Function at 0x5878fc
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, eax
mov esi, edx
mov eax, dword [eax]
test eax, eax
je 0x5838eb
mov dword [esp], eax
call fcn.0058370c
mov eax, dword [ebx + 0x30]
lea edx, [ebx + 0x38]
cmp eax, edx
je 0x5838fd
mov dword [esp], eax
call fcn.004ee144
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x583909
call fcn.005837ec
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x583917
mov eax, ebx
call fcn.005817a8
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x583929
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00583890
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x58393b
mov dword [esp], eax
call fcn.004ee144
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x58394d
mov dword [esp], eax
call fcn.004ee144
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x583962
mov edx, dword [ebx + 0x8c]
call fcn.00581808
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x583975
mov dword [ebx + 0x14], esi
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], edx
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], 0x90
mov dword [esp], 0x68c9f4
call fcn.00509044
mov ebx, eax
test ebp, 0x2000
je 0x587edc
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x587ecc
test edi, edi
je 0x587ecc
test ebp, 4
jne 0x587ec0
mov eax, ebp
and eax, 3
cmp eax, 2
je 0x587ecc
mov eax, dword [esp + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], edi
mov edx, dword [esp + 0x18]
lea eax, [edi + edx*2]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x2c], 0
lea edx, [ebx + 0x38]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], 0xa
xor eax, eax
jmp 0x5879bb
mov edx, dword [ebx + 0x30]
mov dword [edx + eax], 0
add eax, 4
cmp eax, 0x28
jne 0x5879b8
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov word [ebx + 0x68], 0xffff
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov eax, dword [esp + 0x14]
mov dword [eax], 0xfed7
mov dword [eax + 8], 0
mov dword [eax + 0xc], 2
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0x5f2360
mov dword [esp], 0x928
call fcn.004edfec
mov ebp, eax
mov edx, dword [esp + 0x14]
mov dword [edx + 0x14], eax
test eax, eax
je 0x588084
mov dword [eax + 0x10], 0
lea edx, [eax + 0x3c]
mov dword [eax + 0x3c], 0x876
mov dword [eax + 0x40], ebx
mov dword [eax + 0x44], 0xa
lea eax, [eax + 0x54]
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x48], 0
mov word [ebp + 0x4c], 0
mov word [ebp + 0x58], 0xffff
mov dword [ebp + 0x5c], 0
mov dword [ebp + 0x60], 0
mov dword [ebp + 0x54], 0x10000
lea edi, [ebp + 0x11c]
lea ecx, [ebp + 0x51c]
mov eax, 0xff
nop
mov dword [edi + eax*4], ecx
dec eax
cmp eax, 0xffffffff
jne 0x587ac0
mov eax, 0xff
lea edi, [edx + 0x4e0]
mov word [edi + eax*2], 0
dec eax
cmp eax, 0xffffffff
jne 0x587ad4
mov dword [ebp + 0x64], ecx
mov dword [ebx + 0x64], edx
mov dword [ebp + 0x920], 0
mov dword [ebp + 0x924], 0
mov dword [ebp + 0x14], 0
xor ecx, ecx
mov eax, ebx
call fcn.00585f14
mov dword [ebx + 0x60], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov edx, 0x14
mov eax, 0x64
call fcn.005816b8
mov dword [ebx + 0x80], eax
test eax, eax
je 0x588084
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x587f04
mov edi, dword [ebx + 8]
mov edx, dword [ebx + 4]
mov ecx, edi
sub ecx, edx
cmp ecx, 7
jle 0x587ef8
cmp word [edx], 0x2a
jne 0x587ef8
cmp word [edx + 2], 0x2a
jne 0x587ef8
cmp word [edx + 4], 0x2a
jne 0x587ef8
mov cx, word [edx + 6]
cmp cx, 0x3d
je 0x58811c
cmp cx, 0x3f
je 0x5880fe
cmp cx, 0x3a
je 0x587ee3
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov dword [ebx + 0x14], 0xd
test byte [ebx + 0x18], 0xc0
jne 0x58808e
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
mov dword [esp], eax
mov ecx, 0x70
mov edx, 0x65
mov eax, ebx
call fcn.005876f0
