Function at 0x49bab0
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x4ff2e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52e144]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
cmp dword [0x53ac38], 0
mov dword [esp + 0x1c], 0x53ac20
mov byte [esp + 0x20], 1
je 0x49baf8
push 0x53ac20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esp + 0x34]
push ebx
push 0
push 0x1fffff
mov dword [esp + 0x38], 0
call dword [0x5385d8]
test eax, eax
je 0x49bb58
lea ecx, [esp + 0x17]
push ecx
push eax
call fcn.00492e70
add esp, 8
cmp byte [esp + 0x17], 1
jne 0x49bb58
cmp dword [0x53ac38], 0
je 0x49bb3f
push 0x53ac20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x64
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
cmp dword [esp + 0x38], 0
mov byte [esp + 0x17], 0
je 0x49bb8c
push 0x548f58
push ebx
push 0x5216ec
mov byte [esp + 0x23], 1
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
jmp 0x49bba8
push ebx
push 0x5216d8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp dword [0x54a0f8], 0
mov ebp, 0x16
jne 0x49bc7d
push 0
mov dword [0x54a0f8], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x49bbfe
cmp dword [0x53ac38], eax
je 0x49bbe5
push 0x53ac20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x14
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, 0x5a4d
cmp word [esi], dx
je 0x49bc35
cmp dword [0x53ac38], 0
je 0x49bc1c
push 0x53ac20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x15
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x49bd6b
cmp dword [esi + 0x30], 0
je 0x49bc7d
cmp dword [esi + 0x34], 0
je 0x49bc7d
mov eax, dword [eax + 8]
push eax
call fcn.0040c5d0
add esp, 4
call fcn.0040c5e0
xor eax, dword [esi + 0x30]
mov dword [0x54a0f4], eax
call fcn.0040c5e0
mov edi, eax
xor edi, dword [esi + 0x34]
mov dword [0x54a0f0], edi
jmp 0x49bc83
mov edi, dword [0x54a0f0]
mov esi, dword [0x54a0f4]
test esi, esi
je 0x49bcfc
test edi, edi
je 0x49bcfc
mov dword [esp + 0x18], 0
mov edx, dword [0x548d74]
xor edx, esi
xor ecx, ecx
test edi, edi
jbe 0x49bcbb
mov al, dl
add al, cl
mov bl, 3
imul bl
xor byte [esi + ecx], al
inc ecx
cmp ecx, edi
jb 0x49bca7
mov ebx, dword [esp + 0x34]
cmp dword [esp + 0x18], 0
jne 0x49bce9
cmp byte [esp + 0x17], 0
jne 0x49bccd
push 0
jmp 0x49bcd2
mov ecx, dword [esp + 0x38]
push ecx
push ebx
call fcn.00499fe0
mov edi, dword [0x54a0f0]
mov esi, dword [0x54a0f4]
mov ebp, eax
add esp, 8
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 2
mov dword [esp + 0x18], eax
jl 0x49bc99
jmp 0x49bda5
cmp byte [esp + 0x17], 0
jne 0x49bd95
push 0
push ebx
call fcn.00499fe0
add esp, 8
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push 0x5216bc
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
cmp ebp, 0x64
je 0x49bd6b
cmp dword [0x539710], 0x3b
jne 0x49bd6b
push 0x521694
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
mov eax, dword [0x539720]
add esp, 0xc
push 0xffffffffffffffff
push eax
call dword [0x5385dc]
cmp dword [0x53ac38], 0
je 0x49bd7f
push 0x53ac20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x38]
push edx
push ebx
call fcn.00499fe0
add esp, 8
mov ebp, eax
cmp byte [esp + 0x17], 0
je 0x49bd14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push 0x521678
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
jmp 0x49bd6b