Function at 0x4519a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], ecx
mov ecx, 0x800
push edi
or edi, 0xffffffff
call fcn.004bca70
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x452145
mov eax, dword [esi]
push 0x400
push ecx
push ebx
push esi
call dword [eax + 0x38]
test eax, eax
js 0x452105
mov ecx, 0x800
call fcn.004bca70
mov dword [ebp - 0x14], eax
test eax, eax
je 0x452105
mov ecx, dword [esi]
push 0x400
push eax
push esi
call dword [ecx + 0x28]
test eax, eax
js 0x452105
mov dword [ebp - 0x7c], 0x1f
mov eax, dword [ebp - 0x7c]
xor eax, 0x47
mov word [ebp - 0x78], ax
mov eax, dword [ebp - 0x7c]
inc eax
xor eax, 0x50
mov word [ebp - 0x76], ax
mov eax, dword [ebp - 0x7c]
add eax, 2
xor eax, 0x54
mov word [ebp - 0x74], ax
mov eax, dword [ebp - 0x7c]
add eax, 3
xor eax, 0x2e
mov word [ebp - 0x72], ax
mov eax, dword [ebp - 0x7c]
add eax, 4
xor eax, 0x49
mov word [ebp - 0x70], ax
mov eax, dword [ebp - 0x7c]
add eax, 5
xor eax, 0x4e
mov word [ebp - 0x6e], ax
mov eax, dword [ebp - 0x7c]
add eax, 6
xor eax, 0x49
mov word [ebp - 0x6c], ax
mov eax, dword [ebp - 0x7c]
add eax, 7
mov word [ebp - 0x6a], ax
mov eax, dword [ebp - 0x7c]
movzx ecx, word [0x402d0c]
add eax, 8
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x68], cx
mov eax, dword [ebp - 0x7c]
movzx ecx, word [0x402d0e]
add eax, 9
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x66], cx
mov eax, dword [ebp - 0x7c]
movzx ecx, word [0x402d10]
add eax, 0xa
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x64], cx
mov eax, dword [ebp - 0x7c]
movzx ecx, word [0x402d12]
add eax, 0xb
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x62], cx
mov eax, dword [ebp - 0x7c]
movzx ecx, word [0x402d14]
add eax, 0xc
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x60], cx
mov eax, dword [ebp - 0x7c]
movzx ecx, word [0x402d16]
add eax, 0xd
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x5e], cx
mov eax, dword [ebp - 0x7c]
movzx ecx, word [0x402d18]
add eax, 0xe
movzx eax, ax
xor ecx, eax
xor eax, eax
mov word [ebp - 0x5c], cx
xor edx, edx
mov word [ebp - 0x5a], ax
mov ax, word [ebp - 0x78]
nop word [eax + eax]
mov ax, word [ebp + edx*2 - 0x78]
mov ecx, dword [ebp - 0x7c]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [ebp + edx*2 - 0x78], cx
inc edx
cmp edx, 0xf
jb 0x451b20
mov esi, dword [ebp - 0x20]
xor eax, eax
mov word [ebp - 0x5a], ax
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x452105
mov ecx, 0x800
call fcn.004bca70
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x452105
mov ecx, 0x3e
mov eax, 0x42
mov word [ebp - 0x58], cx
mov word [ebp - 0x56], ax
mov eax, 0x3d
mov word [ebp - 0x54], cx
mov word [ebp - 0x52], ax
mov eax, 0x44
mov word [ebp - 0x50], ax
mov eax, 0x45
mov word [ebp - 0x4e], ax
mov eax, 0xc
mov word [ebp - 0x4c], cx
mov word [ebp - 0x4a], ax
movzx eax, word [0x402ce0]
add eax, 0xc
mov word [ebp - 0x48], ax
movzx eax, word [0x402ce2]
add eax, 0xc
mov word [ebp - 0x46], ax
movzx eax, word [0x402ce4]
add eax, 0xc
mov word [ebp - 0x44], ax
movzx eax, word [0x402ce6]
add eax, 0xc
mov word [ebp - 0x42], ax
movzx eax, word [0x402ce8]
add eax, 0xc
mov word [ebp - 0x40], ax
movzx eax, word [0x402cea]
add eax, 0xc
mov word [ebp - 0x3e], ax
movzx eax, word [0x402cec]
add eax, 0xc
mov word [ebp - 0x3c], ax
xor eax, eax
mov word [ebp - 0x3a], ax
xor ecx, ecx
mov ax, word [ebp - 0x58]
nop dword [eax + eax]
mov ax, word [ebp + ecx*2 - 0x58]
movzx eax, ax
add eax, 0xfffffff4
mov word [ebp + ecx*2 - 0x58], ax
inc ecx
cmp ecx, 0xf
jb 0x451c40
mov ebx, dword [0x4f37a8]
test ebx, ebx
jne 0x451cf1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x18], eax
mov edx, eax
mov dword [ebp - 8], ecx
nop dword [eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x451cd8
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x451ca0
cmp eax, 0xc0323159
je 0x452090
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x451ce9
cmp dword [ecx + 0x18], 0
jne 0x451c80
xor ebx, ebx
mov dword [0x4f37a8], ebx
mov eax, dword [0x4f37b4]
test eax, eax
jne 0x451d90
test ebx, ebx
je 0x451d89
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0x30], eax
lea eax, [ecx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x451d89
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x451d89
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 8]
add eax, ebx
mov dword [ebp - 0x18], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
mov al, byte [esi + ebx]
add esi, ebx
inc esi
test al, al
je 0x451d77
movsx edx, al
lea esi, [esi + 1]
sub al, 0x41
mov ecx, edx
or ecx, 0x20
cmp al, 0x19
mov al, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test al, al
jne 0x451d44
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp edi, 0xaeb3c6d5
je 0x45209b
mov eax, dword [ebp - 0x18]
inc ecx
add eax, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [edx + 0x18]
jne 0x451d33
xor eax, eax
mov dword [0x4f37b4], eax
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push str._General__r_nVersion_s_r_ndisplayName_s_r_n
push esi
call eax
add esp, 0x10
mov ecx, esi
call fcn.004bcfd0
mov ebx, dword [0x4f3810]
mov dword [ebp - 0x1c], eax
test ebx, ebx
jne 0x451e46
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x18], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x451e2d
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x18]
imul eax, eax, 0x1000193
mov dword [ebp - 0x18], eax
cmp edi, ebx
jne 0x451df5
cmp eax, 0xa3e6f6c3
je 0x4520b5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp eax, edx
je 0x451e3e
cmp dword [ecx + 0x18], 0
jne 0x451dd7
xor ebx, ebx
mov dword [0x4f3810], ebx
mov eax, dword [0x4f37a4]
test eax, eax
jne 0x451ee3
test ebx, ebx
je 0x451edc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0x30], eax
lea eax, [ecx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x451edc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x451edc
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x18], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x451eca
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x451e95
mov ecx, dword [ebp - 0xc]
cmp edi, 0xa83e21de
je 0x4520c0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [edx + 0x18]
jne 0x451e85
xor eax, eax
mov dword [0x4f37a4], eax
mov ebx, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
push dword [ebp - 0x1c]
push ebx
push 0
push 0xfde9
call eax
mov dword [ebp - 0x2c], eax
test eax, eax
jle 0x452109
mov ecx, eax
call fcn.004bca70
mov dword [ebp - 0x30], eax
test eax, eax
je 0x452109
mov ebx, dword [0x4f3810]
test ebx, ebx
jne 0x451fb1
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
nop
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x18], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x451f98
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x18]
imul eax, eax, 0x1000193
mov dword [ebp - 0x18], eax
cmp edi, ebx
jne 0x451f60
cmp eax, 0xa3e6f6c3
je 0x4520dd
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp eax, edx
je 0x451fa9
cmp dword [ecx + 0x18], 0
jne 0x451f40
xor ebx, ebx
mov dword [0x4f3810], ebx
mov eax, dword [0x4f37a4]
test eax, eax
jne 0x45204e
test ebx, ebx
je 0x452047
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x452047
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x452047
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x18], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x452035
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x452000
mov ecx, dword [ebp - 0xc]
cmp edi, 0xa83e21de
je 0x4520e8
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [edx + 0x18]
jne 0x451ff0
xor eax, eax
mov dword [0x4f37a4], eax
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x10]
push 0
push 0
push esi
push edi
push dword [ebp - 0x1c]
push ebx
push 0
push 0xfde9
call eax
push 0
lea eax, [ebp - 0x38]
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
xor esi, esi
mov ecx, 1
test eax, eax
cmovne esi, ecx
mov ecx, edi
call fcn.004bced0
jmp 0x45210b
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
jmp 0x451ceb
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x451d8b
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x18]
jmp 0x451e40
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x451ede
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x18]
jmp 0x451fab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x452049
xor esi, esi
jmp 0x45210e
xor esi, esi
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
call fcn.004bced0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x452124
mov ecx, eax
call fcn.004bced0
test ebx, ebx
je 0x45212f
mov ecx, ebx
call fcn.004bced0
cmp edi, 0xffffffff
je 0x45213c
push edi
call fcn.00411330
call eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret