Function at 0x10005680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x60]
mov dword [ebp - 8], ecx
push eax
mov edi, edx
mov dword [ebp - 0x60], 0x16
push 0x10005560
push 2
xor ebx, ebx
mov dword [ebp - 0x78], edi
push dword [edi + 0xc]
xor esi, esi
mov dword [ebp - 0x70], ebx
push dword [edi + 8]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x5c], str.coreclr.dll
call dword [sym.imp.SystemInformer.exe_PhEnumGenericModules]
mov eax, dword ds:[ebp - 0x58]
test eax, eax
je 0x100056e8
cmp dword [eax], ebx
jne 0x10005710
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0xe
push eax
push 0x10005560
push 2
push dword [edi + 0xc]
mov dword [ebp - 0x5c], str.clr.dll
push dword [edi + 8]
call dword [sym.imp.SystemInformer.exe_PhEnumGenericModules]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x1000571c
cmp dword [eax], ebx
je 0x1000571c
mov esi, eax
jmp 0x10005738
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 8]
call dword [sym.imp.SystemInformer.exe_PhGetProcessImageFileNameByProcessId]
test eax, eax
js 0x100057b3
mov esi, dword [ebp - 0x64]
mov byte [edi + 0x11], 1
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x6c], esi
push eax
push 0
push esi
call dword [sym.imp.SystemInformer.exe_PhLoadLibraryAsImageResource]
test eax, eax
js 0x100057a9
lea eax, ds:[ebp - 0x40]
push eax
push 0
push 0xa
push str.CLRDEBUGINFO
push dword [ebp - 0x4c]
call dword [sym.imp.SystemInformer.exe_PhLoadResource]
test al, al
je 0x100057a0
mov edi, dword [ebp - 0x40]
cmp dword [edi], ebx
jne 0x100057a0
lea ecx, [edi + 4]
mov edx, 0x1001bd94
mov esi, 0xc
mov edi, edi
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000579d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10005780
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x6c]
push dword [ebp - 0x4c]
call dword [sym.imp.SystemInformer.exe_PhFreeLibraryAsImageResource]
push esi
call dword [sym.imp.SystemInformer.exe_PhGetBaseDirectory]
mov dword [ebp - 0x74], eax
push 0x10020a18
call dword [sym.imp.SystemInformer.exe_PhExpandEnvironmentStrings]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x10005948
push 2
call dword [sym.imp.SystemInformer.exe_PhCreateList]
push 0x21
push 1
push 7
push 0x10
push 0x100001
push dword [esi + 4]
mov edi, eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SystemInformer.exe_PhCreateFileWin32]
test eax, eax
js 0x10005810
push edi
push 0x10005600
push 0
push dword [ebp - 0x50]
call dword [sym.imp.SystemInformer.exe_PhEnumDirectoryFile]
push dword [ebp - 0x50]
call dword [sym.imp.ntdll.dll_NtClose]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp dword [edi], ebx
jbe 0x10005908
lea ecx, [ecx]
mov eax, dword ds:[edi + 8]
push 0x10020a10
mov eax, dword [eax + ebx*4]
push eax
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], str.__
call dword [sym.imp.SystemInformer.exe_PhConcatStringRef4]
push eax
mov dword [ebp - 0x68], eax
call dword [sym.imp.SystemInformer.exe_PhDosPathNameToNtPathName]
mov esi, eax
test esi, esi
je 0x10005a2f
cmp dword ds:[esi], 0
je 0x10005a2f
push esi
call dword [sym.imp.SystemInformer.exe_PhDoesFileExist]
test al, al
je 0x10005a2f
lea eax, [ebp - 0x34]
or edi, 0xffffffff
push eax
push 0
push esi
or ebx, 0xffffffff
call dword [sym.imp.SystemInformer.exe_PhLoadMappedImageHeaderPageSize]
test eax, eax
js 0x100058b8
mov ax, word [ebp - 0x1c]
mov ecx, 0x10b
cmp ax, cx
je 0x100058a5
mov ecx, 0x20b
cmp ax, cx
jne 0x100058ae
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax + 0x50]
mov edi, dword [eax + 8]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.SystemInformer.exe_PhUnloadMappedImage]
mov esi, dword ds:[ebp - 0x68]
cmp dword [ebp - 0x48], edi
jne 0x100058df
cmp dword [ebp - 0x44], ebx
jne 0x100058df
test esi, esi
je 0x100058d3
mov eax, dword [esi + 4]
jmp 0x100058d5
xor eax, eax
push eax
call dword [sym.imp.SystemInformer.exe_PhLoadLibrary]
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x3c]
push esi
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
cmp dword [ebp - 0x70], 0
jne 0x10005908
mov esi, dword ds:[ebp - 0x40]
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, dword [edi]
jb 0x10005820
mov eax, dword [ebp - 0x3c]
xor esi, esi
mov edi, dword [edi]
mov ebx, dword [eax + 8]
test edi, edi
je 0x10005927
push dword [ebx + esi*4]
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
inc esi
cmp esi, edi
jb 0x10005916
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
push dword [ebp - 0x40]
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
mov ebx, dword ds:[ebp - 0x70]
test ebx, ebx
jne 0x10005ba6
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x10005a7c
push 0x10020a10
push eax
call dword [sym.imp.SystemInformer.exe_PhConcatStringRef2]
mov edi, eax
push edi
call dword [sym.imp.SystemInformer.exe_PhGetFileName]
mov esi, eax
test edi, edi
je 0x10005975
push edi
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x5e
push eax
mov dword [ebp - 0x14], str.ProcessHacker.DotNetTools.DotNetVerifySignature
call dword [sym.imp.SystemInformer.exe_PhGetIntegerStringRefSetting]
test eax, eax
je 0x100059a8
push 0
push esi
call dword [sym.imp.SystemInformer.exe_PhVerifyFileIsChainedToMicrosoft]
lea ebx, [ebx]
test al, al
je 0x10005a66
push dword ds:[ebp - 8]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0xc], 0
push 0x1000
push eax
xor bl, bl
call dword [sym.imp.SystemInformer.exe_PhOpenProcess]
test eax, eax
js 0x10005a26
push 0
push 0x20
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x20
push eax
push 0
push dword [ebp - 0x3c]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x10005a17
test byte [ebp - 0x1c], 0x40
je 0x10005a17
lea eax, [ebp - 0xc]
push eax
push 0xe
push dword [ebp - 0x3c]
call dword [sym.imp.SystemInformer.exe_PhOpenProcessToken]
nop
test eax, eax
js 0x10005a17
push dword [ebp - 0xc]
push 0xfffffffffffffffe
call dword [sym.imp.SystemInformer.exe_PhImpersonateToken]
mov ebx, eax
shr ebx, 0x1f
xor bl, 1
push dword ds:[ebp - 0x3c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x10005a37
mov eax, dword [esi + 4]
jmp 0x10005a39
mov esi, dword [ebp - 0x68]
jmp 0x100058e5
xor eax, eax
push eax
call dword [sym.imp.SystemInformer.exe_PhLoadLibrary]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10005a66
test bl, bl
je 0x10005a5f
push 0xfffffffffffffffe
call dword [sym.imp.SystemInformer.exe_PhRevertImpersonationToken]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x10005a71
push esi
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
mov ebx, dword [ebp - 0x70]
test ebx, ebx
jne 0x10005baf
mov eax, dword ds:[ebp - 0x6c]
test eax, eax
je 0x10005ba6
mov ecx, dword [ebp - 0x78]
cmp byte [ecx + 0x11], 0
je 0x10005ba6
lea ecx, ds:[ebp - 0x44]
push ecx
push 0
push eax
call dword [sym.imp.SystemInformer.exe_PhLoadLibraryAsImageResource]
test eax, eax
js 0x10005ba6
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 8]
push eax
push 0xa
push str.MINIDUMP_EMBEDDED_AUXILIARY_PROVIDER
push dword [ebp - 0x44]
call dword [sym.imp.SystemInformer.exe_PhLoadResource]
test al, al
je 0x10005b9d
call dword [sym.imp.SystemInformer.exe_PhGetTemporaryDirectoryRandomAlphaFileName]
mov ecx, dword [ebp - 8]
mov edi, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
test edi, edi
je 0x10005aec
mov eax, dword [edi + 4]
jmp 0x10005aee
xor eax, eax
push 0
push 0x64
push 2
push 7
push 0x80
lea ecx, [ebp - 0x18]
push ecx
push 0x120116
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SystemInformer.exe_PhCreateFileWin32Ex]
test eax, eax
js 0x10005b92
push 0
push 0
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push dword [ebp - 0x48]
push eax
push 0
push 0
push 0
push dword [ebp - 0x40]
call dword [sym.imp.ntdll.dll_NtWriteFile]
push dword [ebp - 0x40]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
nop
test esi, esi
js 0x10005b92
mov ecx, edi
call fcn.100055a0
test al, al
je 0x10005b7f
test edi, edi
je 0x10005b58
mov eax, dword [edi + 4]
jmp 0x10005b5a
xor eax, eax
push eax
call dword [sym.imp.SystemInformer.exe_PhLoadLibrary]
mov ebx, eax
test ebx, ebx
je 0x10005b7f
mov eax, dword [ebp - 0x78]
mov dword [eax + 0x18], edi
test edi, edi
je 0x10005b9d
push edi
call dword [sym.imp.SystemInformer.exe_PhReferenceObject]
jmp 0x10005b96
nop
test edi, edi
je 0x10005b89
mov eax, dword [edi + 4]
jmp 0x10005b8b
xor eax, eax
push eax
call dword [sym.imp.SystemInformer.exe_PhDeleteFileWin32]
test edi, edi
je 0x10005b9d
push edi
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
push dword [ebp - 0x44]
call dword [sym.imp.SystemInformer.exe_PhFreeLibraryAsImageResource]
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x10005bb9
jmp 0x10005bb2
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
mov eax, dword ds:[ebp - 0x6c]
test eax, eax
je 0x10005bcb
push eax
call dword [sym.imp.SystemInformer.exe_PhDereferenceObject]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000972a
mov esp, ebp
pop ebp
ret