Function at 0x402b50
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x180
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], rcx
mov dword [rbp + 0x118], edx
mov qword [rbp + 0x120], r8
lea rax, [rbp + 0x50]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0x110], 0
jne 0x402ba2
mov r8d, 0x3a
lea rdx, str.C:Usersl00810585Downloads_nbtscan_source_1.0.35dump_packet.c
lea rcx, [0x00409871]
call sym._assert
cmp qword [rbp + 0x120], 0
jne 0x402bc5
mov r8d, 0x3b
lea rdx, str.C:Usersl00810585Downloads_nbtscan_source_1.0.35dump_packet.c
lea rcx, str.ofp___0
call sym._assert
mov rax, qword [rbp + 0x110]
movzx eax, word [rax + 2]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_ntohs]
call rax
mov word [rbp + 0xdc], ax
lea rax, [rbp + 0x50]
mov qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0xdc]
test ax, ax
jns 0x402c1d
mov rax, qword [rbp + 0xe8]
lea rdx, [0x00409883]
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
jmp 0x402c3c
mov rax, qword [rbp + 0xe8]
lea rdx, [0x00409887]
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0xdc]
sar eax, 0xb
and eax, 0xe
mov word [rbp + 0xda], ax
movzx eax, word [rbp + 0xda]
cmp eax, 8
ja case.0x402c80.1
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x004099a0]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x004099a0]
add rax, rdx
jmp rax
mov rax, qword [rbp + 0xe8]
lea rdx, str._opQuery
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
jmp 0x402d57
mov rax, qword [rbp + 0xe8]
lea rdx, str._opReg
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
jmp 0x402d57
mov rax, qword [rbp + 0xe8]
lea rdx, str._opRelease
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
jmp 0x402d57
mov rax, qword [rbp + 0xe8]
lea rdx, str._opWACK
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
jmp 0x402d57
mov rax, qword [rbp + 0xe8]
lea rdx, str._opRefresh
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
jmp 0x402d57
movzx edx, word [rbp + 0xda]
mov rax, qword [rbp + 0xe8]
mov r8d, edx
lea rdx, str._op_d
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
nop
movzx eax, word [rbp + 0xdc]
and eax, 0x400
test eax, eax
je 0x402d86
mov rax, qword [rbp + 0xe8]
lea rdx, [0x004098c5]
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0xdc]
and eax, 0x200
test eax, eax
je 0x402db5
mov rax, qword [rbp + 0xe8]
lea rdx, [0x004098c9]
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0xdc]
and eax, 0x100
test eax, eax
je 0x402de4
mov rax, qword [rbp + 0xe8]
lea rdx, [0x004098cd]
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0xdc]
and eax, 0x80
test eax, eax
je 0x402e13
mov rax, qword [rbp + 0xe8]
lea rdx, [0x004098d1]
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0xdc]
and eax, 0x10
test eax, eax
je 0x402e40
mov rax, qword [rbp + 0xe8]
lea rdx, [0x004098d5]
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0xdc]
and eax, 0xf
mov edx, eax
mov rax, qword [rbp + 0xe8]
mov r8d, edx
lea rdx, str._rcode_d
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x120]
mov r9, rax
mov r8d, 0xf
mov edx, 1
lea rcx, str.DUMP_OF_PACKET_n
call sym.fwrite
mov rax, qword [rbp + 0x110]
movzx eax, word [rax]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_ntohs]
call rax
movzx edx, ax
mov rax, qword [rbp + 0x120]
mov r8d, edx
lea rdx, str.__tranid_________d_n
mov rcx, rax
call sym.fprintf
movzx edx, word [rbp + 0xdc]
lea rcx, [rbp + 0x50]
mov rax, qword [rbp + 0x120]
mov r9, rcx
mov r8d, edx
lea rdx, str.__flags_________0x_02x____s_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x110]
movzx eax, word [rax + 4]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_ntohs]
call rax
movzx edx, ax
mov rax, qword [rbp + 0x120]
mov r8d, edx
lea rdx, str.__query_count____d_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x110]
movzx eax, word [rax + 6]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_ntohs]
call rax
movzx edx, ax
mov rax, qword [rbp + 0x120]
mov r8d, edx
lea rdx, str.__answer_count___d_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x110]
movzx eax, word [rax + 8]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_ntohs]
call rax
movzx edx, ax
mov rax, qword [rbp + 0x120]
mov r8d, edx
lea rdx, str.__ns_count_______d_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x110]
movzx eax, word [rax + 0xa]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_ntohs]
call rax
movzx edx, ax
mov rax, qword [rbp + 0x120]
mov r8d, edx
lea rdx, str.__ar_count_______d_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x110]
add rax, 0xc
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0x120]
mov rdx, rax
mov ecx, 0xa
call sym.fputc
mov edx, dword [rbp + 0x118]
mov rax, qword [rbp + 0x120]
mov r8d, edx
lea rdx, str.__data_bytes_...__d_n
mov rcx, rax
call sym.fprintf
lea rax, [rbp - 0x40]
mov qword [rbp + 0xf8], rax
lea rax, [rbp - 0x60]
mov qword [rbp + 0xf0], rax
jmp 0x4030ff
mov rax, qword [rbp + 0xe0]
lea rdx, [rax + 1]
mov qword [rbp + 0xe0], rdx
movzx eax, byte [rax]
mov byte [rbp + 0xdf], al
movzx edx, byte [rbp + 0xdf]
mov rax, qword [rbp + 0xf8]
mov r8d, edx
lea rdx, str._02X
mov rcx, rax
call sym.sprintf
cdqe
add qword [rbp + 0xf8], rax
movzx eax, byte [rbp + 0xdf]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_isprint]
call rax
test eax, eax
jne 0x40307f
mov byte [rbp + 0xdf], 0x2e
mov rax, qword [rbp + 0xf0]
lea rdx, [rax + 1]
mov qword [rbp + 0xf0], rdx
movzx edx, byte [rbp + 0xdf]
mov byte [rax], dl
mov rax, qword [rbp + 0xf8]
mov byte [rax], 0
mov rax, qword [rbp + 0xf0]
mov byte [rax], 0
lea rax, [rbp - 0x60]
mov rdx, qword [rbp + 0xf0]
sub rdx, rax
mov rax, rdx
cmp rax, 0xf
jle 0x4030ff
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x120]
mov r9, rcx
mov r8, rdx
lea rdx, str._t__48s___s_n
mov rcx, rax
call sym.fprintf
lea rax, [rbp - 0x40]
mov qword [rbp + 0xf8], rax
lea rax, [rbp - 0x60]
mov qword [rbp + 0xf0], rax
mov eax, dword [rbp + 0x118]
lea edx, [rax - 1]
mov dword [rbp + 0x118], edx
test eax, eax
jg 0x40301e
lea rax, [rbp - 0x60]
cmp qword [rbp + 0xf0], rax
jbe 0x403147
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x120]
mov r9, rcx
mov r8, rdx
lea rdx, str._t__48s___s_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x120]
mov rdx, rax
mov ecx, 0xa
call sym.fputc
mov rax, qword [rbp + 0x120]
mov rcx, rax
call sym.fflush
nop
add rsp, 0x180
pop rbp
ret