Function at 0x501d40
Capabilities:
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5719e6
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
test byte [0x685e98], 1
jne 0x5026f0
or dword [0x685e98], 1
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x54], ebx
call fcn.00500ba0
add esp, 4
push 0x685a18
mov ecx, eax
mov byte [esp + 0x54], 1
call fcn.004d6ce0
mov eax, str.000000000000000000000000000000000000000001
mov edi, 0xa3
mov ebp, 7
mov esi, 2
mov dword [0x685a30], edi
mov dword [0x685a34], ebp
mov dword [0x685a38], 6
mov dword [0x685a3c], 3
mov dword [0x685a40], ebx
mov dword [0x685a44], eax
mov dword [0x685a48], eax
mov dword [0x685a4c], 0x627370
mov dword [0x685a50], 0x6273c8
mov dword [0x685a54], esi
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x54], 3
call fcn.004d6d30
lea edx, [esp + 0x30]
push edx
call fcn.00500c20
add esp, 4
push 0x685a58
mov ecx, eax
mov byte [esp + 0x54], 4
call fcn.004d6ce0
mov dword [0x685a70], edi
mov dword [0x685a74], ebp
mov dword [0x685a78], 6
mov dword [0x685a7c], 3
mov dword [0x685a80], ebx
mov dword [0x685a84], 0x627264
mov dword [0x685a88], 0x627290
mov dword [0x685a8c], 0x6272c0
mov dword [0x685a90], 0x627318
mov dword [0x685a94], esi
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x54], 6
call fcn.004d6d30
lea ecx, [esp + 0x18]
push ecx
call fcn.00500ca0
add esp, 4
push 0x685a98
mov ecx, eax
mov byte [esp + 0x54], 7
call fcn.004d6ce0
mov edi, 4
mov dword [0x685ab0], ebx
mov dword [0x685ab4], ebx
mov dword [0x685ab8], 0xef
mov dword [0x685abc], 0x9e
mov dword [0x685ac0], ebx
mov dword [0x685ac4], 0x627124
mov dword [0x685ac8], 0x627164
mov dword [0x685acc], 0x6271a8
mov dword [0x685ad0], 0x627224
mov dword [0x685ad4], edi
mov byte [esp + 0x50], 9
lea edx, [esp + 0x18]
push edx
call fcn.004d6d30
lea eax, [esp + 0x30]
push eax
call fcn.004d7d90
add esp, 4
push 0x685ad8
mov ecx, eax
mov byte [esp + 0x54], 0xa
call fcn.004d6ce0
mov dword [0x685af0], ebx
mov dword [0x685af4], ebx
mov dword [0x685af8], 0x71
mov dword [0x685afc], 9
mov dword [0x685b00], ebx
mov dword [0x685b04], 0x627084
mov dword [0x685b08], 0x6270a4
mov dword [0x685b0c], 0x6270c4
mov dword [0x685b10], 0x627104
mov dword [0x685b14], esi
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x54], 0xc
call fcn.004d6d30
lea edx, [esp + 0x18]
push edx
call fcn.00500d20
add esp, 4
push 0x685b18
mov ecx, eax
mov byte [esp + 0x54], 0xd
call fcn.004d6ce0
mov dword [0x685b30], ebx
mov dword [0x685b34], ebx
mov dword [0x685b38], 0x71
mov dword [0x685b3c], 9
mov dword [0x685b40], ebx
mov dword [0x685b44], 0x626fe4
mov dword [0x685b48], 0x627004
mov dword [0x685b4c], 0x627024
mov dword [0x685b50], 0x627064
mov dword [0x685b54], esi
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x54], 0xf
call fcn.004d6d30
lea ecx, [esp + 0x30]
push ecx
call fcn.00500da0
add esp, 4
push 0x685b58
mov ecx, eax
mov byte [esp + 0x54], 0x10
call fcn.004d6ce0
mov dword [0x685b70], 0xa3
mov dword [0x685b74], ebp
mov dword [0x685b78], 6
mov dword [0x685b7c], 3
mov dword [0x685b80], ebx
mov dword [0x685b84], 0x627344
mov dword [0x685b88], 0x626f34
mov dword [0x685b8c], 0x626f60
mov dword [0x685b90], 0x626fb8
mov dword [0x685b94], esi
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x54], 0x12
call fcn.004d6d30
lea eax, [esp + 0x18]
push eax
call fcn.00500e20
add esp, 4
push 0x685b98
mov ecx, eax
mov byte [esp + 0x54], 0x13
call fcn.004d6ce0
mov dword [0x685bb0], 0x11b
mov dword [0x685bb4], 0xc
mov dword [0x685bb8], ebp
mov dword [0x685bbc], 5
mov dword [0x685bc0], ebx
mov dword [0x685bc4], 0x626db0
mov dword [0x685bc8], 0x626e00
mov dword [0x685bcc], 0x626e50
mov dword [0x685bd0], 0x626ee8
mov dword [0x685bd4], edi
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x54], 0x15
call fcn.004d6d30
lea edx, [esp + 0x30]
push edx
call fcn.00500ea0
add esp, 4
push 0x685bd8
mov ecx, eax
mov byte [esp + 0x54], 0x16
call fcn.004d6ce0
mov dword [0x685bf8], ebp
mov ebp, 5
mov dword [0x685bf0], 0x11b
mov dword [0x685bf4], 0xc
mov dword [0x685bfc], ebp
mov dword [0x685c00], ebx
mov dword [0x685c04], 0x626e00
mov dword [0x685c08], 0x626c78
mov dword [0x685c0c], 0x626cc8
mov dword [0x685c10], 0x626d60
mov dword [0x685c14], esi
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x54], 0x18
call fcn.004d6d30
lea ecx, [esp + 0x18]
push ecx
call fcn.00500f20
add esp, 4
push 0x685c18
mov ecx, eax
mov byte [esp + 0x54], 0x19
call fcn.004d6ce0
mov dword [0x685c30], 0x83
mov dword [0x685c34], 8
mov dword [0x685c38], 3
mov dword [0x685c3c], esi
mov dword [0x685c40], ebx
mov dword [0x685c44], 0x626bbc
mov dword [0x685c48], 0x626be0
mov dword [0x685c4c], 0x626c08
mov dword [0x685c50], 0x626c50
mov dword [0x685c54], esi
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x54], 0x1b
call fcn.004d6d30
lea eax, [esp + 0x30]
push eax
call fcn.00500fa0
add esp, 4
mov byte [esp + 0x50], 0x1c
push 0x685c58
mov ecx, eax
call fcn.004d6ce0
mov dword [0x685c70], 0x83
mov dword [0x685c74], 8
mov dword [0x685c78], 3
mov dword [0x685c7c], esi
mov dword [0x685c80], ebx
mov dword [0x685c84], 0x626b04
mov dword [0x685c88], 0x626b28
mov dword [0x685c8c], 0x626b50
mov dword [0x685c90], 0x626b98
mov dword [0x685c94], esi
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x54], 0x1e
call fcn.004d6d30
lea edx, [esp + 0x18]
push edx
call fcn.00501020
add esp, 4
push 0x685c98
mov ecx, eax
mov byte [esp + 0x54], 0x1f
call fcn.004d6ce0
mov dword [0x685cb0], ebx
mov dword [0x685cb4], ebx
mov dword [0x685cb8], 0xc1
mov dword [0x685cbc], 0xf
mov dword [0x685cc0], ebx
mov dword [0x685cc4], 0x6269fc
mov dword [0x685cc8], 0x626a30
mov dword [0x685ccc], 0x626a68
mov dword [0x685cd0], 0x626ad0
mov dword [0x685cd4], esi
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x54], 0x21
call fcn.004d6d30
lea ecx, [esp + 0x30]
push ecx
call fcn.005010a0
add esp, 4
push 0x685cd8
mov ecx, eax
mov byte [esp + 0x54], 0x22
call fcn.004d6ce0
mov dword [0x685cf0], ebx
mov dword [0x685cf4], ebx
mov dword [0x685cf8], 0xc1
mov dword [0x685cfc], 0xf
mov dword [0x685d00], ebx
mov dword [0x685d04], 0x6268f8
mov dword [0x685d08], 0x62692c
mov dword [0x685d0c], 0x626960
mov dword [0x685d10], 0x6269c8
mov dword [0x685d14], esi
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x54], 0x24
call fcn.004d6d30
lea eax, [esp + 0x18]
push eax
call fcn.00501120
add esp, 4
push 0x685d18
mov ecx, eax
mov byte [esp + 0x54], 0x25
