Function at 0x44fc48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, 0xd4f4
lea ebp, [esp - 0x70]
call fcn.00480210
lea eax, [ebp + 0x78]
push edi
push eax
call fcn.00430961
mov eax, dword [ebp + 0x78]
xor edi, edi
cmp word [eax], di
pop ecx
jne 0x44fc73
xor eax, eax
jmp 0x4502c9
push ebx
push esi
mov esi, 0x4949a4
push esi
lea ecx, [ebp + 0x54]
call fcn.004403c3
push esi
lea ecx, [ebp + 0x50]
call fcn.004403c3
push 2
mov byte [ebp + 0x66], 0
mov byte [ebp + 0x6f], 0x20
mov byte [ebp + 0x68], 0
mov dword [ebp + 0x60], 0xff000000
pop ebx
jmp 0x44fdfe
push ebx
lea eax, [ebp + 0x78]
push eax
push 0x497444
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x44fcc6
mov byte [ebp + 0x66], 1
jmp 0x44fdfe
push ebx
lea eax, [ebp + 0x78]
push eax
push 0x4972a8
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x44fce5
mov byte [ebp + 0x6f], 2
jmp 0x44fdfe
push 4
pop esi
push esi
lea eax, [ebp + 0x78]
push eax
push 0x49c25c
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x44fd07
mov byte [ebp + 0x6f], pe_nt_image_headers32
jmp 0x44fdfe
push ebx
lea eax, [ebp + 0x78]
push eax
push 0x49c258
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x44fd26
mov byte [ebp + 0x6f], 1
jmp 0x44fdfe
push ebx
lea eax, [ebp + 0x78]
push eax
push 0x49c254
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x44fd45
mov byte [ebp + 0x6f], 0x10
jmp 0x44fdfe
push esi
lea eax, [ebp + 0x78]
push eax
push 0x49bebc
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x44fd70
add dword [ebp + 0x78], esi
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x68], 1
call fcn.00430961
jmp 0x44fdfd
push esi
push dword [ebp + 0x78]
push 0x49c24c
call fcn.004318b1
add esp, 0xc
test al, al
je 0x44fdc1
add dword [ebp + 0x78], 8
mov eax, dword [ebp + 0x78]
xor ecx, ecx
mov cx, word [eax]
mov eax, ecx
call fcn.0040bc38
test al, al
je 0x44fda5
mov dword [ebp + 0x60], 5
jmp 0x44fdfe
cmp cx, 0x3a
jne 0x44fdfe
add dword [ebp + 0x78], ebx
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x60], edi
call fcn.00438b8e
pop ecx
jmp 0x44fdfd
push ebx
lea eax, [ebp + 0x78]
push eax
push 0x4950b8
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x44fe0a
mov esi, dword [ebp + 0x78]
push 1
push esi
push 0x495888
call fcn.00431867
add esp, 0xc
test al, al
jne 0x44fe0a
cmp word [esi], 0x2d
jne 0x44fe0a
lea eax, [ebp + 0x78]
push eax
call fcn.0040459d
pop ecx
mov eax, dword [ebp + 0x78]
cmp word [eax], di
jne 0x44fca7
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004386e6
push dword [ebp + 0x54]
call fcn.0040eec0
mov esi, eax
mov eax, dword [ebp + 0x78]
add esp, 0x10
cmp word [eax], 0x2c
mov dword [ebp + 0x4c], esi
lea eax, [ebp + 0x78]
jne 0x44fe60
add dword [ebp + 0x78], ebx
push eax
call fcn.00430961
push 0x2c
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004386e6
push dword [ebp + 0x50]
call fcn.0040eec0
add esp, 0x14
jmp 0x44feb6
push 1
push eax
lea eax, [ebp + 0x5c]
push eax
mov dword [ebp + 0x78], edi
call fcn.00416853
add esp, 0xc
push dword [ebp + 0x78]
lea ecx, [ebp + 0x54]
push dword [ebp + 0x5c]
mov ebx, eax
call fcn.00435e88
mov esi, dword [ebp + 0x54]
lea eax, [ebp + 0x5c]
push eax
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x5c], ebx
call fcn.00430961
push edi
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00416853
add esp, 0x10
push dword [ebp + 0x78]
lea ecx, [ebp + 0x50]
push dword [ebp + 0x5c]
call fcn.00435e88
mov eax, dword [ebp + 0x50]
cmp word [eax], di
mov dword [ebp + 0x58], eax
je 0x4502b2
cmp word [esi], di
je 0x4502b2
push esi
push 0x49c248
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
neg eax
sbb al, al
inc al
mov byte [ebp + 0x67], al
mov esi, 0x80
xor ebx, ebx
cmp byte [ebp + 0x6f], 2
je 0x44ff44
push edi
call fcn.00482302
pop ecx
mov ebx, eax
call fcn.00432a01
add ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
add ebx, eax
mov eax, dword [0x4ada80]
shl eax, 4
add ebx, eax
xor dword [0x4ada80], ebx
mov eax, ebx
and eax, 3
cmp al, 3
mov dword [ebp + 0x78], ebx
jne 0x44feed
test bh, 0xf0
je 0x44feed
test bh, 0xf
je 0x44feed
mov ax, word [ebp + 0x7a]
test al, 0xf0
je 0x44feed
test al, 0xf
je 0x44feed
test ah, 0xf
je 0x44feed
mov al, ah
and al, 0x88
cmp al, 0x80
jne 0x44feed
cmp byte [ebp + 0x6f], 0x10
je 0x450228
mov eax, ebx
and eax, 0xfffffff
cmp ebx, edi
mov dword [ebp + 0x78], eax
je 0x44ff62
xor ebx, 0x5aa59669
xor eax, eax
cmp byte [ebp + 0x6f], 0x20
mov dword [ebp + 0x24], ebx
jne 0x44ff70
push 0x14
pop eax
cmp byte [ebp + 0x6f], 0x40
jne 0x44ff79
push 0x18
pop eax
xor ebx, eax
cmp ax, di
mov word [ebp + 0x24], bx
je 0x44ff8d
cmp bx, di
je 0x44fee5
lea ecx, [ebp]
call fcn.0043937a
lea ecx, [ebp + 0x28]
call fcn.0043937a
cmp byte [ebp + 0x67], 0
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x44], eax
je 0x44ffb3
mov eax, dword [0x4ab2e0]
mov dword [ebp + 4], eax
jmp 0x44ffc7
push edi
push esi
push 3
push edi
push 7
push 1
push dword [ebp + 0x4c]
lea ecx, [ebp + 4]
call fcn.004045f9
movzx eax, byte [ebp + 0x67]
push eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
push dword [ebp + 4]
push 0x49c210
push 0x4acf10
call fcn.0040cde2
add esp, 0x14
cmp dword [ebp + 4], edi
jne 0x45000a
mov esi, 0x49b148
lea ecx, [ebp + 0x2c]
mov dword [ebp + 0x28], esi
call fcn.0043934d
mov dword [ebp], esi
lea ecx, [ebp + 4]
jmp 0x4502ad
push edi
push esi
push 2
push edi
push 7
push 0x40000001
push dword [ebp + 0x58]
lea ecx, [ebp + 0x2c]
call fcn.004045f9
cmp dword [ebp + 0x2c], edi
je 0x44ffef
push edi
push edi
lea ecx, [ebp - 0xd484]
mov byte [ebp + 0x3c], 1
call fcn.00431139
cmp byte [ebp + 0x6f], 0x20
lea eax, [ebp]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov byte [ebp + 0x7b], 0x53
jne 0x450053
mov byte [ebp + 0x7b], 0x61
jmp 0x45005d
cmp byte [ebp + 0x6f], 0x40
jne 0x45005d
mov byte [ebp + 0x7b], 0x4d
lea ecx, [ebp + 0x58]
call fcn.00435d62
cmp dword [ebp + 0x60], edi
jge 0x450074
cmp byte [ebp + 0x7b], 0x53
je 0x450113
cmp byte [ebp + 0x68], 0
jne 0x450113
lea eax, [ebp + 8]
push eax
push dword [ebp + 4]
call fcn.00439467
mov ebx, dword [ebp + 8]
pop ecx
pop ecx
lea ecx, [ebp + 4]
mov esi, eax
call fcn.00402b27
cmp esi, edi
jg 0x4500ca
lea ecx, [ebp + 0x58]
call fcn.0043092f
mov esi, 0x49b148
lea ecx, [ebp + 0x2c]
mov dword [ebp + 0x28], esi
call fcn.0043934d
lea ecx, [ebp + 4]
mov dword [ebp], esi
call fcn.0043934d
mov esi, 0x80070057
jmp 0x4502b5
cmp esi, 1
jle 0x4500f3
lea eax, [ebx + 2]
cmp word [eax], 0x7f
ja 0x4500f3
cmp byte [ebp + 0x6f], 0x20
je 0x4500e4
cmp byte [ebp + 0x6f], 0x40
jne 0x4500f3
lea ecx, [esi + esi]
push ecx
push eax
push ebx
call fcn.00410296
add esp, 0xc
dec esi
cmp dword [ebp + 0x60], edi
jge 0x4500ff
