Function at 0x430faf
Capabilities:
Inspect section memory permissions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [ebp + 0xc]
mov edi, eax
push 8
pop eax
push 8
mov edx, dword [esi]
mov ecx, edx
sar ecx, 0x14
and ecx, 7
sar edx, 0x17
shl eax, cl
and edx, 7
pop ebx
mov ecx, edx
mov dword [ebp - 0xc], eax
shl ebx, cl
push 4
mov dword [ebp - 4], ebx
imul ebx, eax
pop eax
push eax
mov dword [ebp - 0x10], edi
push ebx
call dword [sym.imp.msvcrt.dll_calloc]
push 1
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push esi
push dword [ebp - 4]
push dword [ebp - 0xc]
push eax
call fcn.004308dd
xor edx, edx
add esp, 0x20
mov esi, edx
test ebx, ebx
jle 0x431059
mov edi, dword [ebp - 8]
mov ecx, dword [edi + esi*4]
mov edx, ecx
shr edx, 0x10
and edx, 0xff
movzx eax, cl
shl eax, 0x10
and ecx, 0xff00ff00
or edx, eax
or edx, ecx
mov dword [edi + esi*4], edx
inc esi
cmp esi, ebx
jl 0x43102e
mov edi, dword [ebp - 0x10]
xor edx, edx
mov esi, dword [ebp - 8]
mov eax, edx
test ebx, ebx
jle 0x431072
cmp byte [esi + eax*4 + 3], 0xff
jb 0x43122e
inc eax
cmp eax, ebx
jl 0x431062
mov eax, edx
push 0x18
pop ebx
test eax, eax
mov dword [ebp - 0x4c], 0x20014
mov eax, dword [ebp - 4]
push 0x20
pop ecx
cmovne ebx, ecx
mov word [ebp - 0x3e], ax
mov eax, ebx
mov byte [ebp - 0x33], cl
cdq
and edx, 7
mov byte [ebp - 0x2f], cl
mov ecx, dword [ebp - 0xc]
add eax, edx
sar eax, 3
imul eax, dword [ebp - 4]
push 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3b], 0x534e4e08
imul eax, ecx
mov dword [ebp - 0x37], 0x6167545f
mov word [ebp - 0x32], 0x6556
mov byte [ebp - 0x30], 0x72
mov dword [ebp - 0x2e], 0x302e31
add eax, 0x26
mov word [ebp - 0x40], cx
mov dword [ebp - 0x2a], eax
lea eax, [ebp - 0x14]
push eax
push 0x26
lea eax, [ebp - 0x4c]
mov byte [ebp - 0x3c], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push dword [ebp - 4]
push dword [ebp - 0xc]
push esi
push edi
call fcn.00431359
mov ebx, dword [ebp + 0xc]
add esp, 0x14
mov eax, dword [ebx]
sar eax, 0x1a
and eax, 7
push 0xffffffffffffffff
push eax
call fcn.004302be
pop ecx
push eax
push str.nns_frmt
push edi
call fcn.004313ef
push dword [ebx]
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.00430034
push eax
push dword [ebx + 8]
mov dword [ebp - 0x10], eax
push str.nns_txel
push edi
call fcn.004313ef
mov ecx, dword [ebx]
mov edx, 0x1c000000
and ecx, edx
add esp, 0x2c
cmp ecx, 0x14000000
jne 0x431178
mov eax, dword [ebp - 0x10]
cdq
sub eax, edx
sar eax, 1
push eax
push dword [ebx + 0xc]
push str.nns_pidx
push edi
call fcn.004313ef
add esp, 0x10
mov edx, 0x1c000000
mov eax, dword [ebx]
and eax, edx
cmp eax, edx
je 0x43124e
mov esi, dword [ebp + 0x10]
add esi, 8
push esi
call fcn.00431518
push eax
push esi
push str.nns_pnam
push edi
call fcn.004313ef
mov edx, dword [ebp + 0x10]
add esp, 0x14
mov eax, dword [edx]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
and eax, 0x1c000000
push 4
pop esi
cmp eax, 0x8000000
jne 0x4311c0
cmp ecx, esi
cmovg ecx, esi
cmp ecx, esi
je 0x431236
mov eax, ecx
and eax, 0x80000007
jns 0x4311d2
dec eax
or eax, 0xfffffff8
inc eax
je 0x431236
lea eax, [ecx + 7]
cdq
and edx, 7
lea ebx, [edx + eax]
and ebx, 0xfffffff8
cmp ecx, esi
jge 0x4311f2
lea eax, [ecx + 3]
cdq
and edx, 3
lea ebx, [edx + eax]
and ebx, 0xfffffffc
push 2
push ebx
call dword [sym.imp.msvcrt.dll_calloc]
mov ecx, dword [ebp - 0x10]
mov esi, eax
mov eax, dword [ebp + 0x10]
add ecx, ecx
push ecx
push dword [eax + 4]
push esi
call sub.msvcrt.dll_memcpy
lea ecx, [ebx + ebx]
push ecx
push esi
push str.nns_pcol
push edi
call fcn.004313ef
push esi
call dword [sym.imp.msvcrt.dll_free]
mov ebx, dword [ebp + 0xc]
add esp, 0x28
jmp 0x43124b
xor eax, eax
inc eax
jmp 0x431074
lea eax, [ecx + ecx]
push eax
push dword [edx + 4]
push str.nns_pcol
push edi
call fcn.004313ef
add esp, 0x10
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.0043145c
push 0xffffffffffffffff
push 0x43ce28
push str.nns_gnam
push edi
call fcn.004313ef
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
push str.nns_gver
push edi
call fcn.004313ef
push 0
push 0
push str.nns_imst
push edi
call fcn.004313ef
add esp, 0x38
test dword [ebx], 0x20000000
je 0x4312a8
push 0
push 0
push str.nns_c0xp
push edi
call fcn.004313ef
add esp, 0x10
push 0
push 0
push str.nns_endb
push edi
call fcn.004313ef
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret