Function at 0x53d4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xa1c]
sub esp, 0xa1c
push 0xfffffffffffffffe
push 0x6745a0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xa18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xa28]
mov esi, dword [ebp + 0xa2c]
mov dword [ebp - 0x34], 1
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], ebx
mov ecx, dword [0x75d458]
cmp ecx, ebx
jne 0x53d565
push str.Iphlpapi.dll
call fcn.004f4be0
mov ecx, eax
mov dword [0x75d458], ecx
cmp ecx, ebx
jne 0x53d565
push str.Failed_to_LoadLibrary_Iphlpapi.dll
push edi
call fcn.0053d3c0
add esp, 8
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebx + 1]
jmp 0x53dca7
mov eax, dword [0x75d454]
cmp eax, ebx
jne 0x53d5b4
push str.GetExtendedTcpTable
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x75d454], eax
cmp eax, ebx
jne 0x53d5b4
push str.Failed_to_get_procedure_address.
push edi
call fcn.0053d3c0
add esp, 8
mov eax, dword [0x75d458]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x75d458], ebx
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x53dca7
push ebx
push 5
push 2
push 1
lea ecx, [ebp - 0x44]
push ecx
push ebx
call eax
push ebx
push 5
push 0x17
push 1
lea edx, [ebp - 0x48]
push edx
push ebx
call dword [0x75d454]
mov eax, dword [ebp - 0x44]
push eax
call fcn.005e20e4
mov edi, eax
mov dword [ebp - 0x40], edi
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.005e20e4
add esp, 8
mov dword [ebp - 0x30], eax
cmp esi, ebx
je 0x53d625
cmp byte [esi], bl
je 0x53d625
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
push esi
call fcn.004e0400
add esp, 0x1c
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x53d625
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x44], ebx
je 0x53d632
cmp edi, ebx
je 0x53dc6e
cmp dword [ebp - 0x48], ebx
je 0x53d640
cmp dword [ebp - 0x30], ebx
je 0x53dc6e
push ebx
push 5
push 2
push 1
lea edx, [ebp - 0x44]
push edx
push edi
call dword [0x75d454]
test eax, eax
jne 0x53d6ae
xor edi, edi
mov eax, dword [ebp + 0xa34]
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x40]
cmp edi, dword [esi]
jae 0x53d6ae
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x53d77d
cmp dword [ebp + 0xa30], ebx
jne 0x53d77d
cmp eax, ebx
jne 0x53d724
lea eax, [edi + edi*2]
mov ecx, esi
lea esi, [ecx + eax*8]
movzx edx, word [esi + 0xc]
push edx
call dword [0x75d2c4]
movzx eax, ax
cmp eax, dword [ebp + 0xa24]
jne 0x53dbec
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 1
jne 0x53dc6e
push ebx
push 5
push 0x17
push 1
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [0x75d454]
test eax, eax
jne 0x53dc6e
xor esi, esi
mov dword [ebp - 0x38], esi
mov edx, dword [ebp - 0x30]
cmp esi, dword [edx]
jae 0x53dc6e
cmp dword [ebp + 0xa34], ebx
jne 0x53dbf2
lea eax, [esi*8]
sub eax, esi
mov ecx, edx
lea edi, [ecx + eax*8]
movzx edx, word [edi + 0x18]
push edx
call dword [0x75d2c4]
movzx eax, ax
cmp eax, dword [ebp + 0xa24]
jne 0x53dc4f
mov ecx, dword [edi + 0x38]
mov dword [ebp - 0x34], ecx
jmp 0x53dc6e
lea edx, [edi + edi*2]
lea esi, [esi + edx*8]
cmp eax, dword [esi + 0x18]
jne 0x53dbec
movzx eax, word [esi + 0x14]
push eax
call dword [0x75d2c4]
cmp ax, 0x50
je 0x53d772
movzx ecx, word [esi + 0x14]
push ecx
call dword [0x75d2c4]
mov edx, 0x1bb
cmp ax, dx
je 0x53d772
movzx eax, word [esi + 0x14]
push eax
call dword [0x75d2c4]
mov ecx, 0x400
cmp ax, cx
jb 0x53dbec
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x34], edx
jmp 0x53d6ae
mov byte [ebp + 0x208], bl
push 0x3ff
push ebx
lea eax, [ebp + 0x209]
push eax
call fcn.005dfd60
mov byte [ebp + 0x608], bl
push 0x103
push ebx
lea ecx, [ebp + 0x609]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x2c], bl
mov word [ebp - 0x2b], bx
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x20], bl
mov word [ebp - 0x1f], bx
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x24], bl
mov word [ebp - 0x23], bx
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x28], bl
mov word [ebp - 0x27], bx
mov byte [ebp - 0x25], bl
mov byte [ebp], bl
push 0x103
push ebx
lea edx, [ebp + 1]
push edx
call fcn.005dfd60
mov byte [ebp + 0x104], bl
push 0x103
push ebx
lea eax, [ebp + 0x105]
push eax
call fcn.005dfd60
add esp, 0x30
cmp dword [ebp - 0x4c], ebx
jne 0x53d916
cmp dword [ebp - 0x1c], 0xffffffff
je 0x53d902
mov byte [ebp + 0x810], bl
push 0x103
push ebx
lea ecx, [ebp + 0x811]
push ecx
call fcn.005dfd60
push 1
lea edx, [ebp + 0x810]
push edx
call fcn.004f00d0
lea eax, [ebp + 0x810]
push eax
push str._r_n_s_r_n_r_n
lea ecx, [ebp + 0x208]
push ecx
call fcn.005dfb23
add esp, 0x20
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53d860
sub eax, edx
push ebx
lea edx, [ebp - 0x3c]
push edx
push eax
lea eax, [ebp + 0x208]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.LocIP:LocPort_t_tRemIP:RemPort_t_tPID_tState_r_n
lea edx, [ebp + 0x208]
push edx
call fcn.005dfb23
add esp, 8
lea eax, [ebp + 0x208]
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53d8a0
sub eax, esi
push ebx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea edx, [ebp + 0x208]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str._r_n
lea ecx, [ebp + 0x208]
push ecx
call fcn.005dfb23
add esp, 8
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53d8e0
sub eax, edx
push ebx
lea edx, [ebp - 0x3c]
push edx
push eax
lea eax, [ebp + 0x208]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x53d90f
push str.LocIP:LocPort_t_tRemIP:RemPort_t_tPID_tState_n_n
call fcn.005e0e7f
add esp, 4
mov dword [ebp - 0x4c], 1
lea edx, [edi + edi*2]
mov eax, dword [ebp - 0x40]
lea esi, [eax + edx*8]
lea ecx, [ebp + 0x608]
push ecx
mov edx, dword [esi + 4]
push edx
call fcn.0053ce80
mov eax, dword [esi + 8]
push eax
call fcn.00508720
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x2c], bl
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004d9250
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x28]
push edx
push str._s._s._s._s
lea eax, [ebp]
push eax
call fcn.005dfb23
mov ecx, dword [esi + 0x10]
push ecx
call fcn.00508720
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x2c], bl
push eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.004d9250
add esp, 0x50
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x28]
push eax
push str._s._s._s._s
lea ecx, [ebp + 0x104]
push ecx
call fcn.005dfb23
add esp, 0x18
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
movzx edx, word [esi + 0xc]
push edx
call dword [0x75d2c4]
movzx eax, ax
cmp eax, 0x1bd
je 0x53d9ec
cmp eax, 0x8b
jne 0x53d9f3
mov dword [ebp - 0x54], 1
push eax
lea eax, [ebp]
push eax
push str._s:_u_t
lea ecx, [ebp + 0x914]
push ecx
call fcn.005dfb23
add esp, 0x10
lea eax, [ebp + 0x914]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53da15
sub eax, edx
cmp eax, 0x11
jae 0x53da45
lea edi, [ebp + 0x914]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x53da30
mov dx, word [0x6484a0]
mov word [edi], dx
mov edi, dword [ebp - 0x38]
movzx eax, word [esi + 0x14]
push eax
call dword [0x75d2c4]
movzx ecx, ax
push ecx
lea edx, [ebp + 0x104]
push edx
push str._s:_u_t
lea eax, [ebp + 0x70c]
push eax
call fcn.005dfb23
add esp, 0x10
lea eax, [ebp + 0x70c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53da78
sub eax, edx
cmp eax, 0x11
jae 0x53daa5
lea edi, [ebp + 0x70c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x53da90
mov cx, word [0x6484a0]
mov word [edi], cx
mov edi, dword [ebp - 0x38]
cmp dword [ebp - 0x54], ebx
je 0x53dae3
cmp dword [esi + 4], 2
je 0x53dae3
lea edx, [ebp + 0x608]
push edx
mov eax, dword [esi + 0x18]
push eax
lea ecx, [ebp + 0x70c]
push ecx
lea edx, [ebp + 0x914]
push edx
push str._s_s_u_t_s
lea eax, [ebp + 0x208]
push eax
call fcn.005dfb23
mov dword [ebp - 0x50], 1
jmp 0x53db0d
lea ecx, [ebp + 0x608]
push ecx
mov edx, dword [esi + 0x18]
push edx
lea eax, [ebp + 0x70c]
push eax
lea ecx, [ebp + 0x914]
push ecx
push 0x6545dc
lea edx, [ebp + 0x208]
push edx
call fcn.005dfb23
add esp, 0x18
mov esi, dword [ebp - 0x1c]
cmp esi, 0xffffffff
je 0x53dbd8
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53db25
sub eax, edx
push ebx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea edx, [ebp + 0x208]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x63f820
lea eax, [ebp + 0x208]
push eax
call fcn.005dfb23
add esp, 8
lea eax, [ebp + 0x208]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53db60
sub eax, edx
push ebx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea edx, [ebp + 0x208]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x50], ebx
je 0x53dbec
cmp byte [0x75d2c8], bl
je 0x53dbec
lea ecx, [ebp + 0x914]
push ecx
lea edx, [ebp + 0x70c]
push edx
push str.REM:_s___LOC:_s
lea eax, [ebp + 0x810]
push eax
call fcn.005dfb23
add esp, 0x10
push ebx
push ebx
push 0x75d2c8
lea ecx, [ebp + 0x810]
push ecx
push 0x60c810
push ebx
push str.eScan_Monitor
push 0x6d6
call fcn.00513910
inc edi
jmp 0x53d658
lea edx, [ebp + 0x208]
push edx
push 0x60c990
call fcn.005e0e7f
add esp, 8
inc edi
jmp 0x53d658
lea edx, [esi*8]
sub edx, esi
mov eax, dword [ebp - 0x30]
lea edi, [eax + edx*8]
mov ecx, dword [ebp + 0xa34]
cmp ecx, dword [edi + 0x38]
jne 0x53dc4f
movzx edx, word [edi + 0x30]
push edx
call dword [0x75d2c4]
cmp ax, 0x50
je 0x53dc47
movzx eax, word [edi + 0x30]
push eax
call dword [0x75d2c4]
mov ecx, 0x1bb
cmp ax, cx
je 0x53dc47
movzx edx, word [edi + 0x30]
push edx
call dword [0x75d2c4]
mov ecx, 0x400
cmp ax, cx
jb 0x53dc4f
mov edx, dword [edi + 0x38]
mov dword [ebp - 0x34], edx
jmp 0x53dc6e
inc esi
jmp 0x53d6d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x40]
cmp eax, ebx
je 0x53dc85
push eax
call fcn.005e0865
add esp, 4
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x53dc95
push eax
call fcn.005e0865
add esp, 4
cmp dword [ebp - 0x1c], 0xffffffff
je 0x53dca4
lea eax, [ebp - 0x1c]
push eax
call fcn.004dca10
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa18]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0xa1c
mov esp, ebp
pop ebp
ret