Function at 0x4be9f0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], ecx
push eax
push 8
xor ebx, ebx
mov dword [ebp - 0xc], 0
push 0xffffffffffffffff
mov dword [ebp - 0x1c], ebx
call fcn.00411150
call eax
mov ecx, 0x200
call fcn.004bca70
mov dword [ebp - 4], eax
test eax, eax
je 0x4beeee
lea ecx, [ebp - 0x1c]
push ecx
push 0x200
push eax
push 1
push dword [ebp - 0xc]
call fcn.00411240
call eax
test eax, eax
jne 0x4beee5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [0x4fbe90]
mov dword [ebp - 0x10], ebx
test eax, eax
jne 0x4beb1a
test ebx, ebx
je 0x4beb13
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], edx
cmp edx, ebx
je 0x4beb15
mov ecx, dword [edx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x4beb13
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4beae3
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x4beab2
cmp esi, 0x28d62d1a
je 0x4beaf3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
inc eax
add edi, 4
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4beb13
mov ebx, dword [ebp - 0x10]
jmp 0x4beaa2
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4beb15
xor eax, eax
mov dword [0x4fbe90], eax
push 1
lea ecx, [ebp - 0x38]
push ecx
call eax
test eax, eax
jne 0x4beee3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [0x4fbea8]
mov dword [ebp - 0x10], ebx
test eax, eax
jne 0x4bebfa
test ebx, ebx
je 0x4bebf3
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x14], edx
cmp edx, ebx
je 0x4bebf5
mov ecx, dword [edx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x4bebf3
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4bebc3
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x4beb92
cmp esi, 0xb36ab5d1
je 0x4bebd3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
inc eax
add edi, 4
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4bebf3
mov ebx, dword [ebp - 0x10]
jmp 0x4beb82
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4bebf5
xor eax, eax
mov dword [0x4fbea8], eax
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x38]
push 0
push dword [esi]
push ecx
call eax
test eax, eax
jne 0x4beeea
mov esi, dword [0x4f3830]
test esi, esi
jne 0x4beca4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov edx, eax
mov dword [ebp - 8], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x10], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4bec8b
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x10]
imul eax, eax, 0x1000193
mov dword [ebp - 0x10], eax
cmp edi, ebx
jne 0x4bec53
cmp eax, 0x39794115
je 0x4bee96
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x4bec9c
cmp dword [ecx + 0x18], 0
jne 0x4bec35
xor esi, esi
mov dword [0x4f3830], esi
mov eax, dword [0x4fbeb4]
test eax, eax
jne 0x4bed3e
test esi, esi
je 0x4bed37
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x4bed37
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4bed37
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4bed25
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4becf0
mov ecx, dword [ebp - 8]
cmp edi, 0xb808a9cc
je 0x4beea1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [edx + 0x18]
jne 0x4bece0
xor eax, eax
mov dword [0x4fbeb4], eax
lea ecx, [ebp - 0x38]
push ecx
push 1
push dword [ebp - 0x18]
call eax
test eax, eax
je 0x4beee3
mov esi, dword [0x4f3830]
test esi, esi
jne 0x4bede6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 8], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x14], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4bedcd
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x14]
imul eax, eax, 0x1000193
mov dword [ebp - 0x14], eax
cmp edi, ebx
jne 0x4bed95
cmp eax, 0x39794115
je 0x4beebe
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x4bedde
cmp dword [ecx + 0x18], 0
jne 0x4bed77
xor esi, esi
mov dword [0x4f3830], esi
mov eax, dword [0x4fbeb4]
test eax, eax
jne 0x4bee7a
test esi, esi
je 0x4bee73
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x4bee73
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4bee73
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
nop
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4bee61
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4bee30
mov ecx, dword [ebp - 8]
cmp edi, 0xb808a9cc
je 0x4beec9
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [edx + 0x18]
jne 0x4bee20
xor eax, eax
mov dword [0x4fbeb4], eax
lea ecx, [ebp - 0x38]
push ecx
push 4
push dword [ebp - 0x18]
call eax
mov esi, dword [ebp - 4]
xor ebx, ebx
test eax, eax
mov ecx, 1
cmovne ebx, ecx
jmp 0x4beef0
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x18]
jmp 0x4bec9e
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4bed39
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x18]
jmp 0x4bede0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4bee75
xor ebx, ebx
mov esi, dword [ebp - 4]
jmp 0x4beef0
xor ebx, ebx
jmp 0x4beef0
mov esi, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4beeff
push eax
call fcn.00411330
call eax
test esi, esi
je 0x4bef0a
mov ecx, esi
call fcn.004bced0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret