Function at 0x570c30
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x480
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x24]
xor edx, edx
push esi
xor ebp, ebp
cmp eax, 2
push edi
mov dword [esp + 0x1c], edx
je 0x570c68
cmp eax, ebp
je 0x570c63
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x570c85
cmp dword [ebx + 0x40], ebp
je 0x570c85
mov eax, dword [ebx + 0x10]
cmp eax, ebp
je 0x570c85
cmp dword [eax], ebp
jle 0x570c85
mov ecx, ebx
call fcn.0056c1c0
mov dword [esp + 0x1c], eax
mov edx, eax
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebx + 0x10]
cmp ecx, ebp
mov dword [esp + 0x20], eax
mov eax, 1
je 0x570ecc
cmp dword [ecx], ebp
jle 0x570e96
mov dword [ebx + 0x10b8], eax
cmp dword [ecx], ebp
mov dword [esp + 0x18], ebp
jle 0x570e96
lea ecx, [ecx]
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [eax + ecx*4]
xor eax, eax
mov ecx, 0x15
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x28], 0xb014d55
mov edx, dword [esi + 4]
mov dword [esp + 0x2c], edx
mov eax, dword [esi + 8]
mov dword [esp + 0x30], eax
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x34], ecx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x38], edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x3c], eax
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x40], ecx
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x44], edx
mov eax, dword [esi + 0x20]
mov dword [esp + 0x48], eax
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x4c], ecx
mov edx, dword [esi + 0x28]
mov dword [esp + 0x50], edx
mov eax, dword [esi + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x54], eax
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x58], ecx
mov edx, dword [esi + 0x38]
mov dword [esp + 0x5c], edx
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x60], eax
mov ecx, dword [esi + 0x40]
mov dword [esp + 0x74], ecx
mov edx, dword [esi + 0x44]
push ebp
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x80], edx
mov eax, dword [esi + 0x34]
push 0x54
lea edx, [esp + 0x34]
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0xc]
push edx
push eax
mov dword [esp + 0x28], ebp
call edi
mov edx, dword [ebx + 0x18]
mov ecx, dword [esp + 0x14]
add edx, ecx
mov dword [ebx + 0x18], edx
mov edx, dword [ebx + 0x1c]
adc edx, ebp
cmp eax, ebp
mov dword [ebx + 0x1c], edx
je 0x570ebf
cmp dword [esi + 0x38], ebp
jle 0x570e09
push 0x104
lea edx, [esi + 0x48]
push edx
lea eax, [esp + 0x88]
push eax
call dword [0x5d2618]
lea ecx, [esp + 0x8c]
add esp, 0xc
test ecx, ecx
mov word [esp + 0x286], bp
je 0x570dd3
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
mov ecx, dword [esi + 0x38]
push ebp
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx + 0xc]
shl ecx, 1
push ecx
lea edx, [esp + 0x8c]
push edx
push eax
call edi
cmp eax, ebp
je 0x570ebf
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x18]
add edx, ecx
mov ecx, dword [ebx + 0x1c]
adc ecx, ebp
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], ecx
cmp dword [esi + 0x3c], ebp
jle 0x570e7c
push 0x104
lea edx, [esi + 0x250]
push edx
lea eax, [esp + 0x290]
push eax
call dword [0x5d2618]
lea ecx, [esp + 0x294]
add esp, 0xc
test ecx, ecx
mov word [esp + 0x48e], bp
je 0x570e4a
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
mov ecx, dword [esi + 0x3c]
push ebp
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx + 0xc]
shl ecx, 1
push ecx
lea edx, [esp + 0x294]
push edx
push eax
call edi
cmp eax, ebp
je 0x570e7c
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x18]
add edx, ecx
mov ecx, dword [ebx + 0x1c]
adc ecx, ebp
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx + 0x10]
mov esi, dword [edx]
inc ecx
cmp ecx, esi
mov dword [esp + 0x18], ecx
jl 0x570cc0
mov edx, dword [esp + 0x1c]
cmp edx, ebp
jl 0x570eeb
cmp eax, ebp
je 0x570eeb
cmp dword [ebx + 0x10b8], ebp
je 0x570eeb
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
mov ecx, ebx
call fcn.0056c520
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x8004e009
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
push str.AddCentralDirectory
push 0xaaaaaaa3
mov ecx, ebx
call fcn.0056a380
mov eax, 0x8007000e
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret