Function at 0x53dcd0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xa1c]
sub esp, 0xa1c
push 0xfffffffffffffffe
push 0x6745c0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xa18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xa28]
mov esi, dword [ebp + 0xa2c]
mov dword [ebp - 0x3c], 1
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x48], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x40], eax
cmp eax, ebx
jne 0x53dd71
push str.Failed_to_get_the_process_heap
push edi
call fcn.0053d3c0
add esp, 8
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x53e4e4
mov eax, dword [0x75d460]
cmp eax, ebx
jne 0x53dd94
push str.iphlpapi.dll
call fcn.004f4be0
mov dword [0x75d460], eax
cmp eax, ebx
jne 0x53dd94
push str.Failed_to_load_library_iphlpapi.dll
jmp 0x53dd57
mov ecx, dword [0x75d45c]
cmp ecx, ebx
jne 0x53dde7
push str.AllocateAndGetTcpExTableFromStack
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x75d45c], ecx
cmp ecx, ebx
jne 0x53dde7
push str.Failed_to_get_procedure_address.
push edi
call fcn.0053d3c0
add esp, 8
mov eax, dword [0x75d460]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x75d460], ebx
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x53e4e4
cmp esi, ebx
je 0x53de1b
cmp byte [esi], bl
je 0x53de1b
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
push esi
call fcn.004e0400
add esp, 0x1c
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x53de1b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebx
mov ecx, dword [ebp - 0x40]
push ecx
push 1
lea edx, [ebp - 0x1c]
push edx
call dword [0x75d45c]
test eax, eax
jne 0x53de92
xor edi, edi
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x1c]
cmp edi, dword [eax]
jae 0x53de92
mov esi, dword [ebp - 0x24]
cmp esi, 0xffffffff
jne 0x53df7b
cmp dword [ebp + 0xa30], ebx
jne 0x53df7b
cmp dword [ebp + 0xa34], ebx
jne 0x53e40c
lea esi, [edi + edi*2]
add esi, esi
add esi, esi
add esi, esi
mov ecx, eax
movzx edx, word [esi + ecx + 0xc]
push edx
call dword [0x75d2c4]
movzx eax, ax
cmp eax, dword [ebp + 0xa24]
jne 0x53df15
mov ecx, dword [ebp - 0x1c]
mov edx, dword [esi + ecx + 0x18]
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 1
jne 0x53e478
push 0x17
push ebx
mov eax, dword [ebp - 0x40]
push eax
push 1
lea ecx, [ebp - 0x20]
push ecx
call dword [0x75d45c]
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x53e47b
xor edi, edi
mov dword [ebp - 0x38], edi
cmp edi, dword [eax]
jae 0x53e47b
mov ecx, dword [ebp + 0xa34]
lea esi, [edi*8]
sub esi, edi
add esi, esi
add esi, esi
add esi, esi
cmp ecx, ebx
jne 0x53e412
movzx edx, word [esi + eax + 0x18]
push edx
call dword [0x75d2c4]
movzx eax, ax
cmp eax, dword [ebp + 0xa24]
jne 0x53e46f
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + eax + 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x53e4a7
mov eax, dword [ebp - 0x1c]
cmp dword [esi + eax + 0x18], ebx
jne 0x53e40c
mov ecx, eax
movzx edx, word [esi + ecx + 0x14]
push edx
call dword [0x75d2c4]
cmp ax, 0x50
je 0x53df6c
mov eax, dword [ebp - 0x1c]
movzx ecx, word [esi + eax + 0x14]
push ecx
call dword [0x75d2c4]
mov edx, 0x1bb
cmp ax, dx
je 0x53df6c
mov eax, dword [ebp - 0x1c]
movzx ecx, word [esi + eax + 0x14]
push ecx
call dword [0x75d2c4]
mov edx, 0x400
cmp ax, dx
jb 0x53e40c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [esi + eax + 0x18]
mov dword [ebp - 0x3c], ecx
jmp 0x53de92
mov byte [ebp + 0x208], bl
push 0x3ff
push ebx
lea edx, [ebp + 0x209]
push edx
call fcn.005dfd60
mov byte [ebp + 0x608], bl
push 0x103
push ebx
lea eax, [ebp + 0x609]
push eax
call fcn.005dfd60
mov byte [ebp - 0x2c], bl
mov word [ebp - 0x2b], bx
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x34], bl
mov word [ebp - 0x33], bx
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov word [ebp - 0x2f], bx
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x28], bl
mov word [ebp - 0x27], bx
mov byte [ebp - 0x25], bl
mov byte [ebp + 0x104], bl
push 0x103
push ebx
lea ecx, [ebp + 0x105]
push ecx
call fcn.005dfd60
mov byte [ebp], bl
push 0x103
push ebx
lea edx, [ebp + 1]
push edx
call fcn.005dfd60
add esp, 0x30
cmp dword [ebp - 0x48], ebx
jne 0x53e116
cmp esi, 0xffffffff
je 0x53e102
mov byte [ebp + 0x70c], bl
push 0x103
push ebx
lea eax, [ebp + 0x70d]
push eax
call fcn.005dfd60
push 1
lea ecx, [ebp + 0x70c]
push ecx
call fcn.004f00d0
lea edx, [ebp + 0x70c]
push edx
push str._r_n_s_r_n_r_n
lea eax, [ebp + 0x208]
push eax
call fcn.005dfb23
add esp, 0x20
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53e060
sub eax, edx
push ebx
lea ecx, [ebp - 0x44]
push ecx
push eax
lea edx, [ebp + 0x208]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.LocIP:LocPort_t_tRemIP:RemPort_t_tPID_tState_r_n
lea ecx, [ebp + 0x208]
push ecx
call fcn.005dfb23
add esp, 8
lea eax, [ebp + 0x208]
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53e0a0
sub eax, esi
push ebx
lea edx, [ebp - 0x44]
push edx
push eax
lea eax, [ebp + 0x208]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str._r_n
lea edx, [ebp + 0x208]
push edx
call fcn.005dfb23
add esp, 8
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53e0e0
sub eax, edx
push ebx
lea ecx, [ebp - 0x44]
push ecx
push eax
lea edx, [ebp + 0x208]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x53e10f
push str.LocIP:LocPort_t_tRemIP:RemPort_t_tPID_tState_n_n
call fcn.005e0e7f
add esp, 4
mov dword [ebp - 0x48], 1
lea esi, [edi + edi*2]
add esi, esi
add esi, esi
add esi, esi
lea ecx, [ebp + 0x608]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi + edx + 4]
push eax
call fcn.0053ce80
mov ecx, dword [ebp - 0x1c]
mov edx, dword [esi + ecx + 8]
push edx
call fcn.00508720
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x2c], bl
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.004d9250
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
push ecx
push str._s._s._s._s
lea edx, [ebp + 0x104]
push edx
call fcn.005dfb23
mov eax, dword [ebp - 0x1c]
mov ecx, dword [esi + eax + 0x10]
push ecx
call fcn.00508720
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x2c], bl
push eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.004d9250
add esp, 0x50
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x28]
push eax
push str._s._s._s._s
lea ecx, [ebp]
push ecx
call fcn.005dfb23
add esp, 0x18
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov edx, dword [ebp - 0x1c]
movzx eax, word [esi + edx + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, 0x1bd
je 0x53e1fc
cmp eax, 0x8b
jne 0x53e203
mov dword [ebp - 0x50], 1
push eax
lea ecx, [ebp + 0x104]
push ecx
push str._s:_u_t
lea edx, [ebp + 0x914]
push edx
call fcn.005dfb23
add esp, 0x10
lea eax, [ebp + 0x914]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53e228
sub eax, edx
cmp eax, 0x11
jae 0x53e254
lea edi, [ebp + 0x914]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x53e240
mov ax, word [0x6484a0]
mov word [edi], ax
mov edi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
movzx edx, word [esi + ecx + 0x14]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
lea ecx, [ebp]
push ecx
push str._s:_u_t
lea edx, [ebp + 0x810]
push edx
call fcn.005dfb23
add esp, 0x10
lea eax, [ebp + 0x810]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53e288
sub eax, edx
cmp eax, 0x11
jae 0x53e2b4
lea edi, [ebp + 0x810]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x53e2a0
mov ax, word [0x6484a0]
mov word [edi], ax
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x50], ebx
je 0x53e2f7
cmp dword [esi + eax + 4], 2
je 0x53e2f7
lea ecx, [ebp + 0x608]
push ecx
mov edx, dword [esi + eax + 0x18]
push edx
lea eax, [ebp + 0x810]
push eax
lea ecx, [ebp + 0x914]
push ecx
push str._s_s_u_t_s
lea edx, [ebp + 0x208]
push edx
call fcn.005dfb23
mov dword [ebp - 0x4c], 1
jmp 0x53e322
lea ecx, [ebp + 0x608]
push ecx
mov edx, dword [esi + eax + 0x18]
push edx
lea eax, [ebp + 0x810]
push eax
lea ecx, [ebp + 0x914]
push ecx
push 0x6545dc
lea edx, [ebp + 0x208]
push edx
call fcn.005dfb23
add esp, 0x18
mov esi, dword [ebp - 0x24]
cmp esi, 0xffffffff
je 0x53e3f8
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53e340
sub eax, edx
push ebx
lea ecx, [ebp - 0x44]
push ecx
push eax
lea edx, [ebp + 0x208]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x63f820
lea eax, [ebp + 0x208]
push eax
call fcn.005dfb23
add esp, 8
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53e380
sub eax, edx
push ebx
lea ecx, [ebp - 0x44]
push ecx
push eax
lea edx, [ebp + 0x208]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x4c], ebx
je 0x53e40c
cmp byte [0x75d2c8], bl
je 0x53e40c
lea ecx, [ebp + 0x914]
push ecx
lea edx, [ebp + 0x810]
push edx
push str.REM:_s___LOC:_s
lea eax, [ebp + 0x70c]
push eax
call fcn.005dfb23
add esp, 0x10
push ebx
push ebx
push 0x75d2c8
lea ecx, [ebp + 0x70c]
push ecx
push 0x60c810
push ebx
push str.eScan_Monitor
push 0x6d6
call fcn.00513910
inc edi
jmp 0x53de34
lea edx, [ebp + 0x208]
push edx
push 0x60c990
call fcn.005e0e7f
add esp, 8
inc edi
jmp 0x53de34
cmp ecx, dword [esi + eax + 0x38]
jne 0x53e472
movzx edx, word [esi + eax + 0x30]
push edx
call dword [0x75d2c4]
cmp ax, 0x50
je 0x53e45c
mov eax, dword [ebp - 0x20]
movzx ecx, word [esi + eax + 0x30]
push ecx
call dword [0x75d2c4]
mov edx, 0x1bb
cmp ax, dx
je 0x53e45c
mov eax, dword [ebp - 0x20]
movzx ecx, word [esi + eax + 0x30]
push ecx
call dword [0x75d2c4]
mov edx, 0x400
cmp ax, dx
jb 0x53e46f
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + eax + 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x53e4a7
mov eax, dword [ebp - 0x20]
inc edi
jmp 0x53debc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0xfffffffe
jmp 0x53e4a7
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x40]
cmp ecx, ebx
je 0x53e4c1
cmp esi, ebx
je 0x53e4c1
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x53e4d2
cmp esi, ebx
je 0x53e4d2
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x24], 0xffffffff
je 0x53e4e1
lea edx, [ebp - 0x24]
push edx
call fcn.004dca10
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa18]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0xa1c
mov esp, ebp
pop ebp
ret