Function at 0x444d63
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx eax, word [eax]
mov dword [esp], 0x999afdcf
mov byte [esp + 4], 0
mov edx, 0x9b
nop
movzx ecx, byte [esp + edx - 0x9b]
lea esi, [edx - 0x32d2af00]
mov edi, edx
and edi, ecx
or esi, ecx
lea ecx, [esi + esi]
not ecx
add ecx, esi
or ecx, edi
lea esi, [ecx + ecx]
not esi
mov ebp, 7
sub ebp, ecx
sub ebp, esi
lea ebx, [ecx + esi]
add ebx, 0xf8
and ebp, 0x5f
and ebx, 0xa0
sub ebx, ebp
add bl, 0x60
mov byte [esp + edx - 0x9b], bl
inc edx
cmp edx, 0xa0
jne case.default.0x444b70
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
mov ebp, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x450b60]
jmp dword [0x450b68]
mov ecx, dword [esp + 0x1c]
jmp dword [ecx*4 + 0x450ba8]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
mov esi, dword [eax + ecx*4]
add esi, ebp
mov ebx, esi
neg ebx
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ebx
cmp byte [eax], 0
lea eax, [eax + 1]
jne 0x444bb0
mov ebp, ebx
not ebp
mov dword [esp], 0x8e8e881f
mov edx, 0x22
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x22]
mov ecx, eax
and ecx, edx
add cl, cl
sub al, cl
movzx eax, al
add eax, edx
add al, 0x56
mov byte [esp + edx - 0x22], al
inc edx
cmp edx, 0x26
jne 0x444bd0
mov eax, esi
not eax
and ebp, eax
and ebx, esi
mov edx, ebp
sub edx, ebx
je 0x444c10
mov edi, dword [esp]
sub ebx, ebp
cmp ebx, 0xfffffffc
jbe 0x444c20
mov ebx, 0xfb520141
jmp 0x444c5b
mov eax, 0xfb520141
jmp 0x444c80
mov eax, edx
and eax, 0xfffffffc
mov ebx, 0xfb520141
nop
nop
nop
nop
nop
nop
movsx ecx, byte [esi]
xor ecx, ebx
imul ecx, edi
movsx ebx, byte [esi + 1]
xor ebx, ecx
imul ebx, edi
movsx ecx, byte [esi + 2]
xor ecx, ebx
imul ecx, edi
movsx ebx, byte [esi + 3]
xor ebx, ecx
imul ebx, edi
add esi, 4
add eax, 0xfffffffc
jne 0x444c30
mov eax, ebx
and edx, 3
je 0x444c80
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx eax, byte [esi + ebp]
xor eax, ebx
imul eax, edi
inc ebp
mov ebx, eax
cmp edx, ebp
jne 0x444c70
xor ecx, ecx
cmp eax, dword [esp + 0x40]
setne cl
jmp dword [ecx*4 + 0x450b90]
mov ecx, dword [esp + 0xc]
inc ecx
xor eax, eax
mov edx, dword [esp + 0x20]
cmp ecx, edx
setb al
mov ebp, dword [esp + 0x3c]
jmp dword [eax*4 + 0x450b88]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
xor ecx, ecx
cmp eax, dword [esp + 8]
setae cl
mov esi, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x450b98]
mov edx, eax
and edx, 0xf8cadd44
add edx, edx
mov ecx, eax
xor ecx, 0x73522bb
sub edx, ecx
mov edi, dword [esp + 8]
mov ecx, edi
not ecx
and ecx, edx
add ecx, ecx
xor edx, edi
sub ecx, edx
add ecx, 0x73522bb
xor edx, edx
cmp ecx, dword [esp + 0x10]
setb dl
jmp dword [edx*4 + 0x450ba0]
add esi, eax
xor ecx, ecx
mov eax, esi
jmp dword [ecx*4 + 0x450ba8]
xor eax, eax
jmp case.0x444b70.0
mov dword [esp + 0x10], esi
mov eax, dword [ebp + edi + 0x20]
add eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + edi + 0x24]
add eax, ebp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + edi + 0x1c]
add eax, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 8], edi
mov edx, dword [ebp + edi + 0x18]
xor ecx, ecx
xor eax, eax
cmp ecx, edx
setb al
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], edx
jmp dword [eax*4 + 0x450b88]
xor ecx, ecx
cmp esi, dword [esp]
setne cl
jmp dword [ecx*4 + 0x450b78]
mov esi, dword [ebp + edx + 0x7c]
mov edi, dword [ebp + edx + 0x78]
test esi, esi
sete cl
test edi, edi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x450b80]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x3c]
mov esi, dword [ebp + edx]
mov dword [esp], 0x97962428
mov word [esp + 4], 0
mov edi, 0xfe036de6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi + 0x1fc921a]
xor ebx, edi
mov ecx, ebx
and ecx, 1
xor ebx, 0x9eeda81
lea ecx, [ebx + ecx*2]
and ebx, 1
or ecx, 1
add ecx, ebx
mov byte [esp + edi + 0x1fc921a], cl
inc edi
cmp edi, 0xfe036dec
jne 0x444dc0
jmp dword [0x450b70]
mov dword [esp], 0x97962428
mov word [esp + 4], 0
mov edx, 0xfe036de6
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x1fc921a]
xor esi, edx
mov ecx, esi
and ecx, 1
xor esi, 0x9eeda81
lea ecx, [esi + ecx*2]
and esi, 1
or ecx, 1
add ecx, esi
mov byte [esp + edx + 0x1fc921a], cl
inc edx
cmp edx, 0xfe036dec
jne 0x444e10
jmp case.0x444b70.1
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + eax]
mov dword [esp + 8], eax
mov dword [esp], 0xcfce8cb8
mov byte [esp + 4], 0
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebx, edx
and ebx, 0xa
mov ebp, esi
xor ebp, 0xd87936dd
mov ecx, 0xa
sub ecx, ebx
sub ecx, ebp
add ebx, ebp
add ebx, 0xf5
or ebx, edi
not edi
or edi, ecx
and ebx, edi
add bl, 0xe6
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 5
jne case.default.0x444f3b
xor ecx, ecx
mov eax, dword [esp + 8]
cmp eax, dword [esp]
setne cl
xor eax, eax
mov edi, dword [esp + 0x38]
jmp dword [ecx*4 + 0x450bb8]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi + ecx + 0x84]
mov ecx, dword [edi + ecx + 0x80]
mov esi, dword [case.0x444f3b.4]
nop
nop
nop
nop
nop
nop
jmp esi
test ecx, ecx
sete bl
test edx, edx
sete dl
or dl, bl
movzx edx, dl
jmp dword [edx*4 + 0x450bd0]
mov esi, dword [edi + ecx]
add esi, edi
mov ecx, dword [edi + ecx + 0x10]
add ecx, edi
mov dword [esp + 0x18], ecx
lea ebx, [edi + 2]
mov ebp, dword [case.0x444b70.38]
mov ecx, 0xfffffffe
sub ecx, edi
mov dword [esp + 0x20], ecx
inc edi
mov edx, dword [esi]
mov ecx, edx
shr ecx, 0x1f
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
jmp dword [ecx*4 + 0x450bd8]
xor ecx, ecx
test edx, edx
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x450be0]
lea eax, [ebx + edx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebx + edx], 0
lea edx, [edx + 1]
jne 0x444fe0
mov dword [esp + 8], esi
lea ebp, [edi + edx]
mov edi, dword [esp + 0x20]
sub edi, edx
mov dword [esp], 0x8e8e881f
mov edx, 0x22
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x22]
mov ecx, ebx
and ecx, edx
add cl, cl
sub bl, cl
movzx ecx, bl
add ecx, edx
add cl, 0x56
mov byte [esp + edx - 0x22], cl
inc edx
cmp edx, 0x26
jne 0x445010
mov ecx, eax
not ecx
and ebp, ecx
and edi, eax
mov esi, ebp
mov ecx, 0xfb520141
sub esi, edi
je 0x4450b0
mov ecx, edi
mov edi, dword [esp]
mov edx, esi
and edx, 3
sub ecx, ebp
mov ebp, 0xfb520141
cmp ecx, 0xfffffffc
ja 0x44508b
and esi, 0xfffffffc
nop
nop
nop
nop
nop
movsx ecx, byte [eax]
xor ecx, ebp
imul ecx, edi
movsx ebx, byte [eax + 1]
xor ebx, ecx
imul ebx, edi
movsx ecx, byte [eax + 2]
xor ecx, ebx
imul ecx, edi
movsx ebp, byte [eax + 3]
xor ebp, ecx
imul ebp, edi
add eax, 4
add esi, 0xfffffffc
jne 0x445060
mov ecx, ebp
test edx, edx
je 0x4450b0
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [eax + esi]
xor ecx, ebp
imul ecx, edi
inc esi
mov ebp, ecx
cmp edx, esi
jne 0x4450a0
xor eax, eax
cmp ecx, dword [esp + 0x3c]
sete al
jmp dword [eax*4 + 0x450be8]
mov esi, dword [esp + 8]
add esi, 4
add dword [esp + 0x18], 4
mov ecx, 1
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x1c]
jmp 0x4450f0
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
xor ecx, ecx
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 8]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ebp
jmp dword [ecx*4 + 0x450c00]
mov edx, dword [esi]
mov ecx, edx
shr ecx, 0x1f
mov dword [esp + 0xc], eax
xor eax, eax
jmp dword [ecx*4 + 0x450bd8]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x3c]
lea ecx, [edx + eax]
mov edi, dword [edx + eax]
mov dword [esp + 4], 0xb18e487c
mov ebx, 0x5d
mov ebp, 0xa2
nop
nop
nop
movzx edx, byte [esp + ebx - 0x59]
mov esi, ebp
or esi, edx
not edx
or edx, ebx
and edx, esi
mov al, 0x2e
sub al, dl
mov byte [esp + ebx - 0x59], al
inc ebx
dec ebp
cmp ebx, 0x61
jne case.default.0x445219
xor edx, edx
cmp edi, dword [esp + 4]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x450c10]
movzx eax, word [ecx + 0x14]
lea esi, [ecx + eax]
add esi, 0x18
movzx ecx, word [ecx + 6]
xor ebp, ebp
xor eax, eax
mov word [esp + 0xe], cx
cmp bp, cx
setb al
mov dword [esp], 1
jmp dword [eax*4 + 0x450c18]
xor eax, eax
xor ecx, ecx
test eax, 0
sete cl
jmp dword [ecx*4 + 0x450c20]
inc ebp
add esi, 0x28
xor eax, eax
cmp bp, word [esp + 0xe]
setb al
jmp dword [eax*4 + 0x450c18]
mov edx, 8
mov edi, dword [esp + 0x28]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub edx, 1
jb 0x445250
movzx ebx, byte [edi]
inc edi
movzx ecx, byte [eax]
inc eax
cmp bl, cl
je case.default.0x4452b2
mov eax, ebx
not eax
and eax, ecx
not ecx
and ecx, ebx
xor edx, edx
sub ecx, eax
sete dl
jmp dword [edx*4 + 0x450c20]
xor eax, eax
mov ecx, dword [esp + 0x2c]
test ecx, ecx
setne al
jmp dword [eax*4 + 0x450c28]
xor eax, eax
cmp dword [esp + 0x30], 0
setne al
mov dword [esp], 0
jmp dword [eax*4 + 0x450c30]
mov al, 1
mov ecx, dword [esp]
jmp dword [ecx*4 + 0x450c38]
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x24]
add eax, dword [esi + 0xc]
mov dword [ecx], eax
xor eax, eax
cmp dword [esp + 0x30], 0
setne al
mov dword [esp], 0
jmp dword [eax*4 + 0x450c30]
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
xor ecx, ecx
mov al, 1
jmp dword [ecx*4 + 0x450c38]