Function at 0x5a3ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x5a4028
push ebx
call fcn.005a7450
add esp, 4
test eax, eax
je 0x5a4028
xor eax, eax
mov eax, dword [ebx]
push esi
push edi
cmp eax, 1
jne 0x5a3de1
mov eax, dword [ebx + 4]
mov ebx, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
jle 0x5a401f
lea edi, [ebp + 0x18]
nop dword [eax]
cmp dword [edi + 8], 0x80000004
mov dword [ebp - 4], 0
jne 0x5a3d44
mov esi, dword [edi]
jmp 0x5a3d71
push edi
call fcn.005a7480
mov esi, eax
add esp, 4
test esi, esi
jne 0x5a3d6a
push eax
lea eax, [ebp - 8]
push eax
push 2
push 0x5c1098
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x5a3dc5
mov dword [ebp - 4], 1
push esi
call dword [0x652770]
add esp, 4
test eax, eax
jle 0x5a3dae
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5a3dac
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x5c1098
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x5a3dae
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x5a3dbd
push esi
call fcn.005ac096
add esp, 4
test ebx, ebx
je 0x5a401f
mov eax, dword [ebp - 0x10]
add edi, 0xc
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp + 8]
jl 0x5a3d30
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x5a3e85
mov eax, dword [ebp + 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], 1
cmp eax, 1
jle 0x5a401a
dec eax
lea edi, [ebp + 0x18]
mov dword [ebp - 8], eax
nop word [eax + eax]
cmp dword [edi + 8], 0x80000004
mov dword [ebp - 0x10], 0
jne 0x5a3e24
mov esi, dword [edi]
jmp 0x5a3e3a
push edi
call fcn.005a7480
mov esi, eax
add esp, 4
test esi, esi
je 0x5a3e70
mov dword [ebp - 0x10], 1
push esi
call dword [0x652770]
mov ecx, eax
add esp, 4
test ecx, ecx
jle 0x5a3e53
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0x24]
mov eax, dword [ebx]
mov ecx, ebx
push 2
push 0x5c1098
call dword [eax + 0x24]
cmp dword [ebp - 0x10], 0
je 0x5a3e70
push esi
call fcn.005ac096
add esp, 4
add edi, 0xc
sub dword [ebp - 8], 1
jne 0x5a3e10
mov ebx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x5a400f
cmp dword [ebp + 8], 1
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
mov word [ebp - 4], 2
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x1c], 1
jle 0x5a401a
lea edi, [ebp + 0x18]
nop word [eax + eax]
cmp dword [edi + 8], 0x80000004
mov dword [ebp - 0x18], 0
jne 0x5a3ed4
mov esi, dword [edi]
jmp 0x5a3f35
push edi
call fcn.005a7480
mov esi, eax
add esp, 4
test esi, esi
jne 0x5a3f2e
mov esi, dword [ebp - 8]
push 1
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
mov word [ebp - 4], 0xa0d
lea eax, [ebx + 0xc]
push eax
push dword [ebx + 0x130]
lea eax, [ebx + 0x2c]
push eax
push 2
lea eax, [ebp - 4]
push eax
push ecx
call fcn.005a6140
add esp, 0x18
lea eax, [ebp - 0x14]
push 0
push eax
push 2
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x5a3ff0
mov dword [ebp - 0x18], 1
push esi
call dword [0x652770]
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x5a3fdb
push 1
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebx + 0xc]
push ecx
push dword [ebx + 0x130]
lea edx, [ebx + 0x2c]
push edx
push dword [ebp - 0x10]
push esi
push eax
call fcn.005a6140
add esp, 0x18
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp - 0x10]
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5a3fd4
push 1
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebx + 0xc]
mov word [ebp - 4], 0xa0d
push ecx
push dword [ebx + 0x130]
lea ecx, [ebx + 0x2c]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.005a6140
add esp, 0x18
lea eax, [ebp - 0x14]
push 0
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x5a3fdb
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x18], 0
je 0x5a3fea
push esi
call fcn.005ac096
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x5a4003
mov eax, dword [ebp - 0x1c]
add edi, 0xc
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp + 8]
jl 0x5a3ec0
mov ebx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor ebx, ebx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret