Function at 0x603ed100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], edx
cmp eax, 1
je 0x603ed4c0
cmp eax, 1
jb 0x603ed4a7
cmp eax, 2
je 0x603ed140
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x603ed448
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x90]
mov ecx, dword [ecx + 0x1c]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
push edi
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
sub eax, ebx
sar eax, 5
push eax
push 0x603ecf76
push esi
call fcn.6041d180
mov eax, dword [ebp - 0x18]
add esp, 0x10
test byte [eax + 4], 1
jne 0x603ed438
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
sub esp, 0xc
mov edx, dword [ecx + 4]
push edx
push eax
mov edx, dword [ebp - 0x18]
xor eax, eax
mov al, byte [edx + 0x1b]
push eax
xor eax, eax
mov al, byte [edx + 0x1a]
push eax
mov ax, word [edx + 0x18]
and eax, 0xffff
push eax
mov ax, word [edx + 0x16]
and eax, 0xffff
push eax
movsx eax, word [edx + 0x14]
push eax
push 0x603ecf90
push esi
call fcn.6041d180
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
add esp, 0x30
cmp byte [ecx + 0x1b], 0
je 0x603ed254
mov ebx, ecx
add ebx, 0x20
lea esi, [esi]
test byte [ebx + 4], 2
je 0x603ed430
mov edi, dword [ebx + 8]
mov eax, dword [ebp - 0x20]
sub edi, eax
sar edi, 5
push ecx
push ecx
push esi
push 0xa
call sub.msvcrt.dll_fputc
pop eax
mov ecx, dword [ebp - 0x1c]
pop edx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov eax, dword [eax + 0x178]
push ecx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x20]
push ecx
push esi
push edx
call dword [eax + 0x8c]
add esp, 0x20
test eax, eax
je 0x603ed2d0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
inc eax
add ebx, 0x20
mov dword [ebp - 0x1c], eax
xor eax, eax
mov al, byte [edx + 0x1b]
cmp dword [ebp - 0x1c], eax
jb 0x603ed1f0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x603ed132
push eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 4]
mov edi, dword [eax + 4]
push edi
push 0x603ecfc9
push esi
call fcn.6041d180
mov ebx, dword [ebp - 0x24]
add esp, 0x10
add ebx, 8
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x603ed132
mov esi, esi
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [eax + 0x18]
add eax, edx
push eax
mov eax, dword [ecx]
push eax
push 0x603ecfcf
push esi
call fcn.6041d180
mov eax, dword [ebp - 0x24]
add esp, 0x10
add eax, 8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
test eax, eax
jne 0x603ed290
jmp 0x603ed132
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov al, byte [ecx + 0x1a]
cmp eax, 3
je 0x603ed3bd
cmp eax, 3
jg 0x603ed3a0
cmp eax, 2
je 0x603ed340
nop
sub esp, 0xc
push edi
mov ax, word [ebx + 0xe]
and eax, 0xffff
push eax
mov ax, word [ebx + 0xc]
and eax, 0xffff
push eax
push 0x603ecff0
push esi
call fcn.6041d180
add esp, 0x20
test byte [ebx + 4], 4
je 0x603ed23d
push ecx
mov eax, dword [ebx + 0x14]
mov edx, dword [ebp - 0x20]
sub eax, edx
sar eax, 5
push eax
push 0x603ed011
push esi
call fcn.6041d180
add esp, 0x10
jmp 0x603ed23d
mov ecx, dword [ebp - 0x18]
mov ax, word [ecx + 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, eax
and edx, 0xffff
mov eax, dword [ecx + 0x90]
mov ecx, dword [eax + 0x24]
and edx, ecx
mov ecx, dword [eax + 0x20]
mov eax, 2
shl eax, cl
cmp edx, eax
jne 0x603ed2f0
test byte [ebx + 4], 4
je 0x603ed39b
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 5
push edx
push edx
push eax
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx + 0xc]
push eax
push edi
push 0x603ed030
push esi
call fcn.6041d180
add esp, 0x20
jmp 0x603ed23d
mov eax, dword [ebx + 0x14]
jmp 0x603ed37c
cmp eax, 0x67
jne 0x603ed2f0
push esi
push 5
push 1
push 0x603ed05f
call sub.msvcrt.dll_fwrite
jmp 0x603ed338
mov edx, dword [ebp - 0x18]
mov ax, word [edx + 0x18]
test ax, ax
jne 0x603ed347
sub esp, 0xc
mov ax, word [ebx + 0xe]
and eax, 0xffff
push eax
mov ax, word [ebx + 0xc]
and eax, 0xffff
push eax
mov eax, dword [ebx + 8]
push eax
push 0x603ed070
push esi
call fcn.6041d180
mov eax, dword [ebx + 0x10]
add esp, 0x20
test eax, eax
jne 0x603ed40a
test dword [ebx + 0x14], 0xffffff
je 0x603ed23d
sub esp, 0xc
xor eax, eax
mov al, byte [ebx + 0x16]
push eax
mov ax, word [ebx + 0x14]
and eax, 0xffff
push eax
mov edi, dword [ebx + 0x10]
push edi
push 0x603ed0b0
jmp 0x603ed38d
mov edi, dword [ebx + 8]
jmp 0x603ed205
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
sub eax, ecx
jmp 0x603ed194
push edi
mov ebx, dword [ebp - 0x14]
push ebx
push esi
mov ecx, dword [ebp - 0x10]
push ecx
call sym.exchndl.dll_bfd_print_symbol_vandf
pop eax
pop edx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
mov eax, dword [edx + 0x1c]
test eax, eax
je 0x603ed4a0
mov eax, 0x603ed0d3
push eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x603ed499
mov eax, 0x603ed0d5
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov eax, dword [eax]
push eax
push 0x603ed0d7
push esi
call fcn.6041d180
add esp, 0x20
jmp 0x603ed132
mov eax, 0x603ed0e6
jmp 0x603ed47c
mov eax, 0x603ed0e8
jmp 0x603ed46c
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0xc], esi
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6041d2a0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x603ed507
mov eax, 0x603ed0d3
mov edx, dword [ebp - 0x14]
mov dword [ebp + 0x14], eax
mov eax, dword [edx + 0x18]
test eax, eax
je 0x603ed500
mov eax, 0x603ed0d5
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], 0x603ed0ea
mov dword [ebp + 8], esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6041d180
mov eax, 0x603ed0e6
jmp 0x603ed4e1
mov eax, 0x603ed0e8
jmp 0x603ed4cf