Function at 0x449370
Capabilities:
Encode data using xor
Resolve function by parsing pe exports
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4e4211
mov eax, dword fs:[0]
push eax
sub esp, 0x55c
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x558], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x417270]
xor eax, esp
push eax
lea eax, [esp + 0x570]
mov dword fs:[0], eax
mov eax, dword [0x4fbd08]
test al, 1
jne 0x449f43
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x9c
or eax, 1
push 0
mov dword [0x4fbd08], eax
mov dword [0x53e190], 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
test ebx, ebx
jne 0x4493fb
push 0x12
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
call esi
jmp 0x449401
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov dword [ebx], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x449427
push ebx
push eax
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xff
call edi
push eax
call esi
push 1
call fcn.004cc0eb
add esp, 4
test eax, eax
jne 0x44943c
push 0x1c
call edi
push eax
call esi
call fcn.004cc59f
test eax, eax
jne 0x44944c
push 0x10
call edi
push eax
call esi
call fcn.004cc72c
test eax, eax
jge 0x44945f
push 0x1b
call fcn.004cc9fe
add esp, 4
push 1
call fcn.004ccabd
add esp, 4
test eax, eax
je 0x449476
push eax
call fcn.004cc9fe
add esp, 4
call fcn.00432510
mov ebp, eax
lea edi, [ebp + 0x30]
mov ecx, 0x27
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
call fcn.0045cb20
mov ecx, ebp
call fcn.0045cb40
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.004282c0
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov dword [edi + 0x14], eax
call eax
mov dword [ebp + 0x2c], eax
push 0x400
mov esi, 0x4fbd08
sub esi, dword [0x4fbd14]
lea eax, [esp + 0x170]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x16c]
push ecx
lea ecx, [ebp + 8]
mov dword [ebp + 0x28], esi
call fcn.00466fc0
push 0xf0
lea edx, [esp + 0x6c]
push 0
push edx
mov dword [esp + 0x164], 0xe
call fcn.004caf20
add esp, 0xc
mov al, 0xe3
mov byte [esp + 0x15e], al
mov byte [esp + 0x162], al
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x57c], 0
mov byte [esp + 0x160], 0xd6
mov byte [esp + 0x161], 0xa5
mov byte [esp + 0x163], 0x74
mov byte [esp + 0x164], 0x36
mov byte [esp + 0x165], 0xf2
mov byte [esp + 0x167], 0x18
mov byte [esp + 0x168], 0xa6
mov byte [esp + 0x169], 0xab
mov byte [esp + 0x16a], 0xcc
mov byte [esp + 0x16b], 0xa4
mov byte [esp + 0x16c], 0x76
mov byte [esp + 0x16d], 0x95
mov byte [esp + 0x16e], 0x69
mov byte [esp + 0x16f], 0x73
call fcn.00470d30
lea ecx, [esp + 0x58]
call fcn.004701e0
push 0x41374
push 0x4fbe18
push 0x4fbe18
lea ecx, [esp + 0x64]
call fcn.00470730
push 0x4fbe18
lea ecx, [esp + 0x5c]
call fcn.00470d30
lea ecx, [esp + 0x58]
call fcn.004701e0
push 0x2c
push 0x4fdcbc
push 0x4fdcbc
lea ecx, [esp + 0x64]
call fcn.00470730
mov ecx, edi
call fcn.0044a460
test al, al
jne 0x449614
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x4fbd08]
shr ecx, 0xa
test cl, 1
je 0x449693
cmp dword [edi + 0x1fc], 0
je 0x449693
lea edx, [esp + 0x16c]
push edx
lea ecx, [esp + 0x3c]
call fcn.0046e330
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x57c], 1
call fcn.0046e4a0
cmp dword [eax + 0x1c], 0x10
mov byte [esp + 0x578], 2
jb 0x449665
mov eax, dword [eax + 8]
jmp 0x449668
add eax, 8
mov ecx, dword [edi + 0x1fc]
push eax
call ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x578], 1
call fcn.004a5ea0
lea ecx, [esp + 0x38]
mov byte [esp + 0x578], 0
call fcn.004a5ea0
call fcn.00444450
mov ebx, 0x800000
test dword [0x4fdcbc], ebx
jne 0x4496eb
mov eax, dword [0x53e1a0]
mov edx, dword [eax + 0x1c]
lea esi, [eax + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
int3
mov ecx, ebp
call fcn.0045cac0
mov ecx, dword [0x4fbd08]
shr ecx, 1
test cl, 1
jne 0x449729
mov edx, 0xd6a5e374
mov eax, 0x4fbd18
mov esi, 0x40
mov edi, edi
mov ecx, dword [eax]
mov ebx, ecx
xor ebx, edx
mov dword [eax], ebx
add eax, 4
sub esi, 1
mov edx, ecx
jne 0x449710
or dword [0x4fbd08], 2
call fcn.00434410
test dword [0x4fdcbc], 0x800000
mov ebx, eax
jne 0x449759
mov eax, dword [0x53e1a0]
mov edx, dword [eax + 0x1c]
lea esi, [eax + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
invalid
push 0x4fbd08
mov ecx, ebx
call fcn.004445b0
test al, al
jne 0x4497f8
mov ecx, dword [0x53e1ec]
xor edi, edi
cmp ecx, edi
je 0x449787
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x53e1ec], edi
mov ecx, dword [0x53e1c0]
cmp ecx, edi
je 0x44979f
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x53e1c0], edi
mov ecx, dword [0x53e1f0]
cmp ecx, edi
je 0x4497b7
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x53e1f0], edi
mov ecx, dword [0x53e1e8]
cmp ecx, edi
je 0x4497cf
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x53e1e8], edi
mov ecx, dword [0x53f24c]
cmp ecx, edi
je 0x44a022
mov esi, ecx
call fcn.004b0370
push esi
call fcn.004cada5
add esp, 4
mov dword [0x53f24c], edi
jmp 0x44a022
mov ecx, dword [0x4fbd08]
shr ecx, 8
test cl, 1
jne 0x449833
mov edx, dword [ebx + 0x4c]
shr edx, 0x17
test dl, 1
jne 0x449833
cmp dword [edi + 0x94], 0
je 0x449833
mov eax, dword [edi + 0x9c]
push 0
call eax
mov ecx, dword [edi + 0x94]
push 0x447730
push 1
call ecx
test dword [0x4fdcbc], 0x800000
jne 0x44985c
mov eax, dword [0x53e1a0]
mov edx, dword [eax + 0x1c]
lea esi, [eax + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
invalid
cmp dword [0x4fbe28], 0
jbe 0x449d63
mov esi, dword [0x4fbe2c]
mov ecx, dword [ebp + 0x2c]
lea esi, [esi + 0x52b18c]
mov dword [esi], ecx
mov dword [esi + 4], 0x4475a0
mov dword [esi + 8], 0x446bd0
mov dword [esi + 0xc], 0x449350
test dword [0x4fdcbc], 0x800000
jne 0x4498b7
mov eax, dword [0x53e1a0]
mov edx, dword [eax + 0x1c]
lea edi, [eax + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
int3
mov dword [esi + 0x10], 0x45ee20
mov dword [esi + 0x14], fcn.0045e360
mov dword [esi + 0x18], 0x45ee40
mov dword [esi + 0x1c], fcn.0045e3d0
mov dword [esi + 0x20], 0x45ee60
mov dword [esi + 0x24], fcn.0045e440
mov dword [esi + 0x28], 0x45ee80
mov dword [esi + 0x2c], fcn.0045e4e0
mov dword [esi + 0x30], 0x45eea0
mov dword [esi + 0x34], fcn.0045e540
mov dword [esi + 0x38], 0x45d960
mov dword [esi + 0x3c], 0x45eec0
mov dword [esi + 0x40], fcn.0045e610
mov dword [esi + 0x44], 0x45eee0
mov dword [esi + 0x48], fcn.0045e680
mov dword [esi + 0x4c], fcn.0045e6f0
mov dword [esi + 0x50], 0x45e770
mov dword [esi + 0x54], fcn.0045e7e0
mov dword [esi + 0x58], 0x45e860
mov dword [esi + 0x5c], 0x45e8d0
mov dword [esi + 0x60], 0x45ef00
mov dword [esi + 0x64], fcn.0045e900
mov dword [esi + 0x68], 0x45ef20
mov dword [esi + 0x6c], fcn.0045e980
mov dword [esi + 0x70], fcn.0045ea00
mov dword [esi + 0x74], fcn.0045eae0
mov dword [esi + 0x78], fcn.0045ebb0
mov dword [esi + 0x7c], fcn.0045ec50
mov dword [esi + 0x80], 0x46b620
mov dword [esi + 0x84], 0x46c650
mov dword [esi + 0x88], 0x46ad20
mov dword [esi + 0x8c], 0x46c050
mov dword [esi + 0x90], 0x46ae40
mov dword [esi + 0x94], 0x46b970
mov dword [esi + 0x98], 0x46ba80
mov dword [esi + 0x9c], 0x46c780
mov dword [esi + 0xa0], 0x469920
mov dword [esi + 0xa4], 0x469320
mov dword [esi + 0xa8], 0x469440
mov dword [esi + 0xac], fcn.0046bb90
mov dword [esi + 0xb0], 0x46bf30
mov dword [esi + 0xb4], 0x469160
mov dword [esi + 0xb8], 0x46c3d0
mov dword [esi + 0xbc], 0x46a780
mov dword [esi + 0xc0], fcn.0046a8a0
mov dword [esi + 0xc4], 0x46a9c0
mov dword [esi + 0xc8], 0x46aae0
mov dword [esi + 0xcc], 0x46a660
mov dword [esi + 0xd0], 0x46c8a0
mov dword [esi + 0xd4], 0x46cb20
mov dword [esi + 0xd8], fcn.0046cc40
mov dword [esi + 0xdc], fcn.0046d0b0
mov dword [esi + 0xe0], fcn.0046d1c0
mov dword [esi + 0xe4], 0x46cd60
mov dword [esi + 0xe8], 0x46c290
mov dword [esi + 0xec], 0x46af60
mov dword [esi + 0xf0], 0x469a40
mov dword [esi + 0xf4], 0x46c170
mov dword [esi + 0xf8], 0x46ce80
mov dword [esi + 0xfc], 0x46cfa0
mov dword [esi + 0x100], 0x46a190
mov dword [esi + 0x104], fcn.00469570
mov dword [esi + 0x108], fcn.0046b860
mov dword [esi + 0x10c], 0x469200
mov dword [esi + 0x110], 0x46ac00
mov dword [esi + 0x114], fcn.004691c0
mov dword [esi + 0x118], 0x469e30
mov dword [esi + 0x11c], 0x4696b0
mov dword [esi + 0x120], 0x46b080
mov dword [esi + 0x124], fcn.0046c4f0
mov dword [esi + 0x128], fcn.0046b740
mov dword [esi + 0x12c], fcn.0046d1c0
mov dword [esi + 0x130], 0x469b80
mov dword [esi + 0x134], 0x469cc0
mov dword [esi + 0x138], 0x469f50
mov dword [esi + 0x13c], 0x46a070
mov dword [esi + 0x140], 0x46a2b0
mov dword [esi + 0x144], 0x46a3e0
mov dword [esi + 0x148], 0x4697e0
mov dword [esi + 0x14c], 0x46b1b0
mov dword [esi + 0x150], 0x46a510
mov dword [esi + 0x154], 0x46bc20
mov dword [esi + 0x158], 0x469190
mov dword [esi + 0x15c], 0x46c9e0
mov dword [esi + 0x160], fcn.0046b2d0
mov dword [esi + 0x164], fcn.0046b410
mov dword [esi + 0x168], fcn.0046b520
mov dword [esi + 0x16c], 0x46d250
mov dword [esi + 0x170], 0x46d350
mov dword [esi + 0x174], 0x46d440
mov dword [esi + 0x178], 0x4bfd70
mov dword [esi + 0x17c], 0x4c0390
mov dword [esi + 0x180], 0x4c03a0
mov dword [esi + 0x184], 0x4c0390
mov dword [esi + 0x188], 0x4c03a0
mov dword [esi + 0x18c], 0x4c03b0
mov dword [esi + 0x190], 0x4c0790
mov dword [esi + 0x194], 0x4c1620
mov dword [esi + 0x198], 0x4c1dc0
mov dword [esi + 0x19c], 0x4c29f0
mov dword [esi + 0x1a0], 0x4c2a90
mov dword [esi + 0x1a4], 0x4bf5a0
mov dword [esi + 0x1a8], 0x4bf770
mov dword [esi + 0x1ac], 0x4bf360
mov dword [esi + 0x1b0], 0x4c2a70
mov dword [esi + 0x1b4], 0x4c3500
mov dword [esi + 0x1b8], 0x4c07c0
mov dword [esi + 0x1bc], 0x4c3850
mov dword [esi + 0x1c0], fcn.004c1280
mov dword [esi + 0x1c4], fcn.004bfd90
mov dword [esi + 0x1c8], 0x4c1b90
mov dword [esi + 0x1cc], 0x4c33c0
mov dword [esi + 0x1d0], 0x4c3740
mov dword [esi + 0x1d4], 0x4c0070
mov dword [esi + 0x1d8], 0x4c0480
mov dword [esi + 0x1dc], 0x4c0500
mov dword [esi + 0x1e0], 0x4bfd80
mov dword [esi + 0x1e4], 0x4c3190
mov dword [esi + 0x1e8], 0x4c3210
mov dword [esi + 0x1ec], 0x4c3290
mov dword [esi + 0x1f0], 0x4c3330
mov dword [esi + 0x1f4], fcn.004c0960
mov dword [esi + 0x1f8], fcn.004c0e60
mov dword [esi + 0x1fc], 0x4bf2d0
mov dword [esi + 0x200], fcn.004c0740
mov dword [esi + 0x204], 0x4c2e10
mov dword [esi + 0x208], 0x4c2f30
mov dword [esi + 0x20c], 0x4c3060
test dword [0x4fdcbc], 0x800000
jne 0x449d91
mov eax, dword [0x53e1a0]
mov edx, dword [eax + 0x1c]
lea esi, [eax + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov byte [0], 0x54
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ecx, dword [ebx + 0x4c]
mov edx, dword [0x4fbe20]
mov eax, dword [0x4fbe24]
shr ecx, 0x11
and cl, 1
push edx
lea ecx, [eax + 0x52b18c]
sete dl
push ecx
mov ecx, dword [0x4fbe5c]
movzx eax, dl
push eax
push ecx
call fcn.004492e0
mov ecx, eax
call fcn.0045a170
xor esi, esi
mov dword [0x4fbe5c], esi
mov dword [0x4fbe20], esi
mov edx, dword [ebx + 0x4c]
shr edx, 2
test dl, 1
je 0x449e17
mov eax, dword [0x4fbe38]
mov ecx, dword [0x4fbe3c]
push eax
mov eax, dword [0x4fdcd8]
lea edx, [ecx + 0x52b18c]
push edx
push eax
call fcn.00449240
mov ecx, eax
call fcn.00452800
mov dword [0x4fdcd8], esi
mov dword [0x4fbe38], esi
mov dword [0x4fbe3c], esi
mov eax, dword [ebx + 0x4c]
mov ecx, eax
shr ecx, 3
test cl, 1
je 0x449e34
mov ebx, eax
shr ebx, 0x12
and bl, 1
call fcn.00445d20
mov byte [eax + 5], bl
cmp dword [ebp + 0x40], 1
jne 0x449e64
test dword [0x4fdcbc], 0x800000
jne 0x449e64
mov eax, dword [0x53e1a0]
mov edx, dword [eax + 0x1c]
lea esi, [eax + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
in ax, 0x64
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ecx, dword [0x4fbe48]
mov edx, dword [0x4fbe44]
mov eax, dword [0x4fbe40]
push ecx
push edx
push eax
push 0x4fbd18
call fcn.00446bf0
mov ecx, eax
call fcn.004470c0
test dword [0x4fbe4c], 0x10000000
je 0x449eba
mov ecx, dword [0x53fbdc]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
inc dword [eax + 0xdc888]
push 0xd
call fcn.004ca22e
add esp, 4
mov dword [0x4fbe40], eax
xor eax, eax
test dword [0x4fdcbc], 0x800000
mov dword [0x4fbe44], eax
mov dword [0x4fbe48], eax
jne 0x449ef3
mov eax, dword [0x53e1a0]
lea esi, [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
call edx
mov byte [0], 0x58
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
call fcn.00432510
mov eax, dword [eax + 0x28]
add eax, dword [0x4fbe58]
mov dword [0x53e18c], eax
cmp dword [ebp + 0x40], 1
jne 0x44a02c
test dword [0x4fdcbc], 0x800000
jne 0x44a02c
mov eax, dword [0x53e1a0]
mov edx, dword [eax + 0x1c]
lea esi, [eax + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
in ax, 0x64
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
jmp 0x44a02c
shr eax, 8
test al, 1
je 0x44a02c
mov ecx, dword [0x4fdcbc]
shr ecx, 4
test cl, 1
jne 0x44a02c
cmp dword [esp + 0x580], 0
jne 0x44a02c
call fcn.00445d20
mov ecx, eax
call fcn.00437b70
mov ecx, dword [0x53e1cc]
test ecx, ecx
je 0x449f89
call fcn.00459790
cmp dword [0x53e1c0], 0
je 0x449fa0
call fcn.00434410
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
call fcn.00444e00
call fcn.00445b00
call fcn.00444ef0
call fcn.00444f10
call fcn.00444ed0
call fcn.00444e70
call fcn.00444e20
call fcn.00444f60
call fcn.004454e0
call fcn.00444dc0
call fcn.00444de0
cmp dword [0x53fbd4], 0
jne 0x449fe5
call fcn.004ccc84
cmp dword [esp + 0x584], 0
jne 0x44a02c
or esi, 0xffffffff
cmp dword [0x4172f4], esi
je 0x44a018
call fcn.004282c0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x44a012
mov ecx, dword [0x4172f4]
push ecx
call eax
mov dword [0x4172f4], esi
call fcn.00444f30
call fcn.004cc980
call fcn.004cc2b9
call fcn.004cc11b
mov ecx, dword [esp + 0x570]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x558]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x568
ret