Function at 0x44ee20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x28], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
mov dl, byte [edi]
test dl, dl
jne 0x44efb0
mov edx, dword [ebp - 0x2c]
mov eax, 0x1c
mov ebx, dword [edx]
test ebx, ebx
je 0x44ee55
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
mov esi, 1
xor edx, edx
mov eax, 0x28
test esi, edx
jne 0x44ee4d
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x1d8], 1
sbb ebx, 0xffffffff
mov esi, dword [eax + 0x178]
test esi, esi
je 0x44ef6f
cmp ebx, dword [esi + 0x18]
jg 0x44ef46
mov edx, dword [ebp - 0x28]
mov eax, dword [esi + 4]
mov dword [edx + 0x178], eax
mov dword [esi + 0x14], ebx
push eax
push ebx
push edi
mov eax, dword [esi + 0x10]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x28]
add esp, 0x10
mov dl, byte [eax + 0x1d8]
test dl, dl
je 0x44eebd
mov eax, dword [esi + 0x10]
mov byte [ebx + eax - 1], dl
mov edx, dword [ebp - 0x2c]
mov dword [esi], edx
mov eax, dword [ebp - 0x30]
mov dword [esi + 0xc], eax
mov eax, dword [edx + 4]
mov dword [esi + 8], eax
cmp byte [edi], 0
jne 0x44eeeb
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x164]
lea eax, [edx + 0x98]
cmp eax, dword [ebp - 0x2c]
je 0x44f04e
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], esi
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esi + 4], eax
mov dword [edx], esi
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x44f047
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x64]
test edx, edx
je 0x44f047
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
push esi
test eax, eax
setne al
and eax, 0xff
neg eax
and edi, eax
push edi
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
push ebx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call edx
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebx + 0x18]
mov dword [ebp - 0x24], edx
push ecx
push ecx
push edx
mov edx, dword [esi + 0x10]
push edx
call dword [eax + 0x10]
add esp, 0x10
test eax, eax
je 0x44f05d
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x18], eax
jmp 0x44ee8b
sub esp, 0xc
push 0x1c
mov edx, dword [ebp - 0x28]
call dword [edx + 0xc]
add esp, 0x10
test eax, eax
je 0x44f05d
sub esp, 0xc
mov esi, eax
lea eax, [ebx + 0x18]
mov dword [ebp - 0x1c], eax
push eax
mov edx, dword [ebp - 0x28]
call dword [edx + 0xc]
add esp, 0x10
mov dword [esi + 0x10], eax
test eax, eax
je 0x44f08d
mov edx, dword [ebp - 0x1c]
mov dword [esi + 0x18], edx
jmp 0x44ee97
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
test ecx, ecx
je 0x44efc2
cmp byte [ecx], 0x78
je 0x44f067
mov byte [ebp - 0x1d], 0
mov al, byte [ebp - 0x1d]
mov cl, 1
xor eax, 1
mov byte [ebp - 0x48], 1
mov esi, eax
xor ebx, ebx
test cl, cl
je 0x44efe9
cmp ebx, 0x24
jg 0x44efe7
cmp dl, byte [ebx + str.http:__www.w3.org_XML_1998_namespace]
je 0x44efe9
xor ecx, ecx
cmp byte [ebp - 0x48], 0
je 0x44f006
mov eax, esi
test al, al
je 0x44f006
cmp ebx, 0x1d
jg 0x44f002
cmp dl, byte [ebx + 0x4b7bcb]
je 0x44f006
mov byte [ebp - 0x48], 0
inc ebx
mov dl, byte [ebx + edi]
test dl, dl
jne 0x44efd6
mov dl, byte [ebp - 0x48]
and edx, 1
cmp ebx, 0x1d
mov esi, edx
sete al
xor edx, edx
cmp ebx, 0x24
mov dl, al
sete al
and eax, 0xff
and eax, ecx
cmp byte [ebp - 0x1d], al
je 0x44ee5e
cmp byte [ebp - 0x1d], 1
sbb eax, eax
and eax, 2
add eax, 0x26
jmp 0x44ee4d
xor eax, eax
jmp 0x44ee4d
mov dword [edx + 0x9c], 0
jmp 0x44eef1
mov eax, 1
jmp 0x44ee4d
cmp byte [ecx + 1], 0x6d
jne 0x44efc2
cmp byte [ecx + 2], 0x6c
jne 0x44efc2
mov al, byte [ecx + 3]
cmp al, 0x6e
je 0x44f0a4
test al, al
sete byte [ebp - 0x1d]
jmp 0x44efc6
sub esp, 0xc
push esi
mov eax, dword [ebp - 0x28]
call dword [eax + 0x14]
mov eax, 1
add esp, 0x10
jmp 0x44ee4d
cmp byte [ecx + 4], 0x73
jne 0x44efc2
mov eax, 0x27
cmp byte [ecx + 5], 0
jne 0x44efc2
jmp 0x44ee4d