 0x1c9]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a76e5]
lea edx, [ebx + 0x1d3]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a76e4]
lea edx, [ebx + 0x1de]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a77c1]
lea edx, [ebx + 0x1e7]
lea eax, [ebp - 0x60]
call fcn.004609a8
lea edx, [ebx + 0x1ec]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a76cc]
call fcn.004609a8
lea edx, [ebx + 0x1f3]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a5e38]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a80a1]
lea edx, [ebx + 0x23b]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a7c8a]
lea edx, [ebx + 0x246]
lea eax, [ebp - 0x60]
call fcn.004609a8
push 0x4a723c
lea eax, [ebp - 0xbb4]
push eax
call fcn.00482a00
add esp, 8
lea edx, [ebp - 0xbb4]
push edx
call fcn.00482a30
pop ecx
mov edx, eax
inc edx
xor eax, eax
cmp edx, eax
jle 0x44b1fc
mov ecx, eax
add cl, 0x49
xor byte [ebp + eax - 0xbb4], cl
inc eax
cmp edx, eax
jg 0x44b1eb
push edx
lea ecx, [ebp - 0xbb4]
lea eax, [ebp - 0x60]
lea edx, [ebx + 0x1fe]
call fcn.004609e4
xor ecx, ecx
mov cl, byte [0x4a72bc]
lea edx, [ebx + 0x207]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a7716]
lea edx, [ebx + 0x216]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a7708]
lea edx, [ebx + 0x221]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a776c]
lea edx, [ebx + 0x22f]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4a771a]
lea edx, [ebx + 0x24f]
lea eax, [ebp - 0x60]
call fcn.004609a8
lea edx, [ebx + 0x25f]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a7c84]
call fcn.004609a8
mov ecx, 0x4a771b
lea edx, [ebx + 0x26e]
lea eax, [ebp - 0x60]
call fcn.004608a8
lea edx, [ebx + 0x299]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4baa04]
call fcn.004609a8
lea edx, [ebx + 0x2a6]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4baa08]
call fcn.004609a8
lea edx, [ebx + 0x2af]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4baa0c]
call fcn.004609a8
lea edx, [ebx + 0x2b9]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4baa10]
call fcn.004609a8
mov eax, 0x4a7778
call fcn.00411f5c
mov ecx, eax
lea edx, [ebx + 0x2cf]
lea eax, [ebp - 0x60]
call fcn.004609a8
mov eax, 0x4a779c
call fcn.00411f5c
mov ecx, eax
lea edx, [ebx + 0x2de]
lea eax, [ebp - 0x60]
call fcn.004609a8
cmp dword [0x4a7700], 1
sete cl
and ecx, 1
lea edx, [ebx + 0x2ec]
lea eax, [ebp - 0x60]
call fcn.004609a8
cmp dword [0x4a7700], 2
sete cl
and ecx, 1
lea edx, [ebx + 0x2fc]
lea eax, [ebp - 0x60]
call fcn.004609a8
lea edx, [ebx + 0x30a]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a7c8c]
call fcn.004609a8
lea edx, [ebx + 0x310]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a7c90]
call fcn.004609a8
lea edx, [ebx + 0x316]
lea eax, [ebp - 0x60]
mov ecx, dword [0x4a7c94]
call fcn.004609a8
cmp dword [0x4a76ec], 3
sete cl
and ecx, 1
lea edx, [ebx + 0x31c]
lea eax, [ebp - 0x60]
call fcn.004609a8
cmp dword [0x4a76ec], 2
sete cl
and ecx, 1
lea edx, [ebx + 0x325]
lea eax, [ebp - 0x60]
call fcn.004609a8
xor ecx, ecx
mov cl, byte [0x4baa16]
lea edx, [ebx + 0x32f]
lea eax, [ebp - 0x60]
call fcn.004609a8
mov ecx, 0x4a7884
lea edx, [ebx + 0x33b]
lea eax, [ebp - 0x60]
call fcn.004608a8
push 0xc0
mov ecx, 0x4a77c4
lea edx, [ebx + 0x346]
lea eax, [ebp - 0x60]
call fcn.004609e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8