Function at 0x5851fc
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, eax
mov esi, edx
mov eax, dword [eax]
test eax, eax
je 0x5811eb
mov dword [esp], eax
call fcn.0058100c
mov eax, dword [ebx + 0x30]
lea edx, [ebx + 0x38]
cmp eax, edx
je 0x5811fd
mov dword [esp], eax
call fcn.004edc48
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x581209
call fcn.005810ec
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x581217
mov eax, ebx
call fcn.0057f0a8
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x581229
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00581190
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x58123b
mov dword [esp], eax
call fcn.004edc48
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x58124d
mov dword [esp], eax
call fcn.004edc48
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x581262
mov edx, dword [ebx + 0x8c]
call fcn.0057f108
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x581275
mov dword [ebx + 0x14], esi
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], edx
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], 0x90
mov dword [esp], 0x67c3a4
call fcn.00508278
mov ebx, eax
test ebp, 0x2000
je 0x5857dc
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5857cc
test edi, edi
je 0x5857cc
test ebp, 4
jne 0x5857c0
mov eax, ebp
and eax, 3
cmp eax, 2
je 0x5857cc
mov eax, dword [esp + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], edi
mov edx, dword [esp + 0x18]
lea eax, [edi + edx*2]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x2c], 0
lea edx, [ebx + 0x38]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], 0xa
xor eax, eax
jmp 0x5852bb
mov edx, dword [ebx + 0x30]
mov dword [edx + eax], 0
add eax, 4
cmp eax, 0x28
jne 0x5852b8
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov word [ebx + 0x68], 0xffff
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov eax, dword [esp + 0x14]
mov dword [eax], 0xfed7
mov dword [eax + 8], 0
mov dword [eax + 0xc], 2
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0x5e15e0
mov dword [esp], 0x928
call fcn.004edaf0
mov ebp, eax
mov edx, dword [esp + 0x14]
mov dword [edx + 0x14], eax
test eax, eax
je 0x585984
mov dword [eax + 0x10], 0
lea edx, [eax + 0x3c]
mov dword [eax + 0x3c], 0x876
mov dword [eax + 0x40], ebx
mov dword [eax + 0x44], 0xa
lea eax, [eax + 0x54]
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x48], 0
mov word [ebp + 0x4c], 0
mov word [ebp + 0x58], 0xffff
mov dword [ebp + 0x5c], 0
mov dword [ebp + 0x60], 0
mov dword [ebp + 0x54], 0x10000
lea edi, [ebp + 0x11c]
lea ecx, [ebp + 0x51c]
mov eax, 0xff
nop
mov dword [edi + eax*4], ecx
dec eax
cmp eax, 0xffffffff
jne 0x5853c0
mov eax, 0xff
lea edi, [edx + 0x4e0]
mov word [edi + eax*2], 0
dec eax
cmp eax, 0xffffffff
jne 0x5853d4
mov dword [ebp + 0x64], ecx
mov dword [ebx + 0x64], edx
mov dword [ebp + 0x920], 0
mov dword [ebp + 0x924], 0
mov dword [ebp + 0x14], 0
xor ecx, ecx
mov eax, ebx
call fcn.00583814
mov dword [ebx + 0x60], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
mov edx, 0x14
mov eax, 0x64
call fcn.0057efb8
mov dword [ebx + 0x80], eax
test eax, eax
je 0x585984
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x585804
mov edi, dword [ebx + 8]
mov edx, dword [ebx + 4]
mov ecx, edi
sub ecx, edx
cmp ecx, 7
jle 0x5857f8
cmp word [edx], 0x2a
jne 0x5857f8
cmp word [edx + 2], 0x2a
jne 0x5857f8
cmp word [edx + 4], 0x2a
jne 0x5857f8
mov cx, word [edx + 6]
cmp cx, 0x3d
je 0x585a1c
cmp cx, 0x3f
je 0x5859fe
cmp cx, 0x3a
je 0x5857e3
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x5854aa
mov dword [ebx + 0x14], 0xd
test byte [ebx + 0x18], 0xc0
jne 0x58598e
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
mov eax, dword [ebx + 0x60]
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
mov dword [esp], eax
mov ecx, 0x70
mov edx, 0x65
mov eax, ebx
call fcn.00584ff0
mov dword [ebx + 0x70], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
mov eax, dword [ebx + 0x60]
call fcn.0058340c
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
test esi, esi
je 0x5859b9
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_RAW__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.005837c8
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.0057ee04
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.0057ee30
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00581190
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_TREE_FIXED__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.005837c8
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 8]
mov edx, dword [ebx + 0x70]
mov ecx, esi
mov eax, ebx
call fcn.00583a38
or eax, edi
mov edx, dword [esp + 0x14]
mov dword [edx + 8], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
cmp dword [ebx + 0x8c], 1
jle 0x58560c
mov dword [esp + 0x18], 0x44
mov edi, 1
mov dword [esp + 0x1c], ebp
mov ebp, 0x44
nop
test esi, esi
je 0x5855e0
mov dword [esp + 8], edi
mov dword [esp + 4], str._n_n_n_LA_d__n
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov edx, dword [ebx + 0x88]
add edx, ebp
mov ecx, esi
mov eax, ebx
call fcn.00583988
inc edi
add ebp, 0x44
cmp dword [ebx + 0x8c], edi
jg 0x5855c8
mov ebp, dword [esp + 0x1c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
mov eax, dword [ebx + 0x70]
test byte [eax + 1], 2
je 0x58561e
mov eax, dword [ebx]
or dword [eax + 8], 0x2000
test esi, esi
je 0x585642
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_SEARCH__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x60]
mov edx, esi
call fcn.00580638
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
mov edi, dword [eax]
mov esi, dword [edi + 0x14]
test esi, esi
je 0x585852
mov ecx, dword [eax + 0x24]
mov eax, esi
mov dword [esp + 0x1c], esi
jmp 0x585683
mov eax, dword [eax + 0x10]
test eax, eax
je 0x5859e1
mov edx, dword [eax + 4]
cmp cx, dx
je 0x585678
mov esi, dword [esp + 0x18]
cmp dx, word [esi + 0x26]
je 0x585678
mov edx, dword [ebx + 0x64]
mov dword [esp + 4], edi
mov dword [esp], edi
mov ecx, 0xffffffff
mov eax, dword [esp + 0x18]
call fcn.005834b8
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x24]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.0057fe80
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x26]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.0057fe80
mov esi, dword [edi + 0x14]
test esi, esi
je 0x585840
mov dword [esp + 0x24], 0
xor ecx, ecx
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0xc]
test eax, eax
jne 0x585707
jmp 0x585717
mov eax, dword [eax + 0x14]
test eax, eax
je 0x585717
cmp edi, dword [eax + 8]
je 0x585700
mov eax, dword [edx + 0x1c]
test eax, eax
je 0x5859af
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x5856f4
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x585840
mov eax, dword [esp + 0x18]
add eax, 0x34
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
add edx, 0x20
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x18]
call fcn.0057fd60
mov ebp, eax
mov esi, dword [esp + 0x24]
mov edx, dword [esi + 0x14]
mov ecx, eax
mov eax, dword [esp + 0x18]
call fcn.00580560
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x5857a1
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 8]
cmp edi, eax
je 0x58579b
movsx ecx, word [ebx + 4]
mov dword [esp + 4], ebp
mov dword [esp], eax
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
call fcn.0057fe80
mov ecx, ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
call fcn.0057f8f8
mov ebx, esi
test esi, esi
jne 0x58576c
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x1c], 0
test eax, eax
je 0x585838
mov dword [esp + 0x24], eax
jmp 0x585748
test ebp, 0xe3
je 0x585266
mov eax, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x585246
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
or eax, 3
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
and eax, 3
cmp eax, 3
je 0x5858f2
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x5854aa
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x5858e6
and eax, 1
neg eax
add eax, 2
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x20], 0x6e
mov eax, ebx
call fcn.00581864
jmp 0x5854aa
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
lea edx, [ebp + 0x14]
mov eax, dword [esp + 0x18]
call fcn.0057f1bc
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x5858d8
mov edx, dword [ebx + 0x2c]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], edx
mov dword [ebx], 0
mov dword [ebp], 0xfed9
mov eax, dword [ebx + 0x18]
mov dword [ebp + 4], eax
mov ecx, dword [esi + 8]
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov edx, dword [ebx + 0x70]
mov dword [ebp + 0x10], edx
mov dword [ebx + 0x70], 0
mov edx, dword [ebx + 0x7c]
mov dword [ebp + 0x38], edx
test al, 8
je 0x5859ea
mov eax, 0x57f580
mov dword [ebp + 0x91c], eax
mov eax, dword [ebx + 0x88]
mov dword [ebp + 0x920], eax
mov dword [ebx + 0x88], 0
mov eax, dword [ebx + 0x8c]
mov dword [ebp + 0x924], eax
xor edx, edx
lea esi, [esi]
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x5811d4
mov dword [ebx + 0x28], 3
jmp 0x585825
mov eax, dword [ebx + 4]
sub edi, eax
cmp edi, 5
jle 0x585804
cmp word [eax], 0x28
jne 0x585804
cmp word [eax + 2], 0x3f
jne 0x585804
movzx eax, word [eax + 4]
mov dword [esp], eax
call fcn.0050c8dc
test eax, eax
je 0x585804
mov eax, dword [ebx]
or dword [eax + 8], 0x80
mov eax, dword [ebx + 4]
add eax, 4
mov dword [ebx + 4], eax
cmp dword [ebx + 8], eax
jbe case.0x5859f7.2
movzx eax, word [eax]
mov dword [esp], eax
call fcn.0050c8dc
test eax, eax
je 0x585a38
mov edx, dword [ebx + 4]
mov ax, word [edx]
sub eax, 0x62
cmp ax, 0x16
jbe 0x5859f4
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x5854aa
mov dword [ebx + 0x14], 0x12
jmp 0x5854aa
mov edx, 0xc
jmp 0x5858d8
mov eax, dword [ebx + 0x64]
mov edx, 0xa
call fcn.0057f7c0
mov word [ebx + 0x68], ax
mov edx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x60]
call fcn.00580114
jmp 0x5854b4
mov dword [edx + 0x1c], ecx
mov ecx, edx
jmp 0x585717
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.0057ee04
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.0057ee30
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00581190
jmp 0x585580
mov esi, dword [esp + 0x1c]
jmp 0x5856ea
mov eax, 0x57f8ec
jmp 0x5858ab
movzx eax, ax
jmp dword [eax*4 + 0x61db24]
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x5854aa
mov dword [ebx + 0x14], 2
jmp 0x5854aa
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
and al, 0x1c
or eax, 4
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
jmp 0x585804
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jae case.0x5859f7.2
cmp word [eax], 0x29
jne case.0x5859f7.2
add eax, 2
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
test al, 4
je 0x585804
and al, 0x1f
mov dword [ebx + 0x18], eax
jmp 0x585804
or dword [ebx + 0x18], 0x20
lea eax, [edx + 2]
mov dword [ebx + 4], eax
cmp eax, dword [ebx + 8]
jb 0x585940
jmp case.0x5859f7.2
mov eax, dword [ebx + 0x18]
and eax, 0xffffffbf
or al, 0x80
mov dword [ebx + 0x18], eax
jmp 0x585a6d
and dword [ebx + 0x18], 0xffffffdf
jmp 0x585a6d
and dword [ebx + 0x18], 0xffffff3f
jmp 0x585a6d
mov eax, dword [ebx + 0x18]
and eax, 0xfffffffc
or eax, 4
mov dword [ebx + 0x18], eax
jmp 0x585a6d
mov eax, dword [ebx + 0x18]
and al, 0x7f
or eax, 0x40
mov dword [ebx + 0x18], eax
jmp 0x585a6d
or dword [ebx + 0x18], 0xc0
jmp 0x585a6d
or dword [ebx + 0x18], 8
jmp 0x585a6d
mov eax, dword [ebx + 0x18]
and eax, 0xfffffff9
or eax, 1
mov dword [ebx + 0x18], eax
jmp 0x585a6d
and dword [ebx + 0x18], 0xfffffff7
jmp 0x585a6d
and dword [ebx + 0x18], 0xfffffff8
jmp 0x585a6d