Function at 0x436e51
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [0x4e5ce8]
mov ebx, ecx
xor edi, edi
mov esi, edx
mov dword [ebp - 0x894], ebx
mov dword [ebp - 0x884], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 6
mov edx, esi
lea ecx, [ebp - 0x86c]
call fcn.00413f1b
pop ecx
test eax, eax
jne 0x43710c
mov edx, dword [0x4e6d98]
test edx, edx
jne 0x4370dd
mov eax, dword fs:[0x30]
mov ebx, edi
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x878], 0x65d9be96
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x2c]
mov esi, dword [eax + 0x30]
add ecx, 0xfffffff8
test ebx, ebx
je 0x436f2b
movzx ecx, cx
mov edx, 0x9fb32536
shr ecx, 1
lea ecx, [esi + ecx*2]
mov dword [ebp - 0x87c], ecx
cmp esi, ecx
je 0x436f23
mov ebx, ecx
movsx ecx, byte [esi]
add esi, 2
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
cmp esi, ebx
jne 0x436ef1
mov ebx, dword [ebp - 0x874]
cmp edx, ebx
jne 0x437000
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ebx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
add ebx, esi
mov dword [ebp - 0x890], ecx
cmp ebx, esi
je 0x436ffa
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x436ffa
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
sub ecx, 4
mov dword [ebp - 0x880], 0x9fb32536
mov dword [ebp - 0x88c], ecx
dec edx
mov dword [ebp - 0x87c], edx
mov ecx, dword [ecx]
add ecx, esi
mov dl, byte [ecx]
inc ecx
mov dword [ebp - 0x888], ecx
mov cl, dl
mov byte [ebp - 0x86d], dl
mov edx, dword [ebp - 0x87c]
test cl, cl
je 0x436fde
mov esi, dword [ebp - 0x888]
mov edi, dword [ebp - 0x880]
movsx ecx, cl
xor ecx, edi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edi, ecx, 0x1000193
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x436fa1
mov esi, dword [eax + 0x18]
mov edx, dword [ebp - 0x87c]
mov dword [ebp - 0x880], edi
xor edi, edi
mov ecx, dword [ebp - 0x880]
cmp ecx, dword [ebp - 0x878]
je 0x437007
mov ecx, dword [ebp - 0x88c]
test edx, edx
jne 0x436f5c
mov ebx, dword [ebp - 0x874]
mov eax, dword [eax]
jmp 0x436ecb
mov eax, dword [ebx + 0x24]
lea eax, [eax + edx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
cmp edx, ebx
jbe 0x4370d1
mov eax, dword [ebp - 0x890]
add eax, ebx
cmp edx, eax
jae 0x4370d1
mov eax, 0x9fb32536
mov ecx, eax
mov dword [ebp - 0x874], eax
mov ebx, eax
mov dword [ebp - 0x878], ecx
mov al, byte [edx]
cmp al, 0x2e
je 0x437087
movsx eax, al
xor eax, ebx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ebx, eax, 0x1000193
inc edx
mov al, byte [edx]
cmp al, 0x2e
jne 0x43704f
mov ecx, dword [ebp - 0x878]
mov dword [ebp - 0x874], ebx
inc edx
mov al, byte [edx]
test al, al
je 0x4370c0
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
mov al, byte [edx]
test al, al
jne 0x43708e
mov dword [ebp - 0x878], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
jmp 0x437000
mov ebx, dword [ebp - 0x894]
mov dword [0x4e6d98], edx
lea eax, [ebp - 0x884]
push eax
push ebx
call edx
push eax
mov edx, ebx
lea ecx, [ebp - 0x86c]
call fcn.0041458d
pop ecx
pop ecx
test eax, eax
jne 0x43710c
lea ecx, [ebp - 0x86c]
call fcn.004149ec
mov edi, dword [ebp - 0x884]
push dword [0x4e5ce8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0ce6
leave
ret