Function at 0x586d78
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, eax
mov esi, edx
mov eax, dword [eax]
test eax, eax
je 0x582d67
mov dword [esp], eax
call fcn.00582b88
mov eax, dword [ebx + 0x30]
lea edx, [ebx + 0x38]
cmp eax, edx
je 0x582d79
mov dword [esp], eax
call fcn.004ed958
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x582d85
call fcn.00582c68
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x582d93
mov eax, ebx
call fcn.00580c24
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x582da5
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00582d0c
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x582db7
mov dword [esp], eax
call fcn.004ed958
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x582dc9
mov dword [esp], eax
call fcn.004ed958
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x582dde
mov edx, dword [ebx + 0x8c]
call fcn.00580c84
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x582df1
mov dword [ebx + 0x14], esi
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], edx
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], 0x90
mov dword [esp], 0x67f9f4
call fcn.0050879c
mov ebx, eax
test ebp, 0x2000
je 0x587358
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x587348
test edi, edi
je 0x587348
test ebp, 4
jne 0x58733c
mov eax, ebp
and eax, 3
cmp eax, 2
je 0x587348
mov eax, dword [esp + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], edi
mov edx, dword [esp + 0x18]
lea eax, [edi + edx*2]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x2c], 0
lea edx, [ebx + 0x38]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], 0xa
xor eax, eax
jmp 0x586e37
mov edx, dword [ebx + 0x30]
mov dword [edx + eax], 0
add eax, 4
cmp eax, 0x28
jne 0x586e34
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov word [ebx + 0x68], 0xffff
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov eax, dword [esp + 0x14]
mov dword [eax], 0xfed7
mov dword [eax + 8], 0
mov dword [eax + 0xc], 2
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0x5e2dc0
mov dword [esp], 0x928
call fcn.004ed800
mov ebp, eax
mov edx, dword [esp + 0x14]
mov dword [edx + 0x14], eax
test eax, eax
je 0x587500
mov dword [eax + 0x10], 0
lea edx, [eax + 0x3c]
mov dword [eax + 0x3c], 0x876
mov dword [eax + 0x40], ebx
mov dword [eax + 0x44], 0xa
lea eax, [eax + 0x54]
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x48], 0
mov word [ebp + 0x4c], 0
mov word [ebp + 0x58], 0xffff
mov dword [ebp + 0x5c], 0
mov dword [ebp + 0x60], 0
mov dword [ebp + 0x54], 0x10000
lea edi, [ebp + 0x11c]
lea ecx, [ebp + 0x51c]
mov eax, 0xff
nop
mov dword [edi + eax*4], ecx
dec eax
cmp eax, 0xffffffff
jne 0x586f3c
mov eax, 0xff
lea edi, [edx + 0x4e0]
mov word [edi + eax*2], 0
dec eax
cmp eax, 0xffffffff
jne 0x586f50
mov dword [ebp + 0x64], ecx
mov dword [ebx + 0x64], edx
mov dword [ebp + 0x920], 0
mov dword [ebp + 0x924], 0
mov dword [ebp + 0x14], 0
xor ecx, ecx
mov eax, ebx
call fcn.00585390
mov dword [ebx + 0x60], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
mov edx, 0x14
mov eax, 0x64
call fcn.00580b34
mov dword [ebx + 0x80], eax
test eax, eax
je 0x587500
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x587380
mov edi, dword [ebx + 8]
mov edx, dword [ebx + 4]
mov ecx, edi
sub ecx, edx
cmp ecx, 7
jle 0x587374
cmp word [edx], 0x2a
jne 0x587374
cmp word [edx + 2], 0x2a
jne 0x587374
cmp word [edx + 4], 0x2a
jne 0x587374
mov cx, word [edx + 6]
cmp cx, 0x3d
je 0x587598
cmp cx, 0x3f
je 0x58757a
cmp cx, 0x3a
je 0x58735f
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587026
mov dword [ebx + 0x14], 0xd
test byte [ebx + 0x18], 0xc0
jne 0x58750a
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
mov eax, dword [ebx + 0x60]
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
mov dword [esp], eax
mov ecx, 0x70
mov edx, 0x65
mov eax, ebx
call fcn.00586b6c
mov dword [ebx + 0x70], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
mov eax, dword [ebx + 0x60]
call fcn.00584f88
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
test esi, esi
je 0x587535
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_RAW__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.00585344
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.00580980
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.005809ac
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00582d0c
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_TREE_FIXED__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x70]
mov edx, esi
call fcn.00585344
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 8]
mov edx, dword [ebx + 0x70]
mov ecx, esi
mov eax, ebx
call fcn.005855b4
or eax, edi
mov edx, dword [esp + 0x14]
mov dword [edx + 8], eax
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
cmp dword [ebx + 0x8c], 1
jle 0x587188
mov dword [esp + 0x18], 0x44
mov edi, 1
mov dword [esp + 0x1c], ebp
mov ebp, 0x44
nop
test esi, esi
je 0x58715c
mov dword [esp + 8], edi
mov dword [esp + 4], str._n_n_n_LA_d__n
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov edx, dword [ebx + 0x88]
add edx, ebp
mov ecx, esi
mov eax, ebx
call fcn.00585504
inc edi
add ebp, 0x44
cmp dword [ebx + 0x8c], edi
jg 0x587144
mov ebp, dword [esp + 0x1c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
mov eax, dword [ebx + 0x70]
test byte [eax + 1], 2
je 0x58719a
mov eax, dword [ebx]
or dword [eax + 8], 0x2000
test esi, esi
je 0x5871be
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str._n_n_n_SEARCH__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x60]
mov edx, esi
call fcn.005821b4
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
mov edi, dword [eax]
mov esi, dword [edi + 0x14]
test esi, esi
je 0x5873ce
mov ecx, dword [eax + 0x24]
mov eax, esi
mov dword [esp + 0x1c], esi
jmp 0x5871ff
mov eax, dword [eax + 0x10]
test eax, eax
je 0x58755d
mov edx, dword [eax + 4]
cmp cx, dx
je 0x5871f4
mov esi, dword [esp + 0x18]
cmp dx, word [esi + 0x26]
je 0x5871f4
mov edx, dword [ebx + 0x64]
mov dword [esp + 4], edi
mov dword [esp], edi
mov ecx, 0xffffffff
mov eax, dword [esp + 0x18]
call fcn.00585034
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x24]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.005819fc
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x26]
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, 0x70
call fcn.005819fc
mov esi, dword [edi + 0x14]
test esi, esi
je 0x5873bc
mov dword [esp + 0x24], 0
xor ecx, ecx
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0xc]
test eax, eax
jne 0x587283
jmp 0x587293
mov eax, dword [eax + 0x14]
test eax, eax
je 0x587293
cmp edi, dword [eax + 8]
je 0x58727c
mov eax, dword [edx + 0x1c]
test eax, eax
je 0x58752b
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x587270
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x5873bc
mov eax, dword [esp + 0x18]
add eax, 0x34
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
add edx, 0x20
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x18]
call fcn.005818dc
mov ebp, eax
mov esi, dword [esp + 0x24]
mov edx, dword [esi + 0x14]
mov ecx, eax
mov eax, dword [esp + 0x18]
call fcn.005820dc
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x58731d
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 8]
cmp edi, eax
je 0x587317
movsx ecx, word [ebx + 4]
mov dword [esp + 4], ebp
mov dword [esp], eax
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
call fcn.005819fc
mov ecx, ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
call fcn.00581474
mov ebx, esi
test esi, esi
jne 0x5872e8
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x1c], 0
test eax, eax
je 0x5873b4
mov dword [esp + 0x24], eax
jmp 0x5872c4
test ebp, 0xe3
je 0x586de2
mov eax, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x586dc2
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
or eax, 3
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
and eax, 3
cmp eax, 3
je 0x58746e
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587026
mov eax, dword [ebx + 0x18]
test al, 4
jne 0x587462
and eax, 1
neg eax
add eax, 2
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x20], 0x6e
mov eax, ebx
call fcn.005833e0
jmp 0x587026
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x18], eax
lea edx, [ebp + 0x14]
mov eax, dword [esp + 0x18]
call fcn.00580d38
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x587454
mov edx, dword [ebx + 0x2c]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], edx
mov dword [ebx], 0
mov dword [ebp], 0xfed9
mov eax, dword [ebx + 0x18]
mov dword [ebp + 4], eax
mov ecx, dword [esi + 8]
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov edx, dword [ebx + 0x70]
mov dword [ebp + 0x10], edx
mov dword [ebx + 0x70], 0
mov edx, dword [ebx + 0x7c]
mov dword [ebp + 0x38], edx
test al, 8
je 0x587566
mov eax, 0x5810fc
mov dword [ebp + 0x91c], eax
mov eax, dword [ebx + 0x88]
mov dword [ebp + 0x920], eax
mov dword [ebx + 0x88], 0
mov eax, dword [ebx + 0x8c]
mov dword [ebp + 0x924], eax
xor edx, edx
lea esi, [esi]
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x582d50
mov dword [ebx + 0x28], 3
jmp 0x5873a1
mov eax, dword [ebx + 4]
sub edi, eax
cmp edi, 5
jle 0x587380
cmp word [eax], 0x28
jne 0x587380
cmp word [eax + 2], 0x3f
jne 0x587380
movzx eax, word [eax + 4]
mov dword [esp], eax
call fcn.0050dbf4
test eax, eax
je 0x587380
mov eax, dword [ebx]
or dword [eax + 8], 0x80
mov eax, dword [ebx + 4]
add eax, 4
mov dword [ebx + 4], eax
cmp dword [ebx + 8], eax
jbe case.0x587573.2
movzx eax, word [eax]
mov dword [esp], eax
call fcn.0050dbf4
test eax, eax
je 0x5875b4
mov edx, dword [ebx + 4]
mov ax, word [edx]
sub eax, 0x62
cmp ax, 0x16
jbe 0x587570
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587026
mov dword [ebx + 0x14], 0x12
jmp 0x587026
mov edx, 0xc
jmp 0x587454
mov eax, dword [ebx + 0x64]
mov edx, 0xa
call fcn.0058133c
mov word [ebx + 0x68], ax
mov edx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x60]
call fcn.00581c90
jmp 0x587030
mov dword [edx + 0x1c], ecx
mov ecx, edx
jmp 0x587293
mov eax, dword [ebx + 0x70]
mov edx, 1
call fcn.00580980
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x70]
call fcn.005809ac
lea edx, [ebx + 0x78]
lea eax, [ebx + 0x74]
call fcn.00582d0c
jmp 0x5870fc
mov esi, dword [esp + 0x1c]
jmp 0x587266
mov eax, 0x581468
jmp 0x587427
movzx eax, ax
jmp dword [eax*4 + 0x620004]
mov dword [ebx + 0x20], 0x65
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x587026
mov dword [ebx + 0x14], 2
jmp 0x587026
mov ecx, dword [ebx]
or dword [ecx + 8], 0x80
and al, 0x1c
or eax, 4
mov dword [ebx + 0x18], eax
add edx, 8
mov dword [ebx + 4], edx
jmp 0x587380
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jae case.0x587573.2
cmp word [eax], 0x29
jne case.0x587573.2
add eax, 2
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
test al, 4
je 0x587380
and al, 0x1f
mov dword [ebx + 0x18], eax
jmp 0x587380
or dword [ebx + 0x18], 0x20
lea eax, [edx + 2]
mov dword [ebx + 4], eax
cmp eax, dword [ebx + 8]
jb 0x5874bc
jmp case.0x587573.2
mov eax, dword [ebx + 0x18]
and eax, 0xffffffbf
or al, 0x80
mov dword [ebx + 0x18], eax
jmp 0x5875e9
and dword [ebx + 0x18], 0xffffffdf
jmp 0x5875e9
and dword [ebx + 0x18], 0xffffff3f
jmp 0x5875e9
mov eax, dword [ebx + 0x18]
and eax, 0xfffffffc
or eax, 4
mov dword [ebx + 0x18], eax
jmp 0x5875e9
mov eax, dword [ebx + 0x18]
and al, 0x7f
or eax, 0x40
mov dword [ebx + 0x18], eax
jmp 0x5875e9
or dword [ebx + 0x18], 0xc0
jmp 0x5875e9
or dword [ebx + 0x18], 8
jmp 0x5875e9
mov eax, dword [ebx + 0x18]
and eax, 0xfffffff9
or eax, 1
mov dword [ebx + 0x18], eax
jmp 0x5875e9
and dword [ebx + 0x18], 0xfffffff7
jmp 0x5875e9
and dword [ebx + 0x18], 0xfffffff8
jmp 0x5875e9