Function at 0x438f56
Capabilities:
Access peb ldr_data
Encode data using xor
Get hostname
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x4e7a54]
push ebx
push esi
push edi
test edx, edx
jne 0x439133
mov eax, dword fs:[0x30]
xor ebx, ebx
mov edi, 0xaa9fe779
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x2c]
mov esi, dword [eax + 0x30]
add ecx, 0xfffffff8
test ebx, ebx
je 0x438fe0
movzx ecx, cx
mov edx, 0x195ce854
shr ecx, 1
lea edi, [esi + ecx*2]
jmp 0x438fd4
movsx ecx, byte [esi]
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
add esi, 2
cmp esi, edi
jne 0x438fac
cmp edx, ebx
jne 0x439071
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov edi, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
add edi, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], edi
cmp edi, esi
je 0x439071
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x43906e
mov ecx, dword [edi + 0x20]
lea ecx, [ecx + ebx*4]
add ecx, esi
sub ecx, 4
mov dword [ebp - 0x10], 0x195ce854
mov dword [ebp - 0x20], ecx
dec ebx
mov ecx, dword [ecx]
add ecx, esi
mov dl, byte [ecx]
inc ecx
mov dword [ebp - 0x18], ecx
test dl, dl
je 0x43905f
mov edi, dword [ebp - 0x10]
mov esi, ecx
movsx ecx, dl
xor ecx, edi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [esi]
imul edi, ecx, 0x1000193
inc esi
test dl, dl
jne 0x43902a
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
je 0x439078
mov ecx, dword [ebp - 0x20]
test ebx, ebx
jne 0x439009
mov ebx, dword [ebp - 0xc]
mov eax, dword [eax]
jmp 0x438f90
mov eax, dword [edi + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
cmp edx, edi
jbe 0x43912d
mov eax, dword [ebp - 8]
add eax, edi
cmp edx, eax
jae 0x43912d
mov eax, 0x195ce854
mov ebx, eax
mov dword [ebp - 0xc], eax
mov edi, eax
mov dword [ebp - 0x14], eax
mov al, byte [edx]
cmp al, 0x2e
je 0x4390e6
movsx eax, al
xor eax, ebx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ebx, eax, 0x1000193
inc edx
mov al, byte [edx]
cmp al, 0x2e
jne 0x4390b7
mov dword [ebp - 0xc], ebx
inc edx
mov al, byte [edx]
test al, al
je 0x43911c
movsx eax, al
xor eax, edi
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul edi, eax, 0x1000193
inc edx
mov al, byte [edx]
test al, al
jne 0x4390ed
mov dword [ebp - 0x14], edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
jmp 0x439071
mov dword [0x4e7a54], edx
mov esi, 0x4e7628
push esi
call edx
test eax, eax
jne 0x43915a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x1ff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
mov eax, 0x4d1688
je 0x43915c
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0ce6
leave
ret