Function at 0x44fa70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x34], ecx
mov ecx, 0x800
push edi
xor edi, edi
call fcn.004baba0
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x45046c
mov eax, dword [esi]
push 0x400
push ecx
push edi
push esi
call dword [eax + 0x38]
test eax, eax
js 0x450433
mov ecx, 0x800
call fcn.004baba0
mov dword [ebp - 0x14], eax
test eax, eax
je 0x450433
mov ecx, dword [esi]
push 0x400
push eax
push esi
call dword [ecx + 0x28]
test eax, eax
js 0x450433
mov dword [ebp - 0x58], 0x1f
mov eax, 0x58
mov word [ebp - 0x54], ax
mov ecx, 0x56
mov eax, 0x4f
mov word [ebp - 0x52], ax
mov eax, 0x4b
mov word [ebp - 0x50], ax
mov eax, 0x31
mov word [ebp - 0x4e], ax
mov eax, 0x51
mov word [ebp - 0x4c], cx
mov word [ebp - 0x4a], ax
mov eax, 0x1f
mov word [ebp - 0x48], cx
mov word [ebp - 0x46], ax
movzx eax, word [0x402d0c]
xor eax, 0x1f
mov word [ebp - 0x44], ax
movzx eax, word [0x402d0e]
xor eax, 0x1f
mov word [ebp - 0x42], ax
movzx eax, word [0x402d10]
xor eax, 0x1f
mov word [ebp - 0x40], ax
movzx eax, word [0x402d12]
xor eax, 0x1f
mov word [ebp - 0x3e], ax
movzx eax, word [0x402d14]
xor eax, 0x1f
mov word [ebp - 0x3c], ax
movzx eax, word [0x402d16]
xor eax, 0x1f
mov word [ebp - 0x3a], ax
movzx eax, word [0x402d18]
xor eax, 0x1f
mov word [ebp - 0x38], ax
xor eax, eax
mov word [ebp - 0x36], ax
xor edx, edx
mov ax, word [ebp - 0x54]
nop word [eax + eax]
mov ax, word [ebp + edx*2 - 0x54]
movzx ecx, ax
movzx eax, word [ebp - 0x58]
xor ecx, eax
mov word [ebp + edx*2 - 0x54], cx
inc edx
cmp edx, 0xf
jb 0x44fba0
xor eax, eax
mov word [ebp - 0x36], ax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x10]
push edx
call 0x5d7920
mov ebx, dword [0x4f081c]
test ebx, ebx
jne 0x44fc61
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 4], eax
mov edx, eax
mov dword [ebp - 8], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44fc48
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x44fc10
cmp eax, 0xa3e6f6c3
je 0x450363
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x44fc59
cmp dword [ecx + 0x18], 0
jne 0x44fbf2
xor ebx, ebx
mov dword [0x4f081c], ebx
mov eax, dword [0x4f0810]
test eax, eax
jne 0x44fcf3
test ebx, ebx
je 0x44fcec
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x44fcec
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x44fcec
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0xc], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x44fcda
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x44fca5
cmp edi, 0xe95da064
je 0x45036e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x44fc95
xor eax, eax
mov dword [0x4f0810], eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0xc0000000
push dword [ebp - 0x10]
call eax
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x450431
mov ecx, 0x800
call fcn.004baba0
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x450433
mov dword [ebp - 0x7c], 0x5a
mov ecx, 0x68
mov word [ebp - 0x78], cx
mov eax, 0x6c
mov word [ebp - 0x76], ax
mov eax, 0x6b
mov word [ebp - 0x74], cx
mov word [ebp - 0x72], ax
mov eax, 0x62
mov word [ebp - 0x70], ax
mov eax, 0x63
mov word [ebp - 0x6e], ax
mov eax, 0x5a
mov word [ebp - 0x6c], cx
mov word [ebp - 0x6a], ax
movzx eax, word [0x402ce0]
xor eax, 0x5a
mov word [ebp - 0x68], ax
movzx eax, word [0x402ce2]
xor eax, 0x5a
mov word [ebp - 0x66], ax
movzx eax, word [0x402ce4]
xor eax, 0x5a
mov word [ebp - 0x64], ax
movzx eax, word [0x402ce6]
xor eax, 0x5a
mov word [ebp - 0x62], ax
movzx eax, word [0x402ce8]
xor eax, 0x5a
mov word [ebp - 0x60], ax
movzx eax, word [0x402cea]
xor eax, 0x5a
mov word [ebp - 0x5e], ax
movzx eax, word [0x402cec]
xor eax, 0x5a
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x5a], ax
xor edx, edx
mov ax, word [ebp - 0x78]
mov ax, word [ebp + edx*2 - 0x78]
movzx ecx, ax
movzx eax, word [ebp - 0x7c]
xor ecx, eax
mov word [ebp + edx*2 - 0x78], cx
inc edx
cmp edx, 0xf
jb 0x44fde2
mov ebx, dword [0x4f07ac]
xor eax, eax
mov word [ebp - 0x5a], ax
test ebx, ebx
jne 0x44fe96
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x1c], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x18], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44fe7d
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x18]
imul eax, eax, 0x1000193
mov dword [ebp - 0x18], eax
cmp edi, ebx
jne 0x44fe45
cmp eax, 0xc0323159
je 0x45038c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp eax, edx
je 0x44fe8e
cmp dword [ecx + 0x18], 0
jne 0x44fe27
xor ebx, ebx
mov dword [0x4f07ac], ebx
mov eax, dword [0x4f07b8]
test eax, eax
jne 0x44ff2e
test ebx, ebx
je 0x44ff27
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x44ff27
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x44ff27
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x1c], eax
nop
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x44ff15
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x44fee0
mov ecx, dword [ebp - 0xc]
cmp edi, 0xaeb3c6d5
je 0x450397
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
inc ecx
add eax, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], eax
cmp ecx, dword [edx + 0x18]
jne 0x44fed0
xor eax, eax
mov dword [0x4f07b8], eax
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push str._General__r_nVersion_s_r_ndisplayName_s_r_n
push esi
call eax
add esp, 0x10
mov ecx, esi
call fcn.004bb100
mov ebx, dword [0x4f081c]
mov dword [ebp - 0x20], eax
test ebx, ebx
jne 0x44ffe4
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x1c], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44ffcb
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x1c]
imul eax, eax, 0x1000193
mov dword [ebp - 0x1c], eax
cmp edi, ebx
jne 0x44ff93
cmp eax, 0xa3e6f6c3
je 0x4503b4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp eax, edx
je 0x44ffdc
cmp dword [ecx + 0x18], 0
jne 0x44ff75
xor ebx, ebx
mov dword [0x4f081c], ebx
mov eax, dword [0x4f07a8]
test eax, eax
jne 0x45007e
test ebx, ebx
je 0x450077
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x450077
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x450077
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x450065
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x450030
mov ecx, dword [ebp - 0xc]
cmp edi, 0xa83e21de
je 0x4503bf
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
inc ecx
add eax, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], eax
cmp ecx, dword [edx + 0x18]
jne 0x450020
xor eax, eax
mov dword [0x4f07a8], eax
mov edi, dword [ebp - 4]
push 0
push 0
push 0
push 0
push dword [ebp - 0x20]
push edi
push 0
push 0xfde9
call eax
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x45042c
mov ecx, eax
call fcn.004baba0
mov dword [ebp - 0x28], eax
test eax, eax
je 0x45042c
mov esi, dword [0x4f081c]
test esi, esi
jne 0x450151
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x18], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
nop word [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x1c], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x450138
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x1c]
imul eax, eax, 0x1000193
mov dword [ebp - 0x1c], eax
cmp edi, ebx
jne 0x450100
cmp eax, 0xa3e6f6c3
je 0x4503dc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp eax, edx
je 0x450149
cmp dword [ecx + 0x18], 0
jne 0x4500e0
xor esi, esi
mov dword [0x4f081c], esi
mov eax, dword [0x4f07a8]
test eax, eax
jne 0x4501ee
test esi, esi
je 0x4501e7
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x4501e7
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x4501e7
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4501d5
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4501a0
mov ecx, dword [ebp - 0xc]
cmp edi, 0xa83e21de
je 0x4503e7
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
inc ecx
add eax, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], eax
cmp ecx, dword [edx + 0x18]
jne 0x450190
xor eax, eax
mov dword [0x4f07a8], eax
mov esi, dword [ebp - 4]
push 0
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
push esi
push 0
push 0xfde9
call eax
mov esi, dword [0x4f081c]
test esi, esi
jne 0x4502a1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x1c], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
nop
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x20], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x450288
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x20]
imul eax, eax, 0x1000193
mov dword [ebp - 0x20], eax
cmp edi, ebx
jne 0x450250
cmp eax, 0xa3e6f6c3
je 0x450404
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp eax, edx
je 0x450299
cmp dword [ecx + 0x18], 0
jne 0x450230
xor esi, esi
mov dword [0x4f081c], esi
mov eax, dword [0x4f0778]
test eax, eax
jne 0x450333
test esi, esi
je 0x45032c
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x45032c
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x45032c
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x20], eax
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x45031a
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4502e5
mov ecx, dword [ebp - 0xc]
cmp edi, 0x84aec1ca
je 0x45040f
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
inc ecx
add eax, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], eax
cmp ecx, dword [edx + 0x18]
jne 0x4502d5
xor eax, eax
mov dword [0x4f0778], eax
mov ebx, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
push 0
push ecx
push dword [ebp - 0x24]
push ebx
push dword [ebp - 8]
call eax
xor esi, esi
mov ecx, 1
test eax, eax
cmovne esi, ecx
mov ecx, ebx
call fcn.004bb000
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
jmp 0x450435
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
jmp 0x44fc5b
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x44fcee
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x18]
jmp 0x44fe90
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x44ff29
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x18]
jmp 0x44ffde
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x450079
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x18]
jmp 0x45014b
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4501e9
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x18]
jmp 0x45029b
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x45032e
mov ebx, dword [ebp - 8]
jmp 0x450433
xor edi, edi
xor esi, esi
mov ecx, dword [ebp - 0x10]
call fcn.004bb000
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x45044b
mov ecx, eax
call fcn.004bb000
test edi, edi
je 0x450456
mov ecx, edi
call fcn.004bb000
cmp ebx, 0xffffffff
je 0x450463
push ebx
call fcn.00411310
call eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret