Function at 0x5878fc
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, eax
mov esi, edx
mov eax, dword [eax]
test eax, eax
je 0x5838eb
mov dword [esp], eax
call fcn.0058370c
mov eax, dword [ebx + 0x30]
lea edx, [ebx + 0x38]
cmp eax, edx
je 0x5838fd
mov dword [esp], eax
call fcn.004ee144
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x583909
call fcn.005837ec
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x583917
mov eax, ebx
call fcn.005817a8
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x583929
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00583890
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x58393b
mov dword [esp], eax
call fcn.004ee144
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x58394d
mov dword [esp], eax
call fcn.004ee144
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x583962
mov edx, dword [ebx + 0x8c]
call fcn.00581808
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x583975
mov dword [ebx + 0x14], esi
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], edx
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], 0x90
mov dword [esp], 0x68c9f4
call fcn.00509044
mov ebx, eax
test ebp, 0x2000
je 0x587edc
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x587ecc
test edi, edi
je 0x587ecc
test ebp, 4
jne 0x587ec0
mov eax, ebp
and eax, 3
cmp eax, 2
je 0x587ecc
mov eax, dword [esp + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], edi
mov edx, dword [esp + 0x18]
lea eax, [edi + edx*2]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x2c], 0
lea edx, [ebx + 0x38]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], 0xa
xor eax, eax
jmp 0x5879bb
mov edx, dword [ebx + 0x30]
mov dword [edx + eax], 0
add eax, 4
cmp eax, 0x28
jne 0x5879b8
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov word [ebx + 0x68], 0xffff
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov eax, dword [esp + 0x14]
mov dword [eax], 0xfed7
mov dword [eax + 8], 0
mov dword [eax + 0xc], 2
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0x5f2360
mov dword [esp], 0x928
call fcn.004edfec
mov ebp, eax
mov edx, dword [esp + 0x14]
mov dword [edx + 0x14], eax
test eax, eax
je 0x588084
mov dword [eax + 0x10], 0
lea edx, [eax + 0x3c]
mov dword [eax + 0x3c], 0x876
mov dword [eax + 0x40], ebx
mov dword [eax + 0x44], 0xa
lea eax, [eax + 0x54]
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x48], 0
mov word [ebp + 0x4c], 0
mov word [ebp + 0x58], 0xffff
mov dword [ebp + 0x5c], 0
mov dword [ebp + 0x60], 0
mov dword [ebp + 0x54], 0x10000
lea edi, [ebp + 0x11c]
lea ecx, [ebp + 0x51c]
mov eax, 0xff
nop
mov dword [edi + eax*4], ecx
dec eax
cmp eax, 0xffffffff
jne 0x587ac0
mov eax, 0xff
lea edi, [edx + 0x4e0]
mov word [edi + eax*2], 0
dec eax
cmp eax, 0xffffffff
jne 0x587ad4
mov dword [ebp + 0x64], ecx
mov dword [ebx + 0x64], edx
mov dword [ebp + 0x920], 0
mov dword [ebp + 0x924], 0
mov dword [ebp + 0x14], 0
xor ecx, ecx
mov eax, ebx
call fcn.00585f14
mov dword [ebx + 0x60], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov edx, 0x14
mov eax, 0x64
call fcn.005816b8
mov dword [ebx + 0x80], eax
test eax, eax
je 0x588084
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x587f04
mov edi, dword [ebx + 8]
mov edx, dword [ebx + 4]
mov ecx, edi
sub ecx, edx
cmp ecx, 7
jle 0x587ef8
cmp word [edx], 0x2a
jne 0x587ef8
cmp word [edx + 2], 0x2a
jne 0x587ef8
cmp word [edx + 4], 0x2a
jne 0x587ef8
mov cx, word [edx + 6]
cmp cx, 0x3d
je 0x58811c
cmp cx, 0x3f
je 0x5880fe
cmp cx, 0x3a
je 0x587ee3
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov dword [ebx + 0x14], 0xd
test byte [ebx + 0x18], 0xc0
jne 0x58808e
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
mov dword [esp], eax
mov ecx, 0x70
mov edx, 0x65
mov eax, ebx
call fcn.005876f0
mov dword [ebx + 0x70], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
call fcn.00585b0c
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
test esi, esi
je 0x5880b9
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_RAW__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.00585ec8
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.00581504
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.00581530
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00583890
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_TREE_FIXED__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.00585ec8
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 8]
mov edx, dword [ebx + 0x70]
mov ecx, esi
mov eax, ebx
call fcn.00586138
or eax, edi
mov edx, dword [esp + 0x14]
mov dword [edx + 8], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
cmp dword [ebx + 0x8c], 1
jle 0x587d0c
mov dword [esp + 0x18], 0x44
mov edi, 1
mov dword [esp + 0x1c], ebp
mov ebp, 0x44
nop
test esi, esi
je 0x587ce0
mov dword [esp + 8], edi
mov dword [esp + 4], str._n_n_n_LA_d__n
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov edx, dword [ebx + 0x88]
add edx, ebp
mov ecx, esi
mov eax, ebx
call fcn.00586088
inc edi
add ebp, 0x44
cmp dword [ebx + 0x8c], edi
jg 0x587cc8
mov ebp, dword [esp + 0x1c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x70]
test byte [eax + 1], 2
je 0x587d1e
mov eax, dword [ebx]
or dword [eax + 8], 0x2000
test esi, esi
je 0x587d42
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_SEARCH__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x60]
mov edx, esi
call fcn.00582d38
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
mov edi, dword [eax]
mov esi, dword [edi + 0x14]
test esi, esi
je 0x587f52
mov ecx, dword [eax + 0x24]
mov eax, esi
mov dword [esp + 0x1c], esi
jmp 0x587d83
mov eax, dword [eax + 0x10]
test eax, eax
je 0x5880e1
mov edx, dword [eax + 4]
cmp cx, dx
je 0x587d78
mov esi, dword [esp + 0x18]
cmp dx, word [esi + 0x26]
je 0x587d78
mov edx, dword [ebx + 0x64]
mov dword [esp + 4], edi
mov dword [esp], edi
mov ecx, 0xffffffff
mov eax, dword [esp + 0x18]
call fcn.00585bb8
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x24]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.00582580
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x26]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.00582580
mov esi, dword [edi + 0x14]
test esi, esi
je 0x587f40
mov dword [esp + 0x24], 0
xor ecx, ecx
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0xc]
test eax, eax
jne 0x587e07
jmp 0x587e17
mov eax, dword [eax + 0x14]
test eax, eax
je 0x587e17
cmp edi, dword [eax + 8]
je 0x587e00
mov eax, dword [edx + 0x1c]
test eax, eax
je 0x5880af
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x587df4
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x587f40
mov eax, dword [esp + 0x18]
add eax, 0x34
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
add edx, 0x20
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x18]
call fcn.00582460
mov ebp, eax
mov esi, dword [esp + 0x24]
mov edx, dword [esi + 0x14]
mov ecx, eax
mov eax, dword [esp + 0x18]
call fcn.00582c60
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x587ea1
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 8]
cmp edi, eax
je 0x587e9b
movsx ecx, word [ebx + 4]
mov dword [esp + 4], ebp
mov dword [esp], eax
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
call fcn.00582580
mov ecx, ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
call fcn.00581ff8
mov ebx, esi
test esi, esi
jne 0x587e6c
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x1c], 0
test eax, eax
je 0x587f38
mov dword [esp + 0x24], eax
jmp 0x587e48
test ebp, 0xe3
je 0x587966
mov eax, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
xor esi, esi
jmp 0x587946
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
or eax, 3
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
and eax, 3
cmp eax, 3
je 0x587ff2
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x587fe6
and eax, 1
neg eax
add eax, 2
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x20], 0x6e
mov eax, ebx
call fcn.00583f64
jmp 0x587baa
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
lea edx, [ebp + 0x14]
mov eax, dword [esp + 0x18]
call fcn.005818bc
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587fd8
mov edx, dword [ebx + 0x2c]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], edx
mov dword [ebx], 0
mov dword [ebp], 0xfed9
mov eax, dword [ebx + 0x18]
mov dword [ebp + 4], eax
mov ecx, dword [esi + 8]
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov edx, dword [ebx + 0x70]
mov dword [ebp + 0x10], edx
mov dword [ebx + 0x70], 0
mov edx, dword [ebx + 0x7c]
mov dword [ebp + 0x38], edx
test al, 8
je 0x5880ea
mov eax, 0x581c80
mov dword [ebp + 0x91c], eax
mov eax, dword [ebx + 0x88]
mov dword [ebp + 0x920], eax
mov dword [ebx + 0x88], 0
mov eax, dword [ebx + 0x8c]
mov dword [ebp + 0x924], eax
xor edx, edx
lea esi, [esi]
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x5838d4
mov dword [ebx + 0x28], 3
jmp 0x587f25
mov eax, dword [ebx + 4]
sub edi, eax
cmp edi, 5
jle 0x587f04
cmp word [eax], 0x28
jne 0x587f04
cmp word [eax + 2], 0x3f
jne 0x587f04
movzx eax, word [eax + 4]
mov dword [esp], eax
call fcn.0050e4c8
test eax, eax
je 0x587f04
mov eax, dword [ebx]
or dword [eax + 8], 0x80
mov eax, dword [ebx + 4]
add eax, 4
mov dword [ebx + 4], eax
cmp dword [ebx + 8], eax
jbe case.0x5880f7.2
movzx eax, word [eax]
mov dword [esp], eax
call fcn.0050e4c8
test eax, eax
je 0x588138
mov edx, dword [ebx + 4]
mov ax, word [edx]
sub eax, 0x62
cmp ax, 0x16
jbe 0x5880f4
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov dword [ebx + 0x14], 0x12
jmp 0x587baa
mov edx, 0xc
jmp 0x587fd8
mov eax, dword [ebx + 0x64]
mov edx, 0xa
call fcn.00581ec0
mov word [ebx + 0x68], ax
mov edx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x60]
call fcn.00582814
jmp 0x587bb4
mov dword [edx + 0x1c], ecx
mov ecx, edx
jmp 0x587e17
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.00581504
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.00581530
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00583890
jmp 0x587c80
mov esi, dword [esp + 0x1c]
jmp 0x587dea
mov eax, 0x581fec
jmp 0x587fab
movzx eax, ax
jmp dword [eax*4 + 0x62f804]
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587baa
mov dword [ebx + 0x14], 2
jmp 0x587baa
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
and al, 0x1c
or eax, 4
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
jmp 0x587f04
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jae case.0x5880f7.2
cmp word [eax], 0x29
jne case.0x5880f7.2
add eax, 2
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
test al, 4
je 0x587f04
and al, 0x1f
mov dword [ebx + 0x18], eax
jmp 0x587f04
or dword [ebx + 0x18], 0x20
lea eax, [edx + 2]
mov dword [ebx + 4], eax
cmp eax, dword [ebx + 8]
jb 0x588040
jmp case.0x5880f7.2
mov eax, dword [ebx + 0x18]
and eax, 0xffffffbf
or al, 0x80
mov dword [ebx + 0x18], eax
jmp 0x58816d
and dword [ebx + 0x18], 0xffffffdf
jmp 0x58816d
and dword [ebx + 0x18], 0xffffff3f
jmp 0x58816d
mov eax, dword [ebx + 0x18]
and eax, 0xfffffffc
or eax, 4
mov dword [ebx + 0x18], eax
jmp 0x58816d
mov eax, dword [ebx + 0x18]
and al, 0x7f
or eax, 0x40
mov dword [ebx + 0x18], eax
jmp 0x58816d
or dword [ebx + 0x18], 0xc0
jmp 0x58816d
or dword [ebx + 0x18], 8
jmp 0x58816d
mov eax, dword [ebx + 0x18]
and eax, 0xfffffff9
or eax, 1
mov dword [ebx + 0x18], eax
jmp 0x58816d
and dword [ebx + 0x18], 0xfffffff7
jmp 0x58816d
and dword [ebx + 0x18], 0xfffffff8
jmp 0x58816d