Function at 0x5997e0
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r13d, r13d
mov rdi, rcx
lea rcx, [0x006a1700]
mov ebp, r9d
mov rsi, rdx
mov edx, 0x108
mov r12, r8
call fcn.0056c0c0
test ebp, 0x2000
mov rbx, rax
jne 0x599e32
test rdi, rdi
je 0x599829
test rsi, rsi
jne 0x599840
mov eax, 0x10
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test bpl, 4
je 0x59984c
test bpl, 0xe3
jne 0x599829
mov eax, ebp
and eax, 3
cmp eax, 2
je 0x599829
lea rax, [rsi + r12*2]
lea rdx, [rbx + 0x58]
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0
xor eax, eax
mov dword [rbx + 0x28], 0
mov dword [rbx + 0x2c], ebp
mov dword [rbx + 0x40], 0
mov qword [rbx + 0x48], rdx
mov qword [rbx + 0x50], 0xa
jmp 0x5998a4
mov rdx, qword [rbx + 0x48]
mov qword [rdx + rax], 0
add rax, 8
cmp rax, 0x50
jne 0x5998a0
mov eax, 0xffffffff
mov qword [rbx + 0xa8], 0
mov qword [rbx + 0xb0], 0
mov word [rbx + 0xb8], ax
lea rax, [0x00611020]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xc8], 0
mov qword [rbx + 0xd0], 0
mov ecx, 0x11e0
mov qword [rbx + 0xd8], 0
mov qword [rbx + 0xe8], 0
mov qword [rbx + 0xf0], 0
mov qword [rbx + 0xf8], 0
mov dword [rbx + 0x100], 0
mov dword [rdi], 0xfed7
mov dword [rdi + 0x10], 0
mov dword [rdi + 0x14], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x28], rax
call fcn.004df170
test rax, rax
mov r14, rax
mov qword [rdi + 0x20], rax
je 0x599f78
mov qword [rax + 0x18], 0
mov dword [rax + 0x58], 0x876
lea rdx, [rax + 0x58]
mov qword [rax + 0x60], rbx
mov qword [rax + 0x68], 0xa
lea rax, [rax + 0x88]
lea r12, [r14 + 0x9c8]
lea r11, [r14 + 0x9c0]
lea rsi, [r14 + 0x1c0]
mov qword [r14 + 0x80], rax
xor eax, eax
mov qword [r14 + 0x70], 0
mov word [r14 + 0x78], ax
mov eax, 0xffffffff
mov qword [r14 + 0x90], 0
mov word [r14 + 0x8c], ax
mov dword [r14 + 0x98], 0
mov dword [r14 + 0x88], 0x10000
nop
mov qword [r11], r12
sub r11, 8
cmp r11, rsi
jne 0x5999f0
lea r11, [r14 + 0xbc6]
lea rsi, [r14 + 0x9c6]
nop word [rax + rax]
xor r15d, r15d
sub r11, 2
mov word [r11 + 2], r15w
cmp r11, rsi
jne 0x599a10
mov qword [r14 + 0xa0], r12
xor r8d, r8d
mov qword [rbx + 0xb0], rdx
mov rcx, rbx
mov qword [r14 + 0x11d0], 0
mov dword [r14 + 0x11d8], 0
mov dword [r14 + 0x20], 0
call fcn.005989c0
mov edx, dword [rbx + 0x28]
mov qword [rbx + 0xa8], rax
test edx, edx
jne 0x599f13
mov edx, 0x14
mov ecx, 0x64
call fcn.005923b0
test rax, rax
mov qword [rbx + 0xe8], rax
je 0x599f78
mov eax, dword [rbx + 0x2c]
test al, 4
jne 0x599f2b
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov r8, rcx
sub r8, rdx
cmp r8, 7
jle 0x599ab2
cmp word [rdx], 0x2a
je 0x59a054
and eax, 3
cmp eax, 3
je 0x599f7f
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x599f42
mov eax, dword [rbx + 0x2c]
test al, 4
jne 0x599f36
and eax, 1
neg eax
add eax, 2
mov dword [rbx + 0x3c], eax
mov dword [rbx + 0x34], 0x6e
mov rcx, rbx
call fcn.00594b00
test byte [rbx + 0x2c], 0xc0
jne 0x599f48
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x599f13
mov rax, qword [rbx + 0xa8]
mov edx, 0x65
mov r8d, 0x70
mov rcx, rbx
mov r9, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
call fcn.00598780
mov edx, dword [rbx + 0x28]
mov qword [rbx + 0xc8], rax
test edx, edx
jne 0x599f13
mov rcx, qword [rbx + 0xa8]
call fcn.00596c80
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x599f13
test r13, r13
je 0x59a019
lea rcx, str._n_n_n_RAW__n
mov r9, r13
mov r8d, 0x1c
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, qword [rbx + 0xc8]
mov rdx, r13
call fcn.00596fc0
mov rcx, qword [rbx + 0xc8]
mov edx, 1
call fcn.00592180
mov rcx, qword [rbx + 0xc8]
mov dword [rbx + 0xe0], eax
call fcn.005921c0
lea rdx, [rbx + 0xd8]
lea rcx, [rbx + 0xd0]
call fcn.00594310
lea rcx, str._n_n_n_TREE_FIXED__n
mov edx, 1
mov r9, r13
mov r8d, 0x23
call sub.msvcrt.dll_fwrite
mov rcx, qword [rbx + 0xc8]
mov rdx, r13
call fcn.00596fc0
mov rdx, qword [rbx + 0xc8]
mov r8, r13
mov rcx, rbx
call fcn.00599790
mov edx, dword [rbx + 0x28]
or dword [rdi + 0x10], eax
test edx, edx
jne 0x599f13
cmp dword [rbx + 0x100], 1
mov r12d, 0x68
mov esi, 1
jle 0x599c66
nop dword [rax + rax]
test r13, r13
je 0x599c37
lea rdx, str._n_n_n_LA_d__n
mov r8d, esi
mov rcx, r13
call sub.msvcrt.dll_fprintf
mov rdx, r12
add rdx, qword [rbx + 0xf8]
mov r8, r13
mov rcx, rbx
add esi, 1
add r12, 0x68
call fcn.005996c0
cmp dword [rbx + 0x100], esi
jg 0x599c20
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x599f13
mov rax, qword [rbx + 0xc8]
test byte [rax + 1], 2
je 0x599c7d
mov rax, qword [rbx]
or dword [rax + 0x10], 0x2000
test r13, r13
je 0x599c9c
lea rcx, str._n_n_n_SEARCH__n
mov r9, r13
mov r8d, 0x1f
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, qword [rbx + 0xa8]
mov rdx, r13
call fcn.00598c90
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x599f13
mov r12, qword [rbx + 0xa8]
mov r15, qword [r12]
mov rdx, qword [r15 + 0x20]
test rdx, rdx
je 0x599e5f
movzx r8d, word [r12 + 0x48]
mov rax, rdx
jmp 0x599ce9
mov rax, qword [rax + 0x18]
test rax, rax
je 0x599d5b
movzx ecx, word [rax + 4]
cmp cx, r8w
je 0x599ce0
cmp cx, word [r12 + 0x4a]
je 0x599ce0
mov rdx, qword [rbx + 0xb0]
mov r9, r15
mov r8d, 0xffffffff
mov rcx, r12
mov qword [rsp + 0x20], r15
call fcn.00597010
movsx r8d, word [r12 + 0x48]
mov r9, r15
mov edx, 0x70
mov rcx, r12
mov qword [rsp + 0x20], r15
call fcn.00593430
movsx r8d, word [r12 + 0x4a]
mov edx, 0x70
mov qword [rsp + 0x20], r15
mov r9, r15
mov rcx, r12
call fcn.00593430
mov rdx, qword [r15 + 0x20]
test rdx, rdx
je 0x59a0b0
xor r8d, r8d
mov rcx, qword [rdx + 0x10]
mov rax, qword [rcx + 0x10]
test rax, rax
jne 0x599d79
jmp 0x599d8a
mov rax, qword [rax + 0x20]
test rax, rax
je 0x599d8a
cmp r15, qword [rax + 8]
je 0x599d70
cmp qword [rcx + 0x30], 0
je 0x59a00d
mov rdx, qword [rdx + 0x18]
test rdx, rdx
jne 0x599d5e
test r8, r8
je 0x59a0b0
lea rax, [r12 + 0x60]
lea rcx, [r12 + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rbx
mov r14, r8
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x4c], ebp
mov rsi, rax
mov r13, rcx
mov rcx, r12
call fcn.005932d0
mov rdx, qword [r14 + 0x20]
mov r8, rax
mov rcx, r12
mov rbx, rax
call fcn.00593be0
mov rdi, qword [r14 + 0x10]
test rdi, rdi
je 0x599e1c
mov r9, qword [rdi + 8]
mov rbp, qword [rdi + 0x20]
cmp r15, r9
je 0x599e14
movsx r8d, word [rdi + 4]
mov qword [rsp + 0x20], rbx
mov rcx, r12
mov edx, dword [rdi]
call fcn.00593430
mov r8, rdi
mov rdx, rsi
mov rcx, r13
call fcn.00592e70
test rbp, rbp
mov rdi, rbp
jne 0x599de5
mov rax, qword [r14 + 0x30]
mov qword [r14 + 0x30], 0
test rax, rax
je 0x599e41
mov r14, rax
jmp 0x599dc2
call qword [sym.imp.msvcrt.dll___iob_func]
lea r13, [rax + 0x30]
jmp 0x59981f
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov ebp, dword [rsp + 0x4c]
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x599f13
mov rcx, qword [rbx + 0xa8]
lea rdx, [r14 + 0x20]
call fcn.005926b0
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x599f13
movsxd rdx, dword [rbx + 0x40]
mov eax, dword [rbx + 0x2c]
mov ecx, dword [rdi + 0x10]
test al, 8
mov qword [rdi + 8], rdx
mov qword [rbx], 0
mov qword [r14 + 0x10], rdx
mov rdx, qword [rbx + 0xc8]
mov dword [r14 + 4], eax
mov dword [r14], 0xfed9
lea rax, [0x00592410]
mov dword [r14 + 8], ecx
mov qword [r14 + 0x18], rdx
mov edx, dword [rbx + 0xe0]
mov qword [rbx + 0xc8], 0
mov dword [r14 + 0x50], edx
lea rdx, [0x00592400]
cmove rax, rdx
and ebp, 0x800
mov qword [r14 + 0x11c8], rax
mov rax, qword [rbx + 0xf8]
mov qword [r14 + 0x11d0], rax
mov eax, dword [rbx + 0x100]
mov qword [rbx + 0xf8], 0
mov dword [r14 + 0x11d8], eax
je 0x599f11
call qword [sym.imp.msvcrt.dll___iob_func]
xor edx, edx
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.00594370
mov ecx, dword [rbx + 0x28]
test ecx, ecx
jne 0x599aee
mov dword [rbx + 0x3c], 3
jmp 0x599adf
test byte [rbx + 0x2c], 0xc0
je 0x599f13
mov rcx, qword [rbx + 0xb0]
mov edx, 0xa
call fcn.00592ce0
mov rdx, qword [rbx + 0xb0]
mov rcx, qword [rbx + 0xa8]
mov word [rbx + 0xb8], ax
call fcn.00593750
jmp 0x599af8
mov edx, 0xc
jmp 0x599f13
mov rax, qword [rbx + 8]
sub rcx, rax
cmp rcx, 5
jle 0x599abe
cmp word [rax], 0x28
jne 0x599abe
cmp word [rax + 2], 0x3f
jne 0x599abe
movzx ecx, word [rax + 4]
call fcn.00572960
test eax, eax
je 0x599abe
mov rax, qword [rbx]
lea rsi, [0x00666200]
or dword [rax + 0x10], 0x80
mov rax, qword [rbx + 8]
add rax, 4
cmp rax, qword [rbx + 0x10]
mov qword [rbx + 8], rax
jae case.0x59a00b.2
movzx ecx, word [rax]
call fcn.00572960
test eax, eax
mov rax, qword [rbx + 8]
je 0x59a1c2
movzx ecx, word [rax]
lea edx, [rcx - 0x62]
cmp dx, 0x16
ja case.0x59a00b.2
movzx edx, dx
movsxd rdx, dword [rsi + rdx*4]
add rdx, rsi
jmp rdx
mov qword [rcx + 0x30], r8
mov r8, rcx
jmp 0x599d8a
mov rcx, qword [rbx + 0xc8]
mov edx, 1
call fcn.00592180
mov rcx, qword [rbx + 0xc8]
mov dword [rbx + 0xe0], eax
call fcn.005921c0
lea rdx, [rbx + 0xd8]
lea rcx, [rbx + 0xd0]
call fcn.00594310
jmp 0x599be4
cmp word [rdx + 2], 0x2a
jne 0x599ab2
cmp word [rdx + 4], 0x2a
jne 0x599ab2
movzx r8d, word [rdx + 6]
cmp r8w, 0x3d
je 0x59a12c
cmp r8w, 0x3f
je 0x59a10c
cmp r8w, 0x3a
je 0x59a0ee
mov r9d, dword [rbx + 0x28]
mov dword [rbx + 0x34], 0x65
test r9d, r9d
jne 0x599aee
mov dword [rbx + 0x28], 0xd
jmp 0x599aee
mov edx, dword [rbx + 0x28]
jmp 0x599e57
or dword [rbx + 0x2c], 0x20
add rax, 2
cmp rax, qword [rbx + 0x10]
mov qword [rbx + 8], rax
jb 0x599fdd
mov r8d, dword [rbx + 0x28]
mov dword [rbx + 0x34], 0x65
test r8d, r8d
jne 0x599aee
mov dword [rbx + 0x28], 0x12
jmp 0x599aee
mov r8, qword [rbx]
or eax, 3
add rdx, 8
or dword [r8 + 0x10], 0x80
mov dword [rbx + 0x2c], eax
mov qword [rbx + 8], rdx
jmp 0x599ab2
mov r10d, dword [rbx + 0x28]
mov dword [rbx + 0x34], 0x65
test r10d, r10d
jne 0x599aee
mov dword [rbx + 0x28], 2
jmp 0x599aee
mov rcx, qword [rbx]
and al, 0x1c
add rdx, 8
or eax, 4
or dword [rcx + 0x10], 0x80
mov dword [rbx + 0x2c], eax
mov qword [rbx + 8], rdx
jmp 0x599abe
mov edx, dword [rbx + 0x2c]
and edx, 0xffffffbf
or dl, 0x80
mov dword [rbx + 0x2c], edx
jmp 0x59a0bc
and dword [rbx + 0x2c], 0xffffffdf
jmp 0x59a0bc
and dword [rbx + 0x2c], 0xffffff3f
jmp 0x59a0bc
mov edx, dword [rbx + 0x2c]
and edx, 0xfffffffc
or edx, 4
mov dword [rbx + 0x2c], edx
jmp 0x59a0bc
mov edx, dword [rbx + 0x2c]
and dl, 0x7f
or edx, 0x40
mov dword [rbx + 0x2c], edx
jmp 0x59a0bc
or dword [rbx + 0x2c], 0xc0
jmp 0x59a0bc
or dword [rbx + 0x2c], 8
jmp 0x59a0bc
mov edx, dword [rbx + 0x2c]
and edx, 0xfffffff9
or edx, 1
mov dword [rbx + 0x2c], edx
jmp 0x59a0bc
and dword [rbx + 0x2c], 0xfffffff7
jmp 0x59a0bc
cmp rax, qword [rbx + 0x10]
jae case.0x59a00b.2
cmp word [rax], 0x29
jne case.0x59a00b.2
add rax, 2
mov qword [rbx + 8], rax
mov eax, dword [rbx + 0x2c]
test al, 4
je 0x59a1f8
and al, 0x1f
mov dword [rbx + 0x2c], eax
jmp 0x599abe
and dword [rbx + 0x2c], 0xfffffff8
jmp 0x59a0bc
mov edx, dword [rbx + 0x28]
test edx, edx
je 0x599ad4
jmp 0x599aee