Function at 0x418de5
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x78
push 0xffffffffffffffff
push 0x49b1d0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4c7080]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
mov edx, str.unzip.exe__
lea ecx, [ebp + 0x14]
xor ebx, ebx
call fcn.0041b5e7
pop ecx
push 3
push 0x4a6c50
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0041531c
push eax
lea ecx, [ebp + 0x2c]
call fcn.0041431e
push esi
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 1
call fcn.004142a7
push eax
lea ecx, [ebp + 0x44]
call fcn.0041431e
push 1
push 0x4a6c4c
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 2
call fcn.0041531c
push eax
lea ecx, [ebp + 0x5c]
call fcn.0041431e
lea ecx, [ebp + 0x44]
call fcn.004151f6
lea ecx, [ebp + 0x2c]
call fcn.004151f6
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 6
call fcn.004151f6
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.0046e020
xor eax, eax
mov dword [ebp - 0x64], esi
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x6c]
inc eax
push eax
call fcn.0046c511
cmp dword [ebp + 0x70], 0xf
lea ecx, [ebp + 0x5c]
mov edx, eax
mov eax, dword [ebp + 0x6c]
cmova ecx, dword [ebp + 0x5c]
inc eax
push ecx
push eax
push edx
mov dword [ebp + 8], edx
call fcn.0047cf49
mov eax, dword fs:[0x30]
add esp, 0x1c
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov edi, dword [ecx + edx + 0x78]
add edi, edx
cmp edi, edx
je 0x418f51
mov esi, dword [edi + 0x18]
test esi, esi
je 0x418f51
mov ecx, dword [edi + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp + 0xc], 0xb5b4aecd
dec esi
mov dword [ebp - 0x10], ecx
mov dword [ebp + 4], esi
mov esi, dword [ecx]
add esi, edx
mov dl, byte [esi]
inc esi
mov byte [ebp + 0x13], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x418f4a
mov cl, byte [ebp + 0x13]
mov edx, dword [ebp + 0xc]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x418f26
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0x470a8d01
mov edx, dword [eax + 0x18]
je 0x418f55
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + 4]
test esi, esi
jne 0x418efe
mov eax, dword [eax]
jmp 0x418edf
mov eax, dword [edi + 0x24]
mov ecx, dword [ebp + 4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
mov edi, dword [ebp + 8]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x64]
add eax, edx
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call eax
push edi
mov esi, eax
call fcn.0046be87
pop ecx
test esi, esi
je 0x41904f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov edi, dword [ecx + edx + 0x78]
add edi, edx
cmp edi, edx
je 0x41900b
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x41900b
mov ecx, dword [edi + 0x20]
lea ecx, [ecx + ebx*4]
add ecx, edx
sub ecx, 4
mov dword [ebp + 0xc], 0x24d6238f
dec ebx
mov dword [ebp + 8], ecx
mov esi, dword [ecx]
add esi, edx
mov dl, byte [esi]
inc esi
mov byte [ebp + 0x13], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x419007
mov cl, byte [ebp + 0x13]
mov edx, dword [ebp + 0xc]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x418fe3
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0x6f24da7e
mov edx, dword [eax + 0x18]
je 0x41900f
mov ecx, dword [ebp + 8]
test ebx, ebx
jne 0x418fbe
mov eax, dword [eax]
jmp 0x418f9f
mov eax, dword [edi + 0x24]
push 0xffffffffffffffff
push dword [ebp - 0x20]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
cmp dword [ebp], 0
sete bl
lea ecx, [ebp + 0x5c]
call fcn.004151f6
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0046be79
add ebp, 0x78
leave
ret