Function at 0x4c2000
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x40], 0x7865742e
mov word [ebp - 0x3c], 0x74
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x4c2084
nop dword [eax]
mov eax, dword [eax + 0x18]
mov edi, 0xf08a2a02
mov dword [ebp - 0x2c], eax
nop dword [eax + eax]
movzx esi, word [ebx]
lea ebx, [ebx + 2]
mov eax, esi
lea ecx, [eax - 0x41]
add eax, 0x20
movzx edx, ax
cmp cx, 0x19
mov eax, esi
cmova edx, eax
movzx eax, dx
test ax, ax
je 0x4c2069
rol edi, 5
add edi, eax
jmp 0x4c2040
cmp edi, 0xcf63f1cf
je 0x4c2728
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x4c2030
xor edx, edx
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x4c2102
mov eax, dword [ecx + edx + 0x24]
lea edi, [ecx + edx]
mov ebx, dword [edi + 0x20]
add eax, edx
mov dword [ebp - 0xc], eax
add ebx, edx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x18], 0
mov dword [ebp - 0x2c], eax
jbe 0x4c2102
nop word [eax + eax]
mov ecx, dword [ebx]
mov esi, 0xe1bf6360
add ecx, edx
mov al, byte [ecx]
inc ecx
test al, al
je 0x4c20ec
movsx eax, al
lea ecx, [ecx + 1]
lea esi, [eax + esi*2]
mov al, byte [ecx - 1]
test al, al
jne 0x4c20d0
cmp esi, 0xf63b9ba3
je 0x4c2730
mov eax, dword [ebp - 0x20]
add ebx, 4
add dword [ebp - 0xc], 2
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi + 0x18]
jb 0x4c20c0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2c], 0
lea edi, [edx + ecx]
test ecx, ecx
je 0x4c2171
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x20]
add eax, edx
mov dword [ebp - 0xc], eax
add ebx, edx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x18], 0
mov dword [ebp - 0x24], eax
jbe 0x4c2171
mov ecx, dword [ebx]
mov esi, 0xe1bf6360
add ecx, edx
mov al, byte [ecx]
inc ecx
test al, al
je 0x4c215e
movsx eax, al
lea ecx, [ecx + 1]
lea esi, [eax + esi*2]
mov al, byte [ecx - 1]
test al, al
jne 0x4c2142
cmp esi, 0xd8edbdfd
je 0x4c2746
mov eax, dword [ebp - 0x20]
add ebx, 4
add dword [ebp - 0xc], 2
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi + 0x18]
jb 0x4c2132
cmp dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
je 0x4c21df
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x20]
add eax, edx
mov dword [ebp - 0xc], eax
add ebx, edx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x18], 0
mov dword [ebp - 0x24], eax
jbe 0x4c21df
mov ecx, dword [ebx]
mov esi, 0xe1bf6360
add ecx, edx
mov al, byte [ecx]
inc ecx
test al, al
je 0x4c21cc
movsx eax, al
lea ecx, [ecx + 1]
lea esi, [eax + esi*2]
mov al, byte [ecx - 1]
test al, al
jne 0x4c21b0
cmp esi, 0xd8f0609e
je 0x4c275c
mov eax, dword [ebp - 0x20]
add ebx, 4
add dword [ebp - 0xc], 2
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi + 0x18]
jb 0x4c21a0
cmp dword [ebp - 4], 0
mov dword [ebp - 8], 0
je 0x4c224f
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x20]
add eax, edx
mov dword [ebp - 0xc], eax
add ebx, edx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x18], 0
mov dword [ebp - 0x24], eax
jbe 0x4c224f
nop
mov ecx, dword [ebx]
mov esi, 0xe1bf6360
add ecx, edx
mov al, byte [ecx]
inc ecx
test al, al
je 0x4c223c
movsx eax, al
lea ecx, [ecx + 1]
lea esi, [eax + esi*2]
mov al, byte [ecx - 1]
test al, al
jne 0x4c2220
cmp esi, 0xf63c16a1
je 0x4c2772
mov eax, dword [ebp - 0x20]
add ebx, 4
add dword [ebp - 0xc], 2
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi + 0x18]
jb 0x4c2210
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], 0
test eax, eax
je 0x4c2315
mov ebx, dword [edi + 0x20]
add ebx, edx
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x18], 0
jbe 0x4c22b1
mov ecx, dword [ebx]
mov esi, 0xe1bf6360
add ecx, edx
mov al, byte [ecx]
inc ecx
test al, al
je 0x4c229b
movsx eax, al
lea ecx, [ecx + 1]
lea esi, [eax + esi*2]
mov al, byte [ecx - 1]
test al, al
jne 0x4c2283
cmp esi, 0xfb1e0b47
je 0x4c22b1
mov eax, dword [ebp - 0x20]
add ebx, 4
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi + 0x18]
jb 0x4c2273
mov eax, dword [ebp - 4]
test eax, eax
je 0x4c2315
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x20]
add eax, edx
mov dword [ebp - 0xc], eax
add ebx, edx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x18], 0
mov dword [ebp - 0x18], eax
jbe 0x4c2312
mov ecx, dword [ebx]
mov esi, 0xe1bf6360
add ecx, edx
mov al, byte [ecx]
inc ecx
test al, al
je 0x4c22ff
movsx eax, al
lea ecx, [ecx + 1]
lea esi, [eax + esi*2]
mov al, byte [ecx - 1]
test al, al
jne 0x4c22e3
cmp esi, 0x37ec775e
je 0x4c2788
mov eax, dword [ebp - 0x20]
add ebx, 4
add dword [ebp - 0xc], 2
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi + 0x18]
jb 0x4c22d3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
test eax, eax
je 0x4c2395
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x20]
add eax, edx
mov dword [ebp - 0x10], eax
add ebx, edx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 4], eax
test eax, eax
je 0x4c2395
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebx]
mov esi, 0xe1bf6360
add ecx, edx
mov al, byte [ecx]
inc ecx
test al, al
je 0x4c2383
movsx eax, al
lea ecx, [ecx + 1]
lea esi, [eax + esi*2]
mov al, byte [ecx - 1]
test al, al
jne 0x4c2367
cmp esi, 0x63b6cb5b
je 0x4c27ac
mov eax, dword [ebp - 0x20]
add ebx, 4
inc eax
add edi, 2
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 4]
jb 0x4c2357
xor eax, eax
push 0
call eax
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x20], edi
mov edx, dword [edi + 0x3c]
add edx, edi
mov dword [ebp - 4], edx
movzx eax, word [edx + 0x14]
movzx ecx, word [edx + 6]
add eax, 0x18
add eax, edx
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x4c23ec
mov esi, eax
lea eax, [ebp - 0x40]
sub esi, eax
xor edx, edx
lea ecx, [ebp - 0x40]
add ecx, edx
mov al, byte [esi + ecx]
cmp al, byte [ecx]
jne 0x4c27bc
inc edx
cmp edx, 6
jb 0x4c23c7
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
call fcn.004c29e0
mov ebx, dword [ebp - 0x14]
mov esi, eax
mov eax, dword [ebp - 0xc]
add eax, edi
add eax, ebx
cmp esi, eax
ja 0x4c27e1
nop word [eax + eax]
xor ecx, ecx
cmp byte [ecx + esi], 0
jne 0x4c27d8
inc ecx
cmp ecx, 0x80
jb 0x4c2412
push 0x3e8
call dword [ebp - 0x18]
lea ecx, [esi + 0x100]
mov eax, edi
sub eax, ecx
add eax, dword [ebp - 0xc]
push 4
add eax, ebx
push 0x3000
push eax
push 0
mov dword [ebp - 0x14], eax
call dword [ebp - 0x24]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x4c27e1
push 0x3e8
call dword [ebp - 0x18]
xor edx, edx
cmp dword [ebp - 0x14], edx
jbe 0x4c2498
mov edi, dword [ebp - 0x14]
lea eax, [esi + 0x100]
sub eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [edx + ebx]
mov eax, edx
mov ebx, dword [ebp - 0x30]
and eax, 0x7f
inc edx
mov al, byte [eax + esi + 0x80]
xor al, byte [ebx + ecx]
mov ebx, dword [ebp - 0x24]
mov byte [ecx], al
cmp edx, edi
jb 0x4c2476
mov edi, dword [ebp - 0x20]
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 4]
add eax, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
movzx esi, word [ecx + 0x14]
movzx ebx, word [eax + 0x14]
add esi, ecx
xor ecx, ecx
add ebx, 0x28
cmp cx, word [eax + 6]
jae 0x4c2527
add esi, 0x20
add ebx, eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [esi + 4]
push 4
push dword [esi]
add eax, edi
push eax
call dword [ebp - 8]
mov ecx, dword [ebx]
xor edx, edx
test ecx, ecx
je 0x4c24fd
nop dword [eax]
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0x24]
add eax, edx
mov ecx, dword [esi + 4]
add ecx, edx
inc edx
mov al, byte [eax + edi]
mov edi, dword [ebp - 0x20]
mov byte [ecx + edi], al
mov ecx, dword [ebx]
cmp edx, ecx
jb 0x4c24e0
cmp ecx, dword [esi]
jae 0x4c250f
mov eax, dword [esi + 4]
add eax, ecx
inc ecx
mov byte [eax + edi], 0
cmp ecx, dword [esi]
jb 0x4c2501
mov eax, dword [ebp - 0xc]
add ebx, 0x28
mov ecx, dword [ebp - 0x18]
add esi, 0x28
inc ecx
mov dword [ebp - 0x18], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jb 0x4c24c4
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x28]
push eax
push 4
movzx eax, word [ebx + 0x14]
add eax, 0x18
push eax
push ebx
call dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x78]
mov dword [ebx + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [ebx + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [ebx + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [ebx + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 0x8c]
mov dword [ebx + 0x8c], eax
mov eax, dword [esi + 0x90]
mov dword [ebx + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [ebx + 0x94], eax
mov eax, dword [esi + 0x98]
mov dword [ebx + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [ebx + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [ebx + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [ebx + 0xa4], eax
mov eax, dword [esi + 0xa8]
mov dword [ebx + 0xa8], eax
mov eax, dword [esi + 0xac]
mov dword [ebx + 0xac], eax
mov eax, dword [esi + 0xb0]
mov dword [ebx + 0xb0], eax
mov eax, dword [esi + 0xb4]
mov dword [ebx + 0xb4], eax
mov eax, dword [esi + 0xb8]
mov dword [ebx + 0xb8], eax
mov eax, dword [esi + 0xbc]
mov dword [ebx + 0xbc], eax
mov eax, dword [esi + 0xc0]
mov dword [ebx + 0xc0], eax
mov eax, dword [esi + 0xc4]
mov dword [ebx + 0xc4], eax
mov eax, dword [esi + 0xc8]
mov dword [ebx + 0xc8], eax
mov eax, dword [esi + 0xcc]
mov dword [ebx + 0xcc], eax
mov eax, dword [esi + 0xd0]
mov dword [ebx + 0xd0], eax
mov eax, dword [esi + 0xd4]
mov dword [ebx + 0xd4], eax
mov eax, dword [esi + 0xd8]
mov dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, dword [esi + 0xe0]
mov dword [ebx + 0xe0], eax
mov eax, dword [esi + 0xe4]
mov dword [ebx + 0xe4], eax
mov eax, dword [esi + 0xe8]
mov dword [ebx + 0xe8], eax
mov eax, dword [esi + 0xec]
mov dword [ebx + 0xec], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
movzx eax, word [ebx + 0x14]
add eax, 0x18
push eax
push ebx
call dword [ebp - 8]
mov eax, dword [ebx + 0x80]
lea ebx, [eax + edi]
mov dword [ebp - 0x18], ebx
test eax, eax
je 0x4c281b
cmp dword [ebx + 0xc], 0
je 0x4c281b
cmp dword [ebx + 0x10], 0
je 0x4c2818
mov eax, dword [ebx + 0xc]
add eax, edi
push eax
call dword [ebp - 0x2c]
mov ecx, eax
mov dword [ebp - 0x30], ecx
test ecx, ecx
je 0x4c2808
mov eax, dword [ebx]
test eax, eax
jne 0x4c26fb
mov eax, dword [ebx + 0x10]
mov esi, dword [ebx + 0x10]
lea ebx, [eax + edi]
add esi, edi
test ebx, ebx
je 0x4c2805
nop dword [eax + eax]
mov eax, dword [ebx]
test eax, eax
je 0x4c2805
jns 0x4c27ea
movzx eax, ax
jmp 0x4c27ef
mov edx, dword [ebp - 0x2c]
jmp 0x4c2086
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
movzx eax, word [eax]
mov esi, dword [ecx + eax*4]
add esi, edx
mov dword [ebp - 0x2c], esi
jmp 0x4c2110
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
movzx eax, word [eax]
mov ecx, dword [ecx + eax*4]
add ecx, edx
mov dword [ebp - 0x1c], ecx
jmp 0x4c217e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
movzx eax, word [eax]
mov ecx, dword [ecx + eax*4]
add ecx, edx
mov dword [ebp - 8], ecx
jmp 0x4c21ec
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
movzx eax, word [eax]
mov ecx, dword [ecx + eax*4]
add ecx, edx
mov dword [ebp - 0x24], ecx
jmp 0x4c2261
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
movzx eax, word [eax]
mov ecx, dword [ecx + eax*4]
add ecx, edx
mov dword [ebp - 0x18], ecx
jmp 0x4c232e
movzx eax, word [edi]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + eax*4]
add eax, edx
jmp 0x4c2397
mov ecx, dword [ebp - 4]
inc ebx
add dword [ebp - 0x10], 0x28
add esi, 0x28
movzx eax, word [ecx + 6]
cmp ebx, eax
jb 0x4c23c5
jmp 0x4c23ec
inc esi
cmp esi, eax
jbe 0x4c2410
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 2
add eax, edi
push eax
push ecx
call dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov dword [esi], eax
add esi, 4
add ebx, 4
jne 0x4c2710
mov ebx, dword [ebp - 0x18]
add ebx, 0x14
mov dword [ebp - 0x18], ebx
cmp dword [ebx + 0xc], 0
jne 0x4c26d2
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ebx, edi
sub ebx, dword [esi + 0x34]
mov eax, dword [edx + 0xa0]
lea ecx, [eax + edi]
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x4c28f2
cmp dword [edx + 0xa4], 0
je 0x4c28f2
mov eax, dword [ecx + 4]
lea edx, [ecx + 4]
mov dword [ebp - 0x18], edx
test eax, eax
je 0x4c28f2
mov esi, dword [ecx]
add eax, 0xfffffff8
add esi, edi
shr eax, 1
mov dword [ebp - 0x24], eax
lea eax, [ecx + 8]
mov dword [ebp - 0x2c], eax
je 0x4c28dc
nop dword [eax]
movzx edx, word [eax]
mov cx, dx
mov eax, edx
shr cx, 0xc
movzx edi, cx
cmp cx, 0xa
jne 0x4c2890
and edx, 0xfff
add dword [edx + esi], ebx
jmp 0x4c28c4
cmp edi, 3
jne 0x4c289f
and eax, 0xfff
add dword [eax + esi], ebx
jmp 0x4c28c4
cmp edi, 1
jne 0x4c28b6
and eax, 0xfff
lea ecx, [eax + esi]
mov eax, ebx
shr eax, 0x10
add word [ecx], ax
jmp 0x4c28c4
cmp edi, 2
jne 0x4c28c4
and eax, 0xfff
add word [eax + esi], bx
mov eax, dword [ebp - 0x2c]
add eax, 2
sub dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], eax
jne 0x4c2870
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add ecx, dword [edx]
mov eax, dword [ecx + 4]
lea edx, [ecx + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
test eax, eax
jne 0x4c2855
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0xc]
xor ebx, ebx
movzx esi, word [ecx + 0x14]
add esi, 0x24
cmp dx, word [eax + 6]
jae 0x4c2942
add esi, ecx
nop dword [eax + eax]
lea eax, [ebp - 0x34]
push eax
test ebx, ebx
je 0x4c2923
mov ecx, dword [esi + 0x18]
call fcn.004c2950
push eax
jmp 0x4c2925
push 0x40
mov eax, dword [esi]
push dword [esi - 4]
add eax, edi
push eax
call dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc ebx
add esi, 0x28
movzx eax, word [eax + 6]
cmp ebx, eax
jb 0x4c2910
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x28]
add eax, edi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret