Function at 0x4474cd
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49495c]
mov dword [ebp - 0x10], ecx
push ebx
push esi
push edi
test eax, eax
jne 0x44757c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x44755e
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x44755e
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0x3795910d
dec esi
mov dword [ebp - 0xc], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x44755a
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x447536
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xd7a6b5b
mov edx, dword [eax + 0x18]
je 0x447562
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x447511
mov eax, dword [eax]
jmp 0x4474f2
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x49495c], eax
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [ebp - 0x10]
push ecx
push ecx
push dword [0x4946fc]
call eax
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4476f2
mov ecx, dword [0x494944]
test ecx, ecx
jne 0x447642
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x447620
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x447620
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0x14fa149d
dec esi
mov dword [ebp - 0x10], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x44761c
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x4475f8
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xaf65cfc
mov edx, dword [eax + 0x18]
je 0x447624
mov ecx, dword [ebp - 0x10]
test esi, esi
jne 0x4475d3
mov eax, dword [eax]
jmp 0x4475b4
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
mov eax, dword [ebp - 0xc]
add ecx, edx
mov dword [0x494944], ecx
push 0x1388
push eax
call ecx
mov eax, dword [0x494940]
test eax, eax
jne 0x4476ed
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x4476cf
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x4476cf
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0x8f6d30c9
dec esi
mov dword [ebp - 0x10], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x4476cb
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x4476a7
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x11354a49
mov edx, dword [eax + 0x18]
je 0x4476d3
mov ecx, dword [ebp - 0x10]
test esi, esi
jne 0x447682
mov eax, dword [eax]
jmp 0x447663
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494940], eax
push dword [ebp - 0xc]
call eax
pop edi
pop esi
pop ebx
leave
ret