Function at 0x403170
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp + 0x80]
mov qword [rbp - 0x20], rax
mov rcx, qword [0x00442300]
mov rcx, qword [rcx]
xor rcx, rbp
mov qword [rbp + 0x48], rcx
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r8
mov dword [rbp - 4], 0xaaaaaaaa
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
cmp byte [rax + 8], 0
jne 0x4031eb
jmp 0x403223
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x20]
call fcn.004043f0
cmp byte [rbp + 0x24], 0
jne 0x403255
jmp 0x40325d
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov ecx, eax
mov dword [rbp + 0x10], ecx
mov ecx, 0x20
shr rax, cl
mov dword [rbp + 0x14], eax
mov qword [rbp + 0x18], 0
mov rax, rbp
mov qword [rbp - 0x48], rax
jmp 0x4031ce
xor eax, eax
mov qword [rbp - 0x48], rax
jmp 0x4031ce
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x38]
mov r9, qword [rbp - 0x40]
mov r8d, dword [rbp - 0x4c]
mov rax, rsp
mov qword [rax + 0x20], r9
lea r9, [rbp - 4]
call sub.KERNEL32.dll_WriteFile
cmp eax, 0
je 0x4032b1
jmp 0x403355
mov eax, dword [rbp + 0x20]
mov dword [rbp - 0x4c], eax
jmp 0x40322b
mov eax, 0xffffffff
mov dword [rbp - 0x4c], eax
jmp 0x40322b
mov rax, qword [rbp - 0x30]
mov ecx, dword [rbp - 4]
mov word [rbp + 0x40], 0
mov qword [rbp + 0x38], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x40]
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x4032a4
call fcn.0041bf30
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
call fcn.004044c0
mov cx, ax
mov word [rbp - 0x4e], cx
sub ax, 6
je 0x4034d8
jmp 0x4032c9
mov ax, word [rbp - 0x4e]
sub ax, 8
je 0x4033dd
jmp 0x4032d9
mov ax, word [rbp - 0x4e]
sub ax, 0x21
je 0x40350f
jmp 0x4032e9
mov ax, word [rbp - 0x4e]
sub ax, 0x40
je 0x403546
jmp 0x4032f9
mov ax, word [rbp - 0x4e]
sub ax, 0x6d
je 0x4034a1
jmp 0x403309
mov ax, word [rbp - 0x4e]
movzx eax, ax
sub eax, 0x3e3
je 0x403414
jmp 0x40331d
mov ax, word [rbp - 0x4e]
movzx eax, ax
sub eax, 0x3e5
je 0x403482
jmp 0x403331
mov ax, word [rbp - 0x4e]
movzx eax, ax
sub eax, 0x6f8
je 0x4033a6
jmp 0x403341
mov ax, word [rbp - 0x4e]
movzx eax, ax
sub eax, 0x718
je 0x40344b
jmp 0x40335a
jmp 0x403267
mov cx, word [rbp - 0x4e]
call fcn.004044e0
mov cx, ax
mov rax, qword [rbp - 0x30]
mov word [rbp + 0x30], cx
mov rcx, qword [rbp + 0x28]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x30]
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x403399
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441400]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x4033d0
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441400]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x403407
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441410]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x40343e
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441400]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x403475
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
lea rcx, str.reached_unreachable_code
mov edx, 0x18
xor eax, eax
lea r9, [0x00441420]
xor eax, eax
mov r8d, eax
call fcn.00401340
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441430]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x4034cb
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441440]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x403502
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441450]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x403539
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [0x00441460]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x40329f
jmp 0x403570
mov rax, qword [rbp - 0x28]
add rsp, 0xd0
pop rbp
ret