mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp [ebp+arg_4], eax
jnz short loc_1001019
mov eax, 0C000000Dh
jmp short loc_100103F
mov edx, [ebp+arg_0]
push esi
mov esi, [ebp+arg_8]
mov cl, [esi]
test cl, cl
jz short loc_100102F
mov [edx], cl
inc edx 
inc esi
dec [ebp+arg_4]
jnz short loc_1001020
cmp [ebp+arg_4], 0 
pop esi
jnz short loc_100103C
dec edx
mov eax, 80000005h
mov byte ptr [edx], 0
pop ebp
retn 0Ch

NTSTATUS WINAPI FirstFunction(PCHAR Destination,ULONG Size,PCHAR Source)
{
  NTSTATUS NTstatus=STATUS_SUCCESS;
  if (Size!=0)
  {
    while(*Source!=0)
    {
      *Destination=*Source;
      Destination++;
      Source++;
      Size--;
      if (Size==0)
      {
        Destination--;
        return 0x80000005;
      }
    }
    *Destination=0;
  }
  else
  {
    return 0xC000000D;
  }
  return NTstatus;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！