Function at 0x498840
Capabilities:
Accept command line arguments
Access peb ldr_data
Create thread
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffd60
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x672494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00451070
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ecx, word [eax + 0x2c]
xor edi, edi
mov esi, dword [eax + 0x30]
and ecx, 0xfffffffe
mov dword [ebp - 0x1c], eax
mov ebx, 0x811c9dc5
lea edx, [ecx + esi]
inc ecx
shr ecx, 1
cmp esi, edx
cmova ecx, edi
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x4988db
mov eax, ecx
nop
mov dl, byte [esi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x4988c0
or ecx, 0x20
xor ecx, ebx
inc edi
imul ebx, ecx, 0x1000193
add esi, 2
cmp edi, eax
jne 0x4988b0
mov eax, dword [ebp - 0x1c]
cmp ebx, 0xa3e6f6c3
je 0x4988df
mov eax, dword [eax]
jmp 0x498887
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f400]
mov dword [ebp - 0x1c], esi
test eax, eax
jne 0x498988
test esi, esi
je 0x498981
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
cmp ecx, esi
je 0x498981
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x498981
mov edi, dword [ecx + 0x20]
add edi, esi
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x498959
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x49893f
or eax, 0x20
mov cl, byte [edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
test cl, cl
jne 0x498932
cmp esi, 0xab288e66
je 0x498966
mov eax, dword [ebp - 0x18]
inc ebx
add edi, 4
cmp ebx, eax
je 0x498981
mov esi, dword [ebp - 0x1c]
jmp 0x498922
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edx
jmp 0x498983
xor eax, eax
mov dword [0x67f400], eax
push 0
call eax
mov esi, eax
test esi, esi
je 0x498e4f
push 0
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
push 0
push esi
call fcn.004c9d97
test eax, eax
jne 0x498adb
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ecx, word [eax + 0x2c]
xor edi, edi
mov esi, dword [eax + 0x30]
and ecx, 0xfffffffe
mov dword [ebp - 0x1c], eax
mov ebx, 0x811c9dc5
lea edx, [ecx + esi]
inc ecx
shr ecx, 1
cmp esi, edx
cmova ecx, edi
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x498a0e
mov eax, ecx
mov dl, byte [esi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x4989f3
or ecx, 0x20
xor ecx, ebx
inc edi
imul ebx, ecx, 0x1000193
add esi, 2
cmp edi, eax
jne 0x4989e3
mov eax, dword [ebp - 0x1c]
cmp ebx, 0xc0323159
je 0x498a12
mov eax, dword [eax]
jmp 0x4989bb
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f48c]
mov dword [ebp - 0x1c], esi
test eax, eax
jne 0x498ac6
test esi, esi
je 0x498abf
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ecx
cmp ecx, esi
je 0x498abf
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x20], eax
test eax, eax
je 0x498abf
mov edi, dword [ecx + 0x20]
add edi, esi
nop dword [eax]
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x498a97
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x498a7d
or eax, 0x20
mov cl, byte [edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
test cl, cl
jne 0x498a70
cmp esi, 0x3625758e
je 0x498aa4
mov eax, dword [ebp - 0x20]
inc ebx
add edi, 4
cmp ebx, eax
je 0x498abf
mov esi, dword [ebp - 0x1c]
jmp 0x498a60
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edx
jmp 0x498ac1
xor eax, eax
mov dword [0x67f48c], eax
push 0x10
push 0x651fa4
push 0x651fb0
push 0
call eax
jmp 0x498e4f
mov edi, dword [ebp - 0x2c]
push edi
call fcn.004fd0f0
add esp, 4
push 0xbf0
call fcn.004c183f
mov esi, eax
add esp, 4
test esi, esi
je 0x498b13
push 0xbf0
push 0
push esi
call fcn.0056c1d0
add esp, 0xc
mov ecx, esi
call fcn.00452bd0
jmp 0x498b15
xor eax, eax
mov dword [0x67f4f4], eax
call fcn.00498130
push edi
call fcn.004538f0
test eax, eax
je 0x498e4f
call fcn.00454960
test eax, eax
je 0x498e4f
call fcn.00482d50
push 0
push 0
push 0
push 0x4458d0
push 0
push 0
mov dword [ebp - 0x1c], 0
call fcn.0057f519
add esp, 0x18
mov ebx, eax
mov dword [ebp - 0x24], ebx
call fcn.0047a980
test eax, eax
je 0x498b95
push 0xd
push str.Option
call fcn.0047f920
test eax, eax
je 0x498b95
push 0
push 0
push 0
push 0x446c40
push 0
push 0
call fcn.0057f519
add esp, 0x18
mov dword [ebp - 0x1c], eax
mov esi, dword [0x67f4f4]
mov ecx, dword [esi + 0x50c]
cmp ecx, 3
je 0x498bd4
cmp ecx, 4
je 0x498bd4
cmp dword [esi + 0x510], 0x2bc
jne 0x498bd9
call fcn.0047a980
test eax, eax
je 0x498bd9
mov eax, dword [esi + 0xb20]
test eax, eax
je 0x498bd9
push dword [esi + 0x510]
call eax
jmp 0x498bd9
call fcn.004565a0
test ebx, ebx
je 0x498cf7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ecx, word [eax + 0x2c]
xor edi, edi
mov esi, dword [eax + 0x30]
and ecx, 0xfffffffe
mov dword [ebp - 0x18], eax
mov ebx, 0x811c9dc5
lea edx, [ecx + esi]
inc ecx
shr ecx, 1
cmp esi, edx
cmova ecx, edi
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x498c40
mov eax, ecx
mov dl, byte [esi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x498c25
or ecx, 0x20
xor ecx, ebx
inc edi
imul ebx, ecx, 0x1000193
add esi, 2
cmp edi, eax
jne 0x498c15
mov eax, dword [ebp - 0x18]
cmp ebx, 0xa3e6f6c3
je 0x498c44
mov eax, dword [eax]
jmp 0x498bed
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f474]
mov dword [ebp - 0x18], esi
test eax, eax
jne 0x498ced
test esi, esi
je 0x498ce6
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ecx
cmp ecx, esi
je 0x498ce6
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x498ce6
mov edi, dword [ecx + 0x20]
add edi, esi
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x498cbe
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x498ca4
or eax, 0x20
mov cl, byte [edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
test cl, cl
jne 0x498c97
cmp esi, 0x93fae264
je 0x498ccb
mov eax, dword [ebp - 0x2c]
inc ebx
add edi, 4
cmp ebx, eax
je 0x498ce6
mov esi, dword [ebp - 0x18]
jmp 0x498c87
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edx
jmp 0x498ce8
xor eax, eax
mov dword [0x67f474], eax
push 0x1d4c00
push dword [ebp - 0x24]
call eax
cmp dword [ebp - 0x1c], 0
je 0x498e20
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ecx, word [eax + 0x2c]
xor edi, edi
mov esi, dword [eax + 0x30]
and ecx, 0xfffffffe
mov dword [ebp - 0x18], eax
mov ebx, 0x811c9dc5
lea edx, [ecx + esi]
inc ecx
shr ecx, 1
cmp esi, edx
cmova ecx, edi
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x498d60
mov eax, ecx
mov dl, byte [esi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x498d45
or ecx, 0x20
xor ecx, ebx
inc edi
imul ebx, ecx, 0x1000193
add esi, 2
cmp edi, eax
jne 0x498d35
mov eax, dword [ebp - 0x18]
cmp ebx, 0xa3e6f6c3
je 0x498d64
mov eax, dword [eax]
jmp 0x498d0d
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f474]
mov dword [ebp - 0x18], esi
test eax, eax
jne 0x498e16
test esi, esi
je 0x498e0f
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
cmp ecx, esi
je 0x498e0f
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x498e0f
mov edi, dword [ecx + 0x20]
add edi, esi
nop dword [eax + eax]
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x498de7
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x498dcd
or eax, 0x20
mov cl, byte [edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
test cl, cl
jne 0x498dc0
cmp esi, 0x93fae264
je 0x498df4
mov eax, dword [ebp - 0x24]
inc ebx
add edi, 4
cmp ebx, eax
je 0x498e0f
mov esi, dword [ebp - 0x18]
jmp 0x498db0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edx
jmp 0x498e11
xor eax, eax
mov dword [0x67f474], eax
push 0x1d4c00
push dword [ebp - 0x1c]
call eax
call fcn.004997e0
push 0x2710
push 1
push 0x67f644
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push dword [0x67f644]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [0x67f648]
call esi
mov edi, dword [0x67f520]
mov ebx, dword [0x67f524]
cmp edi, ebx
je 0x498ec6
nop
lea eax, [ebp - 0x14]
xor esi, esi
cmp eax, edi
je 0x498e71
mov esi, dword [edi]
mov dword [edi], 0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x499032
cmp byte [esi + 0x6c], 0
jne 0x499032
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 8]
mov dword [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x498eb8
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x498eb0
mov eax, dword [ecx]
push esi
jmp 0x498eb6
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
add edi, 8
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
jne 0x498e60
cmp dword [0x67f4f4], 0
je 0x498efd
call fcn.004580f0
mov esi, dword [0x67f4f4]
test esi, esi
je 0x498ef3
mov ecx, esi
call fcn.00474070
push 0xbf0
push esi
call fcn.004d0c91
add esp, 8
mov dword [0x67f4f4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor ebx, ebx
mov edi, dword [eax + 0x30]
and edx, 0xfffffffe
mov dword [ebp - 0x18], eax
mov esi, 0x811c9dc5
lea ecx, [edx + edi]
inc edx
shr edx, 1
cmp edi, ecx
cmova edx, ebx
mov dword [ebp - 0x24], edx
test edx, edx
je 0x498f5c
mov eax, edx
mov dl, byte [edi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x498f41
or ecx, 0x20
xor esi, ecx
inc ebx
imul esi, esi, 0x1000193
add edi, 2
cmp ebx, eax
jne 0x498f31
mov eax, dword [ebp - 0x18]
cmp esi, 0xa3e6f6c3
je 0x498f60
mov eax, dword [eax]
jmp 0x498f09
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f828]
mov dword [ebp - 0x18], esi
test eax, eax
jne 0x499018
test esi, esi
je 0x499011
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
cmp ecx, esi
je 0x499011
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x499011
mov edi, dword [ecx + 0x20]
add edi, esi
nop dword [eax + eax]
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x498fe7
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x498fcd
or eax, 0x20
mov cl, byte [edx]
xor esi, eax
imul esi, esi, 0x1000193
inc edx
test cl, cl
jne 0x498fc0
cmp esi, 0x52a4cf3a
je 0x498ff4
mov eax, dword [ebp - 0x24]
inc ebx
add edi, 4
cmp ebx, eax
je 0x499011
mov esi, dword [ebp - 0x18]
jmp 0x498fb0
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov eax, dword [esi + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x499013
xor eax, eax
mov dword [0x67f828], eax
push 0
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, 4
lea ecx, [ebp - 0x38]
call fcn.00441980
push eax
call fcn.004d4828
int3