mov dword [ebx + 0x70], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
call fcn.00585b0c
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
test esi, esi
je 0x5880b9
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_RAW__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.00585ec8
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.00581504
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.00581530
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00583890
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_TREE_FIXED__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.00585ec8
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 8]
mov edx, dword [ebx + 0x70]
mov ecx, esi
mov eax, ebx
call fcn.00586138
or eax, edi
mov edx, dword [esp + 0x14]
mov dword [edx + 8], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
cmp dword [ebx + 0x8c], 1
jle 0x587d0c
mov dword [esp + 0x18], 0x44
mov edi, 1
mov dword [esp + 0x1c], ebp
mov ebp, 0x44
nop
test esi, esi
je 0x587ce0
mov dword [esp + 8], edi
mov dword [esp + 4], str._n_n_n_LA_d__n
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov edx, dword [ebx + 0x88]
add edx, ebp
mov ecx, esi
mov eax, ebx
call fcn.00586088
inc edi
add ebp, 0x44
cmp dword [ebx + 0x8c], edi
jg 0x587cc8
mov ebp, dword [esp + 0x1c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x70]
test byte [eax + 1], 2
je 0x587d1e
mov eax, dword [ebx]
or dword [eax + 8], 0x2000
test esi, esi
je 0x587d42
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_SEARCH__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x60]
mov edx, esi
call fcn.00582d38
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
mov edi, dword [eax]
mov esi, dword [edi + 0x14]
test esi, esi
je 0x587f52
mov ecx, dword [eax + 0x24]
mov eax, esi
mov dword [esp + 0x1c], esi
jmp 0x587d83
mov eax, dword [eax + 0x10]
test eax, eax
je 0x5880e1
mov edx, dword [eax + 4]
cmp cx, dx
je 0x587d78
mov esi, dword [esp + 0x18]
cmp dx, word [esi + 0x26]
je 0x587d78
mov edx, dword [ebx + 0x64]
mov dword [esp + 4], edi
mov dword [esp], edi
mov ecx, 0xffffffff
mov eax, dword [esp + 0x18]
call fcn.00585bb8
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x24]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.00582580
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x26]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.00582580
mov esi, dword [edi + 0x14]
test esi, esi
je 0x587f40
mov dword [esp + 0x24], 0
xor ecx, ecx
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0xc]
test eax, eax
jne 0x587e07
jmp 0x587e17
mov eax, dword [eax + 0x14]
test eax, eax
je 0x587e17
cmp edi, dword [eax + 8]
je 0x587e00
mov eax, dword [edx + 0x1c]
test eax, eax
je 0x5880af
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x587df4
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x587f40
mov eax, dword [esp + 0x18]
add eax, 0x34
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
add edx, 0x20
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x18]
call fcn.00582460
mov ebp, eax
mov esi, dword [esp + 0x24]
mov edx, dword [esi + 0x14]
mov ecx, eax
mov eax, dword [esp + 0x18]
call fcn.00582c60
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x587ea1
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 8]
cmp edi, eax
je 0x587e9b
movsx ecx, word [ebx + 4]
mov dword [esp + 4], ebp
mov dword [esp], eax
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
call fcn.00582580
mov ecx, ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
call fcn.00581ff8
mov ebx, esi
test esi, esi
jne 0x587e6c
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x1c], 0
test eax, eax
je 0x587f38
mov dword [esp + 0x24], eax
jmp 0x587e48
test ebp, 0xe3
je 0x587966
mov eax, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x587946
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
or eax, 3
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
and eax, 3
cmp eax, 3
je 0x587ff2
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x587fe6
and eax, 1
neg eax
add eax, 2
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x20], 0x6e
mov eax, ebx
call fcn.00583f64
jmp 0x587baa
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
lea edx, [ebp + 0x14]
mov eax, dword [esp + 0x18]
call fcn.005818bc
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov edx, dword [ebx + 0x2c]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], edx
mov dword [ebx], 0
mov dword [ebp], 0xfed9
mov eax, dword [ebx + 0x18]
mov dword [ebp + 4], eax
mov ecx, dword [esi + 8]
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov edx, dword [ebx + 0x70]
mov dword [ebp + 0x10], edx
mov dword [ebx + 0x70], 0
mov edx, dword [ebx + 0x7c]
mov dword [ebp + 0x38], edx
test al, 8
je 0x5880ea
mov eax, 0x581c80
mov dword [ebp + 0x91c], eax
mov eax, dword [ebx + 0x88]
mov dword [ebp + 0x920], eax
mov dword [ebx + 0x88], 0
mov eax, dword [ebx + 0x8c]
mov dword [ebp + 0x924], eax
xor edx, edx
lea esi, [esi]
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x5838d4
mov dword [ebx + 0x28], 3
jmp 0x587f25
mov eax, dword [ebx + 4]
sub edi, eax
cmp edi, 5
jle 0x587f04
cmp word [eax], 0x28
jne 0x587f04
cmp word [eax + 2], 0x3f
jne 0x587f04
movzx eax, word [eax + 4]
mov dword [esp], eax
call fcn.0050e4c8
test eax, eax
je 0x587f04
mov eax, dword [ebx]
or dword [eax + 8], 0x80
mov eax, dword [ebx + 4]
add eax, 4
mov dword [ebx + 4], eax
cmp dword [ebx + 8], eax
jbe case.0x5880f7.2
movzx eax, word [eax]
mov dword [esp], eax
call fcn.0050e4c8
test eax, eax
je 0x588138
mov edx, dword [ebx + 4]
mov ax, word [edx]
sub eax, 0x62
cmp ax, 0x16
jbe 0x5880f4
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov dword [ebx + 0x14], 0x12
jmp 0x587baa
mov edx, 0xc
jmp 0x587fd8
mov eax, dword [ebx + 0x64]
mov edx, 0xa
call fcn.00581ec0
mov word [ebx + 0x68], ax
mov edx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x60]
call fcn.00582814
jmp 0x587bb4
mov dword [edx + 0x1c], ecx
mov ecx, edx
jmp 0x587e17
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.00581504
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.00581530
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00583890
jmp 0x587c80
mov esi, dword [esp + 0x1c]
jmp 0x587dea
mov eax, 0x581fec
jmp 0x587fab
movzx eax, ax
jmp dword [eax*4 + 0x62f804]
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov dword [ebx + 0x14], 2
jmp 0x587baa
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
and al, 0x1c
or eax, 4
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
jmp 0x587f04
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jae case.0x5880f7.2
cmp word [eax], 0x29
jne case.0x5880f7.2
add eax, 2
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
test al, 4
je 0x587f04
and al, 0x1f
mov dword [ebx + 0x18], eax
jmp 0x587f04
or dword [ebx + 0x18], 0x20
lea eax, [edx + 2]
mov dword [ebx + 4], eax
cmp eax, dword [ebx + 8]
jb 0x588040
jmp case.0x5880f7.2
mov eax, dword [ebx + 0x18]
and eax, 0xffffffbf
or al, 0x80
mov dword [ebx + 0x18], eax
jmp 0x58816d
and dword [ebx + 0x18], 0xffffffdf
jmp 0x58816d
and dword [ebx + 0x18], 0xffffff3f
jmp 0x58816d
mov eax, dword [ebx + 0x18]
and eax, 0xfffffffc
or eax, 4
mov dword [ebx + 0x18], eax
jmp 0x58816d
mov eax, dword [ebx + 0x18]
and al, 0x7f
or eax, 0x40
mov dword [ebx + 0x18], eax
jmp 0x58816d
or dword [ebx + 0x18], 0xc0
jmp 0x58816d
or dword [ebx + 0x18], 8
jmp 0x58816d
mov eax, dword [ebx + 0x18]
and eax, 0xfffffff9
or eax, 1
mov dword [ebx + 0x18], eax
jmp 0x58816d
and dword [ebx + 0x18], 0xfffffff7
jmp 0x58816d
and dword [ebx + 0x18], 0xfffffff8
jmp 0x58816d