Function at 0x1001dd30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
mov ebx, ecx
lea eax, [ebp - 0x212]
push eax
call fcn.1002aea0
add esp, 0xc
mov dword [edi], 0x41454c47
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [esi]
push eax
lea eax, [edi + 0x14]
push str._04d__02d__02d__02d:_02d:_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x214]
push 0x206
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001de10
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.10027bae
lea edx, [ebp - 0x214]
add esp, 8
lea esi, [edi + 0x244]
lea ecx, [eax + 2]
mov eax, edx
sub esi, eax
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [esi + edx - 2], ax
test ax, ax
jne 0x1001dde4
lea edx, [edi + 0x3c]
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1001de00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [edi + 0x44c], eax
mov byte [edi + 0x468], 1
mov eax, dword [ebx + 0x734]
cmp byte [eax + 0x69], 1
jne 0x1001de7c
cmp word [ebx + 0x73a], 0
lea eax, [ebx + 0x73a]
je 0x1001de7c
push eax
lea esi, [edi + 0x46a]
push 0x208
push esi
call fcn.1002844d
push 0x5c
push esi
call fcn.10027bae
add esp, 0x14
test eax, eax
je 0x1001de65
add eax, 2
jmp 0x1001de67
mov eax, esi
push eax
lea eax, [edi + 0x87a]
push 0x104
push eax
call fcn.1002844d
add esp, 0xc
mov eax, dword [ebx + 0x734]
cmp byte [eax + 0x6a], 1
jne 0x1001deb9
mov eax, dword [0x100484ac]
test eax, eax
je 0x1001deb9
cmp word [eax], 0
je 0x1001deb9
push eax
lea eax, [edi + 0xa82]
push 0x400
push eax
call fcn.1002844d
add esp, 0xc
lea ecx, [edi + 0x1282]
mov edx, ecx
call fcn.10021230
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
lea eax, [ebx + 0x2d4]
push eax
lea eax, [ebp - 0x41c]
push str._s_04d_02d_02d_02d_02d_02d.log
push eax
call fcn.10027881
lea eax, [ebp - 0x41c]
push 0x10042b28
push eax
call fcn.1002698f
mov esi, eax
add esp, 0x2c
test esi, esi
je 0x1001e31e
push 0x414
call fcn.100271fa
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1001e315
push esi
push 0xc
push 1
push str.Signature_:
call fcn.10028254
push esi
push 4
push 1
push edi
call fcn.10028254
push 0x414
push 0
push ebx
call fcn.1002aea0
push esi
push 0x10
push 1
push str._r_nDetect_Time_:
call fcn.10028254
movzx eax, word [edi + 0x12]
push eax
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
push str._04d._02d._02d._02d._02d._02d._02d
push ebx
call fcn.100277fd
mov ecx, ebx
add esp, 0x60
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001df90
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10028254
push esi
push 0x17
push 1
push str._r_nDetect_Module_Name_:
call fcn.10028254
lea edx, [edi + 0x3c]
add esp, 0x20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001dfc3
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.10028254
push esi
push 0x17
push 1
push str._r_nDetect_Module_Path_:
call fcn.10028254
lea edx, [edi + 0x244]
add esp, 0x20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e006
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.10028254
push 0x414
push 0
push ebx
call fcn.1002aea0
push esi
push 0xf
push 1
push str._r_nDetect_PID_:
call fcn.10028254
push dword [edi + 0x44c]
push 0x10042bb8
push ebx
call fcn.100277fd
mov ecx, ebx
add esp, 0x38
lea edx, [ecx + 1]
jmp 0x1001e060
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e060
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10028254
push esi
push 0x10
push 1
push str._r_nDetect_Code_:
call fcn.10028254
mov eax, dword [edi + 0x450]
add esp, 0x20
cmp eax, 0x11
ja case.default.0x1001e094
jmp dword [eax*4 + 0x1001e334]
push esi
push 0x12
push 1
push str.EXPLOIT_DETECT_NOT
jmp 0x1001e186
push esi
push 0x20
push 1
push str.EXPLOIT_DETECT_WRONG_CALL_MEMORY
jmp 0x1001e186
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_WRONG_CALL_FLOW
jmp 0x1001e186
push esi
push 0x1d
push 1
push str.EXPLOIT_DETECT_GADGET_INSTACK
jmp 0x1001e186
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_R
jmp 0x1001e186
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_W
jmp 0x1001e186
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_E
jmp 0x1001e186
push esi
push 0x17
push 1
push str.EXPLOIT_DETECT_EXCEP_GS
jmp 0x1001e186
push esi
push 0x19
push 1
push str.EXPLOIT_DETECT_NULLPAGE_E
jmp 0x1001e186
push esi
push 0x1c
push 1
push str.EXPLOIT_DETECT_HEAPSPRAY_RWE
jmp 0x1001e186
push esi
push 0x1b
push 1
push str.EXPLOIT_DETECT_LOAD_UNCPATH
jmp 0x1001e186
push esi
push 0x22
push 1
push str.EXPLOIT_DETECT_OPEN_SCRIPT_UNCPATH
jmp 0x1001e186
push esi
push 0x1b
push 1
push str.EXPLOIT_DETECT_WRITE_PEFILE
jmp 0x1001e186
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_VBS
jmp 0x1001e186
push esi
push 0x26
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_BROWSERJAVA
jmp 0x1001e186
push esi
push 0x1a
push 1
push str.EXPLOIT_DETECT_MDTY_ASLR_E
jmp 0x1001e186
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_OCX
jmp 0x1001e186
push esi
push 0x18
push 1
push str.EXPLOIT_DETECT_INTEGRITY
call fcn.10028254
add esp, 0x10
push 0x414
push 0
push ebx
call fcn.1002aea0
push esi
push 0x13
push 1
push str._r_nDetect_Address_:
call fcn.10028254
add esp, 0x1c
cmp byte [edi + 0x468], 1
push dword [edi + 0x45c]
push dword [edi + 0x458]
jne 0x1001e1c9
push str.0x_08I64X
jmp 0x1001e1ce
push str.0x_016I64X
push ebx
call fcn.100277fd
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e1e0
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10028254
push 0x414
push 0
push ebx
call fcn.1002aea0
push esi
push 0x1b
push 1
push str._r_nDetect_Exception_Value_:
call fcn.10028254
add esp, 0x2c
cmp byte [edi + 0x468], 1
push dword [edi + 0x464]
push dword [edi + 0x460]
jne 0x1001e22e
push str.0x_08I64X
jmp 0x1001e233
push str.0x_016I64X
push ebx
call fcn.100277fd
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e241
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10028254
push esi
push 0x10
push 1
push str._r_nDetect_Arch_:
call fcn.10028254
add esp, 0x20
cmp byte [edi + 0x468], 1
push esi
push 5
push 1
jne 0x1001e27b
push str.32bit
jmp 0x1001e280
push str.64bit
call fcn.10028254
add esp, 0x10
push esi
push 0x1d
push 1
push str._r_nDetect_Current_Open_File_:
call fcn.10028254
lea edx, [edi + 0x46a]
add esp, 0x10
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
jmp 0x1001e2b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e2b0
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.10028254
push esi
push 0x1c
push 1
push str._r_nDetect_Current_Open_URL_:
call fcn.10028254
add esp, 0x20
add edi, 0xa82
mov ecx, edi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e2f0
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edi
call fcn.10028254
push ebx
call fcn.100275bd
add esp, 0x14
push esi
call fcn.100274aa
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026980
mov esp, ebp
pop ebp
ret 4