mov dword [ebp + 0x60], 5
push dword [ebp + 0x60]
push esi
push dword [ebp + 8]
call fcn.004395ff
add esp, 0xc
shl eax, 1
mov dword [ebp + 0x10], eax
push 7
mov esi, 0x499b90
pop edi
mov al, byte [esi]
inc dword [ebp + 0x48]
mov byte [ebp + 0x68], al
push 1
lea eax, [ebp + 0x68]
push eax
lea ecx, [ebp + 0x2c]
call fcn.004333df
inc esi
dec edi
jne 0x45011b
mov al, byte [ebp + 0x7b]
inc dword [ebp + 0x48]
mov byte [ebp + 0x7b], al
push 1
lea eax, [ebp + 0x7b]
push eax
lea ecx, [ebp + 0x2c]
call fcn.004333df
push 4
mov dword [ebp + 0x48], 8
lea esi, [ebp + 0x24]
pop edi
mov al, byte [esi]
inc dword [ebp + 0x48]
mov byte [ebp + 0x7b], al
push 1
lea eax, [ebp + 0x7b]
push eax
lea ecx, [ebp + 0x2c]
call fcn.004333df
inc esi
dec edi
jne 0x450159
xor eax, eax
lea edi, [ebp - 0xc48a]
mov dword [ebp + 0x48], 0xc
stosd dword es:[edi], eax
xor esi, esi
lea ecx, [ebp]
call fcn.00433499
cmp eax, 0xffffffff
je 0x4501a9
movsx ecx, si
inc esi
mov byte [ebp + ecx - 0xc48a], al
inc byte [ebp - 0xc467]
cmp si, 4
jl 0x450185
push 4
lea esi, [ebp - 0xc48a]
pop edi
cmp byte [ebp + 0x66], 0
je 0x4501bf
mov al, byte [esi]
mov byte [ebp + 0x7b], al
jmp 0x4501c3
mov byte [ebp + 0x7b], 0
inc dword [ebp + 0x48]
push 1
lea eax, [ebp + 0x7b]
push eax
lea ecx, [ebp + 0x2c]
call fcn.004333df
inc esi
dec edi
jne 0x4501b2
push 0
mov dword [ebp + 0x48], 0x10
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea ecx, [ebp - 0xd484]
call fcn.00431373
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
cmp byte [ebp + 0x67], 0
je 0x450205
and dword [ebp + 4], 0
lea ecx, [ebp + 0x58]
call fcn.0043092f
mov esi, 0x49b148
lea ecx, [ebp + 0x2c]
mov dword [ebp + 0x28], esi
call fcn.0043934d
mov dword [ebp], esi
lea ecx, [ebp + 4]
jmp 0x450332
lea ecx, [ebp - 0x24]
mov dword [ebp + 0x78], edi
call fcn.004393d6
lea ecx, [ebp - 0x48]
call fcn.004393d6
push edi
push esi
push 3
push edi
push 7
push 1
push dword [ebp + 0x4c]
lea ecx, [ebp - 0x20]
call fcn.004045f9
cmp dword [ebp - 0x20], edi
je 0x450297
push 8
pop ebx
lea ecx, [ebp - 0x24]
call fcn.004334f4
dec ebx
jne 0x450257
xor ebx, ebx
lea ecx, [ebp - 0x24]
call fcn.004334f4
mov byte [ebp + ebx + 0x78], al
inc ebx
cmp ebx, 4
jl 0x450264
cmp dword [ebp + 0x78], edi
jne 0x450297
push edi
push esi
push 2
push edi
push 7
push 0x40000001
push dword [ebp + 0x58]
lea ecx, [ebp - 0x44]
call fcn.004045f9
cmp dword [ebp - 0x44], edi
jne 0x4502d1
mov esi, 0x49b158
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], esi
call fcn.0043934d
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x20]
call fcn.0043934d
xor esi, esi
inc esi
lea ecx, [ebp + 0x50]
call fcn.0043092f
lea ecx, [ebp + 0x54]
call fcn.0043092f
mov eax, esi
pop esi
pop ebx
pop edi
add ebp, 0x70
leave
ret 8
push edi
push edi
lea ecx, [ebp - 0xd484]
mov byte [ebp - 0x34], 1
call fcn.00431139
cmp dword [ebp - 8], edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], eax
je 0x4502fa
xor dword [ebp - 8], 0x5aa59669
push 4
pop esi
lea ecx, [ebp - 0x24]
call fcn.004334f4
dec esi
jne 0x4502fd
lea ecx, [ebp - 0xd484]
call fcn.004315d6
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov esi, 0x49b158
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], esi
call fcn.0043934d
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x20]
call fcn.0043934d
xor esi, esi
jmp 0x4502b5