Function at 0x4904c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3582
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5091d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x24]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x60], eax
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
mov esi, dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x5c], esi
cmp esi, 1
jb 0x4906e7
push esi
lea ecx, [esi + eax]
push 0x20
push eax
mov dword [ebp - 0x4c], ecx
call fcn.004a17b0
mov edx, eax
add esp, 0xc
test edx, edx
je 0x4906e7
movzx ecx, byte [edx]
cmp cl, 0x20
jne 0x490542
xor eax, eax
jmp 0x490547
sbb eax, eax
or eax, 1
test eax, eax
je 0x490568
mov eax, dword [ebp - 0x4c]
inc edx
sub eax, edx
push eax
push 0x20
push edx
call fcn.004a17b0
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x490536
jmp 0x4906e7
sub edx, dword [ebp - 0x48]
cmp edx, 0xffffffff
je 0x4906e7
mov ecx, dword [ebp + 0x20]
lea eax, [ebp + 0xc]
mov edx, dword [ebp + 0xc]
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax], 0x22
jne 0x49059c
cmp ecx, 0x10
lea eax, [ebp + 0xc]
cmovae eax, edx
cmp byte [esi + eax - 1], 0x22
je 0x4906e7
mov eax, 0x7fffffff
sub eax, esi
cmp eax, 1
jb 0x4908c1
cmp ecx, 0x10
mov dword [ebp - 0x28], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], 0
cmovae eax, edx
mov dword [ebp - 0x14], 0
lea ecx, [esi + 1]
mov dword [ebp - 0x50], eax
mov esi, 0xf
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x48], eax
cmp ecx, esi
jbe 0x490615
mov esi, ecx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4905f6
mov esi, 0x7fffffff
jmp 0x490600
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402d80
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
push dword [ebp - 0x5c]
mov dword [ebp - 0x18], ecx
lea ecx, [eax + 1]
push dword [ebp - 0x50]
mov dword [ebp - 0x14], esi
push ecx
mov byte [eax], 0x22
call fcn.004a11f0
mov eax, dword [ebp - 0x48]
add esp, 0xc
mov ecx, dword [ebp - 0x4c]
mov byte [eax + ecx], 0
push 1
push 0x4d7eb4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402de0
lea ecx, [ebp + 0xc]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x40]
push eax
movq qword [ebp - 0x30], xmm0
call fcn.004393f0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4906af
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4906a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4908c6
push edx
push ecx
call fcn.0049f81a
add esp, 8
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x4906e7
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4906dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4908c6
push edx
push ecx
call fcn.0049f81a
add esp, 8
cmp byte [ebp + 0x28], 0
je 0x4906f7
mov esi, 0x4000010
jmp 0x490828
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6d9fe0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6d9a04]
cmp eax, dword [ecx + 4]
jg 0x4908cb
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.004027c0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
add eax, ecx
cmp esi, eax
je 0x490761
mov edi, eax
mov ah, byte [esi]
mov dl, ah
mov al, ah
add al, 0x20
sub dl, 0x41
movzx ecx, al
cmp dl, 0x19
movzx eax, ah
cmova ecx, eax
mov byte [esi], cl
inc esi
cmp esi, edi
jne 0x490740
mov edi, dword [ebp - 0x58]
movups xmm1, xmmword [ebp - 0x28]
lea eax, [ebp - 0x40]
mov byte [ebp - 0x28], 0
movq xmm0, qword [ebp - 0x18]
mov ecx, 0x811c9dc5
movq qword [ebp - 0x30], xmm0
cmp dword [ebp - 0x2c], 0x10
movd esi, xmm1
movups xmmword [ebp - 0x40], xmm1
mov dword [ebp - 0x18], 0
cmovae eax, esi
mov dword [ebp - 0x14], 0xf
xor edx, edx
cmp dword [ebp - 0x30], edx
jbe 0x4907b6
mov edi, eax
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, dword [ebp - 0x30]
jb 0x4907a1
mov edi, dword [ebp - 0x58]
push ecx
lea eax, [ebp - 0x40]
mov ecx, 0x6d99e4
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0043afe0
mov ecx, dword [0x6d99e8]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, dword [0x6d99e8]
setne byte [ebp - 0x41]
cmp eax, 0x10
jb 0x490814
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x49080a
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4909c5
push ecx
push esi
call fcn.0049f81a
add esp, 8
xor eax, eax
cmp byte [ebp - 0x41], al
setne al
lea eax, [eax*8 + 0x4000008]
mov dword [ebp - 0x50], eax
mov esi, eax
mov eax, dword [edi + 0x14]
mov ecx, edi
cmp eax, 0x10
jb 0x490834
mov ecx, dword [edi]
cmp byte [ecx], 0x20
je 0x49084b
push 1
push 0x4d7454
lea ecx, [ebp + 0xc]
call fcn.00402de0
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
cmp eax, 0x10
jb 0x490855
mov edi, dword [edi]
push ecx
push edi
lea ecx, [ebp + 0xc]
call fcn.00402de0
push dword [ebp + 0x2c]
lea eax, [ebp + 0xc]
push esi
push dword [ebp - 0x60]
push eax
call fcn.0048fa60
mov edx, dword [ebp + 0x20]
add esp, 0x10
cmp edx, 0x10
jb 0x4908a6
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49089c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4909ca
push edx
push ecx
call fcn.0049f81a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f836
mov esp, ebp
pop ebp
ret
call fcn.00402d70
call fcn.004a48ef
push 0x6d9a04
call fcn.0049fd00
add esp, 4
cmp dword [0x6d9a04], 0xffffffff
jne 0x490717
movq xmm0, qword [str.powershell]
mov ax, word [0x4dc19c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0xa
movq qword [ebp - 0x28], xmm0
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push 0x20
mov dword [ebp - 0x54], eax
lea esi, [ebp - 0x10]
call fcn.0049f7ea
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [0x6d99e8], eax
mov dword [0x6d99f0], 0
mov dword [0x6d99f4], 0
mov dword [0x6d99f8], 0
push eax
push 0x10
mov ecx, 0x6d99f0
mov byte [ebp - 4], 5
mov dword [0x6d99fc], 7
mov dword [0x6d9a00], 8
mov dword [0x6d99e4], 0x3f800000
call fcn.0040ee60
push esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push eax
mov ecx, 0x6d99e4
call fcn.0048fea0
push fcn.00402b80
push 1
push 0x18
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.0049f867
push 0x4d4cd0
call fcn.0049fbb8
push 0x6d9a04
mov byte [ebp - 4], 0
call fcn.0049fcb6
add esp, 8
jmp 0x490717
call fcn.004a48ef
call fcn.004a48ef
int3