Function at 0x529700
Capabilities:
Disable automatic windows recovery features
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x529976
sub esp, 8
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jne 0x52995d
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
mov ebx, edx
shr edx, 0x18
movzx ebp, byte [eax + 2]
mov esi, ebp
shr ebp, 0x10
or edx, ebp
movzx ebp, byte [eax + 3]
mov edi, ebp
shr ebp, 8
or ebp, edx
movzx edx, byte [eax + 4]
or edx, ebp
movzx ebp, byte [eax + 5]
shl ebp, 8
or edx, ebp
movzx ebp, byte [eax + 6]
shl ebp, 0x10
or edx, ebp
movzx ebp, byte [eax + 7]
shl ebp, 0x18
or edx, ebp
mov ebp, dword [esp + 0xc]
mov dword [ebp + 4], edx
shl ebx, 8
or ecx, ebx
shl esi, 0x10
or ecx, esi
shl edi, 0x18
or ecx, edi
mov dword [ebp], ecx
and edx, 0x7ffff
mov dword [ebp + 4], edx
movzx ecx, byte [eax + 7]
mov edx, ecx
shr ecx, 0x18
movzx ebx, byte [eax + 8]
mov esi, ebx
shr ebx, 0x10
or ecx, ebx
movzx ebx, byte [eax + 9]
mov edi, ebx
shr ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 0xa]
or ecx, ebx
movzx ebx, byte [eax + 0xb]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 0xc]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [eax + 0xd]
shl ecx, 0x18
or ecx, ebx
mov ebx, ecx
shr ecx, 3
movzx eax, byte [eax + 6]
mov dword [ebp + 0xc], ecx
shl edx, 8
or eax, edx
shl esi, 0x10
or eax, esi
shl edi, 0x18
or eax, edi
shr eax, 3
shl ebx, 0x1d
or ebx, eax
mov dword [ebp + 8], ebx
and ecx, 0x7ffff
mov dword [ebp + 0xc], ecx
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 0xd]
mov edx, ecx
shr ecx, 0x18
movzx ebx, byte [eax + 0xe]
mov esi, ebx
shr ebx, 0x10
or ebx, ecx
movzx ecx, byte [eax + 0xf]
mov edi, ecx
shr ecx, 8
or ecx, ebx
movzx ebx, byte [eax + 0x10]
or ebx, ecx
movzx ecx, byte [eax + 0x11]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [eax + 0x12]
shl ebx, 0x10
or ecx, ebx
movzx ebx, byte [eax + 0x13]
shl ebx, 0x18
or ecx, ebx
mov ebx, ecx
shr ecx, 6
movzx eax, byte [eax + 0xc]
mov dword [ebp + 0x14], ecx
shl edx, 8
or eax, edx
shl esi, 0x10
or eax, esi
shl edi, 0x18
or edi, eax
shr edi, 6
shl ebx, 0x1a
or ebx, edi
mov dword [ebp + 0x10], ebx
and ecx, 0x7ffff
mov dword [ebp + 0x14], ecx
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 0x14]
mov edx, ecx
shr ecx, 0x18
movzx ebx, byte [eax + 0x15]
mov esi, ebx
shr ebx, 0x10
or ebx, ecx
movzx ecx, byte [eax + 0x16]
mov edi, ecx
shr ecx, 8
or ebx, ecx
movzx ecx, byte [eax + 0x17]
or ecx, ebx
movzx ebx, byte [eax + 0x18]
shl ebx, 8
or ecx, ebx
movzx ebx, byte [eax + 0x19]
shl ebx, 0x10
or ecx, ebx
movzx ebx, byte [eax + 0x1a]
shl ebx, 0x18
or ecx, ebx
mov ebx, ecx
shr ecx, 1
movzx eax, byte [eax + 0x13]
mov dword [ebp + 0x1c], ecx
shl edx, 8
or eax, edx
shl esi, 0x10
or eax, esi
shl edi, 0x18
or edi, eax
shr edi, 1
shl ebx, 0x1f
or ebx, edi
mov dword [ebp + 0x18], ebx
and ecx, 0x7ffff
mov dword [ebp + 0x1c], ecx
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 0x19]
mov edx, ecx
shr ecx, 0x18
movzx ebx, byte [eax + 0x1a]
mov esi, ebx
shr ebx, 0x10
or ebx, ecx
movzx ecx, byte [eax + 0x1b]
mov edi, ecx
shr ecx, 8
or ebx, ecx
movzx ecx, byte [eax + 0x1c]
or ecx, ebx
movzx ebx, byte [eax + 0x1d]
shl ebx, 8
or ecx, ebx
movzx ebx, byte [eax + 0x1e]
shl ebx, 0x10
or ecx, ebx
movzx ebx, byte [eax + 0x1f]
shl ebx, 0x18
or ecx, ebx
mov ebx, ecx
shr ecx, 0xc
movzx eax, byte [eax + 0x18]
mov dword [ebp + 0x24], ecx
shl edx, 8
or eax, edx
shl esi, 0x10
or eax, esi
shl edi, 0x18
or edi, eax
shr edi, 0xc
shl ebx, 0x14
or ebx, edi
mov dword [ebp + 0x20], ebx
and ecx, 0x7ffff
mov dword [ebp + 0x24], ecx
mov dword [esp + 0x1c], ebp
add esp, 8
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a3d4]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00529700