call fcn.004d6ce0
mov dword [0x685d30], ebx
mov dword [0x685d34], ebx
mov dword [0x685d38], 0xe9
mov dword [0x685d3c], 0x4a
mov dword [0x685d40], ebx
mov dword [0x685d44], 0x627124
mov dword [0x685d48], 0x627164
mov dword [0x685d4c], 0x626840
mov dword [0x685d50], 0x6268bc
mov dword [0x685d54], edi
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x54], 0x27
call fcn.004d6d30
lea edx, [esp + 0x30]
push edx
call fcn.005011a0
add esp, 4
push 0x685d58
mov ecx, eax
mov byte [esp + 0x54], 0x28
call fcn.004d6ce0
mov dword [0x685d70], ebx
mov dword [0x685d74], ebx
mov dword [0x685d78], 0xe9
mov dword [0x685d7c], 0x4a
mov dword [0x685d80], ebx
mov dword [0x685d84], 0x627164
mov dword [0x685d88], 0x626740
mov dword [0x685d8c], 0x626780
mov dword [0x685d90], 0x6267fc
mov dword [0x685d94], esi
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x54], 0x2a
call fcn.004d6d30
lea ecx, [esp + 0x18]
push ecx
call fcn.00501220
add esp, 4
push 0x685d98
mov ecx, eax
mov byte [esp + 0x54], 0x2b
call fcn.004d6ce0
mov dword [0x685db0], ebx
mov dword [0x685db4], ebx
mov dword [0x685db8], 0x199
mov dword [0x685dbc], 0x57
mov dword [0x685dc0], ebx
mov dword [0x685dc4], 0x626520
mov dword [0x685dc8], 0x626590
mov dword [0x685dcc], 0x626600
mov dword [0x685dd0], 0x6266d8
mov dword [0x685dd4], edi
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x54], 0x2d
call fcn.004d6d30
lea eax, [esp + 0x30]
push eax
call fcn.005012a0
add esp, 4
push 0x685dd8
mov ecx, eax
mov byte [esp + 0x54], 0x2e
call fcn.004d6ce0
mov dword [0x685df0], ebx
mov dword [0x685df4], ebx
mov dword [0x685df8], 0x199
mov dword [0x685dfc], 0x57
mov dword [0x685e00], ebx
mov dword [0x685e04], 0x626590
mov dword [0x685e08], 0x626368
mov dword [0x685e0c], 0x6263d8
mov dword [0x685e10], 0x6264b0
mov dword [0x685e14], esi
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x54], 0x30
call fcn.004d6d30
lea edx, [esp + 0x18]
push edx
call fcn.00501320
add esp, 4
push 0x685e18
mov ecx, eax
mov byte [esp + 0x54], 0x31
call fcn.004d6ce0
mov dword [0x685e30], 0x23b
mov dword [0x685e34], 0xa
mov dword [0x685e38], ebp
mov dword [0x685e3c], esi
mov dword [0x685e40], ebx
mov dword [0x685e44], 0x626078
mov dword [0x685e48], 0x626110
mov dword [0x685e4c], 0x6261a8
mov dword [0x685e50], 0x6262d0
mov dword [0x685e54], edi
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x54], 0x33
call fcn.004d6d30
lea ecx, [esp + 0x30]
push ecx
call fcn.005013a0
add esp, 4
push 0x685e58
mov ecx, eax
mov byte [esp + 0x54], 0x34
call fcn.004d6ce0
mov dword [0x685e70], 0x23b
mov dword [0x685e74], 0xa
mov dword [0x685e78], ebp
mov dword [0x685e7c], esi
mov dword [0x685e80], ebx
mov dword [0x685e84], 0x626110
mov dword [0x685e88], 0x625e20
mov dword [0x685e8c], 0x625eb8
mov dword [0x685e90], 0x625fe0
mov dword [0x685e94], esi
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x54], 0x36
call fcn.004d6d30
push 0x577820
mov byte [esp + 0x54], bl
call fcn.0054f10e
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [eax], 0x685a18
add esp, 4
mov dword [ecx], 0x685e98
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov dword [edx], 0x685a18
mov dword [eax], 0x685e98
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret