Function at 0x49df70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
push 0x22c
lea eax, [ebp - 0x250]
mov dword [ebp - 0x1c], ecx
push 0
push eax
call fcn.0040d020
mov esi, dword [0x4f081c]
add esp, 0xc
mov dword [ebp - 0x250], 0x22c
test esi, esi
jne 0x49e034
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49e01b
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x49dfe3
cmp eax, 0xa3e6f6c3
je 0x49e20f
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49e02c
cmp dword [ecx + 0x18], 0
jne 0x49dfc5
xor esi, esi
mov dword [0x4f081c], esi
mov eax, dword [0x4f8c54]
test eax, eax
jne 0x49e0ce
test esi, esi
je 0x49e0c7
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x49e0c7
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49e0c7
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49e0b5
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49e080
mov ecx, dword [ebp - 4]
cmp edi, 0x7f8fe695
je 0x49e21a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x49e070
xor eax, eax
mov dword [0x4f8c54], eax
push 0
push 2
call eax
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x49e530
mov esi, dword [0x4f081c]
test esi, esi
jne 0x49e175
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49e15c
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x49e124
cmp eax, 0xa3e6f6c3
je 0x49e237
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49e16d
cmp dword [ecx + 0x18], 0
jne 0x49e106
xor esi, esi
mov dword [0x4f081c], esi
mov eax, dword [0x4f8c24]
test eax, eax
jne 0x49e513
test esi, esi
je 0x49e203
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x49e203
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49e203
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49e1f1
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49e1c0
mov ecx, dword [ebp - 4]
cmp edi, 0xe05d6ee8
je 0x49e242
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x49e1b0
xor eax, eax
mov dword [0x4f8c24], eax
jmp 0x49e513
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49e02e
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x49e0c9
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49e16f
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4f8c24], eax
jmp 0x49e513
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x1c]
jne 0x49e3e5
cmp eax, dword fs:[0x20]
je 0x49e3e5
mov esi, dword [0x4f081c]
test esi, esi
jne 0x49e321
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49e308
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x49e2d0
cmp eax, 0xa3e6f6c3
je 0x49e6a1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49e319
cmp dword [ecx + 0x18], 0
jne 0x49e2b2
xor esi, esi
mov dword [0x4f081c], esi
mov eax, dword [0x4f8c20]
test eax, eax
jne 0x49e3be
test esi, esi
je 0x49e3b7
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x49e3b7
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49e3b7
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49e3a5
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49e370
mov ecx, dword [ebp - 4]
cmp edi, 0x6e477856
je 0x49e6ac
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x49e360
xor eax, eax
mov dword [0x4f8c20], eax
push dword [ebp - 0x238]
push 1
push 0x1fffff
call eax
mov esi, eax
test esi, esi
je 0x49e3e5
push 1
push esi
call fcn.00414660
call eax
push esi
call fcn.00411310
call eax
mov esi, dword [0x4f081c]
test esi, esi
jne 0x49e481
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop dword [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49e468
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x49e430
cmp eax, 0xa3e6f6c3
je 0x49e6c9
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49e479
cmp dword [ecx + 0x18], 0
jne 0x49e410
xor esi, esi
mov dword [0x4f081c], esi
mov eax, dword [0x4f8c30]
test eax, eax
jne 0x49e513
test esi, esi
je 0x49e50c
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x49e50c
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49e50c
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49e4fa
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49e4c5
mov ecx, dword [ebp - 4]
cmp edi, 0xc900195f
je 0x49e6d4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x49e4b5
xor eax, eax
mov dword [0x4f8c30], eax
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x250]
push ecx
push ebx
call eax
test eax, eax
jne 0x49e270
push ebx
call fcn.00411310
call eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword fs:[0x20]
je 0x49e719
mov esi, dword [0x4f081c]
test esi, esi
jne 0x49e5d5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x10], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x49e5bc
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x10]
imul eax, eax, 0x1000193
mov dword [ebp - 0x10], eax
cmp edi, ebx
jne 0x49e584
cmp eax, 0xa3e6f6c3
je 0x49e6f1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x49e5cd
cmp dword [ecx + 0x18], 0
jne 0x49e566
xor esi, esi
mov dword [0x4f081c], esi
mov eax, dword [0x4f8c20]
test eax, eax
jne 0x49e66e
test esi, esi
je 0x49e667
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x49e667
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x49e667
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x10], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x49e655
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x49e620
mov ecx, dword [ebp - 4]
cmp edi, 0x6e477856
je 0x49e6fc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
cmp ecx, dword [edx + 0x18]
jne 0x49e610
xor eax, eax
mov dword [0x4f8c20], eax
push dword [ebp - 0x1c]
push 1
push 0x1fffff
call eax
mov edi, eax
test edi, edi
je 0x49e719
push 1
push edi
call fcn.00414660
call eax
push edi
mov esi, eax
call fcn.00411310
call eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49e31b
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x49e3b9
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49e47b
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x49e50e
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x49e5cf
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x49e669
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret