joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c80
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
sub esp, 0xa2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa24], eax

Function at 0x4045a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebx
push esi
xor esi, esi
cmp dword [0x419860], 3
push edi
jne 0x404668
test byte [0x419eb0], 2
jne 0x404668
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ecx]
mov dword [0x437268], 0
mov dword [0x437260], 0
mov dword [0x437264], 0
call fcn.00404680
mov eax, dword [0x437268]
test eax, eax
je 0x404668
cmp dword [0x419860], 5
jne 0x40463c
mov eax, dword [0x419eac]
cmp eax, 0xffffffff
je 0x40462c
push eax
call ebx
cmp dword [0x419860], 5
mov dword [0x419eac], 0xffffffff
jae 0x40462c
push 0x419a96
call edi
inc esi
push esi
call fcn.00404000
test eax, eax
je 0x404644
mov eax, dword [0x437268]
test eax, eax
jne 0x4045d0
pop edi
pop esi
pop ebx
ret
push esi
push 0x419ca0
push str.Dump_file__ls:_d_creation_failed__Aborting_multiple_dump_creation
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
mov dword [0x437268], 0
pop edi
pop esi
pop ebx
ret
Function at 0x404aa0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [0x419eb0]
push esi
test eax, 0x400
je 0x404bde
test eax, 0x4000
jne 0x404b2d
mov ecx, dword [0x419ee4]
test ecx, ecx
je 0x404b53
push str.MICROSOFTWID
push ecx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x404b48
push 0x118
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], 0x11c
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x404bde
cmp dword [esp + 0x20], 2
jne 0x404bde
cmp dword [esp + 0x14], 6
jb 0x404bde
mov eax, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0040bb9d
add esp, 0x12c
ret
mov ecx, dword [0x419ee4]
mov eax, dword [0x419eb0]
mov edx, dword [0x419ee8]
push eax
call fcn.00401f40
mov esi, eax
test esi, esi
je 0x404bde
push ebx
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.EnableErrorReporting
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 4
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
test eax, eax
setne bl
test eax, eax
jne 0x404bbe
cmp dword [esp + 0x10], 4
jne 0x404bbe
cmp dword [esp + 8], 4
jne 0x404bbe
cmp dword [esp + 0xc], 1
jne 0x404bbe
lea ebx, [eax + 1]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0040bb9d
add esp, 0x12c
ret
mov ecx, dword [esp + 0x12c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040bb9d
add esp, 0x12c
ret
Function at 0x405d50
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push str.sqlmin.dll
push dword [0x419864]
mov dword [esp + 0x1c], 0
xor ebp, ebp
call fcn.00406060
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405da8
push str.bufferPoolInfo
push eax
call ebx
test eax, eax
je 0x405da8
sub eax, dword [esp + 0x14]
je 0x405da8
push 0x4207c4
lea edi, [ebp + 0x20]
mov esi, eax
mov ecx, 0x419860
call fcn.004025a0
mov ebp, eax
lea eax, [esp + 0x14]
push eax
push str.sqldk.dll
push dword [0x419864]
xor edi, edi
call fcn.00406060
test eax, eax
je 0x405ded
push str.memMgrInfo
push eax
call ebx
test eax, eax
je 0x405ded
sub eax, dword [esp + 0x14]
je 0x405ded
push 0x4207e4
mov edi, 0x4c
mov esi, eax
mov ecx, 0x419860
call fcn.004025a0
mov edi, eax
and edi, ebp
jne 0x405e2e
mov ecx, 0x41a360
mov ebx, 0x420838
call fcn.00401bf0
movzx edi, al
test al, al
je 0x405f73
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
mov dword [0x4207ac], 1
mov dword [0x420834], eax
jmp 0x405f6f
mov ecx, dword [0x4207dc]
mov dword [0x420834], 0x2000
test ecx, ecx
je 0x405e75
push 0x4207b0
push 0x419860
lea ebx, [esp + 0x18]
mov eax, 4
call fcn.00402510
test eax, eax
je 0x405e75
push eax
push str.Can_not_read_m_pBuf_content:__x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
xor edi, edi
mov ecx, dword [0x4207e8]
test ecx, ecx
je 0x405eb2
push 0x4207b4
push 0x419860
lea ebx, [esp + 0x18]
mov eax, 4
call fcn.00402510
test eax, eax
je 0x405eb2
push eax
push str.Can_not_read_m_BucketsPtr_content:__x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
xor edi, edi
mov ecx, dword [0x4207ec]
test ecx, ecx
je 0x405eef
push 0x4207bc
push 0x419860
lea ebx, [esp + 0x18]
mov eax, 4
call fcn.00402510
test eax, eax
je 0x405eef
push eax
push str.Can_not_read_m_LookupTablePtr_content:__x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
xor edi, edi
mov ecx, dword [0x420828]
test ecx, ecx
je 0x405f2c
push 0x4207c0
push 0x419860
lea ebx, [esp + 0x18]
mov eax, 4
call fcn.00402510
test eax, eax
je 0x405f2c
push eax
push str.Can_not_read_m_64KBlockArrayPtr_content:__x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
xor edi, edi
mov ecx, dword [0x4207f0]
test ecx, ecx
je 0x405f69
push 0x4207b8
push 0x419860
lea ebx, [esp + 0x18]
mov eax, 4
call fcn.00402510
test eax, eax
je 0x405f69
push eax
push str.Can_not_read_m_64KBlockArrayPtr_content:__x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
xor edi, edi
mov dword [0x4207ac], edi
test edi, edi
jne 0x405f87
push str.Unable_to_read_remote_buffer_pool_or_memory_manager_information_struct_or_list_of_ranges_to_exclude
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x406060
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x4cc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x4c8], eax
mov eax, dword [esp + 0x4d4]
push ebx
push ebp
mov ebp, dword [esp + 0x4d8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x4e0]
push 0x190
mov dword [esp + 0x14], eax
lea eax, [esp + 0x30]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x190
lea eax, [esp + 0x34]
push eax
push ebp
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x406222
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
cmp edi, 0x64
jb 0x4060d7
mov edi, 0x64
push esi
xor esi, esi
test edi, edi
jle 0x40621b
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc
lea eax, [esp + 0x2c]
push eax
push dword [esp + esi*4 + 0x3c]
push ebp
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
je 0x4061aa
push 0x104
lea eax, [esp + 0x2d0]
push eax
push dword [esp + esi*4 + 0x3c]
push ebp
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x4061aa
push 0x104
lea eax, [esp + 0x1c8]
push eax
push dword [esp + esi*4 + 0x3c]
push ebp
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
test eax, eax
je 0x4061aa
push dword [esp + 0x10]
lea eax, [esp + 0x1c8]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4061c7
push 1
push eax
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4061d4
call ebx
push eax
lea eax, [esp + 0x2d0]
push eax
push str.Could_not_load_module__s___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
mov eax, esi
pop esi
pop edi
mov ecx, dword [esp + 0x4d0]
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bb9d
add esp, 0x4cc
ret 0xc
call ebx
push eax
push str.Could_not_open_module_information_for_remote_process___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
inc esi
cmp esi, edi
jl 0x4060e8
xor eax, eax
jmp 0x40618f
push 0xc
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
je 0x4061fd
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
jmp 0x40618d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call ebx
push eax
push str.Could_not_open_module_information_for_local_image___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
xor eax, eax
jmp 0x40618f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_enumerate_process_modules___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
xor eax, eax
jmp 0x406191
Function at 0x407160
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [0x437498], 0
push ebx
push ebp
push esi
push edi
je 0x407308
test byte [0x43726c], 0x20
je 0x407308
test dword [0x419eb0], 0x40000
jne 0x407308
cmp word [0x437288], 0
jne 0x40722f
mov ecx, 0x437288
mov esi, str.SQLDump_manual_
mov edx, 0x105
sub esi, ecx
jmp 0x4071c0
lea eax, [edx + 0x7ffffef9]
test eax, eax
je 0x4071de
movzx eax, word [esi + ecx]
test ax, ax
je 0x4071de
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x4071c0
jmp 0x4071e2
test edx, edx
jne 0x4071e5
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x40722f
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x40722f
mov eax, dword [esp + 0x10]
push 0x437288
mov edi, 0x105
call fcn.00401150
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4374a8], eax
test eax, eax
je 0x4072e3
mov eax, dword [0x437498]
xor esi, esi
mov dword [0x4374a4], eax
test eax, eax
je 0x407308
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
lea ebx, [ebx]
lea eax, [esp + 0x10]
push eax
push 0
push 0x419860
push 0x4070a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4072c7
push 0x4374a4
call edi
test eax, eax
jne 0x4072a2
push dword [0x4374a8]
call ebp
or dword [0x415054], 0x20008000
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_thread_for_remote_dump_launch___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
inc esi
cmp esi, dword [0x437498]
jb 0x407270
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0040bb9d
add esp, 0x1c
ret
or dword [0x415054], 0x20008000
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_event_for_remote_dump_launch___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bb9d
add esp, 0x1c
ret
Function at 0x407320
Capabilities:
List tcp connections and listeners

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
push ebp
movzx ebp, word [esp + 0xc]
push esi
push edi
xor edi, edi
push 0
push 3
push ebp
push 0
lea eax, [esp + 0x24]
push eax
push 0
mov dword [esp + 0x2c], 0
call ebx
cmp eax, 0x7a
jne 0x407393
push dword [esp + 0x14]
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x4073c0
push 0
push 3
push ebp
push 0
lea eax, [esp + 0x24]
push eax
push esi
call ebx
mov ebx, eax
test ebx, ebx
je 0x4073db
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp ebx, 0x7a
jne 0x40739c
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
inc edi
cmp edi, 4
jb 0x407333
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_get_tcp_table___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_allocate_tcp_table___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4073f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x224
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [0x437494]
push ebx
push ebp
push esi
mov dword [esp + 0xc], 0
movzx eax, word [eax + 4]
push edi
push eax
push str.Lookup_process_by_port__d
push 2
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
push 2
call fcn.00407320
push 0x17
mov ebx, eax
call fcn.00407320
mov ecx, dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, eax
test ebp, ebp
je 0x407480
xor esi, esi
cmp dword [ebp], esi
jbe 0x407480
lea edi, [ebp + 4]
mov eax, dword [0x437494]
movzx eax, word [eax + 4]
push eax
call ecx
mov ecx, dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, dword [edi + 0x14]
je 0x407479
inc esi
add edi, 0x38
cmp esi, dword [ebp]
jb 0x407454
jmp 0x407480
mov eax, dword [edi + 0x34]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
jne 0x4074bf
test ebx, ebx
je 0x4074bf
xor esi, esi
cmp dword [ebx], esi
jbe 0x4074bf
lea edi, [ebx + 4]
mov eax, dword [0x437494]
movzx eax, word [eax + 4]
push eax
call ecx
movzx eax, ax
cmp eax, dword [edi + 8]
je 0x4074b8
mov ecx, dword [sym.imp.WS2_32.dll_ntohs]
inc esi
add edi, 0x18
cmp esi, dword [ebx]
jb 0x407494
jmp 0x4074bf
mov eax, dword [edi + 0x14]
mov dword [esp + 0x10], eax
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
push ebx
call esi
push ebp
call esi
add esp, 8
cmp dword [esp + 0x10], 0
jne 0x407587
push str.Lookup_process_by_uptime_pid
push 2
mov ebx, 0x415428
call fcn.00401660
xor eax, eax
push 0x208
push eax
mov word [esp + 0x34], ax
lea eax, [esp + 0x36]
push eax
mov dword [esp + 0x28], 0
call sub.MSVCR100.dll_memset
add esp, 0x14
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [0x437494]
push 0
add eax, 0x316
push eax
mov dword [esp + 0x28], 0x105
call dword [sym.imp.instapi110.dll_GetInstRegPathByName]
test eax, eax
je 0x407587
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea eax, [esp + 0x30]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407587
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push str.uptime_pid
push dword [esp + 0x28]
mov dword [esp + 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x10]
mov ebx, 0x415428
push str.Lookup_process_finished_with_PID_d
push 2
call fcn.00401660
mov ecx, dword [esp + 0x23c]
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bb9d
add esp, 0x224
ret
Function at 0x4075d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
lea ebp, [ebx + 1]
xor esi, esi
test esi, esi
jne 0x407618
mov ebx, dword [esp + 0x20]
push 0x64
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407604
cmp eax, 0x102
je 0x407656
xor ebp, ebp
mov esi, 1
mov ebx, dword [esp + 0x10]
mov eax, ebx
sub eax, edi
cmp eax, 0x7530
jb 0x4075e4
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push dword [esi + 4]
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test ebp, ebp
je 0x4076af
test eax, eax
je 0x4076af
push dword [esp + 0x14]
push edi
push ebx
push str.Injected_thread_completed_after_waiting_for__d_msec___d_suspended___ret_code___X
push 2
mov ebx, 0x415428
call fcn.00401660
add esp, 0x14
jmp 0x4076c5
push dword [ebx + 4]
add dword [esp + 0x14], 0x64
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x407609
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40769c
mov esi, 1
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_resume_injected_thread___d_
push esi
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
cmp dword [esp + 0x18], 2
jbe 0x407609
add edi, 0x64
jmp 0x407609
push edi
push ebx
push str.Wait_for_injected_thread_exited_after_waiting_for__d_msec___d_suspended_
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
mov eax, dword [esi + 4]
test eax, eax
je 0x4076d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
test eax, eax
je 0x407709
push 0x8000
push 0
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x407709
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_free_parameter_block__x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x407720
Capabilities:
Create thread
Inject thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebx, eax
push edi
lea eax, [esp + 0x10]
push eax
push str.sqlservr.exe
push ebx
mov dword [esi], ebx
call fcn.00406060
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebp, ebp
je 0x407828
push str.DmpRemoteDumpRequest
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407811
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x407811
push 4
push 0x3000
push 0x22c
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esi + 8], eax
test eax, eax
jne 0x407795
call edi
push eax
push str.Unable_to_allocate_parameter_block___d_
jmp 0x407819
lea ecx, [esp + 0xc]
push ecx
push 0x22c
push dword [esp + 0x24]
mov dword [esp + 0x18], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x407807
cmp dword [esp + 0xc], 0x22c
jne 0x407807
lea eax, [esp + 0x14]
push eax
push 0
push dword [esi + 8]
push dword [esp + 0x1c]
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x4077eb
call edi
push eax
push str.Unable_to_create_injected_thread___d_
jmp 0x407819
push ebp
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
call edi
push eax
push str.Unable_to_copy_parameter_block___d_
jmp 0x407819
call edi
push eax
push str.Unable_to_locate_injected_thread_start_point___d_
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
mov eax, dword [esi + 4]
test eax, eax
je 0x407836
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
test eax, eax
je 0x407868
push 0x8000
push 0
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x407868
call edi
push eax
push str.Unable_to_free_parameter_block__x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4

Function at 0x4079b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4374bc], eax
test eax, eax
jne 0x4079da
push edi
mov edi, str.Unable_to_create_service_event
call fcn.00406520
xor eax, eax
pop edi
pop ecx
ret
lea eax, [esp]
push eax
push 0
push 0x419860
push 0x407880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4374c0], eax
test eax, eax
jne 0x407a2a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_thread_for_service_handler___d_.
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
push dword [0x4374bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x407a40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
cmp dword [0x419eb8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
jne 0x407ac7
lea eax, [esp + 8]
push eax
push 1
push 0
push 0x40d450
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407ac7
lea eax, [esp]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push str.DumpOverrideFlags
push dword [esp + 0x1c]
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407abd
cmp dword [esp + 0xc], 4
jne 0x407abd
cmp dword [esp], 4
jne 0x407abd
mov eax, dword [esp + 4]
test eax, eax
je 0x407abd
mov dword [0x419eb8], eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
ret

Function at 0x407ad0
Capabilities:
Resume thread

Disassembly:
mov eax, dword [0x43325c]
test eax, eax
je 0x407b30
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [esp]
dec eax
mov dword [0x43325c], eax
mov esi, dword [eax*4 + 0x433260]
push esi
call ebp
cmp eax, 0xffffffff
jne 0x407b20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_resume_suspended_thread____d
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
push esi
call edi
mov eax, dword [0x43325c]
test eax, eax
jne 0x407af0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407b40
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push str.GetProcessIdOfThread
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x41a9c0]
mov dword [esp + 0x10], eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor ebx, ebx
mov dword [esp + 4], eax
mov dword [0x43325c], ebx
cmp eax, 0xffffffff
jne 0x407bb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_generate_thread_snapshot____d
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0040bb9d
add esp, 0x2c
ret
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x1c], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x407bf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_get_first_thread____d
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
jmp 0x407cce
push esi
mov eax, dword [esp + 0x24]
cmp eax, dword [0x41a9c0]
jne 0x407c5d
push dword [esp + 0x20]
push 0
push 0x42
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x407c23
push esi
call eax
cmp eax, dword [0x41a9c0]
jne 0x407c5a
test esi, esi
je 0x407c5d
test edi, edi
je 0x407ce5
cmp edi, 8
je 0x407c42
cmp edi, 0x10
jne 0x407c5a
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x407c49
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp ecx, 1
je 0x407d0f
push esi
call ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x407c80
cmp dword [0x43325c], 0x1000
jb 0x407bf4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], ebx
call esi
cmp eax, 0x12
je 0x407cb8
cmp dword [0x43325c], 0x1000
jae 0x407cb8
call esi
push eax
push str.Unable_to_get_next_thread____d
push 1
mov ebx, 0x415428
call fcn.00401660
mov ebx, dword [esp + 0x1c]
add esp, 0xc
push ebx
push str.Threads_processed:__d
push 2
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
pop esi
push dword [esp + 8]
call ebp
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bb9d
add esp, 0x2c
ret
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp ecx, 1
jne 0x407c5a
mov eax, dword [0x43325c]
mov dword [eax*4 + 0x433260], esi
inc dword [0x43325c]
inc ebx
jmp 0x407c5d