Function at 0x10001000
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x624
or dword [esp + 0x14], 0xffffffff
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push edi
mov ebp, str.Hello_World
push ebp
xor ebx, ebx
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebx
push 0x4000000
push 2
push ebx
push ebx
push 0xc0000000
push dword [esp + 0x658]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push ebx
mov dword [esp + 0x18], eax
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
cmp dword [esp + 0x10], 0xffffffff
je 0x10001a22
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x34], 0x57
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x6e
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x37], 0x6c
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x38], 0x6f
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x39], 0x67
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x3a], 0x6f
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x3b], 0x6e
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 3
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x48], bl
call dword [0x100124fc]
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x100019c2
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push 1
push ebx
push 3
push ebx
push ebx
push 0x50
push dword [esp + 0x650]
push dword [esp + 0x38]
call dword [0x10012500]
push ebp
push ebx
mov dword [esp + 0x20], eax
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
cmp dword [esp + 0x18], ebx
je 0x100019b8
push ebp
push ebx
mov byte [esp + 0x138], 0x47
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
mov byte [esp + 0x139], 0x45
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push 1
push 0x84000000
push ebx
push ebx
push ebx
push dword [esp + 0x650]
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x34]
mov byte [esp + 0x152], 0x54
mov byte [esp + 0x153], bl
call dword [0x1001250c]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x100019ae
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
push dword [esp + 0x24]
call dword [0x10012510]
test eax, eax
je 0x100019a4
mov byte [esp + 0x234], bl
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x235]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
lea eax, [esp + 0x20]
push eax
push 0x400
lea eax, [esp + 0x23c]
push eax
push dword [esp + 0x20]
call dword [0x10012504]
test eax, eax
je 0x10001934
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x240]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100018d4
cmp dword [esp + 0x20], ebx
jne 0x100016db
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
jmp 0x1000193e
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x14]
call dword [0x10012508]
push dword [esp + 0x18]
call dword [0x10012508]
push dword [esp + 0x1c]
call dword [0x10012508]
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x624
ret