Function at 0x44c150
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x3c], 0
mov esi, ecx
mov dword [ebp - 0xc], ebx
push edi
mov ecx, 0x800
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x30], ebx
or edi, 0xffffffff
mov dword [ebp - 0x150], ebx
call fcn.004baba0
mov ecx, eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x44d880
mov eax, dword [esi]
push 0x400
push ecx
push 2
push esi
call dword [eax + 0x38]
test eax, eax
js 0x44d705
mov eax, 0x52
mov ecx, 0x74
mov word [ebp - 0x98], ax
mov edx, 0x67
mov word [ebp - 0x96], cx
mov eax, 0x68
mov word [ebp - 0x94], dx
mov word [ebp - 0x92], ax
mov eax, 0x70
mov word [ebp - 0x90], dx
mov word [ebp - 0x8e], cx
mov word [ebp - 0x8c], dx
mov word [ebp - 0x8a], ax
mov eax, 0x65
mov word [ebp - 0x88], ax
mov eax, 0x75
mov word [ebp - 0x86], dx
mov word [ebp - 0x84], ax
mov eax, 2
mov word [ebp - 0x82], ax
movzx eax, word [0x4025e0]
add eax, 2
mov word [ebp - 0x80], ax
movzx eax, word [0x4025e2]
add eax, 2
mov word [ebp - 0x7e], ax
movzx eax, word [0x4025e4]
add eax, 2
mov word [ebp - 0x7c], ax
movzx eax, word [0x4025e6]
add eax, 2
mov word [ebp - 0x7a], ax
movzx eax, word [0x4025e8]
add eax, 2
mov word [ebp - 0x78], ax
movzx eax, word [0x4025ea]
add eax, 2
mov word [ebp - 0x76], ax
movzx eax, word [0x4025ec]
add eax, 2
mov word [ebp - 0x74], ax
movzx eax, word [0x4025ee]
add eax, 2
mov word [ebp - 0x72], ax
movzx eax, word [0x4025f0]
add eax, 2
mov word [ebp - 0x70], ax
movzx eax, word [0x4025f2]
add eax, 2
mov word [ebp - 0x6e], ax
movzx eax, word [0x4025f4]
add eax, 2
mov word [ebp - 0x6c], ax
xor eax, eax
mov word [ebp - 0x6a], ax
xor ecx, ecx
mov ax, word [ebp - 0x98]
nop dword [eax + eax]
mov ax, word [ebp + ecx*2 - 0x98]
movzx eax, ax
add eax, 0xfffffffe
mov word [ebp + ecx*2 - 0x98], ax
inc ecx
cmp ecx, 0x17
jb 0x44c2d0
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x98]
push eax
push esi
push ecx
call 0x52a231
test eax, eax
je 0x44d882
mov ebx, dword [0x4f081c]
test ebx, ebx
jne 0x44c3a4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov edx, eax
mov dword [ebp - 8], ecx
nop dword [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x18], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44c388
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x18]
imul eax, eax, 0x1000193
mov dword [ebp - 0x18], eax
cmp edi, ebx
jne 0x44c350
cmp eax, 0xa3e6f6c3
je 0x44d70d
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x44c399
cmp dword [ecx + 0x18], 0
jne 0x44c330
xor ebx, ebx
mov esi, dword [ebp - 0x2c]
mov dword [0x4f081c], ebx
mov eax, dword [0x4f07dc]
test eax, eax
jne 0x44c444
test ebx, ebx
je 0x44c43a
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + ebx]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x44c43a
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x44c43a
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x18], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x44c428
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x44c3f3
cmp edi, 0x28737e55
je 0x44d718
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [edx + 0x18]
jne 0x44c3e3
xor eax, eax
mov esi, dword [ebp - 0x2c]
mov dword [0x4f07dc], eax
push 0
push esi
call eax
mov dword [ebp - 0x64], 0x41
mov eax, dword [ebp - 0x64]
xor eax, 0x53
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x64]
inc eax
xor eax, 0x65
mov word [ebp - 0x5e], ax
mov eax, dword [ebp - 0x64]
add eax, 2
xor eax, 0x72
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x64]
add eax, 3
xor eax, 0x76
mov word [ebp - 0x5a], ax
mov eax, dword [ebp - 0x64]
add eax, 4
xor eax, 0x69
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x64]
add eax, 5
xor eax, 0x63
mov word [ebp - 0x56], ax
mov eax, dword [ebp - 0x64]
add eax, 6
xor eax, 0x65
mov word [ebp - 0x54], ax
mov eax, dword [ebp - 0x64]
add eax, 7
xor eax, 0x73
mov word [ebp - 0x52], ax
mov eax, dword [ebp - 0x64]
add eax, 8
mov word [ebp - 0x50], ax
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d62]
add eax, 9
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x4e], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d64]
add eax, 0xa
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x4c], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d66]
add eax, 0xb
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x4a], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d68]
add eax, 0xc
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x48], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d6a]
add eax, 0xd
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x46], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d6c]
add eax, 0xe
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x44], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d6e]
add eax, 0xf
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x42], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x402d70]
add eax, 0x10
movzx eax, ax
xor ecx, eax
xor eax, eax
mov word [ebp - 0x40], cx
xor edx, edx
mov word [ebp - 0x3e], ax
mov ax, word [ebp - 0x60]
nop dword [eax]
mov ax, word [ebp + edx*2 - 0x60]
mov ecx, dword [ebp - 0x64]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [ebp + edx*2 - 0x60], cx
inc edx
cmp edx, 0x11
jb 0x44c580
xor eax, eax
mov word [ebp - 0x3e], ax
lea eax, [ebp - 0x60]
push eax
push esi
push ecx
call 0x538f07
test eax, eax
je 0x44d879
mov ebx, dword [0x4f081c]
test ebx, ebx
jne 0x44c651
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov edx, eax
mov dword [ebp - 8], ecx
nop dword [eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x18], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44c638
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x18]
imul eax, eax, 0x1000193
mov dword [ebp - 0x18], eax
cmp edi, ebx
jne 0x44c600
cmp eax, 0xa3e6f6c3
je 0x44d736
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x44c649
cmp dword [ecx + 0x18], 0
jne 0x44c5e0
xor ebx, ebx
mov dword [0x4f081c], ebx
mov eax, dword [0x4f07dc]
test eax, eax
jne 0x44c6ee
test ebx, ebx
je 0x44c6e7
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + ebx]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x44c6e7
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x44c6e7
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x18], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x44c6d5
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x44c6a0
cmp edi, 0x28737e55
je 0x44d741
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [edx + 0x18]
jne 0x44c690
xor eax, eax
mov dword [0x4f07dc], eax
mov edi, dword [ebp - 0x2c]
push 0
push edi
call eax
mov dword [ebp - 0xd4], 0x66
mov eax, 0x3a
mov word [ebp - 0xd0], ax
mov ecx, 3
mov eax, 0x35
mov word [ebp - 0xce], ax
mov eax, 0x14
mov word [ebp - 0xcc], cx
mov word [ebp - 0xca], ax
mov eax, 0x10
mov word [ebp - 0xc8], ax
mov eax, 0xf
mov word [ebp - 0xc6], ax
mov eax, 5
mov word [ebp - 0xc4], ax
mov eax, 0x15
mov word [ebp - 0xc2], cx
mov word [ebp - 0xc0], ax
mov eax, 0x48
mov word [ebp - 0xbe], ax
mov eax, 0x1e
mov word [ebp - 0xbc], ax
mov eax, 0xb
mov word [ebp - 0xba], ax
mov eax, 0xa
mov word [ebp - 0xb8], ax
mov eax, 0x66
mov word [ebp - 0xb6], ax
movzx eax, word [0x402d80]
xor eax, 0x66
mov word [ebp - 0xb4], ax
movzx eax, word [0x402d82]
xor eax, 0x66
mov word [ebp - 0xb2], ax
movzx eax, word [0x402d84]
xor eax, 0x66
mov word [ebp - 0xb0], ax
movzx eax, word [0x402d86]
xor eax, 0x66
mov word [ebp - 0xae], ax
movzx eax, word [0x402d88]
xor eax, 0x66
mov word [ebp - 0xac], ax
movzx eax, word [0x402d8a]
xor eax, 0x66
mov word [ebp - 0xaa], ax
movzx eax, word [0x402d8c]
xor eax, 0x66
mov word [ebp - 0xa8], ax
movzx eax, word [0x402d8e]
xor eax, 0x66
mov word [ebp - 0xa6], ax
movzx eax, word [0x402d90]
xor eax, 0x66
mov word [ebp - 0xa4], ax
movzx eax, word [0x402d92]
xor eax, 0x66
mov word [ebp - 0xa2], ax
movzx eax, word [0x402d94]
xor eax, 0x66
mov word [ebp - 0xa0], ax
movzx eax, word [0x402d96]
xor eax, 0x66
mov word [ebp - 0x9e], ax
movzx eax, word [0x402d98]
xor eax, 0x66
mov word [ebp - 0x9c], ax
xor eax, eax
mov word [ebp - 0x9a], ax
xor edx, edx
mov ax, word [ebp - 0xd0]
mov ax, word [ebp + edx*2 - 0xd0]
movzx ecx, ax
movzx eax, word [ebp - 0xd4]
xor ecx, eax
mov word [ebp + edx*2 - 0xd0], cx
inc edx
cmp edx, 0x1b
jb 0x44c892
xor eax, eax
lea edx, [ebp - 0xd0]
mov word [ebp - 0x9a], ax
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44c8c5
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44c8d5
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [0x4f081c]
test ebx, ebx
jne 0x44c984
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov edx, eax
mov dword [ebp - 8], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x18], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44c96b
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x18]
imul eax, eax, 0x1000193
mov dword [ebp - 0x18], eax
cmp edi, ebx
jne 0x44c933
cmp eax, 0xa3e6f6c3
je 0x44d75f
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x44c97c
cmp dword [ecx + 0x18], 0
jne 0x44c915
xor ebx, ebx
mov dword [0x4f081c], ebx
mov eax, dword [0x4f0810]
test eax, eax
jne 0x44ca21
test ebx, ebx
je 0x44ca1a
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + ebx]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x44ca1a
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x44ca1a
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0x18], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x44ca08
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x44c9d3
cmp edi, 0xe95da064
je 0x44d76a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [edx + 0x18]
jne 0x44c9c3
xor eax, eax
mov dword [0x4f0810], eax
mov esi, dword [ebp - 0x2c]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call eax
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x44d875
lea eax, [ebp - 0x160]
push eax
call 0x57c52e
ret
mov esi, dword [ebp - 0x2c]
jmp 0x44d882
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
jmp 0x44c39b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x44c43c
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
jmp 0x44c64b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x44c6e9
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
jmp 0x44c97e
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x44ca1c
xor ebx, ebx
jmp 0x44d882
xor ebx, ebx
or edi, 0xffffffff
jmp 0x44d882
mov esi, eax
mov ecx, dword [ebp - 0x68]
test ecx, ecx
je 0x44d88e
call fcn.004bb000
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x44d89c
mov ecx, eax
call fcn.004bb000
test esi, esi
je 0x44d8a7
mov ecx, esi
call fcn.004bb000
test ebx, ebx
je 0x44d8b2
mov ecx, ebx
call fcn.004bb000
cmp edi, 0xffffffff
je 0x44d8bf
push edi
call fcn.00411310
call eax
mov eax, dword [ebp - 0x30]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret