API tools faq
paste
Guest User

sub_140001C10

a guest
Aug 20th, 2025
6
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 19.04 KB | None | 0 0
raw download clone embed print report
  1. .text:0000000140001C10 sub_140001C10 proc near ; CODE XREF: wWinMain+96↓p
  2. .text:0000000140001C10 ; DATA XREF: .pdata:0000000140016108↓o
  3. .text:0000000140001C10
  4. .text:0000000140001C10 var_1A0 = qword ptr -1A0h
  5. .text:0000000140001C10 var_198 = qword ptr -198h
  6. .text:0000000140001C10 nSize = dword ptr -190h
  7. .text:0000000140001C10 var_188 = qword ptr -188h
  8. .text:0000000140001C10 lpMem = qword ptr -180h
  9. .text:0000000140001C10 var_178 = qword ptr -178h
  10. .text:0000000140001C10 var_170 = qword ptr -170h
  11. .text:0000000140001C10 Format = byte ptr -168h
  12. .text:0000000140001C10 var_160 = qword ptr -160h
  13. .text:0000000140001C10 var_158 = word ptr -158h
  14. .text:0000000140001C10 Buffer = byte ptr -150h
  15. .text:0000000140001C10 var_14F = byte ptr -14Fh
  16. .text:0000000140001C10 var_40 = qword ptr -40h
  17. .text:0000000140001C10 arg_18 = qword ptr 28h
  18. .text:0000000140001C10
  19. .text:0000000140001C10 ; __unwind { // __GSHandlerCheck
  20. .text:0000000140001C10 mov [rsp-8+arg_18], rbx
  21. .text:0000000140001C15 push rbp
  22. .text:0000000140001C16 push rsi
  23. .text:0000000140001C17 push rdi
  24. .text:0000000140001C18 push r12
  25. .text:0000000140001C1A push r13
  26. .text:0000000140001C1C push r14
  27. .text:0000000140001C1E push r15
  28. .text:0000000140001C20 lea rbp, [rsp-90h]
  29. .text:0000000140001C28 sub rsp, 190h
  30. .text:0000000140001C2F mov rax, cs:qword_140012008
  31. .text:0000000140001C36 xor rax, rsp
  32. .text:0000000140001C39 mov [rbp+0C0h+var_40], rax
  33. .text:0000000140001C40 xor esi, esi
  34. .text:0000000140001C42 mov r12, rcx
  35. .text:0000000140001C45 mov [rsp+1C0h+var_178], r8
  36. .text:0000000140001C4A mov [rsp+1C0h+var_170], rdx
  37. .text:0000000140001C4F mov ebx, esi
  38. .text:0000000140001C51 lea rcx, [rsp+1C0h+var_14F] ; void *
  39. .text:0000000140001C56 xor edx, edx ; Val
  40. .text:0000000140001C58 mov r8d, 103h ; Size
  41. .text:0000000140001C5E mov [rsp+1C0h+lpMem], rsi
  42. .text:0000000140001C63 mov [rsp+1C0h+var_188], rbx
  43. .text:0000000140001C68 mov [rsp+1C0h+Buffer], bl
  44. .text:0000000140001C6C mov r13d, esi
  45. .text:0000000140001C6F mov r15d, esi
  46. .text:0000000140001C72 call memset
  47. .text:0000000140001C77 mov rax, cs:qword_14000FE60
  48. .text:0000000140001C7E mov qword ptr [rsp+1C0h+Format], rax
  49. .text:0000000140001C83 mov rax, cs:qword_14000FE68
  50. .text:0000000140001C8A lea rcx, [rsp+1C0h+lpMem]
  51. .text:0000000140001C8F mov [rsp+1C0h+var_160], rax
  52. .text:0000000140001C94 movzx eax, cs:word_14000FE70
  53. .text:0000000140001C9B mov [rsp+1C0h+nSize], esi
  54. .text:0000000140001C9F mov [rsp+1C0h+var_158], ax
  55. .text:0000000140001CA4 call sub_140003300
  56. .text:0000000140001CA9 mov r14, [rsp+1C0h+lpMem]
  57. .text:0000000140001CAE mov edi, eax
  58. .text:0000000140001CB0 test eax, eax
  59. .text:0000000140001CB2 js loc_140001F15
  60. .text:0000000140001CB8 or rcx, 0FFFFFFFFFFFFFFFFh
  61. .text:0000000140001CBC xor eax, eax
  62. .text:0000000140001CBE mov rdi, r14
  63. .text:0000000140001CC1 repne scasb
  64. .text:0000000140001CC3 mov edx, esi
  65. .text:0000000140001CC5 not rcx
  66. .text:0000000140001CC8 dec rcx
  67. .text:0000000140001CCB mov rbx, rcx
  68. .text:0000000140001CCE mov [rsp+1C0h+nSize], ecx
  69. .text:0000000140001CD2 test ecx, ecx
  70. .text:0000000140001CD4 jz short loc_140001CF9
  71. .text:0000000140001CD6 mov rcx, r14
  72. .text:0000000140001CD9 nop dword ptr [rax+00000000h]
  73. .text:0000000140001CE0
  74. .text:0000000140001CE0 loc_140001CE0: ; CODE XREF: sub_140001C10+E7↓j
  75. .text:0000000140001CE0 movzx eax, byte ptr [r12+514h]
  76. .text:0000000140001CE9 inc edx
  77. .text:0000000140001CEB inc rcx
  78. .text:0000000140001CEE xor [rcx-1], al
  79. .text:0000000140001CF1 mov ebx, [rsp+1C0h+nSize]
  80. .text:0000000140001CF5 cmp edx, ebx
  81. .text:0000000140001CF7 jb short loc_140001CE0
  82. .text:0000000140001CF9
  83. .text:0000000140001CF9 loc_140001CF9: ; CODE XREF: sub_140001C10+C4↑j
  84. .text:0000000140001CF9 lea edi, [rbx+rbx+1]
  85. .text:0000000140001CFD call cs:GetProcessHeap
  86. .text:0000000140001D03 mov r8d, edi ; dwBytes
  87. .text:0000000140001D06 mov rcx, rax ; hHeap
  88. .text:0000000140001D09 mov edx, 8 ; dwFlags
  89. .text:0000000140001D0E call cs:HeapAlloc
  90. .text:0000000140001D14 mov r13, rax
  91. .text:0000000140001D17 test ebx, ebx
  92. .text:0000000140001D19 jz short loc_140001D4F
  93. .text:0000000140001D1B mov rdi, r14
  94. .text:0000000140001D1E mov rsi, rax
  95. .text:0000000140001D21 mov ebx, ebx
  96. .text:0000000140001D23 db 66h, 66h, 66h, 66h
  97. .text:0000000140001D23 nop word ptr [rax+rax+00000000h]
  98. .text:0000000140001D30
  99. .text:0000000140001D30 loc_140001D30: ; CODE XREF: sub_140001C10+13D↓j
  100. .text:0000000140001D30 movsx r8d, byte ptr [rdi]
  101. .text:0000000140001D34 lea rdx, a02x ; "%02x"
  102. .text:0000000140001D3B mov rcx, rsi ; Buffer
  103. .text:0000000140001D3E call sprintf
  104. .text:0000000140001D43 add rsi, 2
  105. .text:0000000140001D47 inc rdi
  106. .text:0000000140001D4A dec rbx
  107. .text:0000000140001D4D jnz short loc_140001D30
  108. .text:0000000140001D4F
  109. .text:0000000140001D4F loc_140001D4F: ; CODE XREF: sub_140001C10+109↑j
  110. .text:0000000140001D4F lea rcx, [rsp+1C0h+var_188]
  111. .text:0000000140001D54 call sub_140001770
  112. .text:0000000140001D59 mov edi, eax
  113. .text:0000000140001D5B test eax, eax
  114. .text:0000000140001D5D js loc_140001F10
  115. .text:0000000140001D63 lea rdx, [rsp+1C0h+nSize] ; nSize
  116. .text:0000000140001D68 lea rcx, [rsp+1C0h+Buffer] ; lpBuffer
  117. .text:0000000140001D6D mov [rsp+1C0h+nSize], 104h
  118. .text:0000000140001D75 call cs:GetComputerNameA
  119. .text:0000000140001D7B test eax, eax
  120. .text:0000000140001D7D jnz short loc_140001DA2
  121. .text:0000000140001D7F call cs:GetLastError
  122. .text:0000000140001D85 mov rbx, [rsp+1C0h+var_188]
  123. .text:0000000140001D8A mov edi, eax
  124. .text:0000000140001D8C test eax, eax
  125. .text:0000000140001D8E jle loc_140001F15
  126. .text:0000000140001D94 movzx edi, ax
  127. .text:0000000140001D97 or edi, 80070000h
  128. .text:0000000140001D9D jmp loc_140001F15
  129. .text:0000000140001DA2 ; ---------------------------------------------------------------------------
  130. .text:0000000140001DA2
  131. .text:0000000140001DA2 loc_140001DA2: ; CODE XREF: sub_140001C10+16D↑j
  132. .text:0000000140001DA2 mov rbx, [rsp+1C0h+var_188]
  133. .text:0000000140001DA7 or rcx, 0FFFFFFFFFFFFFFFFh
  134. .text:0000000140001DAB xor eax, eax
  135. .text:0000000140001DAD mov rdi, r12
  136. .text:0000000140001DB0 repne scasb
  137. .text:0000000140001DB2 mov rdi, r13
  138. .text:0000000140001DB5 not rcx
  139. .text:0000000140001DB8 lea rdx, [rcx-1]
  140. .text:0000000140001DBC or rcx, 0FFFFFFFFFFFFFFFFh
  141. .text:0000000140001DC0 repne scasb
  142. .text:0000000140001DC2 mov rdi, rbx
  143. .text:0000000140001DC5 not rcx
  144. .text:0000000140001DC8 dec rcx
  145. .text:0000000140001DCB add edx, ecx
  146. .text:0000000140001DCD or rcx, 0FFFFFFFFFFFFFFFFh
  147. .text:0000000140001DD1 repne scasb
  148. .text:0000000140001DD3 lea rdi, [rsp+1C0h+Format]
  149. .text:0000000140001DD8 not rcx
  150. .text:0000000140001DDB dec rcx
  151. .text:0000000140001DDE add edx, ecx
  152. .text:0000000140001DE0 or rcx, 0FFFFFFFFFFFFFFFFh
  153. .text:0000000140001DE4 repne scasb
  154. .text:0000000140001DE6 lea rdi, [rsp+1C0h+Buffer]
  155. .text:0000000140001DEB not rcx
  156. .text:0000000140001DEE dec rcx
  157. .text:0000000140001DF1 add edx, ecx
  158. .text:0000000140001DF3 or rcx, 0FFFFFFFFFFFFFFFFh
  159. .text:0000000140001DF7 repne scasb
  160. .text:0000000140001DF9 not rcx
  161. .text:0000000140001DFC lea rdi, [rcx-1]
  162. .text:0000000140001E00 add edi, edx
  163. .text:0000000140001E02 call cs:GetProcessHeap
  164. .text:0000000140001E08 mov r8d, edi ; dwBytes
  165. .text:0000000140001E0B mov rcx, rax ; hHeap
  166. .text:0000000140001E0E mov edx, 8 ; dwFlags
  167. .text:0000000140001E13 call cs:HeapAlloc
  168. .text:0000000140001E19 mov r15, rax
  169. .text:0000000140001E1C test rax, rax
  170. .text:0000000140001E1F jnz short loc_140001E2B
  171. .text:0000000140001E21 mov edi, 8007000Eh
  172. .text:0000000140001E26 jmp loc_140001F15
  173. .text:0000000140001E2B ; ---------------------------------------------------------------------------
  174. .text:0000000140001E2B
  175. .text:0000000140001E2B loc_140001E2B: ; CODE XREF: sub_140001C10+20F↑j
  176. .text:0000000140001E2B lea rax, [rsp+1C0h+Buffer]
  177. .text:0000000140001E30 lea rdx, [rsp+1C0h+Format] ; Format
  178. .text:0000000140001E35 mov r9, rbx
  179. .text:0000000140001E38 mov r8, r12
  180. .text:0000000140001E3B mov rcx, r15 ; Buffer
  181. .text:0000000140001E3E mov [rsp+1C0h+var_198], r13
  182. .text:0000000140001E43 mov [rsp+1C0h+var_1A0], rax
  183. .text:0000000140001E48 call sprintf
  184. .text:0000000140001E4D call cs:GetProcessHeap
  185. .text:0000000140001E53 mov edi, 0Eh
  186. .text:0000000140001E58 mov rcx, rax ; hHeap
  187. .text:0000000140001E5B lea edx, [rdi-6] ; dwFlags
  188. .text:0000000140001E5E mov r8d, edi ; dwBytes
  189. .text:0000000140001E61 call cs:HeapAlloc
  190. .text:0000000140001E67 mov rsi, rax
  191. .text:0000000140001E6A test rax, rax
  192. .text:0000000140001E6D jnz short loc_140001E79
  193. .text:0000000140001E6F mov edi, 8007000Eh
  194. .text:0000000140001E74 jmp loc_140001F15
  195. .text:0000000140001E79 ; ---------------------------------------------------------------------------
  196. .text:0000000140001E79
  197. .text:0000000140001E79 loc_140001E79: ; CODE XREF: sub_140001C10+25D↑j
  198. .text:0000000140001E79 mov rax, cs:qword_1400133E8
  199. .text:0000000140001E80 mov [rsi], rax
  200. .text:0000000140001E83 mov eax, cs:dword_1400133F0
  201. .text:0000000140001E89 mov [rsi+8], eax
  202. .text:0000000140001E8C movzx eax, cs:word_1400133F4
  203. .text:0000000140001E93 mov [rsi+0Ch], ax
  204. .text:0000000140001E97 mov rax, rsi
  205. .text:0000000140001E9A nop word ptr [rax+rax+00h]
  206. .text:0000000140001EA0
  207. .text:0000000140001EA0 loc_140001EA0: ; CODE XREF: sub_140001C10+299↓j
  208. .text:0000000140001EA0 xor byte ptr [rax], 41h
  209. .text:0000000140001EA3 inc rax
  210. .text:0000000140001EA6 dec rdi
  211. .text:0000000140001EA9 jnz short loc_140001EA0
  212. .text:0000000140001EAB mov rcx, rsi ; lpszServerName
  213. .text:0000000140001EAE call sub_140002F50
  214. .text:0000000140001EB3 mov rdi, rax
  215. .text:0000000140001EB6 test rax, rax
  216. .text:0000000140001EB9 jnz short loc_140001EC1
  217. .text:0000000140001EBB call cs:GetLastError
  218. .text:0000000140001EC1
  219. .text:0000000140001EC1 loc_140001EC1: ; CODE XREF: sub_140001C10+2A9↑j
  220. .text:0000000140001EC1 mov rdx, r15
  221. .text:0000000140001EC4 mov rcx, rdi
  222. .text:0000000140001EC7 call sub_140003030
  223. .text:0000000140001ECC test rax, rax
  224. .text:0000000140001ECF jnz short loc_140001EE8
  225. .text:0000000140001ED1 call cs:GetLastError
  226. .text:0000000140001ED7 mov edi, eax
  227. .text:0000000140001ED9 test eax, eax
  228. .text:0000000140001EDB jle short loc_140001EFA
  229. .text:0000000140001EDD movzx edi, ax
  230. .text:0000000140001EE0 or edi, 80070000h
  231. .text:0000000140001EE6 jmp short loc_140001EFA
  232. .text:0000000140001EE8 ; ---------------------------------------------------------------------------
  233. .text:0000000140001EE8
  234. .text:0000000140001EE8 loc_140001EE8: ; CODE XREF: sub_140001C10+2BF↑j
  235. .text:0000000140001EE8 mov rcx, [rsp+1C0h+var_178]
  236. .text:0000000140001EED mov [rcx], rax
  237. .text:0000000140001EF0 mov rax, [rsp+1C0h+var_170]
  238. .text:0000000140001EF5 mov [rax], rdi
  239. .text:0000000140001EF8 xor edi, edi
  240. .text:0000000140001EFA
  241. .text:0000000140001EFA loc_140001EFA: ; CODE XREF: sub_140001C10+2CB↑j
  242. .text:0000000140001EFA ; sub_140001C10+2D6↑j
  243. .text:0000000140001EFA call cs:GetProcessHeap
  244. .text:0000000140001F00 mov r8, rsi ; lpMem
  245. .text:0000000140001F03 xor edx, edx ; dwFlags
  246. .text:0000000140001F05 mov rcx, rax ; hHeap
  247. .text:0000000140001F08 call cs:HeapFree
  248. .text:0000000140001F0E jmp short loc_140001F15
  249. .text:0000000140001F10 ; ---------------------------------------------------------------------------
  250. .text:0000000140001F10
  251. .text:0000000140001F10 loc_140001F10: ; CODE XREF: sub_140001C10+14D↑j
  252. .text:0000000140001F10 mov rbx, [rsp+1C0h+var_188]
  253. .text:0000000140001F15
  254. .text:0000000140001F15 loc_140001F15: ; CODE XREF: sub_140001C10+A2↑j
  255. .text:0000000140001F15 ; sub_140001C10+17E↑j ...
  256. .text:0000000140001F15 test r14, r14
  257. .text:0000000140001F18 jz short loc_140001F2E
  258. .text:0000000140001F1A call cs:GetProcessHeap
  259. .text:0000000140001F20 mov r8, r14 ; lpMem
  260. .text:0000000140001F23 xor edx, edx ; dwFlags
  261. .text:0000000140001F25 mov rcx, rax ; hHeap
  262. .text:0000000140001F28 call cs:HeapFree
  263. .text:0000000140001F2E
  264. .text:0000000140001F2E loc_140001F2E: ; CODE XREF: sub_140001C10+308↑j
  265. .text:0000000140001F2E test r13, r13
  266. .text:0000000140001F31 jz short loc_140001F47
  267. .text:0000000140001F33 call cs:GetProcessHeap
  268. .text:0000000140001F39 mov r8, r13 ; lpMem
  269. .text:0000000140001F3C xor edx, edx ; dwFlags
  270. .text:0000000140001F3E mov rcx, rax ; hHeap
  271. .text:0000000140001F41 call cs:HeapFree
  272. .text:0000000140001F47
  273. .text:0000000140001F47 loc_140001F47: ; CODE XREF: sub_140001C10+321↑j
  274. .text:0000000140001F47 test r15, r15
  275. .text:0000000140001F4A jz short loc_140001F60
  276. .text:0000000140001F4C call cs:GetProcessHeap
  277. .text:0000000140001F52 mov r8, r15 ; lpMem
  278. .text:0000000140001F55 xor edx, edx ; dwFlags
  279. .text:0000000140001F57 mov rcx, rax ; hHeap
  280. .text:0000000140001F5A call cs:HeapFree
  281. .text:0000000140001F60
  282. .text:0000000140001F60 loc_140001F60: ; CODE XREF: sub_140001C10+33A↑j
  283. .text:0000000140001F60 test rbx, rbx
  284. .text:0000000140001F63 jz short loc_140001F79
  285. .text:0000000140001F65 call cs:GetProcessHeap
  286. .text:0000000140001F6B mov r8, rbx ; lpMem
  287. .text:0000000140001F6E xor edx, edx ; dwFlags
  288. .text:0000000140001F70 mov rcx, rax ; hHeap
  289. .text:0000000140001F73 call cs:HeapFree
  290. .text:0000000140001F79
  291. .text:0000000140001F79 loc_140001F79: ; CODE XREF: sub_140001C10+353↑j
  292. .text:0000000140001F79 mov eax, edi
  293. .text:0000000140001F7B mov rcx, [rbp+0C0h+var_40]
  294. .text:0000000140001F82 xor rcx, rsp ; StackCookie
  295. .text:0000000140001F85 call __security_check_cookie
  296. .text:0000000140001F8A mov rbx, [rsp+1C0h+arg_18]
  297. .text:0000000140001F92 add rsp, 190h
  298. .text:0000000140001F99 pop r15
  299. .text:0000000140001F9B pop r14
  300. .text:0000000140001F9D pop r13
  301. .text:0000000140001F9F pop r12
  302. .text:0000000140001FA1 pop rdi
  303. .text:0000000140001FA2 pop rsi
  304. .text:0000000140001FA3 pop rbp
  305. .text:0000000140001FA4 retn
  306. .text:0000000140001FA4 ; } // starts at 140001C10
  307. .text:0000000140001FA4 sub_140001C10 endp
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!