joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e25d
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
test edx, edx
mov eax, 0x5285c0
push 0x10
cmovne eax, edx
mov edx, dword [edi]
pop ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x28], ecx
lea ecx, [edx + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [eax + 4], ebp
je 0x40e38d
cmp dword [eax], ebp
je 0x40e38d
test edx, edx
je 0x40e386
cmp dword [edi + 4], ebp
je 0x40e386
push ecx
call fcn.0040d4ee
mov ebx, eax
test ebx, ebx
je 0x40e398
push dword [edi]
lea esi, [ebx + 0x14]
push dword [edi + 4]
push esi
call fcn.0049fa90
lea eax, [ebx + 0x10]
mov edx, esi
push 4
push eax
push dword [edi]
mov ecx, 0x8000
call fcn.004032e8
add esp, 0x18
test eax, eax
je 0x40e371
push 0x10
push ebx
call dword [sym.imp.cryptdll.dll_CDGenerateRandomBits]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.cryptdll.dll_MD5Init]
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.cryptdll.dll_MD5Update]
push dword [eax]
push dword [eax + 4]
lea eax, [esp + 0x40]
push eax
call esi
push 0x10
push ebx
lea eax, [esp + 0x40]
push eax
call esi
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.cryptdll.dll_MD5Final]
mov esi, dword [esp + 0x1c]
add esi, 0x14
lea eax, [esi - 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
lea eax, [ebx + 0x10]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction032]
test eax, eax
js 0x40e36a
mov eax, dword [edi + 4]
inc ebp
mov dword [edi + 4], ebx
mov dword [edi], esi
jmp 0x40e37e
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___RtlEncryptData2_n
jmp 0x40e376
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___Unable_to_calculate_CRC32_n
call fcn.00409cda
mov eax, ebx
pop ecx
push eax
call fcn.0040d4fd
jmp 0x40e398
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_valid_data_n
jmp 0x40e392
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_Session_Key_n
call fcn.00409cda
pop ecx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x40e7bf
Capabilities:
Listen for remote procedure calls

Disassembly:
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push edx
mov edx, ecx
mov dword [esp + 0x10], ebx
mov ecx, 0x4c9a94
mov dword [esp + 0x14], ebx
mov esi, ebx
call fcn.0040e6db
mov edi, eax
pop ecx
test edi, edi
je 0x40e93e
push ebp
push ebx
push ebx
push 0xa
push str.ncacn_ip_tcp
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov esi, eax
test esi, esi
jne 0x40e929
push ebx
push ebx
push 9
push edi
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov esi, eax
test esi, esi
jne 0x40e921
push ebx
push 0xffffffffffffffff
mov ebp, 0x4d2
push ebp
push 8
push ebx
push ebx
push 0x4c9a90
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov esi, eax
test esi, esi
jne 0x40e919
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.RPCRT4.dll_RpcServerInqBindings]
mov esi, eax
test esi, esi
jne 0x40e911
mov eax, dword [esp + 0x10]
mov esi, ebx
cmp dword [eax], ebx
jbe 0x40e8a0
lea ecx, [esp + 0x14]
push ecx
push dword [eax + esi*4 + 4]
call dword [sym.imp.RPCRT4.dll_RpcBindingToStringBindingW]
test eax, eax
jne 0x40e88a
push dword [esp + 0x14]
push esi
push str.___BindString__u_:__s_n
call fcn.00409cda
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x40e897
push eax
push str.ERROR_kull_m_rpc_drsr_start_server___RpcBindingToStringBinding:__08x_n
call fcn.00409cda
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
inc esi
cmp esi, dword [eax]
jb 0x40e858
push str.mimikatz_Ho__hey__Im_a_DC_:_
push ebx
push eax
push 0x4c9a90
call dword [sym.imp.RPCRT4.dll_RpcEpRegisterW]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
test esi, esi
jne 0x40e909
push str.___RPC_bind_registered_n
call fcn.00409cda
pop ecx
push 1
push ebp
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
test esi, esi
jne 0x40e8eb
push str.___RPC_Server_is_waiting__n
call fcn.00409cda
jmp 0x40e935
cmp esi, 0x6b1
jne 0x40e901
push str.___RPC_Server_already_waiting__n
call fcn.00409cda
mov esi, ebx
jmp 0x40e935
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerListen:__08x_n
jmp 0x40e92f
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcEpRegister:__08x_n
jmp 0x40e92f
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerInqBindings:__08x_n
jmp 0x40e92f
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterIf2:__08x_n
jmp 0x40e92f
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterAuthInfo:__08x_n
jmp 0x40e92f
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerUseProtseqEp:__08x_n
call fcn.00409cda
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
ret
Function at 0x40f31d
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebp
push esi
push 3
push 0x4e2624
push 0
mov dword [esp + 0x18], edx
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x40f445
push ebx
push edi
push 0x10
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x40f36c
push esi
push str.____s_service_already_registered_n
jmp 0x40f3ec
call ebx
cmp eax, 0x424
jne 0x40f3e4
push esi
push str.____s_service_not_present_n
call fcn.00409cda
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [esp + 0x34]
push 1
push 2
push dword [esp + 0x44]
push 0x60010
push dword [esp + 0x3c]
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
je 0x40f3da
push esi
push str.____s_service_successfully_registered_n
call fcn.00409cda
pop ecx
pop ecx
mov ecx, edi
call fcn.0040f222
mov dword [esp + 0x10], eax
test eax, eax
je 0x40f3d0
push esi
push str.____s_service_ACL_to_everyone_n
jmp 0x40f3ec
call ebx
push eax
push str.ERROR_kull_m_service_install___kull_m_service_addWorldToSD__0x_08x__n
jmp 0x40f3ec
call ebx
push eax
push str.ERROR_kull_m_service_install___CreateService__0x_08x__n
jmp 0x40f3ec
call ebx
push eax
push str.ERROR_kull_m_service_install___OpenService__0x_08x__n
call fcn.00409cda
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ecx
pop ecx
test edi, edi
je 0x40f43b
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40f418
push esi
push str.____s_service_started_n
jmp 0x40f431
call ebx
cmp eax, 0x420
jne 0x40f429
push esi
push str.____s_service_already_started_n
jmp 0x40f431
call ebx
push eax
push str.ERROR_kull_m_service_install___StartService__0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push edi
call ebp
push dword [esp + 0x18]
call ebp
pop edi
pop ebx
jmp 0x40f458
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_service_install___OpenSCManager_create___0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
mov eax, dword [esp + 8]
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x40fd58
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
push esi
push esi
push ebx
push esi
push 1
mov ebp, ecx
mov dword [edi], esi
push esi
push ebp
mov dword [ebx], esi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x40fdaa
push dword [ebx]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
test eax, eax
je 0x40fdaa
push esi
push esi
push ebx
push eax
push 1
push esi
push ebp
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov esi, eax
test esi, esi
jne 0x40fdaa
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x40fe3e
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov ebp, edx
push eax
mov dword [esp + 0x14], eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov edx, ebx
and edx, 3
inc edx
add edx, ebx
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x40fefe
push ebx
push dword [esp + 0x14]
push esi
call fcn.0049fa90
add esp, 0xc
mov eax, edi
test ebx, ebx
je 0x40feab
mov cl, byte [eax + esi]
cmp cl, 0x2d
jne 0x40fe93
mov byte [eax + esi], 0x2b
jmp 0x40fea6
cmp cl, 0x5f
jne 0x40fe9e
mov byte [eax + esi], 0x2f
jmp 0x40fea6
test cl, cl
jne 0x40fea6
mov byte [eax + esi], 0x3d
inc eax
cmp eax, ebx
jb 0x40fe85
mov ebx, dword [esp + 0x18]
push edi
push edi
push ebx
push edi
push 1
push edi
push esi
mov dword [ebp], edi
mov dword [ebx], edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x40fef7
push dword [ebx]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp], eax
test eax, eax
je 0x40fef7
push edi
push edi
push ebx
push eax
push 1
push edi
push esi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edi, eax
test edi, edi
jne 0x40fef7
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp], eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40ff06
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
push edi
push 0x40000001
mov ebx, edx
mov dword [esp + 0x18], edi
mov ebp, ecx
push ebx
push ebp
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x40ff66
push esi
push dword [esp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [esp + 0x18]
mov dword [esi], eax
test eax, eax
je 0x40ff65
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x40000001
push ebx
push ebp
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edi, eax
test edi, edi
jne 0x40ff65
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], eax
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40ffbd
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
push edi
push SysReAllocString
push dword [esp + 0x20]
mov ebp, edx
mov dword [esp + 0x1c], edi
push ebp
mov ebx, ecx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x410030
push esi
push dword [esp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x41002f
lea eax, [esp + 0x10]
push eax
push esi
push SysReAllocString
push dword [esp + 0x24]
push ebp
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x410028
push ebx
push esi
push ebx
push str._____BEGIN__s______n_s_____END__s______n
push dword [esp + 0x2c]
call fcn.00410091
add esp, 0x14
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x410402
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edx
push eax
push 4
lea eax, [esp + 0x18]
mov ebp, ecx
push eax
push 8
xor esi, esi
push ebp
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4104aa
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x410466
lea eax, [esp + 0xc]
push eax
push 2
push 1
push esi
push 8
push ebp
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
test edi, edi
jne 0x41046f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
call fcn.00409cda
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
jmp 0x41046a
mov dword [esp + 0xc], ebp
cmp eax, 1
je 0x4104bd
push dword [esp + 0x20]
push dword [esp + 0x18]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, eax
test esi, esi
jne 0x41049a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
test edi, edi
je 0x4104bd
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4104bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x410587
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], esi
lea eax, [ebp - 0x10]
push edi
cmovne eax, dword [ebp + 0xc]
mov edi, edx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
push ecx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x41062c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41062c
mov eax, dword [ebp - 4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push 0x40
call ebx
mov dword [edi], eax
test eax, eax
je 0x41062b
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push 0x40
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
test eax, eax
je 0x410621
push dword [ebp - 8]
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [ebp - 4]
push eax
push dword [edi]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test esi, esi
jne 0x41062b
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebx], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [edi], eax
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x418432
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [ecx + 8]
mov ebp, edx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x41845e
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + ebp]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
inc edx
cmp edx, edi
jl 0x418447
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
pop ebp
ret

Function at 0x41b72c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
mov ebp, edx
mov esi, dword [edi + 0x88]
test esi, esi
je 0x41b75c
mov eax, dword [esp + 0x14]
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 8]
and dword [esi + 0x10], 0
and dword [eax], 0
and dword [eax + 4], 0
jmp 0x41b7be
movzx eax, word [edi + 0x8c]
cdq
add eax, 0x28
adc edx, 0
push edx
push eax
call fcn.00412bb1
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test esi, esi
jne 0x41b7a7
mov eax, dword [edi + 0x98]
lea ecx, [ebp - 1]
push esi
cdq
push ecx
push edx
push eax
call fcn.004be990
mov ecx, dword [edi + 0x3c]
push edx
mov edx, dword [esp + 0x14]
push eax
call fcn.0041252a
pop ecx
pop ecx
push 7
pop eax
jmp 0x41b7cd
lea eax, [esi + 0x28]
mov dword [esi + 0x14], edi
mov dword [esi + 8], eax
push 0x20
pop eax
mov word [esi + 0x1c], ax
xor eax, eax
inc eax
mov word [esi + 0x1e], ax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], eax
mov dword [esi + 0x18], ebp
inc dword [edi + 0x78]
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x423fc5
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, edx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x3c]
push esi
push edi
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
movzx edi, byte [edx + 9]
mov dword [esp + 0x2c], edi
mov esi, dword [eax + 0x24]
mov eax, dword [eax]
lea ecx, [esi + ebx]
mov eax, dword [eax + 0xd0]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
add ecx, ebp
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + edi + 6]
mov dword [esp + 0x30], ecx
mov ecx, dword [edx + 0x40]
xor edx, edx
mov dword [esp + 0x18], ecx
movzx ecx, byte [ebx + edi + 5]
shl ecx, 8
or ecx, eax
cmp ecx, esi
cmovbe edx, ecx
sub esi, edx
push esi
lea eax, [edx + ebx]
push eax
mov eax, dword [esp + 0x30]
add eax, edx
push eax
call fcn.0049fa90
mov ecx, dword [esp + 0x28]
add esp, 0xc
xor eax, eax
add ecx, 0x28
jmp 0x42404b
cmp eax, 6
jge 0x42404f
inc eax
add ecx, 4
cmp dword [ecx], ebp
jle 0x424042
mov ecx, dword [esp + 0x1c]
lea eax, [eax + 4]
lea esi, [ecx + eax*4]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x24]
mov eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x34], esi
mov ecx, dword [eax + ebp*4]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
movzx eax, word [eax + ebp*2]
cmp ecx, ebx
jb 0x42409f
cmp ecx, edx
jae 0x42409f
mov edx, eax
lea eax, [edx + ecx]
cmp eax, dword [esp + 0x24]
ja 0x424126
mov eax, dword [esp + 0x28]
sub eax, ebx
add ecx, eax
jmp 0x4240b4
mov edx, eax
lea eax, [edx + ecx]
cmp eax, dword [esp + 0x20]
jbe 0x4240b4
cmp ecx, dword [esp + 0x20]
jb 0x424137
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
sub eax, edx
add dword [esp + 0x18], 2
mov dword [esp + 0x14], eax
sub eax, ebx
sar eax, 8
mov byte [edi], al
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x14]
sub al, bl
mov byte [edi + 1], al
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x18]
jb 0x424180
push edx
push ecx
push eax
call fcn.0049fa90
add esp, 0xc
inc ebp
cmp ebp, dword [esp + 0x30]
jge 0x42413e
cmp dword [esi + 0x18], ebp
jg 0x42410f
mov ecx, dword [esi + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
lea esi, [ecx + 4]
cmovg esi, ecx
mov ecx, dword [esp + 0x1c]
jmp 0x424069
mov ecx, 0x112ab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
jmp fcn.0046ac06
mov ecx, 0x112b0
jmp 0x42412b
mov ecx, dword [esp + 0x44]
xor edx, edx
mov eax, dword [esp + 0x40]
mov word [ecx + 0x18], ax
mov byte [ecx + 0xc], dl
mov word [ebx + edi + 1], dx
mov al, byte [ecx + 0x19]
mov byte [ebx + edi + 3], al
mov al, byte [ecx + 0x18]
mov byte [ebx + edi + 4], al
mov eax, dword [esp + 0x38]
mov byte [ebx + edi + 5], al
mov al, byte [esp + 0x13]
mov byte [ebx + edi + 6], al
xor eax, eax
mov byte [ebx + edi + 7], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov ecx, 0x112b6
jmp 0x42412b
Function at 0x43c528
Capabilities:
Reference sql statements

Disassembly:
push ebx
push esi
push edi
push dword [esp + 0x10]
mov esi, edx
mov ebx, str.sqlite_master
push esi
push ebx
push esi
mov edi, ecx
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push edi
call fcn.0043fb30
add esp, 0x18
cmp dword [esp + 0x10], 0
jne 0x43c560
push esi
push ebx
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push edi
call fcn.0043fb30
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x46b1ea
Capabilities:
Set console window title

Disassembly:
mov eax, 0x20000
call fcn.004beb80
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ebx
call 0x46b1ea
xor edi, edi
mov ebp, 0xc000010a
inc edi
cmp dword [esp + 0x20014], edi
jle 0x46b14c
mov ebx, dword [esp + 0x20018]
cmp esi, ebp
je 0x46b1df
cmp esi, 0xc000004b
je 0x46b142
push dword [ebx + edi*4]
push str._nmimikatz_commandline____s_n
call fcn.00409cda
pop ecx
pop ecx
mov ecx, dword [ebx + edi*4]
call fcn.0046b39c
inc edi
mov esi, eax
cmp edi, dword [esp + 0x20014]
jl 0x46b10f
cmp esi, ebp
je 0x46b1df
xor ebx, ebx
push 0xa
pop edi
cmp esi, 0xc000004b
je 0x46b1df
push str._nmimikatz_
call fcn.00409cda
push ebx
call fcn.004a688a
push eax
call fcn.004a6c1e
push ebx
call fcn.004a688a
push eax
lea eax, [esp + 0x24]
push 0xffff
push eax
call fcn.004afd64
add esp, 0x1c
test eax, eax
je 0x46b1d7
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x46b195
sub ecx, edx
sar ecx, 1
je 0x46b1d7
cmp word [esp + 0x10], di
je 0x46b1d7
cmp word [esp + ecx*2 + 0xe], di
jne 0x46b1bb
xor eax, eax
mov word [esp + ecx*2 + 0xe], ax
lea eax, [esp + 0x10]
push eax
push 0x4e8fe0
call fcn.00409e0c
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.0046b39c
mov esi, eax
cmp esi, ebp
jne 0x46b14f
mov ecx, esi
call fcn.0046b26c
pop edi
pop esi
pop ebp
pop ebx
push esi
mov esi, 0x40000
push esi
push 1
call fcn.004a688a
push eax
call fcn.004a701f
pop ecx
pop ecx
push eax
call fcn.004a6e30
pop ecx
pop ecx
push esi
push 2
mov dword [0x528c90], eax
call fcn.004a688a
push eax
call fcn.004a701f
pop ecx
pop ecx
push eax
call fcn.004a6e30
pop ecx
pop ecx
mov dword [0x528c88], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0xfde9
mov dword [0x528c8c], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push str.mimikatz_2.2.0_x86__oe.eo_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
push 0x46b2e1
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push str._n__..___mimikatz_2.2.0__x86__19041_Aug_13_2024_14:27:23_n_.__.___A_La_Vie__A_LAmour_____oe.eo__n_________Benjamin_DELPY__gentilkiwi____benjamin_gentilkiwi.com___n______________https:__blog.gentilkiwi.com_mimikatz_n__v________Vincent_LE_TOUX_______________vincent.letoux_gmail.com___n____________https:__pingcastle.com___https:__mysmartlogon.com___n
call fcn.00409cda
pop ecx
xor ecx, ecx
inc ecx
pop esi
jmp fcn.0046b2ed

Function at 0x46b26c
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
call fcn.0046b2ed
push 0
push 0x46b2e1
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push dword [0x528c90]
push 1
call fcn.004a688a
push eax
call fcn.004a701f
pop ecx
pop ecx
push eax
call fcn.004a6e30
pop ecx
pop ecx
push dword [0x528c88]
push 2
call fcn.004a688a
push eax
call fcn.004a701f
pop ecx
pop ecx
push eax
call fcn.004a6e30
pop ecx
pop ecx
push dword [0x528c8c]
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
cmp esi, 0xc000004b
pop esi
push 0
jne 0x46b2da
call dword [sym.imp.KERNEL32.dll_ExitThread]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x46b39c
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, 0xc0000001
test ebx, ebx
je 0x46b41d
push ebp
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test ebp, ebp
je 0x46b41c
push esi
lea eax, [ebp*2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x46b41b
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebp, eax
je 0x46b3ea
push esi
call ebx
mov esi, eax
test esi, esi
je 0x46b41b
movzx eax, word [esi]
cmp eax, 0x21
je 0x46b40e
cmp eax, 0x2a
je 0x46b404
mov ecx, esi
call fcn.0046b422
jmp 0x46b416
lea ecx, [esi + 2]
call fcn.0048a5ab
jmp 0x46b416
lea ecx, [esi + 2]
call fcn.0047d180
push esi
mov edi, eax
call ebx
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
ret