Function at 0x401000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1058
call fcn.00402010
mov edi, dword [esp + 0x1070]
mov esi, dword [esp + 0x106c]
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1054], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0x30b0005
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x14], 0x48
mov eax, dword [esi + 4]
mov dword [esp + 0x18], eax
pxor xmm0, xmm0
movdqu xmmword [esp + 0x1024], xmm0
movdqu xmmword [esp + 0x1034], xmm0
movdqu xmmword [esp + 0x1040], xmm0
mov dword [esp + 0x101c], 0x10001000
mov dword [esp + 0x1020], 0
mov byte [esp + 0x1024], 1
mov word [esp + 0x102a], 1
mov dword [esp + 0x1050], 2
push edi
call fcn.00407940
add esp, 4
cmp eax, 0x24
jne 0x4011f3
xor ecx, ecx
mov ebp, 0x842100
mov dword [esp], 0
xor ebx, ebx
jmp 0x4010e7
mov edx, dword [esp]
add dl, al
lea eax, [ebx - 1]
shr eax, 1
mov dword [esp], edx
mov byte [esp + eax + 0x1c], dl
inc ebx
inc ecx
cmp ecx, 0x24
je 0x401133
movzx eax, byte [edi + ecx]
cmp ecx, 0x17
ja 0x401100
bt ebp, ecx
jae 0x401100
cmp al, 0x2d
je 0x4010e1
jmp 0x4011f3
mov ah, al
add ah, 0x9f
cmp ah, 5
ja 0x40110e
add al, 0xa9
jmp 0x401126
mov ah, al
add ah, 0xbf
cmp ah, 5
ja 0x40111c
add al, 0xc9
jmp 0x401126
add al, 0xd0
cmp al, 9
ja 0x4011f3
test bl, 1
jne 0x4010cf
shl al, 4
mov dword [esp], eax
jmp 0x4010e0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
movq xmm0, qword [esp + 0x1c]
pxor xmm1, xmm1
punpcklbw xmm0, xmm1
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0xb1
packuswb xmm0, xmm0
movq qword [esp + 0x102c], xmm0
mov dword [esp + 0x1038], ecx
mov dword [esp + 0x1034], eax
mov eax, dword [esp + 0x1074]
mov dword [esp + 0x103c], eax
xor eax, eax
mov ebp, 0x842100
mov dword [esp], 0
xor edx, edx
jmp 0x4011a6
mov ecx, dword [esp]
add cl, bl
lea edi, [edx - 1]
shr edi, 1
mov dword [esp], ecx
mov byte [esp + edi + 0x1c], cl
inc edx
inc eax
cmp eax, 0x24
je 0x401213
movzx ebx, byte [eax + str.8a885d04_1ceb_11c9_9fe8_08002b104860]
cmp eax, 0x17
ja 0x4011c0
bt ebp, eax
jae 0x4011c0
cmp bl, 0x2d
je 0x4011a0
jmp 0x4011f3
mov bh, bl
add bh, 0x9f
cmp bh, 5
ja 0x4011cf
add bl, 0xa9
jmp 0x4011e6
mov bh, bl
add bh, 0xbf
cmp bh, 5
ja 0x4011de
add bl, 0xc9
jmp 0x4011e6
add bl, 0xd0
cmp bl, 9
ja 0x4011f3
test dl, 1
jne 0x40118e
shl bl, 4
mov dword [esp], ebx
jmp 0x40119f
mov ebx, 1
mov ecx, dword [esp + 0x1054]
xor ecx, esp
call fcn.00401ff6
mov eax, ebx
add esp, 0x1058
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
movq xmm0, qword [esp + 0x1c]
pxor xmm1, xmm1
punpcklbw xmm0, xmm1
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0xb1
packuswb xmm0, xmm0
movq qword [esp + 0x1040], xmm0
mov dword [esp + 0x104c], ecx
mov dword [esp + 0x1048], eax
lea edi, [esp + 8]
lea eax, [esp + 0xc]
push 0
push edi
push 0x10
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, 1
test eax, eax
je 0x4011f8
lea eax, [esp + 0x101c]
push 0
push edi
push 0x38
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4011f8
inc dword [esi + 4]
lea edi, [esp + 0x1c]
push 0x1000
push 0
push edi
call fcn.00403610
add esp, 0xc
lea eax, [esp + 4]
push 0
push eax
push 0x1000
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4011f8
cmp word [esp + 0x1c], 5
jne 0x4011f8
cmp byte [esp + 0x1e], 0xc
jne 0x4011f8
cmp byte [esp + 0x1f], 3
jne 0x4011f8
movzx eax, word [esp + 0x24]
cmp dword [esp + 4], eax
jne 0x4011f8
movzx eax, word [esp + 0x34]
cmp eax, 0x100
ja 0x4011f8
lea ecx, [eax + 5]
and ecx, 0xfffffffc
sub ecx, eax
lea edx, [esp + eax]
add edx, 0x1c
cmp dword [ecx + edx + 0x18], 1
jne 0x4011f8
add eax, esp
add eax, 0x36
xor ebx, ebx
cmp word [eax + ecx + 2], 0
setne bl
jmp 0x4011f8