joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77c077d0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x77c3194c]
push ebx
push esi
mov esi, dword [sym.imp._CKERNEL.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
cmp eax, ebx
push 2
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
pop edi
jne 0x77c07823
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x77c0780a
mov dword [0x77c3194c], 1
jmp 0x77c07828
call dword [sym.imp._CKERNEL.dll_GetLastError]
cmp eax, 0x78
jne 0x77c0781e
mov eax, edi
mov dword [0x77c3194c], eax
jmp 0x77c07823
mov eax, dword [0x77c3194c]
cmp eax, 1
jne 0x77c0788f
cmp dword [ebp - 4], ebx
jne 0x77c0783d
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x77c0783d
xor eax, eax
jmp 0x77c0794e
mov ecx, dword [ebp - 4]
cmp word [ecx], bx
mov eax, ecx
je 0x77c07855
add eax, edi
cmp word [eax], bx
jne 0x77c07847
add eax, edi
cmp word [eax], bx
jne 0x77c07847
sub eax, ecx
add eax, edi
mov esi, eax
push esi
call sym.msvcrt.dll_malloc
cmp eax, ebx
pop ecx
jne 0x77c07876
push dword [ebp - 4]
call dword [sym.imp._CKERNEL.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x77c0794e
mov ecx, esi
mov esi, dword [ebp - 4]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, eax
jmp 0x77c07866
cmp eax, edi
je 0x77c07897
cmp eax, ebx
jne 0x77c07836
call dword [sym.imp._CKERNEL.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x77c07836
cmp byte [esi], bl
je 0x77c078dc
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp._CKERNEL.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x77c07836
add dword [ebp - 8], eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x77c078c8
sub eax, edi
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x77c078aa
mov esi, dword [ebp - 4]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, eax
push eax
call sym.msvcrt.dll_malloc
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x77c078f5
push esi
jmp 0x77c0795f
mov edi, esi
mov esi, eax
mov eax, dword [ebp - 4]
cmp byte [eax], bl
je 0x77c0793f
mov ecx, dword [ebp - 8]
mov eax, esi
sub eax, dword [ebp - 0xc]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp._CKERNEL.dll_MultiByteToWideChar]
test eax, eax
je 0x77c07953
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x77c07923
sub eax, edx
push esi
lea edi, [edi + eax + 1]
call sym.msvcrt.dll_wcslen
cmp byte [edi], bl
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x77c07900
push dword [ebp - 4]
mov word [esi], bx
call dword [sym.imp._CKERNEL.dll_FreeEnvironmentStringsA]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0xc]
call sym.msvcrt.dll_free
pop ecx
push dword [ebp - 4]
call dword [sym.imp._CKERNEL.dll_FreeEnvironmentStringsA]
jmp 0x77c07836
Function at 0x77c0920a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x77c319ac], ebx
push esi
push edi
jne 0x77c0928c
push 0x77be4068
call dword [sym.imp._CKERNEL.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x77c092c7
mov esi, dword [sym.imp._CKERNEL.dll_GetProcAddress]
push 0x77be405c
push edi
call esi
test eax, eax
mov dword [0x77c319ac], eax
je 0x77c092c7
push 0x77be404c
push edi
call esi
push 0x77be4038
push edi
mov dword [0x77c319b0], eax
call esi
cmp dword [sym.msvcrt.dll__osplatform], 2
mov dword [0x77c319b4], eax
jne 0x77c0928c
push 0x77be401c
push edi
call esi
test eax, eax
mov dword [0x77c319bc], eax
je 0x77c0928c
push 0x77be4004
push edi
call esi
mov dword [0x77c319b8], eax
mov eax, dword [0x77c319b8]
test eax, eax
je 0x77c092d1
call eax
test eax, eax
je 0x77c092b8
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x77c319bc]
test eax, eax
je 0x77c092b8
test byte [ebp - 8], 1
jne 0x77c092d1
cmp dword [sym.msvcrt.dll__winmajor], 4
jb 0x77c092cb
or byte [ebp + 0x12], 0x20
jmp 0x77c092f0
xor eax, eax
jmp 0x77c09300
or byte [ebp + 0x12], 4
jmp 0x77c092f0
mov eax, dword [0x77c319b0]
test eax, eax
je 0x77c092f0
call eax
mov ebx, eax
test ebx, ebx
je 0x77c092f0
mov eax, dword [0x77c319b4]
test eax, eax
je 0x77c092f0
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x77c319ac]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x77c09956
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 8], ebx
je 0x77c099c0
push 0x3d
push esi
call sym.msvcrt.dll__mbschr
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], edi
je 0x77c099c0
cmp esi, edi
je 0x77c099c0
xor eax, eax
cmp byte [edi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [sym.msvcrt.dll__environ]
cmp eax, dword [sym.msvcrt.dll___initenv]
jne 0x77c099a6
call fcn.77c098f5
mov dword [sym.msvcrt.dll__environ], eax
cmp eax, ebx
jne 0x77c099ff
cmp dword [ebp + 0xc], ebx
je 0x77c099c8
cmp dword [sym.msvcrt.dll__wenviron], ebx
je 0x77c099c8
call fcn.77c09b12
test eax, eax
je 0x77c099ff
