Function at 0x44e860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481178
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4ade78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov esi, dword [0x4af2c0]
mov ecx, 7
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
mov dword [ebp - 4], 0
cmp edx, 1
jne 0x44e8f5
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004601e0
push eax
call fcn.0046208f
add esp, 8
call fcn.0045b1b0
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or edi, 0xffffffff
test al, al
je 0x44eaf9
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x494228
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 1
call fcn.00402d20
push 0x4918d4
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 2
call fcn.00402d20
push dword [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00402c60
push 1
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.0045a3f0
add esp, 0x30
lea ecx, [ebp - 0x30]
push 0x2001f
push dword [eax]
push dword [0x4adbb0]
call fcn.0041c100
mov edx, dword [ebp - 0x18]
test eax, eax
sete byte [ebp - 0xd]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44e9a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44e9c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44e9e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44ea05
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44ea25
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x44ea4d
push dword [ebx]
lea ecx, [ebp - 0x30]
call fcn.004433f0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x44ea46
push eax
call esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov esi, dword [0x4af2c0]
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, 0xe
idiv ecx
cmp edx, 2
jne 0x44eaf3
xor edx, edx
mov edi, edi
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x44ea70
mov dword [0x4af2c0], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x494228
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.00402d20
push 0x4918d4
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 6
call fcn.00402d20
push dword [ebp + 8]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402c60
push 0
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 8
call fcn.0045a3f0
add esp, 0x30
lea ecx, [ebp - 0x30]
push 0x2001f
push dword [eax]
push dword [0x4adbb0]
call fcn.0041c100
mov edx, dword [ebp - 0x24]
test eax, eax
setne byte [ebp - 0xd]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44eb90
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44ebb0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44ebd0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44ebf0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x44ec0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x44ec37
call fcn.00452630
test al, al
jne 0x44ec2d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov eax, dword [ebp - 0x30]
xor bl, bl
jmp 0x44eccb
push dword [ebx]
lea ecx, [ebp - 0x30]
call fcn.004433f0
mov ecx, dword [0x4af2c0]
mov edi, 0x12
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv edi
cmp edx, 0xb
jne 0x44ecbd
test ecx, ecx
je 0x44ecbd
mov edi, edi
mov eax, ecx
and eax, 0x80000001
jns 0x44ec6e
dec eax
or eax, 0xfffffffe
inc eax
jne 0x44ec7b
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x44ec82
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x4af2c0], ecx
sub edx, 0
je 0x44ecac
sub edx, 2
je 0x44ecaf
dec edx
je 0x44ecb0
jmp 0x44ecb9
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x4af2c0], ecx
test ecx, ecx
jne 0x44ec60
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x44ecc9
push eax
call esi
xor eax, eax
mov bl, 1
test eax, eax
je 0x44ecd2
push eax
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret