Function at 0x44bfb8
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24ba11b8
call fcn.0042f8b4
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
mov ebx, ecx
push 0xba010000
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4ac], edi
mov dword [ebp - 0x4a8], edi
mov dword [ebp - 0x4a4], edi
mov dword [ebp - 0x4a0], edi
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x498], edi
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x48c], edi
mov word [ebp - 0x488], ax
mov word [ebp - 0x280], ax
mov dword [ebp - 0x5c], edi
call fcn.0041f4fe
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004047cb
lea ecx, [ebp - 0x78c]
call fcn.0044bdc8
push edi
push dword [ebx + 4]
xor esi, esi
push dword [ebx]
inc esi
mov ecx, ebx
mov dword [ebp - 0x1c], esi
call fcn.0040452b
push 0x4b3274
inc dword [eax]
or al, ch
mov al, byte [0x59fffd55]
pop ecx
push ecx
test eax, eax
lea eax, [ebp - 0xda4]
push eax
push dword [ebp + 8]
mov ecx, ebx
jne 0x24697b1b
call fcn.0044c581
mov ecx, esi
jne 0x44c124
lea eax, [ebp - 0xb9c]
push eax
lea eax, [ebp - 0x11b4]
push eax
lea eax, [ebp - 0xfac]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call fcn.00421e10
add esp, 0x14
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x994]
push eax
call fcn.00420d37
lea eax, [ebp - 0xfac]
push eax
lea eax, [ebp - 0x994]
push eax
call fcn.00420d08
lea eax, [ebp - 0xb9c]
push eax
lea eax, [ebp - 0x11b4]
push eax
lea eax, [ebp - 0xfac]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xda4]
push eax
call fcn.00421e10
add esp, 0x24
lea eax, [ebp - 0x11b4]
push eax
lea eax, [ebp - 0x994]
push eax
call fcn.00420d08
lea eax, [ebp - 0xb9c]
push eax
lea eax, [ebp - 0x994]
push eax
call fcn.00420d08
add esp, 0x10
lea eax, [ebp - 0x994]
jmp 0x44c12e
push 6
jmp 0x44c37b
push dword [ebx]
mov dword [ebp + 0xc], eax
push esi
push esi
lea eax, [ebp - 5]
push eax
mov ecx, ebx
call fcn.00404501
push dword [ebx]
lea eax, [ebp - 0xc]
push esi
push 4
push eax
mov ecx, ebx
call fcn.00404501
push dword [ebx]
mov eax, dword [ebp - 0xc]
xor eax, 0x87bc
push esi
mov dword [ebp - 0x20], eax
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
call fcn.00404501
push dword [ebx]
lea eax, [ebp - 0xc]
push esi
push 4
push eax
mov ecx, ebx
call fcn.00404501
push dword [ebx]
mov eax, dword [ebp - 0xc]
xor eax, 0xa685
push esi
mov dword [ebp - 0x24], eax
push 4
lea eax, [ebp - 0x38]
push eax
mov ecx, ebx
call fcn.00404501
push dword [ebx]
lea eax, [ebp - 0x3c]
push esi
push 4
push eax
mov ecx, ebx
call fcn.00404501
push dword [ebx]
lea eax, [ebp - 0x40]
push esi
push 4
push eax
mov ecx, ebx
call fcn.00404501
push dword [ebx]
lea eax, [ebp - 0x44]
push esi
push 4
push eax
mov ecx, ebx
call fcn.00404501
lea eax, [ebp - 0x6b4]
push eax
call fcn.0044c72e
lea eax, [ebp - 0x6b4]
push 0x4b3918
push eax
call fcn.004234ad
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov ecx, esi
jne 0x44c1f3
push 9
jmp 0x2468c37b
mov eax, dword [ebx + 8]
add eax, 0x2477
push eax
lea ecx, [ebp - 0x78c]
call fcn.0044be0c
mov edx, dword [ebp - 0x20]
mov ecx, edi
test edx, edx
jle 0x44c2a0
lea eax, [ecx - 0x45ff0000]
cmp eax, edx
jle 0x44c224
mov eax, edx
sub eax, ecx
jmp 0x44c229
mov eax, 0xba010000
push dword [ebx]
add ecx, eax
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x34], ecx
mov ecx, ebx
mov dword [ebp + 8], eax
call fcn.00404501
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], edi
test eax, eax
jle 0x44c271
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov edi, eax
push ecx
push ecx
lea ecx, [ebp - 0x78c]
call fcn.0044bf42
xor byte [ebx + esi], al
inc esi
cmp esi, edi
jl 0x44c251
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp + 8]
xor esi, esi
inc esi
xor edi, edi
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.0044b7a5
push dword [ebp - 0x18]
push dword [ebp + 8]
push esi
push dword [ebp - 0x14]
call fcn.00422ac2
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x20]
add esp, 0x10
cmp ecx, edx
jl 0x44c214
push 0x4d8bfffd
int3
mov esi, dword [ebp - 0x1c]
inc dword [eax]
call 0xfdb8138f
call [ecx + 0x39]
jne 0x44c288
je 0x44c2c2
lea eax, [ebp - 0x6b4]
push eax
call dword [0x48d3dc]
push 0xa
jmp 0x44c47b
cmp byte [ebp - 5], 1
jne 0x44c456
xor eax, eax
mov word [ebp - 0x488], ax
mov word [ebp - 0x280], ax
lea eax, [ebp - 0x6b4]
push eax
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 0x4ac], edi
mov dword [ebp - 0x4a8], edi
mov dword [ebp - 0x4a4], edi
mov dword [ebp - 0x4a0], edi
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x48c], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x498], edi
mov dword [ebp - 0x494], edi
call fcn.0044c831
mov esi, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0x4ac]
call fcn.0044c859
lea ecx, [ebp - 0x4ac]
call fcn.0044b979
mov ecx, esi
je 0x44c37e
lea eax, [ebp - 0x6b4]
push eax
call dword [0x48d3dc]
push 0xb
jmp 0x44c37b
pop edi
jmp 0x44c399
lea eax, [ebp - 0x6b4]
push eax
call dword [0x48d3dc]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.0044c6ed
lea ecx, [ebp - 0x14]
call fcn.004047f6
mov eax, edi
pop edi
pop esi
inc ebp
leave
ret 0xc
pop eax
jmp 0x5ec57a
push dword [edi]
mov ebx, dword [ebp - 8]
push 1
push 4
lea eax, [ebp - 8]
mov esi, 0x87bc
push eax
mov ecx, edi
xor ebx, esi
call fcn.00404501
mov eax, dword [ebp - 8]
push dword [edi]
xor eax, esi
mov esi, dword [ebp + 0x10]
push 1
mov dword [esi], eax
push 4
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.00404501
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
push 1
push 0x10
push dword [ecx]
xor edi, 0xa685
call fcn.0040452b
push dword [esi]
call fcn.00423970
pop ecx
push ebx
mov dword [ebp + 8], eax
call fcn.00423970
mov esi, dword [ebp - 0xc]
pop ecx
push dword [esi]
mov ecx, esi
push 1
push ebx
push eax
mov dword [ebp + 0x10], eax
call fcn.00404501
mov ecx, dword [esi + 8]
add ecx, 0x2477
push ecx
push ebx
push dword [ebp + 0x10]
call fcn.0044bf6e
push ebx
mov ebx, dword [ebp + 0x10]
push ebx
lea ecx, [ebp - 0x10]
call fcn.0044b7a5
mov esi, dword [ebp + 8]
cmp edi, dword [ebp - 0x10]
je 0x44c505
push esi
call fcn.00421cb1
pop ecx
push ebx
call fcn.00421cb1
pop ecx
push 0xa
jmp 0x44c431
cmp byte [ebp - 1], 1
jne 0x44c56a
xor ecx, ecx
xor eax, eax
mov word [ebp - 0x454], ax
mov word [ebp - 0x24c], ax
inc eax
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x46c], ecx
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x478], esi
call fcn.0044b979
push ebx
call fcn.00421cb1
jmp 0x44c572
push esi
call fcn.00421cb1
mov esi, ebx
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
inc ebp
leave
ret 0xc