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x77c09b06
push 4
call sym.msvcrt.dll_malloc
cmp eax, ebx
pop ecx
mov dword [sym.msvcrt.dll__environ], eax
je 0x77c099c0
mov dword [eax], ebx
cmp dword [sym.msvcrt.dll__wenviron], ebx
jne 0x77c099ff
push 4
call sym.msvcrt.dll_malloc
cmp eax, ebx
pop ecx
mov dword [sym.msvcrt.dll__wenviron], eax
je 0x77c099c0
mov dword [eax], ebx
mov ebx, dword [sym.msvcrt.dll__environ]
sub edi, esi
push esi
call fcn.77c0989e
mov edi, eax
test edi, edi
pop ecx
jl 0x77c09a58
cmp dword [ebx], 0
je 0x77c09a58
lea esi, [ebx + edi*4]
push dword [esi]
call sym.msvcrt.dll_free
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x77c09a3d
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov esi, eax
jmp 0x77c09a8e
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x77c09a34
mov eax, edi
shl eax, 2
push eax
push ebx
call sym.msvcrt.dll_realloc
test eax, eax
mov esi, dword [ebp + 8]
pop ecx
pop ecx
je 0x77c09a8e
jmp 0x77c09a89
cmp dword [ebp - 4], 0
jne 0x77c09aff
test edi, edi
jge 0x77c09a68
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call sym.msvcrt.dll_realloc
test eax, eax
pop ecx
pop ecx
je 0x77c099c0
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [sym.msvcrt.dll__environ], eax
cmp dword [ebp + 0xc], 0
je 0x77c09aea
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c09a99
sub eax, edx
add eax, 2
push eax
call sym.msvcrt.dll_malloc
mov edi, eax
test edi, edi
pop ecx
je 0x77c09aea
mov ecx, esi
sub eax, esi
mov dl, byte [ecx]
mov byte [eax + ecx], dl
inc ecx
test dl, dl
jne 0x77c09ab6
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 4]
mov byte [eax], dl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp._CKERNEL.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x77c09ae3
or dword [ebp - 8], 0xffffffff
push edi
call sym.msvcrt.dll_free
pop ecx
cmp dword [ebp - 4], 0
je 0x77c09af7
push esi
call sym.msvcrt.dll_free
pop ecx
mov eax, dword [ebp - 8]
jmp 0x77c099c3
push esi
call sym.msvcrt.dll_free
pop ecx
xor eax, eax
jmp 0x77c099c3
Function at 0x77c09bce
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x77be4088
call fcn.77c07420
xor esi, esi
cmp dword [0x77c31a0c], esi
jne 0x77c09c12
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp._CKERNEL.dll_GetLocaleInfoW]
test eax, eax
je 0x77c09bfd
mov dword [0x77c31a0c], edi
jmp 0x77c09c12
call dword [sym.imp._CKERNEL.dll_GetLastError]
cmp eax, 0x78
jne 0x77c09c12
mov dword [0x77c31a0c], 2
mov eax, dword [0x77c31a0c]
cmp eax, 2
je 0x77c09cf3
cmp eax, esi
je 0x77c09cf3
cmp eax, 1
jne 0x77c09c57
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x77c09c40
mov eax, dword [sym.msvcrt.dll___lc_codepage]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp._CKERNEL.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x77c09c5e
xor eax, eax
jmp 0x77c09d05
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.77c0a600
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x77c09c94
cmp edi, esi
jne 0x77c09caf
lea eax, [ebx + ebx]
push eax
call sym.msvcrt.dll_malloc
pop ecx
mov edi, eax
cmp edi, esi
je 0x77c09c57
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp._CKERNEL.dll_GetLocaleInfoW]
test eax, eax
je 0x77c09ce2
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x77c09ccc
push esi
push esi
jmp 0x77c09cd2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp._CKERNEL.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x77c09cee
push edi
call sym.msvcrt.dll_free
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x77c09d05
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp._CKERNEL.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.77c0745b
ret

Function at 0x77c09f25
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp._CKERNEL.dll_GetLastError]
push dword [0x77c2facc]
mov edi, eax
call dword [sym.imp._CKERNEL.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x77c09f87
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c09f7f
push esi
push dword [0x77c2facc]
call dword [sym.imp._CKERNEL.dll_TlsSetValue]
test eax, eax
je 0x77c09f7f
push esi
call fcn.77c09f08
add esp, 4
call dword [sym.imp._CKERNEL.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x77c09f87
push 0x10
call sym.msvcrt.dll__amsg_exit
pop ecx
push edi
call dword [sym.imp._CKERNEL.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
Function at 0x77c0a125
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
call fcn.77c0a46d
test eax, eax
je 0x77c0a13e
call dword [sym.imp._CKERNEL.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x77c2facc], eax
jne 0x77c0a146
call fcn.77c09ee5
xor eax, eax
ret
push esi
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c0a186
push esi
push dword [0x77c2facc]
call dword [sym.imp._CKERNEL.dll_TlsSetValue]
test eax, eax
je 0x77c0a186
push esi
call fcn.77c09f08
add esp, 4
call dword [sym.imp._CKERNEL.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
pop esi
ret
call fcn.77c09ee5
xor eax, eax
pop esi
ret

Function at 0x77c0a26e
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
jne 0x77c0a28e
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x77c0a2fe
push esi
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c0a2e4
push esi
call fcn.77c09f08
mov eax, dword [ebp + 0x10]
pop ecx
push esi
push 4
push esi
push 0x77c0a1d7
push dword [ebp + 0xc]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp._CKERNEL.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x77c0a2dc
push edi
call dword [sym.imp._CKERNEL.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x77c0a2fb
call dword [sym.imp._CKERNEL.dll_GetLastError]
mov ebx, eax
push esi
call sym.msvcrt.dll_free
test ebx, ebx
pop ecx
je 0x77c0a2f6
push ebx
call fcn.77bef2d8
pop ecx
or eax, 0xffffffff
jmp 0x77c0a2fd
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x77c0a3db
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x77c0a3fa
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
xor eax, eax
jmp 0x77c0a464
push esi
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c0a44f
push esi
call fcn.77c09f08
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x77c0a42d
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x77c0a341
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp._CKERNEL.dll_CreateThread]
test eax, eax
jne 0x77c0a463
call dword [sym.imp._CKERNEL.dll_GetLastError]
mov ebx, eax
push esi
call sym.msvcrt.dll_free
test ebx, ebx
pop ecx
je 0x77c0a461
push ebx
call fcn.77bef2d8
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x77c0af89
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x77c2fac4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x77c2fbf0]
je 0x77c0afb3
inc eax
cmp eax, 0x12
jb 0x77c0afa4
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x77c2fbf0]
mov dword [ebp - 0x110], esi
jne 0x77c0b15e
mov eax, dword [0x77c317b8]
cmp eax, 1
je 0x77c0b12c
test eax, eax
jne 0x77c0afe9
cmp dword [0x77c317bc], 1
je 0x77c0b12c
cmp ecx, 0xfc
je 0x77c0b15e
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp._CKERNEL.dll_GetModuleFileNameA]
test eax, eax
jne 0x77c0b024
push 5
pop ecx
mov esi, 0x77be2db8
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0b02f
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x77c0b067
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0b047
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x77be1c44
push ebx
call sym.msvcrt.dll_strncpy
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0b06c
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x77c2fbf4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x77c0b086
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.77c0a600
mov edx, esp
push 6
pop ecx
mov esi, 0x77be43e8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0b0b2
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c0b0be
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c0b0d7
mov eax, dword [ebp - 0x110]
mov esi, 0x77be2cb8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x77c2fbf4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0b0f5
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c0b101
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x77be2cc0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.77c0920a
add esp, 0xc
jmp 0x77c0b15e
push 0xfffffffffffffff4
call dword [sym.imp._CKERNEL.dll_GetStdHandle]
test eax, eax
je 0x77c0b15e
mov esi, dword [esi + 0x77c2fbf4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x77c0b143
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp._CKERNEL.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.77c27993
pop edi
pop esi
pop ebx
leave
ret
Function at 0x77c0b1fa
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x77c0b25c
cmp dword [0x77c321e4], 0
jne 0x77c0b222
push 0x354
call sym.msvcrt.dll_malloc
test eax, eax
pop ecx
mov dword [0x77c321e4], eax
je 0x77c0b285
mov eax, dword [0x77c321e0]
test eax, eax
je 0x77c0b239
push eax
call dword [sym.imp._CKERNEL.dll_FindClose]
and dword [0x77c321e0], 0
push dword [0x77c321e4]
push dword [ebp + 8]
call dword [sym.imp._CKERNEL.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [0x77c321e0], eax
je 0x77c0b285
mov eax, dword [0x77c321e4]
add eax, 0x2c
pop ebp
ret
push dword [0x77c321e4]
push dword [0x77c321e0]
call dword [sym.imp._CKERNEL.dll_FindNextFileW]
test eax, eax
jne 0x77c0b252
push dword [0x77c321e0]
call dword [sym.imp._CKERNEL.dll_FindClose]
and dword [0x77c321e0], 0
xor eax, eax
pop ebp
ret

Function at 0x77c0b53a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x77c0b59c
cmp dword [0x77c321f0], 0
jne 0x77c0b562
push 0x244
call sym.msvcrt.dll_malloc
test eax, eax
pop ecx
mov dword [0x77c321f0], eax
je 0x77c0b5c5
mov eax, dword [0x77c321f4]
test eax, eax
je 0x77c0b579
push eax
call dword [sym.imp._CKERNEL.dll_FindClose]
and dword [0x77c321f4], 0
push dword [0x77c321f0]
push dword [ebp + 8]
call dword [sym.imp._CKERNEL.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x77c321f4], eax
je 0x77c0b5c5
mov eax, dword [0x77c321f0]
add eax, 0x2c
pop ebp
ret
push dword [0x77c321f0]
push dword [0x77c321f4]
call dword [sym.imp._CKERNEL.dll_FindNextFileA]
test eax, eax
jne 0x77c0b592
push dword [0x77c321f4]
call dword [sym.imp._CKERNEL.dll_FindClose]
and dword [0x77c321f4], 0
xor eax, eax
pop ebp
ret
Function at 0x77c19351
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x77c19374
lea eax, [ebp - 4]
push eax
call sym.msvcrt.dll_time
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
lea eax, [edi + 4]
push eax
call sym.msvcrt.dll_localtime
test eax, eax
pop ecx
jne 0x77c19395
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x77c19496
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
push esi
mov esi, dword [sym.imp._CKERNEL.dll_SystemTimeToFileTime]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x77c19487
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp._CKERNEL.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c19487
push edi
call sym.msvcrt.dll_localtime
test eax, eax
pop ecx
je 0x77c19487
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x77c19487
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp._CKERNEL.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c19487
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sym.msvcrt.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp._CKERNEL.dll_SetFileTime]
test eax, eax
je 0x77c19487
xor eax, eax
jmp 0x77c19495
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x77c194de
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x77c19507
lea eax, [ebp - 0x30]
push eax
call sym.msvcrt.dll__time64
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x34], eax
lea edi, [ebp - 0x38]
lea eax, [edi + 8]
push eax
call sym.msvcrt.dll__localtime64
test eax, eax
pop ecx
jne 0x77c19528
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x77c19629
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
push esi
mov esi, dword [sym.imp._CKERNEL.dll_SystemTimeToFileTime]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x77c1961a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp._CKERNEL.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c1961a
push edi
call sym.msvcrt.dll__localtime64
test eax, eax
pop ecx
je 0x77c1961a
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x77c1961a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp._CKERNEL.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c1961a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call sym.msvcrt.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp._CKERNEL.dll_SetFileTime]
test eax, eax
je 0x77c1961a
xor eax, eax
jmp 0x77c19628
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x77c1f0a4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x77c2fac4]
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jle 0x77c1f145
push edi
lea edi, [esi + 8]
mov dword [ebp - 0x58], ebx
mov eax, dword [esi + 4]
shr eax, 0xb
push 3
and eax, 7
push eax
push edi
call fcn.77c1eee8
mov eax, dword [esi + 4]
mov ecx, eax
and ecx, 0xfffff800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
add esp, 0xc
dec dword [ebp - 0x58]
mov dword [esi + 4], ecx
jne 0x77c1f0cb
lea edi, [ebx + ebx*4]
shl edi, 1
lea eax, [esi + 0x1c]
push edi
push eax
lea eax, [ebp - 0x54]
push eax
call sym.msvcrt.dll_memcpy
push 8
pop eax
sub eax, ebx
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea eax, [edi + esi + 0x1c]
push eax
lea eax, [esi + 0x1c]
push eax
call sym.msvcrt.dll_memmove
push edi
lea eax, [ebp - 0x54]
sub esi, edi
push eax
add esi, 0x6c
push esi
call sym.msvcrt.dll_memcpy
add esp, 0x24
pop edi
jmp 0x77c1f183
jge 0x77c1f183
mov ecx, dword [esi + 4]
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi + 4], eax
shr eax, 0xb
and eax, 7
push 0
push eax
lea eax, [esi + 8]
push eax
call fcn.77c1eee8
lea eax, [esi + 0x1c]
push 0x46
push eax
add esi, 0x26
push esi
call sym.msvcrt.dll_memmove
add esp, 0x18
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.77c27993
leave
ret
Function at 0x77c38048
Capabilities:
Accept command line arguments
Check os version
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xb61c031d
call fcn.77c3805a
jmp loc.77bef2a1