Function at 0x1001d450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
mov ebx, ecx
lea eax, [ebp - 0x212]
push eax
call fcn.10029700
add esp, 0xc
mov dword [edi], 0x41454c47
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [esi]
push eax
lea eax, [edi + 0x14]
push str._04d__02d__02d__02d:_02d:_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x214]
push 0x206
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001d530
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.10027198
lea edx, [ebp - 0x214]
add esp, 8
lea esi, [edi + 0x244]
lea ecx, [eax + 2]
mov eax, edx
sub esi, eax
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [esi + edx - 2], ax
test ax, ax
jne 0x1001d504
lea edx, [edi + 0x3c]
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1001d520
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [edi + 0x44c], eax
mov byte [edi + 0x468], 1
mov eax, dword [ebx + 0x72c]
cmp byte [eax + 0x69], 1
jne 0x1001d59c
cmp word [ebx + 0x732], 0
lea eax, [ebx + 0x732]
je 0x1001d59c
push eax
lea esi, [edi + 0x46a]
push 0x208
push esi
call fcn.10027a2d
push 0x5c
push esi
call fcn.10027198
add esp, 0x14
test eax, eax
je 0x1001d585
add eax, 2
jmp 0x1001d587
mov eax, esi
push eax
lea eax, [edi + 0x87a]
push 0x104
push eax
call fcn.10027a2d
add esp, 0xc
mov eax, dword [ebx + 0x72c]
cmp byte [eax + 0x6a], 1
jne 0x1001d5d9
mov eax, dword [0x100454a8]
test eax, eax
je 0x1001d5d9
cmp word [eax], 0
je 0x1001d5d9
push eax
lea eax, [edi + 0xa82]
push 0x400
push eax
call fcn.10027a2d
add esp, 0xc
lea ecx, [edi + 0x1282]
mov edx, ecx
call fcn.10020870
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
lea eax, [ebx + 0x2cc]
push eax
lea eax, [ebp - 0x41c]
push str._s_04d_02d_02d_02d_02d_02d.log
push eax
call fcn.10026e6b
lea eax, [ebp - 0x41c]
push 0x10040488
push eax
call fcn.10025f8f
mov esi, eax
add esp, 0x2c
test esi, esi
je 0x1001da2e
push 0x414
call fcn.100267e4
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1001da25
push esi
push 0xc
push 1
push str.Signature_:
call fcn.1002783e
push esi
push 4
push 1
push edi
call fcn.1002783e
push 0x414
push 0
push ebx
call fcn.10029700
push esi
push 0x10
push 1
push str._r_nDetect_Time_:
call fcn.1002783e
movzx eax, word [edi + 0x12]
push eax
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
push str._04d._02d._02d._02d._02d._02d._02d
push ebx
call fcn.10026de7
mov ecx, ebx
add esp, 0x60
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d6b0
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.1002783e
push esi
push 0x17
push 1
push str._r_nDetect_Module_Name_:
call fcn.1002783e
lea edx, [edi + 0x3c]
add esp, 0x20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d6e3
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.1002783e
push esi
push 0x17
push 1
push str._r_nDetect_Module_Path_:
call fcn.1002783e
lea edx, [edi + 0x244]
add esp, 0x20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d726
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.1002783e
push 0x414
push 0
push ebx
call fcn.10029700
push esi
push 0xf
push 1
push str._r_nDetect_PID_:
call fcn.1002783e
push dword [edi + 0x44c]
push 0x10040518
push ebx
call fcn.10026de7
mov ecx, ebx
add esp, 0x38
lea edx, [ecx + 1]
jmp 0x1001d780
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d780
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.1002783e
push esi
push 0x10
push 1
push str._r_nDetect_Code_:
call fcn.1002783e
mov eax, dword [edi + 0x450]
add esp, 0x20
cmp eax, 0x10
ja case.default.0x1001d7b4
jmp dword [eax*4 + 0x1001da44]
push esi
push 0x12
push 1
push str.EXPLOIT_DETECT_NOT
jmp 0x1001d897
push esi
push 0x20
push 1
push str.EXPLOIT_DETECT_WRONG_CALL_MEMORY
jmp 0x1001d897
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_WRONG_CALL_FLOW
jmp 0x1001d897
push esi
push 0x1d
push 1
push str.EXPLOIT_DETECT_GADGET_INSTACK
jmp 0x1001d897
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_R
jmp 0x1001d897
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_W
jmp 0x1001d897
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_E
jmp 0x1001d897
push esi
push 0x17
push 1
push str.EXPLOIT_DETECT_EXCEP_GS
jmp 0x1001d897
push esi
push 0x19
push 1
push str.EXPLOIT_DETECT_NULLPAGE_E
jmp 0x1001d897
push esi
push 0x1c
push 1
push str.EXPLOIT_DETECT_HEAPSPRAY_RWE
jmp 0x1001d897
push esi
push 0x1b
push 1
push str.EXPLOIT_DETECT_LOAD_UNCPATH
jmp 0x1001d897
push esi
push 0x22
push 1
push str.EXPLOIT_DETECT_OPEN_SCRIPT_UNCPATH
jmp 0x1001d897
push esi
push 0x1b
push 1
push str.EXPLOIT_DETECT_WRITE_PEFILE
jmp 0x1001d897
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_VBS
jmp 0x1001d897
push esi
push 0x26
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_BROWSERJAVA
jmp 0x1001d897
push esi
push 0x1a
push 1
push str.EXPLOIT_DETECT_MDTY_ASLR_E
jmp 0x1001d897
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_OCX
call fcn.1002783e
add esp, 0x10
push 0x414
push 0
push ebx
call fcn.10029700
push esi
push 0x13
push 1
push str._r_nDetect_Address_:
call fcn.1002783e
add esp, 0x1c
cmp byte [edi + 0x468], 1
push dword [edi + 0x45c]
push dword [edi + 0x458]
jne 0x1001d8da
push str.0x_08I64X
jmp 0x1001d8df
push str.0x_016I64X
push ebx
call fcn.10026de7
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d8f0
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.1002783e
push 0x414
push 0
push ebx
call fcn.10029700
push esi
push 0x1b
push 1
push str._r_nDetect_Exception_Value_:
call fcn.1002783e
add esp, 0x2c
cmp byte [edi + 0x468], 1
push dword [edi + 0x464]
push dword [edi + 0x460]
jne 0x1001d93e
push str.0x_08I64X
jmp 0x1001d943
push str.0x_016I64X
push ebx
call fcn.10026de7
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d951
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.1002783e
push esi
push 0x10
push 1
push str._r_nDetect_Arch_:
call fcn.1002783e
add esp, 0x20
cmp byte [edi + 0x468], 1
push esi
push 5
push 1
jne 0x1001d98b
push str.32bit
jmp 0x1001d990
push str.64bit
call fcn.1002783e
add esp, 0x10
push esi
push 0x1d
push 1
push str._r_nDetect_Current_Open_File_:
call fcn.1002783e
lea edx, [edi + 0x46a]
add esp, 0x10
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
jmp 0x1001d9c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d9c0
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.1002783e
push esi
push 0x1c
push 1
push str._r_nDetect_Current_Open_URL_:
call fcn.1002783e
add esp, 0x20
add edi, 0xa82
mov ecx, edi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001da00
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edi
call fcn.1002783e
push ebx
call fcn.10026ba7
add esp, 0x14
push esi
call fcn.10026a94
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10025f80
mov esp, ebp
pop ebp
ret 4