Function at 0x4be540
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], ecx
push eax
push 8
push 0xffffffffffffffff
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
call fcn.00411130
call eax
test eax, eax
jne 0x4bea38
mov ecx, 0x200
call fcn.004baba0
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4bea40
lea eax, [ebp - 0x1c]
push eax
push 0x200
push ebx
push 1
push dword [ebp - 0xc]
call fcn.00411220
call eax
test eax, eax
jne 0x4bea40
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [0x4f8e80]
mov dword [ebp - 0x10], ebx
test eax, eax
jne 0x4be678
test ebx, ebx
je 0x4be671
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], edx
cmp edx, ebx
je 0x4be673
mov ecx, dword [edx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x4be671
mov edi, dword [edx + 0x20]
add edi, ebx
nop
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4be641
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x4be610
cmp esi, 0x28d62d1a
je 0x4be651
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
inc eax
add edi, 4
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4be671
mov ebx, dword [ebp - 0x10]
jmp 0x4be600
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4be673
xor eax, eax
mov dword [0x4f8e80], eax
push 1
lea ecx, [ebp - 0x38]
push ecx
call eax
test eax, eax
jne 0x4bea3d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [0x4f8ea4]
mov dword [ebp - 0x10], ebx
test eax, eax
jne 0x4be758
test ebx, ebx
je 0x4be751
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x14], edx
cmp edx, ebx
je 0x4be753
mov ecx, dword [edx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x4be751
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4be721
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x4be6f0
cmp esi, 0xb36ab5d1
je 0x4be731
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
inc eax
add edi, 4
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4be751
mov ebx, dword [ebp - 0x10]
jmp 0x4be6e0
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4be753
xor eax, eax
mov dword [0x4f8ea4], eax
mov ebx, dword [ebp - 4]
lea ecx, [ebp - 0x38]
push 0
push dword [ebx]
push ecx
call eax
test eax, eax
jne 0x4bea40
mov esi, dword [0x4f083c]
test esi, esi
jne 0x4be802
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov edx, eax
mov dword [ebp - 8], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x10], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4be7e9
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x10]
imul eax, eax, 0x1000193
mov dword [ebp - 0x10], eax
cmp edi, ebx
jne 0x4be7b1
cmp eax, 0x39794115
je 0x4be9eb
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x4be7fa
cmp dword [ecx + 0x18], 0
jne 0x4be793
xor esi, esi
mov dword [0x4f083c], esi
mov eax, dword [0x4f8eb4]
test eax, eax
jne 0x4be894
test esi, esi
je 0x4be88d
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x4be88d
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4be88d
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4be87b
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4be846
mov ecx, dword [ebp - 8]
cmp edi, 0xb808a9cc
je 0x4be9f6
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [edx + 0x18]
jne 0x4be836
xor eax, eax
mov dword [0x4f8eb4], eax
lea ecx, [ebp - 0x38]
push ecx
push 1
push dword [ebp - 0x18]
call eax
test eax, eax
je 0x4bea3d
mov esi, dword [0x4f083c]
test esi, esi
jne 0x4be941
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 8], ecx
nop dword [eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0x14], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4be928
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0x14]
imul eax, eax, 0x1000193
mov dword [ebp - 0x14], eax
cmp edi, ebx
jne 0x4be8f0
cmp eax, 0x39794115
je 0x4bea13
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, edx
je 0x4be939
cmp dword [ecx + 0x18], 0
jne 0x4be8d0
xor esi, esi
mov dword [0x4f083c], esi
mov eax, dword [0x4f8eb4]
test eax, eax
jne 0x4be9cf
test esi, esi
je 0x4be9c8
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [ecx + esi]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x4be9c8
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4be9c8
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4be9b6
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4be985
mov ecx, dword [ebp - 8]
cmp edi, 0xb808a9cc
je 0x4bea1e
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [edx + 0x18]
jne 0x4be975
xor eax, eax
mov dword [0x4f8eb4], eax
lea ecx, [ebp - 0x38]
push ecx
push 4
push dword [ebp - 0x18]
call eax
mov ebx, dword [ebp - 4]
xor esi, esi
test eax, eax
mov ecx, 1
cmovne esi, ecx
jmp 0x4bea42
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x18]
jmp 0x4be7fc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4be88f
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x18]
jmp 0x4be93b
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4be9ca
mov ebx, dword [ebp - 0x20]
jmp 0x4bea40
mov ebx, dword [ebp - 4]
xor esi, esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4bea51
push eax
call fcn.00411310
call eax
test ebx, ebx
je 0x4bea5c
mov ecx, ebx
call fcn.004bb000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret