Function at 0x49b310
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5193ba
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x569080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0
mov edi, dword [edx + 0xc]
mov esi, dword [edx + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], edi
cmp edi, esi
je 0x49b3d8
mov ebx, dword [ecx]
test ebx, ebx
je 0x49b36e
mov ebx, dword [ebx + 0x10]
jmp 0x49b373
mov ebx, 0x530654
mov edx, ebx
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x49b380
sub edx, ecx
mov ecx, dword [edi + 0x28]
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49b3a0
sub ecx, dword [ebp - 0x18]
sar ecx, 1
cmp ecx, edx
jne 0x49b3c5
push ecx
push ebx
push dword [edi + 0x28]
call fcn.004e0761
add esp, 0xc
test eax, eax
je 0x49b3cf
mov ecx, dword [ebp - 0x2c]
add edi, 0x30
cmp edi, esi
jne 0x49b363
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edi
cmp edi, dword [edx + 0x10]
jne 0x49b3f6
mov dword [eax], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
jmp 0x49b761
mov ecx, edi
mov esi, dword [ebp - 0x14]
sub ecx, dword [edx + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, ebx
mov dword [ebp - 0x18], ebx
shr eax, 8
movzx ecx, al
movzx eax, bl
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x34]
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00493a80
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x49b497
cmp ecx, dword [esi + 0x38]
je 0x49b497
mov edi, dword [ebp - 0x30]
mov ecx, dword [ecx + 0xc]
mov dword [edi], ecx
test ecx, ecx
je 0x49b484
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
call esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
jmp 0x49b75f
mov eax, dword [edi + 0x20]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 7
test eax, eax
jne 0x49b559
cmp byte [edi + 0x18], al
jne 0x49ba1a
mov byte [ebp - 4], 8
push 0x14
call fcn.004d4062
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 9
mov ecx, 1
mov bl, byte [edi]
mov eax, 0x56c2b0
mov dword [esi + 8], 0x53c3bc
lock xadd dword [eax], ecx
mov byte [ebp - 4], 0xa
mov dword [esi + 4], 1
mov byte [ebp - 4], 0xb
mov dword [esi], 0x53c1c4
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0xc]
push dword [ebp - 0x2c]
mov dword [esi], 0x53c1e4
call fcn.00496fa0
mov byte [ebp - 4], 0xd
mov byte [esi + 0x10], bl
mov byte [ebp - 4], 0xe
mov dword [esi], 0x53c088
mov byte [ebp - 4], 8
lea ebx, [esi + 8]
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 8
mov esi, 2
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], esi
and esi, 0xfffffffd
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 7
jmp 0x49b72b
cmp eax, 1
jne 0x49b617
cmp byte [edi + 0x18], al
jne 0x49ba1a
mov byte [ebp - 4], 0x13
push 0x18
call fcn.004d4062
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0x14
lea ebx, [esi + 8]
movsd xmm0, qword [edi]
mov eax, 1
movsd qword [ebp - 0x38], xmm0
mov ecx, 0x56c2b0
mov dword [ebx], 0x53c364
lock xadd dword [ecx], eax
mov byte [ebp - 4], 0x15
mov dword [esi + 4], 1
mov byte [ebp - 4], 0x16
mov dword [esi], 0x53c1c4
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0xc]
push dword [ebp - 0x2c]
mov dword [esi], 0x53c39c
call fcn.00496fa0
mov byte [ebp - 4], 0x18
movsd xmm0, qword [ebp - 0x38]
movsd qword [esi + 0x10], xmm0
mov byte [ebp - 4], 0x19
mov dword [esi], 0x53c0a8
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 0x13
mov esi, 4
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], esi
and esi, 0xfffffffb
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 7
jmp 0x49b72b
cmp eax, 3
jne 0x49b6d6
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 0x18]
test esi, esi
je 0x49b6bd
cmp byte [edi + 0x18], 2
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
jne 0x49ba1a
push edi
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call dword [0x525578]
mov ecx, esi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push eax
call fcn.0049ba20
add esp, 4
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x49b67d
mov ebx, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x20], 0
je 0x49b68f
lea ecx, [ebp - 0x20]
call fcn.0048e9b0
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x28], 0
mov dword [edi], ebx
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 7
cmp dword [ebp - 0x14], 0
je 0x49b6b8
lea ecx, [ebp - 0x14]
call fcn.0048e9b0
jmp 0x49b758
mov edi, dword [ebp - 0x30]
mov dword [edi], 0
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], 1
jmp 0x49b758
cmp eax, 4
jne 0x49b77f
cmp byte [edi + 0x18], 3
jne 0x49ba1a
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
push edi
call fcn.0049ba20
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x28]
cmp eax, ecx
je 0x49b713
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
mov dword [ecx], 0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 7
cmp dword [ebp - 0x2c], 0
je 0x49b725
lea ecx, [ebp - 0x2c]
call fcn.0048e9b0
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
lea ecx, [ecx + 0x34]
push eax
call fcn.004a4930
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x28], 0
mov dword [edi], ebx
mov byte [ebp - 4], 7
or esi, 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d3ce9
mov esp, ebp
pop ebp
ret 8
cmp eax, 5
jne 0x49b84c
cmp byte [edi + 0x18], 4
jne 0x49ba1a
mov byte [ebp - 4], 0x30
push 0x14
call fcn.004d4062
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 0x31
lea ebx, [esi + 8]
mov dword [ebx], 0x53c2b4
mov ecx, 1
mov eax, 0x56c2b0
lock xadd dword [eax], ecx
mov byte [ebp - 4], 0x32
mov dword [esi + 4], 1
mov byte [ebp - 4], 0x33
mov dword [esi], 0x53c1c4
mov byte [ebp - 4], 0x34
lea ecx, [esi + 0xc]
push dword [ebp - 0x2c]
mov dword [esi], 0x53c2ec
call fcn.00496fa0
mov byte [ebp - 4], 0x35
lea eax, [esi + 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [edi]
mov dword [eax], ecx
test ecx, ecx
je 0x49b80f
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
call esi
mov esi, dword [ebp - 0x24]
mov byte [ebp - 4], 0x38
mov dword [esi], 0x53c068
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 0x30
mov esi, 8
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], esi
and esi, 0xfffffff7
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 7
jmp 0x49b72b
mov cl, byte [edi + 0x18]
cmp eax, 6
jne 0x49b902
cmp cl, 5
jne 0x49ba1a
mov byte [ebp - 4], 0x3d
push 0x14
call fcn.004d4062
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 0x3e
lea ebx, [edi + 8]
mov esi, dword [ebp - 0x24]
mov ecx, 1
mov eax, 0x56c2b0
mov esi, dword [esi]
mov dword [ebx], 0x53c18c
lock xadd dword [eax], ecx
mov byte [ebp - 4], 0x3f
mov dword [edi + 4], 1
mov byte [ebp - 4], 0x40
mov dword [edi], 0x53c1c4
mov byte [ebp - 4], 0x41
lea ecx, [edi + 0xc]
push dword [ebp - 0x2c]
mov dword [edi], 0x53c1e4
call fcn.00496fa0
mov byte [ebp - 4], 0x42
mov dword [edi + 0x10], esi
mov byte [ebp - 4], 0x43
mov dword [edi], 0x53c088
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 0x3d
mov esi, 0x10
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], esi
and esi, 0xffffffef
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 7
jmp 0x49b72b
cmp cl, 2
jne 0x49ba1a
cmp dword [edi + 0x14], 7
jbe 0x49b913
mov edi, dword [edi]
mov dword [ebp - 0x38], edi
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x49b920
sub edi, ecx
lea eax, [ebp - 0x38]
sar edi, 1
lea ecx, [ebp - 0x20]
push eax
mov dword [ebp - 0x34], edi
call fcn.00499170
mov byte [ebp - 4], 0x4a
push 0x14
call fcn.004d4062
mov esi, eax
add esp, 4
mov dword [ebp - 0x40], esi
mov byte [ebp - 4], 0x4b
lea ebx, [esi + 8]
mov dword [ebx], 0x53c204
mov ecx, 1
mov eax, 0x56c2b0
lock xadd dword [eax], ecx
mov byte [ebp - 4], 0x4c
mov dword [esi + 4], 1
mov byte [ebp - 4], 0x4d
mov dword [esi], 0x53c1c4
mov byte [ebp - 4], 0x4e
lea ecx, [esi + 0xc]
push dword [ebp - 0x2c]
mov dword [esi], 0x53c294
call fcn.00496fa0
mov byte [ebp - 4], 0x4f
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x10]
push eax
call fcn.00496fa0
mov byte [ebp - 4], 0x51
mov dword [esi], 0x53c048
mov byte [ebp - 4], 0x4a
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 0x4a
mov esi, 0x20
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], esi
and esi, 0xffffffdf
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x49b72b
lea eax, [edx + 0x14]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
add ecx, 0xffffffff
jne 0x49ba11
push edx
push ecx
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapFree
mov dword [ebp - 0x20], 0
jmp 0x49b72b
test ecx, ecx
jns 0x49ba05
call fcn.004e8b6c
call fcn.004ae330
int3