Function at 0x6d5324d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
push ebp
mov ebp, dword [esp + 0x38]
cmp ebp, dword [0x6d535018]
jae 0x6d5328db
mov eax, dword [0x6d535020]
mov ebx, dword [eax + ebp*4]
test ebx, ebx
je 0x6d5328db
mov dword [esp + 0x10], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov eax, dword [esp + 0x3c]
xor ecx, ecx
mov cl, byte [eax + 8]
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x6d53251f
cmp ecx, dword [0x6d53500c]
jbe 0x6d532541
cmp dword [esp + 0x18], 0x80
jbe 0x6d53288a
mov eax, dword [0x6d53500c]
add eax, 0x80
cmp eax, dword [esp + 0x18]
jb 0x6d53288a
mov eax, dword [esp + 0x18]
xor ecx, ecx
and eax, 0x7f
mov cl, byte [eax + 0x6d535050]
mov eax, ecx
mov dword [esp + 0x2c], ecx
shl eax, 6
add eax, ebx
mov dword [esp + 0x28], eax
add eax, 0x16c
mov dword [esp + 0x1c], eax
cmp dword [eax], 0xffffffff
jne 0x6d5325a6
cmp dword [0x6d537df0], 0xffffffff
je 0x6d532599
lea ecx, [ecx + ecx*2]
mov edx, dword [ecx*4 + 0x6d5350d4]
push edx
push ebp
push 0x496
push 0x6d5370c0
push 0x6d5379e8
call fcn.6d533090
add esp, 0x14
mov dword [esp + 0x10], 0x1109
jmp 0x6d5328b8
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
mov cx, word [eax]
mov edi, edx
mov eax, ecx
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
lea eax, [edx + edx*2]
mov edx, dword [esp + 0x14]
shl eax, 2
mov dword [esp + 0x20], eax
sub cl, byte [eax + 0x6d5350d0]
mov eax, dword [esp + 0x3c]
mov byte [edx + 8], cl
mov ax, word [eax + 4]
and eax, 0xffff
cmp eax, 0x8304
jg 0x6d532623
je 0x6d532669
cmp eax, 0x8086
je 0x6d532636
jmp 0x6d53271a
cmp eax, 0x8384
je 0x6d532680
cmp eax, 0x8386
je 0x6d532697
jmp 0x6d53271a
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dx, word [eax + 0x10]
test edx, edx
je 0x6d53271a
mov edi, dword [esp + 0x14]
mov esi, dword [eax + 0xc]
add edi, 0x16
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [esp + 0x24], edx
jmp 0x6d53271a
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 8]
push eax
push ebx
push ebp
call fcn.6d5323e0
add esp, 0xc
jmp 0x6d53271a
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 8]
push eax
push ebx
push ebp
call fcn.6d5323e0
add esp, 0xc
jmp 0x6d53271a
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
mov si, word [eax + 0xc]
mov ecx, dword [ebx + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, esi
mov eax, dword [ebx + 0x24]
and ecx, 0xffff
mov esi, dword [eax + ecx*4]
cmp dword [esi + 4], 0
jne 0x6d5326f4
cmp dword [0x6d537df0], 0xffffffff
je 0x6d532704
xor eax, eax
mov edx, dword [esp + 0x14]
mov ax, word [esi + 2]
xor ecx, ecx
mov cx, word [edx + 0xc]
push eax
push ecx
push ebp
push 0x4b4
push 0x6d5370c0
push 0x6d537990
call fcn.6d533090
add esp, 0x18
jmp 0x6d532704
mov dword [esi + 4], 0
mov eax, dword [ebx + 0x18]
mov word [esi], ax
mov dword [ebx + 0x18], ecx
mov ax, word [esi + 2]
mov edx, dword [esp + 0x14]
mov word [edx + 0xc], ax
mov ecx, dword [ebx + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
cmp dword [ebx + 8], 0
jne 0x6d53272d
mov dword [esp + 0x10], 0x1108
jmp 0x6d532877
xor esi, esi
mov eax, dword [esp + 0x1c]
add eax, 8
lea ecx, [esp + 0x30]
mov edx, dword [esp + 0x24]
push eax
mov dword [esp + 0x34], esi
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
push eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x6d532769
call edi
mov esi, eax
cmp esi, 0x3e5
jne 0x6d532826
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [ebx + 8], 0
jne 0x6d532798
mov dword [esp + 0x10], 0x1108
jmp 0x6d532877
cmp eax, 0xffffffff
jne 0x6d5327ce
cmp dword [0x6d537df0], 0xffffffff
je 0x6d5327c1
call edi
push eax
push ebp
push 0x4e8
push 0x6d5370c0
push 0x6d53794c
call fcn.6d533090
add esp, 0x14
mov dword [esp + 0x10], 0x1108
jmp 0x6d532877
lea eax, [esp + 0x30]
push 0
mov ecx, dword [esp + 0x30]
push eax
mov edx, dword [esp + 0x24]
push ecx
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
test eax, eax
jne 0x6d532877
call edi
cmp dword [0x6d537df0], 0xffffffff
mov esi, eax
je 0x6d532820
mov eax, dword [esp + 0x20]
push esi
mov ecx, dword [eax + 0x6d5350d4]
push ecx
push ebp
push 0x4f2
push 0x6d5370c0
push 0x6d537908
call fcn.6d533090
add esp, 0x18
test esi, esi
jne 0x6d532865
jmp 0x6d53285b
test esi, esi
je 0x6d532877
cmp dword [0x6d537df0], 0xffffffff
je 0x6d532857
mov eax, dword [esp + 0x20]
push esi
mov ecx, dword [eax + 0x6d5350d4]
push ecx
push ebp
push 0x4fb
push 0x6d5370c0
push 0x6d537908
call fcn.6d533090
add esp, 0x18
test esi, esi
jne 0x6d532865
mov dword [esp + 0x10], 0
jmp 0x6d532877
push 0x6d537050
push esi
call section..Upack
mov dword [esp + 0x18], eax
add esp, 8
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x170]
push ecx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
jmp 0x6d5328b8
cmp dword [0x6d537df0], 0xffffffff
je 0x6d5328b0
mov eax, dword [esp + 0x18]
push eax
push ebp
push 0x48c
push 0x6d5370c0
push 0x6d537a28
call fcn.6d533090
add esp, 0x14
mov dword [esp + 0x10], 0x1108
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jge 0x6d5328cd
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
cmp dword [0x6d537df0], 0xffffffff
je 0x6d5328fc
push ebp
push 0x480
push 0x6d5370c0
push 0x6d537a68
call fcn.6d533090
add esp, 0x10
mov eax, 0x1101
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8