Function at 0x44cb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x650], eax
or ebx, 0xffffffff
mov eax, dword [ebp + 0xc]
push 0x1ff
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x61b]
push 0
push eax
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x630], 0
mov byte [ebp - 0x61c], 0
call fcn.004644a0
push 0x1ff
lea eax, [ebp - 0x21b]
mov byte [ebp - 0x21c], 0
push 0
push eax
call fcn.004644a0
push 0x1ff
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x41c], 0
push 0
push eax
call fcn.004644a0
movdqu xmm0, xmmword [0x4a9790]
add esp, 0x24
mov dword [ebp - 0x628], 0
lea eax, [ebp - 0x630]
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x624], 0
movdqu xmmword [ebp - 0x18], xmm0
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44cded
lea eax, [ebp - 0x628]
push eax
push 0x200
lea eax, [ebp - 0x61c]
push eax
push 1
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x44cde1
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x624], 0x200
push eax
lea eax, [ebp - 0x624]
mov dword [ebp - 0x620], 0x200
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x61c]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x44cde1
mov edi, dword [ebp - 0x620]
xor edx, edx
mov esi, 0xba0da71d
test edi, edi
je 0x44ccc3
lea esp, [esp]
mov eax, edx
lea ecx, [ebp - 0x18]
and eax, 3
lea ecx, [ecx + eax*4]
movsx eax, byte [ebp + edx - 0x21c]
imul eax, esi
inc edx
imul esi, esi, 0xbc8f
xor dword [ecx], eax
cmp edx, edi
jb 0x44cca0
mov ebx, dword [ebp - 0x624]
xor edi, edi
test ebx, ebx
je 0x44ccf4
nop
mov eax, edx
lea ecx, [ebp - 0x18]
and eax, 3
inc edx
lea ecx, [ecx + eax*4]
movsx eax, byte [ebp + edi - 0x41c]
imul eax, esi
inc edi
imul esi, esi, 0xbc8f
xor dword [ecx], eax
cmp edi, ebx
jb 0x44ccd0
mov eax, dword [ebp - 0x634]
xor edx, edx
mov ebx, dword [ebp - 0x18]
or ebx, 1
lea edi, [eax + 5]
lea esi, [eax + 4]
mov dword [ebp - 0x63c], edi
cmp dword [ebp + 0x10], edx
jbe 0x44cd5b
sub esi, edi
jmp 0x44cd20
lea eax, [edi + edx]
mov edi, dword [ebp - 0x634]
mov cl, byte [esi + eax]
mov al, byte [eax]
shl cl, 4
sub al, 0x21
sub cl, 0x10
or cl, al
mov eax, edx
shr eax, 1
sub cl, bl
add edx, 2
imul ebx, ebx, 0x10ff5
mov byte [eax + edi], cl
mov edi, dword [ebp - 0x63c]
cmp edx, dword [ebp + 0x10]
jb 0x44cd20
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x644], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x640]
shr edx, 1
push eax
push 1
push 0
push 0
lea eax, [ebp - 0x638]
mov dword [ebp - 0x638], 0x10
push eax
push 0
lea eax, [ebp - 0x648]
mov dword [ebp - 0x634], ecx
push eax
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x648], edx
mov eax, dword [eax + 0x41c]
call eax
test eax, eax
je 0x44cdde
mov esi, dword [ebp - 0x640]
mov edi, dword [ebp - 0x650]
push esi
push dword [ebp - 0x63c]
push edi
call fcn.00464990
add esp, 0xc
mov byte [edi + esi], 0
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 1
jmp 0x44cde1
or ebx, 0xffffffff
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046125f
mov esp, ebp
pop ebp
ret 0xc