Function at 0x44e8b9
Capabilities:
Check os version
Encode data using base64
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0x26
push ebx
pop ebx
push edx
call fcn.00434935
add esp, 8
pop edi
pop esi
mov ebx, ebx
pop ebx
xchg dx, ax
xchg dx, ax
mov esp, ebp
shr di, 0x40
pop ebp
mov cl, cl
ret
mov eax, dword [0x4753b9]
or ebx, 0xffffffff
jb 0x417209
add ah, 0
cmp eax, ebx
jne 0x45075d
push edi
pop edi
je 0x426886
xlatb
add ebp, eax
das
imul eax, dword [ecx], 0
call fcn.0043d3ba
shr eax, 0x1e
sub eax, 3
mov eax, 0x475c98
je 0x43ca7f
jne 0x4268a4
push edi
daa
cwde
cmp dword [eax + 0x475cac], 0x61d0870f
add dword [eax], eax
mov eax, 0x475cac
ja 0x43ca7f
jbe 0x4268b4
call 0x8651b980
lds esp, [ecx + 1]
add dl, bl
sub eax, 0xfb21c35d
jbe 0x43ca7f
fisubr dword [0xfb21c35d]
push ebp
mov ebp, esp
sub esp, 0x24
mov cl, cl
push ebx
push esi
mov esi, dword [ebp + 8]
mov dl, dl
push edi
xchg si, dx
xchg dx, si
mov eax, dword [esi]
call int.0043db52
invalid
add esp, 4
cmp bl, bl
test al, 1
jb 0x43b7ee
jne 0x426864
shr edi, 0x40
je 0x4287f3
fsubr st(5), st(0)
push 0
call fcn.0041b9e7
add esp, 4
test eax, eax
jb 0x43b7f5
je 0x426864
jne 0x428814
cpuid
cmpsd dword [esi], dword es:[edi]
ret
mov edx, dword [edi]
ja 0x42683c
jbe 0x428820
rcr eax, 0xf
xchg byte [esi], dl
loopne 0x428824
jbe 0x42683c
invalid
push dword [ecx + ecx]
xor al, 9
call fcn.00431ed0
xchg dh, bl
push edx
pop edx
xchg bl, dh
shl dh, 0x20
mov cl, byte [ebp + 0xc]
shr bp, 0x40
xchg dh, al
xchg al, dh
mov dx, word [ebp + 0x10]
push eax
push esi
call fcn.00420371
mov dword [0x442bbb], 0x48
dec eax
add byte [eax], al
add byte [edi + ebx*2], dl
inc edx
add ah, dh
in eax, 0x41
add bl, ah
rol dword [ebx], 0xff
inc dword [eax]
add byte [eax + eax], dh
add byte [eax], al
adc al, 0x5f
inc edx
add byte [esi], cl
inc ecx
add byte [edi - 0x5c], ch
inc edx
add byte [eax + eax], al
add byte [0x4400420c], ch
add byte [eax], al
add bl, ch
mov bl, 0x43
add byte [eax], al
popal
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
dec eax
add byte [eax], al
add byte [eax + 0x34], ch
inc esp
add byte [ebx + 0x4800442b], bh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
adc al, 0x5f
inc edx
add byte [ecx], ch
out 0x41, al
add byte [0x4800420c], ch
add byte [eax], al
add byte [edi + 0x74], dh
inc edx
add byte [eax + 0x61], dh
inc edx
add byte [0x34000084], al
add byte [eax], al
add byte [edi + ebx*2], dl
inc edx
add byte [eax - 0x14ffbcdc], al
mov bl, 0x43
add byte [eax], al
inc eax
add byte [eax], al
xor al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], ah
cmp byte [eax], 0
add byte [eax], al
add byte [ecx], ah
add byte [eax], al
dec edx
add byte [eax], al
add byte [eax + 0x34], ch
inc esp
add byte [edi], dh
adc al, byte [edx]
and byte [eax], al
add byte [eax], al
dec esp
add byte [eax], al
add byte [0x4400420c], ch
add byte [eax], al
add byte [esi + ecx*4], dl
inc esp
add byte [eax + eax], al
add byte [eax + eax], al
add byte [edi - 0x5c], ch
add byte [eax], al
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
inc edx
add byte [eax + eax], al
add byte [0x4400420c], ch
add byte [eax], al
add byte [edi + ecx*2 + 0x71880042], al
cmp dword [ebp + 0x43], eax
add byte [edx], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebp + 0x30004456], dh
add byte [eax], al
add byte [eax], cl
add byte [eax], al
mov ch, 0x56
inc esp
add byte [eax], cl
add byte [eax], al
xor byte [eax], al
add byte [eax], al
salc
push eax
inc edx
add al, cl
mov dword [edx], eax
lcall 0, 0x3c0041db
add byte [eax + eax], bh
add byte [eax], al
fiadd dword [ebx + eax*2 + 0x42897a00]
add dh, dl
jo 0x428920
mov esi, 0xc0043
add byte [eax], al
xor byte [eax], al
add byte [eax], al
into
inc ebx
add byte [eax], dh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
cmp dword [si], eax
lodsd eax, dword [esi]
aaa
loope 0x4289bc
xor al, 0
add byte [eax], al
jo 0x428a01
inc edx
add byte [ecx], dh
push ecx
add byte [eax], al
xor al, 0
add byte [eax], al
adc al, 0x5f
inc edx
add byte [eax - 0x1bffbcdc], cl
mov esi, 0x7f350041
add byte [eax], al
xor al, 0
add byte [eax], al
push cs
cmovne eax, dword [eax]
dec edi
cmp al, byte [ebx]
shl dword [0x4219e3], cl
adc dl, byte [ebp + 0x44]
add ch, cl
and eax, dword [ebx]
fisttp dword [ecx + 0xcaf0042]
mov ecx, ebp
and eax, dword [ebx]
adc dl, byte [ebp + 0x44]
add byte [0xfc0852f], ah
and byte [esi + 0xf], 0xff
dec dword [edi]
test esi, edi
or byte [ecx], al
add byte [ebx + eax + 0x1c], dh
rol dword [edx], cl
pop edi
pop esi
mov ax, 0x1f
shl esi, 0x20
pop ebx
jno 0x4392e7
jo 0x428a0d
shr byte [eax - 0x2b7ff0c7], 8
add dword [eax], eax
jo 0x4392e7
xor al, 0x43
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [0x4753b9], eax
jne 0x41568c
je 0x433167
test eax, 0xf9870ff4
and al, 0xfe
push dword [esi + 4]
ja 0x415666
jbe 0x433173
ljmp 0xed86:0xf032a37
jbe 0x415666
invalid
cmc
test eax, eax
jb 0x417228
je 0x435840
jne 0x435826
or byte [edi + 0x6d687d8c], ah
pop esp
inc edi
add bh, al
add eax, 0x475561
add byte [eax], al
add byte [eax], al
push 0x475c6d
mov dword [0x475561], 0
call fcn.0045fb00
add esp, 4
push 0x475c6d
lea eax, [ebp + 8]
push 2
push eax
call fcn.0045fab0
mov ecx, dword [ebp + 8]
mov ch, ch
mov edx, dword [edi]
shr ah, 0x40
push ecx
push 2
ja 0x418395
jbe 0x435868
push ds
outsb dx, byte [esi]
jbe 0x418395
xor al, 0x47
lea esi, [esi + 0xc]
shl dx, 0x20
sar dword [ebp + ebx], cl
mov bx, bx
jmp dword [esi]
mov esp, ebp
pop ebp
shr bx, 0x40
ret
sub dword [0xfdba06e8], esi
inc dword [0x895e40ea]
add eax, 0x895e40ea
in al, dx
xchg esi, eax
xchg esi, eax
push 0
push 0
ja 0x433143
jbe 0x43ca8f
add eax, 0xae860f15
invalid
jbe 0x433143
js 0x443e55
jns 0x43caa0
push edx
nop
invalid
jns 0x443e55
xor al, 0xfd
pop dword [esp - 4]
je 0x44e8fd
jne 0x44e8c8
iretd
cmp ax, 0x100
je 0x44e8fd
jne 0x44e8d7
stc
invalid
cmp ax, 0x12c
xchg edx, ebx
xchg ebx, edx
je 0x44e8fd
push esi
pop esi
jne 0x44e8ed
mov edi, 0x662af420
cmp eax, 0x850f0028
cmp ax, 0x28
jne 0x426864
insd dword es:[edi], dx
jg 0x44e8f3
push dword [esp + eax + 0x7e]
add dword [ebp + 0x5b], edx
je 0x44e8fd
jle 0x44e8fc
push ebp
pop ebx
mov ecx, dword [edi]
push ecx
call fcn.0043f390
ja 0x4287d6
jbe 0x44e912
cpuid
nop
ret
jbe 0x4287d6
xor al, 0x89
jmp dword [esi]
xchg di, si
xchg si, di
mov eax, dword [0x475561]
add ecx, 0
jno 0x450771
ljmp 0x9a81:0xfc3a20f
jno 0x435811
and eax, 0xbe89668a
mov esp, 0xe8000000
cli
cmp bh, ch
invalid