joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100406460
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x840], rax
xor esi, esi
cmp dword [0x1004276d0], 3
mov edi, esi
jne 0x1004066c0
test byte [0x100427d40], 2
jne 0x1004066c0
mov qword [rsp + 0x860], rbx
nop word [rax + rax]
mov dword [0x10044bda0], esi
mov qword [0x10044bd98], rsi
call fcn.1004066f0
mov ecx, dword [0x10044bda0]
test ecx, ecx
je 0x1004066b8
mov eax, dword [0x1004276d0]
cmp eax, 5
jne 0x1004065cf
mov rcx, qword [0x100427d38]
cmp rcx, 0xffffffffffffffff
je 0x10040651b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1004276d0]
mov qword [0x100427d38], 0xffffffffffffffff
cmp eax, 5
jae 0x10040651b
lea rcx, [0x100427924]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x1004276d0]
inc edi
cmp eax, 2
jb 0x10040666d
mov edx, 0x104
lea rcx, [0x100427924]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
cmp rax, 0x102
jae 0x10040666d
lea r9, [0x100427b2e]
mov dword [rsp + 0x20], edi
lea r8, str._ls._d
mov edx, 0x104
lea rcx, [0x100427924]
call fcn.100401090
test eax, eax
js 0x10040664a
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, [0x100427924]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x100427d38], rax
cmp rax, 0xffffffffffffffff
je 0x1004065dc
lea r9, [0x100427924]
mov edx, 2
lea r8, str.Created_new_dump_file__ls
lea rcx, [0x100422050]
call fcn.100401b20
mov ecx, dword [0x10044bda0]
test ecx, ecx
jne 0x1004064b0
jmp 0x1004066b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rsi
mov r9d, 0x400
mov ebx, eax
mov dword [rsp + 0x28], 0x400
lea rax, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9d, ebx
lea rcx, [0x100422050]
mov edx, 1
test eax, eax
je 0x10040663c
lea rax, [rsp + 0x40]
lea r8, str.Create_dump_file_failed_0x_x____ls
mov qword [rsp + 0x20], rax
call fcn.100401b20
jmp 0x100406685
lea r8, str.Create_dump_file_failed_Error_Code_0x_x
call fcn.100401b20
jmp 0x100406685
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Could_not_construct_file_name:__d
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
jmp 0x100406685
lea r8, str.Dump_file_name_too_long
mov edx, 1
lea rcx, [0x100422050]
call fcn.100401b20
or dword [0x100422040], 0x20000002
lea r9, [0x100427b2e]
lea r8, str.Dump_file__ls:_d_creation_failed__Aborting_multiple_dump_creation
mov dword [rsp + 0x20], edi
mov edx, 1
lea rcx, [0x100422050]
call fcn.100401b20
mov dword [0x10044bda0], esi
mov rbx, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1004119e0
mov rsi, qword [rsp + 0x868]
add rsp, 0x850
pop rdi
ret
Function at 0x100406fb0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1004276d8]
cmp rcx, 0xffffffffffffffff
je 0x100406fd2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1004276d8], 0xffffffffffffffff
mov rcx, qword [0x100427d38]
cmp rcx, 0xffffffffffffffff
je 0x100407006
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1004276d0], 5
mov qword [0x100427d38], 0xffffffffffffffff
jae 0x100407006
lea rcx, [0x100427924]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x100427710]
cmp rcx, 0xffffffffffffffff
je 0x100407031
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x100427710]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x100427710], 0xffffffffffffffff
cmp qword [0x100431368], 0
je 0x1004070d5
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp qword [0x100431370], rbx
jbe 0x1004070b9
mov qword [rsp + 0x20], rdi
xor edi, edi
nop word [rax + rax]
mov rax, qword [0x100431368]
mov rcx, qword [rdi + rax + 0x10]
test rcx, rcx
je 0x1004070a4
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1004070a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_release_buffer_for_bitmap_content._Last_Error___d
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
inc rbx
add rdi, 0x18
cmp rbx, qword [0x100431370]
jb 0x100407060
mov rdi, qword [rsp + 0x20]
mov rcx, qword [0x100431368]
call fcn.100411a08
mov rbx, qword [rsp + 0x30]
mov qword [0x100431368], 0
mov dword [0x1004276d0], 6
add rsp, 0x28
ret
Function at 0x100407240
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x160], rax
test dword [0x100427d40], 0x400
je 0x1004073bf
lea r8, str.Send_To_Watson_flag_is_set_to_true
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov rax, qword [0x100427d40]
bt eax, 0xe
jae 0x1004072b2
lea r8, str.Force_Watson_flag_is_set_to_true
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov eax, 1
jmp 0x1004073c1
mov rcx, qword [0x100427d98]
test rcx, rcx
je 0x10040732a
lea rdx, str.MICROSOFTWID
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x10040731c
xor edx, edx
mov dword [rsp + 0x40], 0x11c
mov r8d, 0x118
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1004073bf
cmp dword [rsp + 0x50], 2
jne 0x1004073bf
cmp dword [rsp + 0x44], 6
jb 0x1004073bf
mov eax, 1
jmp 0x1004073c1
mov rcx, qword [0x100427d98]
mov rax, qword [0x100427d40]
mov rdx, qword [0x100427da0]
mov r8d, eax
call fcn.100402560
mov rdi, rax
test rax, rax
je 0x1004073bf
lea rax, [rsp + 0x34]
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], 4
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], ebx
lea rdx, str.EnableErrorReporting
mov dword [rsp + 0x30], ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
setne bl
test eax, eax
jne 0x1004073aa
cmp dword [rsp + 0x30], 4
jne 0x1004073aa
cmp dword [rsp + 0x34], 4
jne 0x1004073aa
mov eax, 1
cmp dword [rsp + 0x38], eax
cmove ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x180]
jmp 0x1004073c1
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1004119e0
add rsp, 0x170
pop rdi
ret
Function at 0x100409c40
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x6d0
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov r14, r8
mov rbp, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x320
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x30]
mov r8d, 0x320
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100409e65
mov eax, dword [rsp + 0x30]
mov ecx, 0x64
shr eax, 3
cmp eax, ecx
mov qword [rsp + 0x6c0], rsi
cmova eax, ecx
mov esi, eax
test eax, eax
je 0x100409e5e
mov qword [rsp + 0x6c8], rbx
xor ebx, ebx
nop word [rax + rax]
mov rdx, qword [rsp + rbx*8 + 0x70]
lea r8, [rsp + 0x50]
mov r9d, 0x18
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x100409dc9
mov rdx, qword [rsp + rbx*8 + 0x70]
lea r8, [rsp + 0x4a0]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x100409dc9
mov rdx, qword [rsp + rbx*8 + 0x70]
lea r8, [rsp + 0x390]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x100409dc9
mov rdx, rbp
lea rcx, [rsp + 0x390]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x100409dea
xor edx, edx
lea r8d, [rax + 1]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x100409dfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x4a0]
mov dword [rsp + 0x20], eax
lea r8, str.Could_not_load_module__s___d_.
lea edx, [rbx + 1]
lea rcx, [0x100422050]
call fcn.100401b20
mov rax, rbx
mov rbx, qword [rsp + 0x6c8]
mov rsi, qword [rsp + 0x6c0]
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1004119e0
add rsp, 0x6d0
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Could_not_open_module_information_for_remote_process___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
inc rbx
cmp rbx, rsi
jl 0x100409cd0
xor eax, eax
jmp 0x100409d9d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x38]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x100409e2d
mov rax, qword [rsp + 0x38]
sub rax, qword [rsp + 0x50]
mov qword [r14], rax
jmp 0x100409d9a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Could_not_open_module_information_for_local_image___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
xor eax, eax
jmp 0x100409d9d
xor eax, eax
jmp 0x100409da5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Could_not_enumerate_process_modules___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
xor eax, eax
jmp 0x100409dad
Function at 0x10040af40
Capabilities:
List tcp connections and listeners

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov qword [rsp + 0x50], rbx
mov edi, r14d
movzx ebp, cx
mov qword [rsp + 0x60], rsi
nop dword [rax]
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x58]
mov r9d, ebp
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov dword [rsp + 0x58], r14d
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x10040afd6
mov ecx, dword [rsp + 0x58]
call fcn.10041200c
mov rbx, rax
test rax, rax
je 0x10040b00f
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x58]
mov r9d, ebp
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov esi, eax
test eax, eax
je 0x10040b030
mov rcx, rbx
call fcn.100411a08
cmp esi, 0x7a
jne 0x10040afec
inc edi
cmp edi, 4
jb 0x10040af60
mov rax, r14
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_get_tcp_table___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
jmp 0x10040afd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_allocate_tcp_table___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
mov rax, rbx
jmp 0x10040afd9
Function at 0x10040b040
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rax, qword [0x10044bfd0]
lea r8, str.Lookup_process_by_port__d
mov qword [r11 + 8], rbx
lea rcx, [0x100422050]
mov qword [r11 + 0x10], rbp
mov edx, 2
mov dword [rsp + 0x30], 0
movzx r9d, word [rax + 4]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 8], rdi
call fcn.100401b20
mov ecx, 2
call fcn.10040af40
mov ecx, 0x17
mov rdi, rax
call fcn.10040af40
mov rsi, rax
test rax, rax
je 0x10040b0f0
xor ebx, ebx
cmp dword [rax], ebx
jbe 0x10040b0f0
nop dword [rax]
mov ecx, ebx
imul rbp, rcx, 0x38
mov rcx, qword [0x10044bfd0]
movzx ecx, word [rcx + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, dword [rbp + rsi + 0x18]
je 0x10040b0e8
inc ebx
cmp ebx, dword [rsi]
jb 0x10040b0c0
jmp 0x10040b0f0
mov eax, dword [rbp + rsi + 0x38]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x10040b140
test rdi, rdi
je 0x10040b140
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x10040b140
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x10044bfd0]
lea rcx, [rbx + rbx*2]
lea rbp, [rdi + rcx*8]
movzx ecx, word [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, dword [rbp + 0xc]
je 0x10040b139
inc ebx
cmp ebx, dword [rdi]
jb 0x10040b110
jmp 0x10040b140
mov eax, dword [rbp + 0x18]
mov dword [rsp + 0x30], eax
mov edx, 0x1c
mov rcx, rdi
call fcn.100411a08
mov edx, 0x3c
mov rcx, rsi
call fcn.100411a08
cmp dword [rsp + 0x30], 0
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
jne 0x10040b24e
lea r8, str.Lookup_process_by_uptime_pid
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
xor edx, edx
mov qword [rsp + 0x40], 0
mov r8d, 0x20a
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x10044bfd0]
lea r9, [rsp + 0x34]
add rcx, 0x316
mov dword [rsp + 0x34], 0x105
lea r8, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.instapi150.dll_GetInstRegPathByName]
test eax, eax
je 0x10040b24e
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10040b24e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.uptime_pid
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, dword [rsp + 0x30]
lea r8, str.Lookup_process_finished_with_PID_d
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1004119e0
add rsp, 0x278
ret
Function at 0x10040b290
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov qword [rcx], rdx
mov rbx, rcx
lea r8, [rsp + 0x60]
mov rcx, rsi
lea rdx, str.sqlservr.exe
call fcn.100409c40
mov rbp, rax
test rax, rax
je 0x10040b403
lea rdx, str.DmpRemoteDumpRequest
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x10040b3e2
sub rdi, qword [rsp + 0x60]
je 0x10040b3e2
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x230
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x10040b330
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_allocate_parameter_block___d_
jmp 0x10040b3ef
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, 0x230
mov rcx, rsi
mov qword [rsp + 0x70], 0
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10040b3d3
cmp qword [rsp + 0x70], 0x230
jne 0x10040b3d3
lea rax, [rsp + 0x78]
mov r9, rdi
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [rbx + 0x10]
xor edx, edx
mov dword [rsp + 0x28], 0
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x10040b3b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_create_injected_thread___d_
jmp 0x10040b3ef
mov rcx, rbp
mov qword [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_copy_parameter_block___d_
jmp 0x10040b3ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_locate_injected_thread_start_point___d_
mov r9d, eax
lea rcx, [0x100422050]
mov edx, 1
call fcn.100401b20
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x10040b412
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x10040b452
mov rcx, qword [rbx]
mov r9d, 0x8000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x10040b452
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_free_parameter_block__x
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x10040b630
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
mov eax, dword [0x100443d90]
test eax, eax
je 0x10040b6a8
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
lea rdi, [0x100443d98]
nop
dec eax
mov dword [0x100443d90], eax
mov rbx, qword [rdi + rax*8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10040b68b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_resume_suspended_thread____d
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100443d90]
test eax, eax
jne 0x10040b650
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x10040b6c0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, str.kernel32.dll
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessIdOfThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x1004290e4]
mov ecx, 4
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor esi, esi
mov r14, rax
mov dword [0x100443d90], esi
cmp rax, 0xffffffffffffffff
jne 0x10040b749
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Unable_to_generate_thread_snapshot____d
lea edx, [rsi + 1]
lea rcx, [0x100422050]
call fcn.100401b20
jmp 0x10040b8c6
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x10040b77a
lea ebx, [rax + 1]
lea rdi, str.Unable_to_get_first_thread____d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10040b8a9
mov qword [rsp + 0x70], r15
lea r15, [0x100443d98]
nop word [rax + rax]
mov eax, dword [0x1004290e4]
cmp dword [rsp + 0x2c], eax
jne 0x10040b83e
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 0x42]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rbp, rbp
je 0x10040b7d0
mov rcx, rax
call rbp
cmp eax, dword [0x1004290e4]
je 0x10040b7d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10040b83e
test rbx, rbx
je 0x10040b83e
test edi, edi
je 0x10040b809
cmp edi, 8
je 0x10040b7f6
cmp edi, 0x10
jne 0x10040b831
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
jmp 0x10040b82c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
jmp 0x10040b82c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
je 0x10040b82c
mov eax, dword [0x100443d90]
mov qword [r15 + rax*8], rbx
inc dword [0x100443d90]
cmp ecx, 1
je 0x10040b83c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10040b83e
inc esi
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x10040b860
cmp dword [0x100443d90], 0x1000
jb 0x10040b790
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15, qword [rsp + 0x70]
cmp eax, 0x12
je 0x10040b89d
cmp dword [0x100443d90], 0x1000
jae 0x10040b89d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_get_next_thread____d
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
mov ebx, 2
lea rdi, str.Threads_processed:__d
mov r9d, esi
lea rcx, [0x100422050]
mov r8, rdi
mov edx, ebx
call fcn.100401b20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1004119e0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x10040cc40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
push rsi
sub rsp, 0x4a8
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x490], rax
test dword [rcx + 0x90], 0x400000
mov rbp, r8
mov rsi, rcx
je 0x10040ce6f
lea rdx, str..mdmp
lea rcx, str..mdmp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x10040ce6f
mov qword [rsp + 0x4c8], rbx
mov rbx, qword [rsi + 0x28]
mov qword [rsp + 0x4a0], rdi
xor edi, edi
mov word [rsp + 0x80], di
test rbx, rbx
je 0x10040cdc4
cmp word [rbx], di
je 0x10040cdc4
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x10040cd04
cmp word [rcx], di
je 0x10040cd04
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], 0xff
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
mov edi, 1
mov rsi, qword [rsi + 0x68]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64_s]
test eax, eax
lea r9, [rsp + 0x80]
lea rax, str.SQLDmpr
je 0x10040cd5c
test edi, edi
mov qword [rsp + 0x20], rsi
lea r8, str._ls._p.0
mov edx, 0x104
cmove r9, rax
lea rcx, [rsp + 0x280]
call fcn.100401090
jmp 0x10040cda8
mov edx, dword [rsp + 0x68]
lea r8, str._ls._p.GMT__4d__02d__02d__02d_00_00
mov ecx, dword [rsp + 0x6c]
inc edx
add ecx, 0x76c
test edi, edi
cmove r9, rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov edx, 0x104
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x20], rsi
call fcn.100401090
test eax, eax
jns 0x10040cdf0
lea r8, str.Failed_to_generate_dump_filename
mov edx, 1
lea rcx, [0x100422050]
call fcn.100401b20
xor eax, eax
mov rbx, qword [rsp + 0x4c8]
mov rdi, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1004119e0
add rsp, 0x4a8
pop rsi
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10040ce02
test al, 0x10
jne 0x10040ce38
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10040ce38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
lea r8, str.Failed_to_create_dump_directory__ls___Error_Code__0x_x
lea rcx, [0x100422050]
mov dword [rsp + 0x20], eax
mov edx, 1
call fcn.100401b20
jmp 0x10040cdc4
lea rax, str..dmp
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x280]
mov edx, 0x104
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmakepath_s]
mov eax, 1
jmp 0x10040cdc6
mov rcx, qword [rsi + 0x20]
lea rdx, str..mdmp
mov r8, rbp
call fcn.10040ce90
jmp 0x10040cdd6