Function at 0x432880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
mov edx, str._help_________Basic_help._n______________Basic_help._n______________Advanced_Expert_help._n______________Shortcut_help._n_sc___________Shortcut_help._n_meta_________Metadata_help._n_nUsage:_n_AdFind__switches____b_basedn____f_filter___attr_list__n_n___basedn________RFC_2253_DN_to_base_search_from._n_________________If_no_base_specified__defaults_to_default_NC._n_________________Base_DN_can_also_be_specified_as_a_SID__GUID__or_IID._n___filter________RFC_2254_LDAP_filter._n_________________If_no_filter_specified__defaults_to_objectclass._n___attr_list_____List_of_specific_attributes_to_return__if_nothing_specified_n_________________returns_default_attributes__aka__set._n_n__Switches:__designated_by___or____n_n
mov ecx, 0x5071a8
call fcn.004872d0
test esi, esi
jne 0x4328a4
mov edx, str.____________CONNECTION_OPTIONS__n____h_host:port__Host_and_port_to_use._If_not_specified_uses_port_389_on_n_________________default_LDAP_server._Localhost_can_be_specified_as_.._n_________________Port_can_also_be_specified_via__p_and__gc._n_________________IPv6_IP_address_w__port_is_specified__address_:port_n____gc___________Search_Global_Catalog__port_3268_._n____p_port_______Alternate_method_to_specify_port_to_connect_to._n_n____________QUERY_OPTIONS__n____s_scope______Scope_of_search._Base__One_Level___Sub_tree_._n____t_xxx________Timeout_value_for_query__default_120_seconds._n_n____________OUTPUT_OPTIONS__n____c____________Object_count_only._n____dn___________Object_DNs_only._n____appver_______Output_AdFind_versioning_info._n_n_n__Notes:_n____o_This_tool_was_written_with_simple_US_ASCII_in_mind._UNICODE_and_special_n______ASCII_characters_such_as_characters_with_umlauts_or_graphics_may_not_n______be_output_correctly_due_to_how_the_command_prompt_handles_those_n______characters._If_you_see_this_occurring__redirect_the_output_to_a_text_file_n______with_the_command_prompt_redirection_symbol_____and_it_is_possible_the_n______program_will_give_the_desired_output._n_n_n__Ex1:_n____adfind__b_dcjoehome_dcnet__f__objectcategorycomputer__n______Find_all_computer_objects_in_joehome.net_and_displays_all_attributes_n_n__Ex2:_n____adfind__b_dcjoehome_dcnet__f__objectcategorycomputer__cn_createTimeStamp_n______Find_all_computer_objects_in_joehome.net_and_displays_cn_and_createTimeStamp_n_n__Ex3:_n____adfind__h_.:50000__b_cnab__f__objectcategoryperson__n______Find_all_person_objects_on_cnab_container_of_local_ADAM_instance_n
jmp 0x4328c6
cmp esi, 2
jne 0x4328b0
mov edx, str.____________CONNECTION_OPTIONS__n____h_host:port__Host_and_port_to_use._If_not_specified_uses_port_389_on_n_________________default_LDAP_server._Localhost_can_be_specified_as_.._n_________________Port_can_also_be_specified_via__p_and__gc._n_________________IPv6_IP_address_w__port_is_specified__address_:port_n____gc___________Search_Global_Catalog__port_3268_._n____gcb__________Combines__gc__null_switches._i.e._Full_forest_search._n____this_xxx_____Combines__s_BASE_and__b_xxx_n____p_port_______Alternate_method_to_specify_port_to_connect_to._n____hh_host:port_Combines__h_with__arecex_n____hd_host:port_Combines__h_with__default_n_________________Advanced_______________n____writeable____Use_a_writeable_domain_controller._n____kerbenc______Kerberos_Encryption__LDAP_OPT_ENCRYPT_._n____ssl__________Use_SSL_n____sslignoresrvcert__Ignore_any_problems_with_the_SSL_server_cert._n____arecex_______Hostname_has_a_actual_host_name__not_domain_name._n____url_xx_______Specify_LDAP_S__URL___LDAP:__host:port_basedn..._n_________________See_https:__www.ldap.com_ldap_urls_n_n____________QUERY_OPTIONS__n____s_scope______Scope_of_search._Base__OneLevel__Subtree._n____t_xxx________Timeout_value_for_query__default_120_seconds._n_________________Advanced_______________n____nopaging______BETA__Turn_off_paging._n____ps_size______Page_size__default_page_size__1000._n____maxe_xx______Max_number_of_entries_to_be_returned._n____null_________Use_null_base._n____root_________Determine_and_use_root_partition_for_BaseDN._n____config_______Determine_and_use_configuration_partition_for_BaseDN._n____schema_______Determine_and_use_schema_partition_for_BaseDN._n____default______Determine_and_use_default_partition_for_BaseDN._n____rb_xx________Relative_Base__use_with_special_BaseDNs_above._n_____________________So_you_could_specify__default_and__rb_cnusers._n_____________________Can_also_use__rb_when_piping_DNs_in._n____users________Use_cnusers__default_domain__for_base._n____forestdns____Use_ForestDNS_NDNC_for_base._n____domaindns____Use_DomainDNS_NDNC_for_base._Use_default_domain_by_default._n____dcs__________Use_Domain_Controllers_container_of_default_domain_for_base._n____gpo__________Use_System_Policies_container_of_default_domain_for_base._n____psocontainer_Use_PSO_Container_of_default_domain_for_base._n____quotas_______Use_NTDS_Quotas_container_of_default_domain_for_base._n____ldappolicy___Use_Ldap_Query_Policies_container_for_base._n____xrights______Use_Extended_Rights_container_for_base._n____partitions___Use_Partitions_container_for_base._n____sites________Use_Sites_container_for_base._n____subnets______Use_Subnets_container_for_base._n____exch_________Use_Exchange_Services_container_for_base._n____fsps_________Use_Foreign_Security_Principals_container_for_base._n____sitelinks____Use_Site_Links_Container_for_base._n____legacydns____Use_Legacy_DNS_Container_for_base._n____displayspecifiers_User_Display_Specifiers_container_in_config_for_base._n____ds___________Use_Directory_Service_container_in_config_for_base._n____svcs_________Use_Services_container_in_config_for_base._n____roles________Use_Roles_relative_base__for_ADLDS_._n____delobjs______Use_Deleted_Objects_relative_base_from_whatever_base_defined_plus__showdel._n____delobjs_____Use_Deleted_Objects_relative_base_from_whatever_base_defined_plus__showdel._n____sort_key_____Server_side_sort_by_key__Note:_Sorts_can_time_out_easily_._n____rsort_key____Reverse_server_side_sort_by_key._n_________________Expert_______________n____stdinsort_xx_Sorts_DNs_that_have_been_piped_in_in_multi_DN_mode__the_n_________________default_sort_is_hierarchical__but_can_specify_case_sensitive_n_________________alphabetic_sort_with_csalpha_or_case_insensitive_with_cialpha_n____srvctls_xx___Inserts_arbitrary_server_controls._Delimiter_is___n____showdel______Inserts_show_deleted_objects_server_control_into_query._n____showdel_____Inserts_show_deleted_objects__links__and_recycled_objects_control._n____showdelobjlinks_Inserts_show_deactivated_links_server_control._n____showrecycled_Inserts_show_recycled_objects_server
jmp 0x4328c6
cmp esi, 3
jne 0x4328bc
mov edx, str._n___AdFind_Shortcuts_n____n___AdFind_allows_you_to_specify_shortcuts._Shortcuts_are_not_actual_commands_n___themselves_but_instead_are_shortcuts_to_other_commands_so_you_do_not_have_n___to_recall_or_type_the_longer_commands._Anything_one_of_the_shortcuts_does_n___is_actually_a_combination_of_various_other_switches._To_see_exactly_what_n___switches_are_specified_on_your_behalf__use_the__po_switch_in_combination_n___with_the_shortcut_switch_and_it_will_show_you_everything_that_AdFind_is_n___processing._n_n___Since_these_shortcuts_are_simply_a_combination_of_switches_auto_entered_for_n___you_it_means_that_generally_you_can_use_the_other_switches_in_AdFind_to_add_n___to_the_query_to_focus_it_further_or_get_output_closer_to_what_you_need._In_n___addition__most_of_the_shortcuts_support_the_added_switch__af_xxx__this_n___allows_you_to_add_on_to_the_filter_that_is_specified_by_the_shortcut_n___in_case_you_want_to_make_the_filter_more_granular._Also_if_you_want_to_change_n___which_attributes_are_returned__you_can_add_additional_attributes_by_specifying_n___them_in_the_normal_manner._If_you_want_to_reset_the_list_of_attributes_returned_n___and_specify_your_own__prefix_one_of_the_attributes_with_an_underscore___attr_._n___If_you_want_to_remove_one_or_more_of_the_attributes_from_the_list_you_can_n___can_specify_the_attribute_with_a_trailing_dash__attr__._n_n___If_you_have_an_issue_with_any_of_these_shortcuts__remember_you_can_just__n___enter_the_proper_combination_of_real_switches_yourself._In_general_the__n___shortcuts_will_work_on_Windows_2000_AD__Windows_Server_2003_AD__and_ADAM._n___There_are_however_some_shortcuts_that_will_not_work_on_Windows_2000_AD_n___and_those_have_been_noted_and_where_possible_I_have_added_other_shortcuts_n___specific_to_Windows_2000_to_try_and_get_the_same_info._There_are_also_some_n___shortcuts_that_are_specific_to_AD_or_ADAM._The_name_of_the_shortcut_should_n___help_in_the_event_that_a_switch_is_specific_to_ADAM_or_AD_in_most_cases_n___This_isnt_for_all_cases_because_there_are_shortcuts_that_dont_work_on_n___Windows_2000_AD_or_Windows_Server_2003_AD_but_expect_to_work_in_a_future_n___version_of_AD._n_n___When_in_doubt__just_try_the_switches__AdFind_is_a_query_only_tool__it_can_n___not_harm_your_directory_by_writing_data_to_it_because_it_cant_write._n_n_________________Shortcuts_______________n____af_xxx_________________Add_filter_to_hardcoded_filter_in_most_shortcuts_n_n_n____sc_policies____________Display_forest_policy_info._n____sc_dompol______________Display_Domain_Policy__specify_domain_base_or__default._n_n____sc_modes_______________Show_DC__Domain__and_Forest_Mode_info_from_RootDSE_n_n____sc_forestmodes_________Show_modes_from_NC_partition_objects_for_forest_n____sc_forestmodes:csv_____Same_as_above_but_CSV_output_n_n____sc_dcmodes_____________Show_modes_of_all_DCs_in_forest_from_config_n____sc_dcmodes:csv_________Same_as_above_but_CSV_output_n_n____sc_masterncs___________Show_NCs_mastered_by_all_DCs_in_forest_n____sc_masterncs:csv_______Same_as_above_but_CSV_output_n_n____sc_domainncs___________Show_all_domain_partitions_of_forest_n____sc_domainncs:csv_______Same_as_above_but_CSV_output_n____sc_domainncsl__________List_domain_partitions__DN_Format__as_list_output_n____sc_domainncsl:q________Same_as_above_but_quoted_list_output_n____sc_domainlist__________Dump_all_Domain_NCs_in_forest_in_sorted_DNS_list_format_n_n____sc_ridpool_____________Dump_Decoded_Rid_Pool_Info_n_n____sc_appparts____________Show_application_partitions_n____sc_appparts:csv________Same_as_above_but_CSV_output_n____sc_apppartsl___________Same_as_above_but_list_output_n____sc_apppartsl:q_________Same_as_above_but_quoted_list_output_n_n____sc_appparts___________Show_application_partitions__extra_info__n____sc_appparts:csv_______Same_as_above_but_CSV_output_n_n____sc_adsid:xx____________Resolve_Active_Directory_SID__xx__to_object_n____sc_adguid:xx___________Resolve_Active_Directory_GUID__xx__to_object_n_n____sc_whoami______________Display_authenticated_user_info_and_token_n____sc_whoami:csv__________Same_as
jmp 0x4328c6
cmp esi, 4
jne 0x4328d0
mov edx, str.___MetaData_Help_n____n___AdFind_has_the_ability_to_decode_various_metadata_type_attributes._These_n___attributes_can_give_information_about_replication_status_of_the_server_n___itself_or_replication_metadata_for_individual_objects._n_n___These_special_attributes_are_normally_returned_from_Active_Directory_in_n___XML_format._This_is_a_bit_bulky_and_can_be_tough_to_read_without_cleanup_n___so_I_have_added_the_ability_decode_the_attributes_and_cut_down_the_amount_n___of_data_passed_over_the_wire._Using_the__binary_option_when_specifying_an_n___attribute_causes_AD_to_reformat_certain_attributes_and_send_them_across_as_n___binary_blocks_of_data._When_requesting_the_meta_attributes_outlined_below_n___if_you_do_not_specify_the__binary_option__they_will_be_returned_in_the_n___native_format__if_you_add_the__binary_option__they_will_be_returned_in_the_n___alternate_format_and_AdFind_will_decode_the_strings_to_its_format._n_n___To_further_assist_the_ease_of_retrieving_this_information__see_the_shortcut_n___usage_menu_via_adfind__sc__n___Also_see__metafilter_switches_under_the_output_section_of_AdFind_____n_n___MetaData_Attributes_n_______________________n___msDS_ReplQueueStatistics____RootDSE_attribute_n_______Replication_queue_statistics._Output_is_labeled._No_sort_options._n_n___msDS_ReplPendingOps___RootDSE_attribute_n_______Any_replications_operations_currently_in_progress._Output_is_labeled._n_______Default_sort_order_is_server_return_order._Sort_options___dsa_date_n_n___msDS_ReplConnectionFailures___RootDSE_attribute_n___msDS_ReplLinkFailures___RootDSE_attribute_n_______Replication_failure_information._Output_is_labeled._Default_sort_order_n_______is_by_DSA._Sort_options___dsa_date_n_n___msDS_ReplAllInboundNeighbors___RootDSE_attribute_n___msDS_ReplAllOutboundNeighbors___RootDSE_attribute_n_______Replication_info_for_all_direct_neighbors._Output_is_labeled._Default_n_______sort_order_is_by_DSA._Sort_options___dsa_date_nc_err_n_n___msDS_TopQuotaUsage___RootDSE_attribute_n_______Indicates_the_top_object_owners_on_a_given_server._Output_is_labeled._n_______Default_sort_order_is_server_return_order._Sort_options___nc_owner._n_n___msDS_NCReplInboundNeighbors___Naming_Context_attribute_n___msDS_NCReplOutboundNeighbors___Naming_Context_attribute_n_______Replication_for_all_direct_neighbors_for_the_specific_NC._Output_is_n_______labeled._Default_sort_order_is_by_DSA._Sort_options___dsa_date_nc_err_n_n___msDS_NCReplCursors___Naming_Context_attribute_n_______Replication_cursors_by_DSA_by_context._Output_format:_n____________HighestUSN_LastSyncTime_DSA_n_______Default_sort_order_is_last_sync_time._Sort_options___lastsync_dsa_n_n___msDS_ReplAttributeMetaData___Object_Level_attribute_n_______Replication_metadata_for_object._Output_format:_n_t_____USNLocal_DSA_USNOrig_Date_Time_Version_Attribute_n_______Default_sort_order_is_attribute._Sort_options___DSA_date_usnloc_usnorig_ver_n_n___msDS_ReplValueMetaData___Object_Level_attribute__FFL2_only___i.e._LVR_Replication__n_______Replication_value_metadata_for_object._Output_format:_n_t_____attribute_USNLocal_DSA_USNOrig_Date_Time_Version_State_ObjectDN_n_______Default_sort_order_is_date._Sort_options___attrib_obj_DSA_state_date_usnloc_usnorig_ver_n_n_n___Sort_Options_n________________n___The_decoded_output_for_most_of_the_metadata_attributes_can_be_sorted_to_various_n___fields_in_the_output._The_specific_fields_for_each_attribute_are_listed_with_n___the_description_of_the_attributes._In_order_to_change_the_sort_field__use_the_n____metasort_switch._Specify_the_switch_combined_with_the_options_specified_above_n___to_change_the_sort_order._If_value_has_a_dash_____appended__the_search_order_n___is_reversed._n_n___Filter_Options_n___The_decoded_output_for_msDS_ReplAttributeMetaData_binary_and_n___msDS_ReplValueMetaData_binary_can_be_filtered_using__metafilter_switches._You_n___can_specify_several_filters_by_separating_them_with_a_semi_colon____._If_you_n___specify_several_filters_of_the_same_type__i.e._two_or_more_version_filters_n___they_are_ORed_together._If_you_specify_several_fi
mov ecx, 0x5071a8
call fcn.004872d0
mov edx, str._n_n_This_software_is_Freeware._Use_at_your_own_risk._n_I_do_not_warrant_this_software_to_be_fit_for_any_purpose_or_use_and_n_I_do_not_guarantee_that_it_will_not_damage_or_destroy_your_system._n_Contact_support_joeware.net_via_email_for_licensing_information_to_package_n_this_utility_in_commercial_products._n_n_See_full_Warranty_documentation_or_download_the_latest_version_n_on_http:__www.joeware.net._n_n_If_you_have_improvement_ideas__bugs__or_just_wish_to_say_Hi__I_n_receive_email_24x7_and_read_it_in_a_semi_regular_timeframe._n_You_can_usually_find_me_at_support_joeware.net_n_n
mov ecx, 0x5071a8
call fcn.004872d0
push 1
call fcn.00498b69
int3