Function at 0x50535e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69c7da
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1007c
call fcn.0056e5a0
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10080], ebx
push ebx
push SysReAllocString
push 3
push ebx
push ebx
push 0xc0000000
push esi
call fcn.005654e9
add esp, 0x1c
mov edi, eax
mov dword [ebp - 0x1008c], edi
cmp edi, 0xffffffff
je 0x50564c
push esi
call fcn.005655b9
pop ecx
mov esi, eax
cmp edx, ebx
ja 0x5053dd
cmp esi, ebx
jbe 0x505645
lea eax, [esi + 2]
push eax
call fcn.0056e306
pop ecx
mov dword [ebp - 0x1007c], eax
test eax, eax
je 0x505635
mov dword [ebp - 0x10084], ebx
push ebx
lea ecx, [ebp - 0x10084]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x505635
cmp dword [ebp - 0x10084], esi
jne 0x505635
mov eax, dword [ebp - 0x1007c]
mov word [esi + eax], bx
lea ecx, [ebp - 0x10070]
call fcn.00419778
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10071], bl
mov dword [ebp - 0x10088], ebx
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x1007c]
push esi
lea ecx, [ebp - 0x10070]
call fcn.00504228
push ebx
push ebx
push str.plist
lea ecx, [ebp - 0x10070]
call fcn.005058f1
mov dword [ebp - 0x10088], eax
test eax, eax
je 0x505505
push ebx
push ebx
push str.dict
mov ecx, eax
call fcn.005058f1
test eax, eax
je 0x505505
push ebx
push ebx
push 0x6eb83c
mov ecx, eax
call fcn.005058f1
mov ecx, eax
mov eax, 0x795d20
mov dword [ebp - 0x10078], ecx
test ecx, ecx
je 0x505505
cmp dword [ecx + 4], 0
cmovne eax, dword [ecx + 4]
push eax
push str.RecentSearchStrings
call fcn.0064821f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10078]
test eax, eax
jne 0x50550a
mov eax, dword [ecx + 0x2c]
mov dword [ebp - 0x10078], eax
test eax, eax
je 0x505505
cmp dword [eax], 0
mov ecx, 0x795d20
cmovne ecx, dword [eax]
push ecx
push 0x6eb854
call fcn.0064821f
pop ecx
pop ecx
test eax, eax
jne 0x505505
mov ecx, dword [ebp - 0x10078]
call fcn.0042c537
mov byte [ebp - 0x10071], 1
mov dword [ebp - 4], ebx
jmp 0x50552f
push ebx
push ebx
push 0x6eb85c
call fcn.0050599f
jmp 0x50549a
cmp byte [ebp - 0x10071], 0
je 0x505624
mov byte [ebp - 4], 3
push ebx
push ebx
push ebx
push ebx
push str.xml_version_1.0__encoding_utf_8_
lea ecx, [ebp - 0x10040]
call fcn.0041ca69
push eax
push 7
lea ecx, [ebp - 0x10040]
call fcn.0041c9c6
push eax
push dword [ebp - 0x10088]
lea ecx, [ebp - 0x10070]
call fcn.0050595c
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov byte [ebp - 4], 4
push ebx
push ebx
lea eax, [ebp - 0x10070]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10078]
push eax
call fcn.0049a103
add esp, 0x14
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5055f3
mov dword [ebp - 0x10078], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x5055c8
lea eax, [ebp - 0x2c]
push ebx
lea ecx, [ebp - 0x10078]
push ecx
push dword [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10080], eax
test eax, eax
je 0x5055f3
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041c86a
mov dword [ebp - 4], ebx
jmp 0x505624
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10040]
call fcn.0041cc8c
jmp 0x50563b
mov esi, dword [ebp - 0x1007c]
push 1
push esi
call fcn.0056df27
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10080]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 4