Function at 0x49fe40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
push 0x22c
lea eax, [ebp - 0x250]
mov dword [ebp - 0x1c], ecx
push 0
push eax
call fcn.0040d020
mov esi, dword [0x4f3810]
add esp, 0xc
mov dword [ebp - 0x250], 0x22c
test esi, esi
jne 0x49ff04
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49feeb
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x49feb3
cmp eax, 0xa3e6f6c3
je 0x4a00df
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49fefc
cmp dword [ecx + 0x18], 0
jne 0x49fe95
xor esi, esi
mov dword [0x4f3810], esi
mov eax, dword [0x4fbc60]
test eax, eax
jne 0x49ff9e
test esi, esi
je 0x49ff97
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x49ff97
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49ff97
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49ff85
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49ff50
mov ecx, dword [ebp - 4]
cmp edi, 0x7f8fe695
je 0x4a00ea
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x49ff40
xor eax, eax
mov dword [0x4fbc60], eax
push 0
push 2
call eax
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x4a0400
mov esi, dword [0x4f3810]
test esi, esi
jne 0x4a0045
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4a002c
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x49fff4
cmp eax, 0xa3e6f6c3
je 0x4a0107
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x4a003d
cmp dword [ecx + 0x18], 0
jne 0x49ffd6
xor esi, esi
mov dword [0x4f3810], esi
mov eax, dword [0x4fbc30]
test eax, eax
jne 0x4a03e3
test esi, esi
je 0x4a00d3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x4a00d3
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4a00d3
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4a00c1
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4a0090
mov ecx, dword [ebp - 4]
cmp edi, 0xe05d6ee8
je 0x4a0112
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x4a0080
xor eax, eax
mov dword [0x4fbc30], eax
jmp 0x4a03e3
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49fefe
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x49ff99
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x4a003f
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4fbc30], eax
jmp 0x4a03e3
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x1c]
jne 0x4a02b5
cmp eax, dword fs:[0x20]
je 0x4a02b5
mov esi, dword [0x4f3810]
test esi, esi
jne 0x4a01f1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4a01d8
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x4a01a0
cmp eax, 0xa3e6f6c3
je 0x4a0571
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x4a01e9
cmp dword [ecx + 0x18], 0
jne 0x4a0182
xor esi, esi
mov dword [0x4f3810], esi
mov eax, dword [0x4fbc2c]
test eax, eax
jne 0x4a028e
test esi, esi
je 0x4a0287
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x4a0287
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4a0287
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4a0275
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4a0240
mov ecx, dword [ebp - 4]
cmp edi, 0x6e477856
je 0x4a057c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x4a0230
xor eax, eax
mov dword [0x4fbc2c], eax
push dword [ebp - 0x238]
push 1
push 0x1fffff
call eax
mov esi, eax
test esi, esi
je 0x4a02b5
push 1
push esi
call fcn.00413f70
call eax
push esi
call fcn.00411330
call eax
mov esi, dword [0x4f3810]
test esi, esi
jne 0x4a0351
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop dword [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4a0338
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x4a0300
cmp eax, 0xa3e6f6c3
je 0x4a0599
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x4a0349
cmp dword [ecx + 0x18], 0
jne 0x4a02e0
xor esi, esi
mov dword [0x4f3810], esi
mov eax, dword [0x4fbc3c]
test eax, eax
jne 0x4a03e3
test esi, esi
je 0x4a03dc
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x4a03dc
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4a03dc
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4a03ca
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4a0395
mov ecx, dword [ebp - 4]
cmp edi, 0xc900195f
je 0x4a05a4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x4a0385
xor eax, eax
mov dword [0x4fbc3c], eax
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x250]
push ecx
push ebx
call eax
test eax, eax
jne 0x4a0140
push ebx
call fcn.00411330
call eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword fs:[0x20]
je 0x4a05e9
mov esi, dword [0x4f3810]
test esi, esi
jne 0x4a04a5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x10], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4a048c
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x10]
imul eax, eax, 0x1000193
mov dword [ebp - 0x10], eax
cmp edi, ebx
jne 0x4a0454
cmp eax, 0xa3e6f6c3
je 0x4a05c1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x4a049d
cmp dword [ecx + 0x18], 0
jne 0x4a0436
xor esi, esi
mov dword [0x4f3810], esi
mov eax, dword [0x4fbc2c]
test eax, eax
jne 0x4a053e
test esi, esi
je 0x4a0537
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x4a0537
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4a0537
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x10], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4a0525
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4a04f0
mov ecx, dword [ebp - 4]
cmp edi, 0x6e477856
je 0x4a05cc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
cmp ecx, dword [edx + 0x18]
jne 0x4a04e0
xor eax, eax
mov dword [0x4fbc2c], eax
push dword [ebp - 0x1c]
push 1
push 0x1fffff
call eax
mov edi, eax
test edi, edi
je 0x4a05e9
push 1
push edi
call fcn.00413f70
call eax
push edi
mov esi, eax
call fcn.00411330
call eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x4a01eb
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4a0289
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x4a034b
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4a03de
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x4a049f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4a0539
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret