Function at 0x1001cb50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
mov ebx, ecx
lea eax, [ebp - 0x212]
push eax
call fcn.10028990
add esp, 0xc
mov dword [edi], 0x41454c47
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [esi]
push eax
lea eax, [edi + 0x14]
push str._04d__02d__02d__02d:_02d:_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x214]
push 0x206
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001cc30
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.100264c8
lea edx, [ebp - 0x214]
add esp, 8
lea esi, [edi + 0x244]
lea ecx, [eax + 2]
mov eax, edx
sub esi, eax
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [esi + edx - 2], ax
test ax, ax
jne 0x1001cc04
lea edx, [edi + 0x3c]
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1001cc20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [edi + 0x44c], eax
mov byte [edi + 0x468], 1
mov eax, dword [ebx + 0x724]
cmp byte [eax + 0x69], 1
jne 0x1001cc9c
cmp word [ebx + 0x72a], 0
lea eax, [ebx + 0x72a]
je 0x1001cc9c
push eax
lea esi, [edi + 0x46a]
push 0x208
push esi
call fcn.10026d5d
push 0x5c
push esi
call fcn.100264c8
add esp, 0x14
test eax, eax
je 0x1001cc85
add eax, 2
jmp 0x1001cc87
mov eax, esi
push eax
lea eax, [edi + 0x87a]
push 0x104
push eax
call fcn.10026d5d
add esp, 0xc
mov eax, dword [ebx + 0x724]
cmp byte [eax + 0x6a], 1
jne 0x1001ccd9
mov eax, dword [0x10044488]
test eax, eax
je 0x1001ccd9
cmp word [eax], 0
je 0x1001ccd9
push eax
lea eax, [edi + 0xa82]
push 0x400
push eax
call fcn.10026d5d
add esp, 0xc
lea ecx, [edi + 0x1282]
mov edx, ecx
call fcn.1001fa20
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
lea eax, [ebx + 0x2c4]
push eax
lea eax, [ebp - 0x41c]
push str._s_04d_02d_02d_02d_02d_02d.log
push eax
call fcn.1002619b
lea eax, [ebp - 0x41c]
push 0x1003f2f8
push eax
call fcn.100253e4
mov esi, eax
add esp, 0x2c
test esi, esi
je 0x1001d11e
push 0x414
call fcn.10025b14
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1001d115
push esi
push 0xc
push 1
push str.Signature_:
call fcn.10026b6e
push esi
push 4
push 1
push edi
call fcn.10026b6e
push 0x414
push 0
push ebx
call fcn.10028990
push esi
push 0x10
push 1
push str._r_nDetect_Time_:
call fcn.10026b6e
movzx eax, word [edi + 0x12]
push eax
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
push str._04d._02d._02d._02d._02d._02d._02d
push ebx
call fcn.10026117
mov ecx, ebx
add esp, 0x60
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001cdb0
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10026b6e
push esi
push 0x17
push 1
push str._r_nDetect_Module_Name_:
call fcn.10026b6e
lea edx, [edi + 0x3c]
add esp, 0x20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001cde3
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.10026b6e
push esi
push 0x17
push 1
push str._r_nDetect_Module_Path_:
call fcn.10026b6e
lea edx, [edi + 0x244]
add esp, 0x20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ce26
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.10026b6e
push 0x414
push 0
push ebx
call fcn.10028990
push esi
push 0xf
push 1
push str._r_nDetect_PID_:
call fcn.10026b6e
push dword [edi + 0x44c]
push 0x1003f388
push ebx
call fcn.10026117
mov ecx, ebx
add esp, 0x38
lea edx, [ecx + 1]
jmp 0x1001ce80
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ce80
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10026b6e
push esi
push 0x10
push 1
push str._r_nDetect_Code_:
call fcn.10026b6e
mov eax, dword [edi + 0x450]
add esp, 0x20
cmp eax, 0xf
ja case.default.0x1001ceb4
jmp dword [eax*4 + 0x1001d134]
push esi
push 0x12
push 1
push str.EXPLOIT_DETECT_NOT
jmp 0x1001cf88
push esi
push 0x20
push 1
push str.EXPLOIT_DETECT_WRONG_CALL_MEMORY
jmp 0x1001cf88
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_WRONG_CALL_FLOW
jmp 0x1001cf88
push esi
push 0x1d
push 1
push str.EXPLOIT_DETECT_GADGET_INSTACK
jmp 0x1001cf88
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_R
jmp 0x1001cf88
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_W
jmp 0x1001cf88
push esi
push 0x16
push 1
push str.EXPLOIT_DETECT_EXCEP_E
jmp 0x1001cf88
push esi
push 0x17
push 1
push str.EXPLOIT_DETECT_EXCEP_GS
jmp 0x1001cf88
push esi
push 0x19
push 1
push str.EXPLOIT_DETECT_NULLPAGE_E
jmp 0x1001cf88
push esi
push 0x1c
push 1
push str.EXPLOIT_DETECT_HEAPSPRAY_RWE
jmp 0x1001cf88
push esi
push 0x1b
push 1
push str.EXPLOIT_DETECT_LOAD_UNCPATH
jmp 0x1001cf88
push esi
push 0x22
push 1
push str.EXPLOIT_DETECT_OPEN_SCRIPT_UNCPATH
jmp 0x1001cf88
push esi
push 0x1b
push 1
push str.EXPLOIT_DETECT_WRITE_PEFILE
jmp 0x1001cf88
push esi
push 0x1e
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_VBS
jmp 0x1001cf88
push esi
push 0x26
push 1
push str.EXPLOIT_DETECT_EXEC_SCRIPT_BROWSERJAVA
jmp 0x1001cf88
push esi
push 0x1a
push 1
push str.EXPLOIT_DETECT_MDTY_ASLR_E
call fcn.10026b6e
add esp, 0x10
push 0x414
push 0
push ebx
call fcn.10028990
push esi
push 0x13
push 1
push str._r_nDetect_Address_:
call fcn.10026b6e
add esp, 0x1c
cmp byte [edi + 0x468], 1
push dword [edi + 0x45c]
push dword [edi + 0x458]
jne 0x1001cfcb
push str.0x_08I64X
jmp 0x1001cfd0
push str.0x_016I64X
push ebx
call fcn.10026117
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001cfe0
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10026b6e
push 0x414
push 0
push ebx
call fcn.10028990
push esi
push 0x1b
push 1
push str._r_nDetect_Exception_Value_:
call fcn.10026b6e
add esp, 0x2c
cmp byte [edi + 0x468], 1
push dword [edi + 0x464]
push dword [edi + 0x460]
jne 0x1001d02e
push str.0x_08I64X
jmp 0x1001d033
push str.0x_016I64X
push ebx
call fcn.10026117
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d041
push esi
sub ecx, edx
push ecx
push 1
push ebx
call fcn.10026b6e
push esi
push 0x10
push 1
push str._r_nDetect_Arch_:
call fcn.10026b6e
add esp, 0x20
cmp byte [edi + 0x468], 1
push esi
push 5
push 1
jne 0x1001d07b
push str.32bit
jmp 0x1001d080
push str.64bit
call fcn.10026b6e
add esp, 0x10
push esi
push 0x1d
push 1
push str._r_nDetect_Current_Open_File_:
call fcn.10026b6e
lea edx, [edi + 0x46a]
add esp, 0x10
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x420], eax
jmp 0x1001d0b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d0b0
sub ecx, dword [ebp - 0x420]
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edx
call fcn.10026b6e
push esi
push 0x1c
push 1
push str._r_nDetect_Current_Open_URL_:
call fcn.10026b6e
add esp, 0x20
add edi, 0xa82
mov ecx, edi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d0f0
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push 1
push edi
call fcn.10026b6e
push ebx
call fcn.10025ed7
add esp, 0x14
push esi
call fcn.10025dc4
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100253d5
mov esp, ebp
pop ebp
ret 4