joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77c39956
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 8], ebx
je 0x77c399c0
push 0x3d
push esi
call sym.msvcrt.dll__mbschr
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], edi
je 0x77c399c0
cmp esi, edi
je 0x77c399c0
xor eax, eax
cmp byte [edi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [sym.msvcrt.dll__environ]
cmp eax, dword [sym.msvcrt.dll___initenv]
jne 0x77c399a6
call fcn.77c398f5
mov dword [sym.msvcrt.dll__environ], eax
cmp eax, ebx
jne 0x77c399ff
cmp dword [ebp + 0xc], ebx
je 0x77c399c8
cmp dword [sym.msvcrt.dll__wenviron], ebx
je 0x77c399c8
call fcn.77c39b12
test eax, eax
je 0x77c399ff
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x77c39b06
push 4
call sym.msvcrt.dll_malloc
cmp eax, ebx
pop ecx
mov dword [sym.msvcrt.dll__environ], eax
je 0x77c399c0
mov dword [eax], ebx
cmp dword [sym.msvcrt.dll__wenviron], ebx
jne 0x77c399ff
push 4
call sym.msvcrt.dll_malloc
cmp eax, ebx
pop ecx
mov dword [sym.msvcrt.dll__wenviron], eax
je 0x77c399c0
mov dword [eax], ebx
mov ebx, dword [sym.msvcrt.dll__environ]
sub edi, esi
push esi
call fcn.77c3989e
mov edi, eax
test edi, edi
pop ecx
jl 0x77c39a58
cmp dword [ebx], 0
je 0x77c39a58
lea esi, [ebx + edi*4]
push dword [esi]
call sym.msvcrt.dll_free
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x77c39a3d
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov esi, eax
jmp 0x77c39a8e
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x77c39a34
mov eax, edi
shl eax, 2
push eax
push ebx
call sym.msvcrt.dll_realloc
test eax, eax
mov esi, dword [ebp + 8]
pop ecx
pop ecx
je 0x77c39a8e
jmp 0x77c39a89
cmp dword [ebp - 4], 0
jne 0x77c39aff
test edi, edi
jge 0x77c39a68
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call sym.msvcrt.dll_realloc
test eax, eax
pop ecx
pop ecx
je 0x77c399c0
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [sym.msvcrt.dll__environ], eax
cmp dword [ebp + 0xc], 0
je 0x77c39aea
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c39a99
sub eax, edx
add eax, 2
push eax
call sym.msvcrt.dll_malloc
mov edi, eax
test edi, edi
pop ecx
je 0x77c39aea
mov ecx, esi
sub eax, esi
mov dl, byte [ecx]
mov byte [eax + ecx], dl
inc ecx
test dl, dl
jne 0x77c39ab6
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 4]
mov byte [eax], dl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x77c39ae3
or dword [ebp - 8], 0xffffffff
push edi
call sym.msvcrt.dll_free
pop ecx
cmp dword [ebp - 4], 0
je 0x77c39af7
push esi
call sym.msvcrt.dll_free
pop ecx
mov eax, dword [ebp - 8]
jmp 0x77c399c3
push esi
call sym.msvcrt.dll_free
pop ecx
xor eax, eax
jmp 0x77c399c3
Function at 0x77c39bce
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x77c14088
call fcn.77c37420
xor esi, esi
cmp dword [0x77c61a0c], esi
jne 0x77c39c12
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x77c39bfd
mov dword [0x77c61a0c], edi
jmp 0x77c39c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x77c39c12
mov dword [0x77c61a0c], 2
mov eax, dword [0x77c61a0c]
cmp eax, 2
je 0x77c39cf3
cmp eax, esi
je 0x77c39cf3
cmp eax, 1
jne 0x77c39c57
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x77c39c40
mov eax, dword [sym.msvcrt.dll___lc_codepage]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x77c39c5e
xor eax, eax
jmp 0x77c39d05
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.77c3a600
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x77c39c94
cmp edi, esi
jne 0x77c39caf
lea eax, [ebx + ebx]
push eax
call sym.msvcrt.dll_malloc
pop ecx
mov edi, eax
cmp edi, esi
je 0x77c39c57
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x77c39ce2
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x77c39ccc
push esi
push esi
jmp 0x77c39cd2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x77c39cee
push edi
call sym.msvcrt.dll_free
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x77c39d05
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.77c3745b
ret

Function at 0x77c39f25
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x77c5facc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x77c39f87
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c39f7f
push esi
push dword [0x77c5facc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x77c39f7f
push esi
call fcn.77c39f08
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x77c39f87
push 0x10
call sym.msvcrt.dll__amsg_exit
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
Function at 0x77c3a125
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
call fcn.77c3a46d
test eax, eax
je 0x77c3a13e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x77c5facc], eax
jne 0x77c3a146
call fcn.77c39ee5
xor eax, eax
ret
push esi
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c3a186
push esi
push dword [0x77c5facc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x77c3a186
push esi
call fcn.77c39f08
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
pop esi
ret
call fcn.77c39ee5
xor eax, eax
pop esi
ret

Function at 0x77c3a26e
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
jne 0x77c3a28e
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x77c3a2fe
push esi
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c3a2e4
push esi
call fcn.77c39f08
mov eax, dword [ebp + 0x10]
pop ecx
push esi
push 4
push esi
push 0x77c3a1d7
push dword [ebp + 0xc]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x77c3a2dc
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x77c3a2fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call sym.msvcrt.dll_free
test ebx, ebx
pop ecx
je 0x77c3a2f6
push ebx
call fcn.77c1f2d8
pop ecx
or eax, 0xffffffff
jmp 0x77c3a2fd
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x77c3a3db
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x77c3a3fa
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
xor eax, eax
jmp 0x77c3a464
push esi
push 0x88
push 1
call sym.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x77c3a44f
push esi
call fcn.77c39f08
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x77c3a42d
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x77c3a341
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x77c3a463
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call sym.msvcrt.dll_free
test ebx, ebx
pop ecx
je 0x77c3a461
push ebx
call fcn.77c1f2d8
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x77c3af89
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x77c5fac4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x77c5fbf0]
je 0x77c3afb3
inc eax
cmp eax, 0x12
jb 0x77c3afa4
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x77c5fbf0]
mov dword [ebp - 0x110], esi
jne 0x77c3b15e
mov eax, dword [0x77c617b8]
cmp eax, 1
je 0x77c3b12c
test eax, eax
jne 0x77c3afe9
cmp dword [0x77c617bc], 1
je 0x77c3b12c
cmp ecx, 0xfc
je 0x77c3b15e
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x77c3b024
push 5
pop ecx
mov esi, 0x77c12db8
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3b02f
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x77c3b067
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3b047
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x77c11c44
push ebx
call sym.msvcrt.dll_strncpy
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3b06c
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x77c5fbf4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x77c3b086
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.77c3a600
mov edx, esp
push 6
pop ecx
mov esi, 0x77c143e8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3b0b2
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c3b0be
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c3b0d7
mov eax, dword [ebp - 0x110]
mov esi, 0x77c12cb8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x77c5fbf4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3b0f5
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c3b101
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x77c12cc0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.77c3920a
add esp, 0xc
jmp 0x77c3b15e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x77c3b15e
mov esi, dword [esi + 0x77c5fbf4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x77c3b143
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.77c57993
pop edi
pop esi
pop ebx
leave
ret
Function at 0x77c3b1fa
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x77c3b25c
cmp dword [0x77c621e4], 0
jne 0x77c3b222
push 0x354
call sym.msvcrt.dll_malloc
test eax, eax
pop ecx
mov dword [0x77c621e4], eax
je 0x77c3b285
mov eax, dword [0x77c621e0]
test eax, eax
je 0x77c3b239
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x77c621e0], 0
push dword [0x77c621e4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [0x77c621e0], eax
je 0x77c3b285
mov eax, dword [0x77c621e4]
add eax, 0x2c
pop ebp
ret
push dword [0x77c621e4]
push dword [0x77c621e0]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x77c3b252
push dword [0x77c621e0]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x77c621e0], 0
xor eax, eax
pop ebp
ret

Function at 0x77c3b53a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x77c3b59c
cmp dword [0x77c621f0], 0
jne 0x77c3b562
push 0x244
call sym.msvcrt.dll_malloc
test eax, eax
pop ecx
mov dword [0x77c621f0], eax
je 0x77c3b5c5
mov eax, dword [0x77c621f4]
test eax, eax
je 0x77c3b579
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x77c621f4], 0
push dword [0x77c621f0]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x77c621f4], eax
je 0x77c3b5c5
mov eax, dword [0x77c621f0]
add eax, 0x2c
pop ebp
ret
push dword [0x77c621f0]
push dword [0x77c621f4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x77c3b592
push dword [0x77c621f4]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x77c621f4], 0
xor eax, eax
pop ebp
ret
Function at 0x77c49351
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x77c49374
lea eax, [ebp - 4]
push eax
call sym.msvcrt.dll_time
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
lea eax, [edi + 4]
push eax
call sym.msvcrt.dll_localtime
test eax, eax
pop ecx
jne 0x77c49395
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x77c49496
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x77c49487
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c49487
push edi
call sym.msvcrt.dll_localtime
test eax, eax
pop ecx
je 0x77c49487
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x77c49487
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c49487
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sym.msvcrt.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x77c49487
xor eax, eax
jmp 0x77c49495
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x77c494de
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x77c49507
lea eax, [ebp - 0x30]
push eax
call sym.msvcrt.dll__time64
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x34], eax
lea edi, [ebp - 0x38]
lea eax, [edi + 8]
push eax
call sym.msvcrt.dll__localtime64
test eax, eax
pop ecx
jne 0x77c49528
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x77c49629
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x77c4961a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c4961a
push edi
call sym.msvcrt.dll__localtime64
test eax, eax
pop ecx
je 0x77c4961a
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x77c4961a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x77c4961a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call sym.msvcrt.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x77c4961a
xor eax, eax
jmp 0x77c49628
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret

Function at 0x77c4d5e4
Capabilities:
Accept command line arguments
Check os version
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [esp + 8], 1
jne 0x77c4d604
push 0

Function at 0x77c4d5ed
Capabilities:
Accept command line arguments
Check os version
Get thread local storage value
Set thread local storage value

Disassembly:
push 0
push 0x7c906788
push reloc.KERNEL32.dll_LoadLibraryA
push 0
push 0
mov eax, reloc.KERNEL32.dll_CreateThread
call eax
jmp fcn.77c1f2a1
Function at 0x77c4f0a4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x77c5fac4]
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jle 0x77c4f145
push edi
lea edi, [esi + 8]
mov dword [ebp - 0x58], ebx
mov eax, dword [esi + 4]
shr eax, 0xb
push 3
and eax, 7
push eax
push edi
call fcn.77c4eee8
mov eax, dword [esi + 4]
mov ecx, eax
and ecx, 0xfffff800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
add esp, 0xc
dec dword [ebp - 0x58]
mov dword [esi + 4], ecx
jne 0x77c4f0cb
lea edi, [ebx + ebx*4]
shl edi, 1
lea eax, [esi + 0x1c]
push edi
push eax
lea eax, [ebp - 0x54]
push eax
call sym.msvcrt.dll_memcpy
push 8
pop eax
sub eax, ebx
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea eax, [edi + esi + 0x1c]
push eax
lea eax, [esi + 0x1c]
push eax
call sym.msvcrt.dll_memmove
push edi
lea eax, [ebp - 0x54]
sub esi, edi
push eax
add esi, 0x6c
push esi
call sym.msvcrt.dll_memcpy
add esp, 0x24
pop edi
jmp 0x77c4f183
jge 0x77c4f183
mov ecx, dword [esi + 4]
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi + 4], eax
shr eax, 0xb
and eax, 7
push 0
push eax
lea eax, [esi + 8]
push eax
call fcn.77c4eee8
lea eax, [esi + 0x1c]
push 0x46
push eax
add esi, 0x26
push esi
call sym.msvcrt.dll_memmove
add esp, 0x18
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.77c57993
leave
ret
Function at 0x40127d
Capabilities:
Parse pe header

Disassembly:
push 0x30
push 0x45f5d0
call fcn.004387a0
push 0x44d5a8
mov ebx, str.CAPIHook::HookImportedFunction
push ebx
push 5
call fcn.00405a24
add esp, 0xc
and dword [ebp - 4], 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4014ce
push dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4014ce
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4014ce
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4014ce
mov esi, dword [ecx + 0x80]
add esi, eax
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x24], esi
cmp esi, ecx
je 0x4014ce
mov dword [ebp - 4], 0xfffffffe
push 4
pop edi
jmp 0x40133b
lea esi, [ecx + eax]
push esi
push str.pszModName___1_hs__failed._n
push ebx
push edi
call fcn.00405a24
push dword [ebp + 0x10]
push esi
call fcn.00438535
add esp, 0x18
test eax, eax
je 0x401344
mov esi, dword [ebp + 0xc]
add esi, 0x14
mov dword [ebp + 0xc], esi
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x40130f
jmp 0x401356
push str.Found_the_module._n
push ebx
push edi
call fcn.00405a24
add esp, 0xc
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0xc], 0
je 0x4014d5
push str.Set_intercept_function._n
push ebx
push edi
call fcn.00405a24
add esp, 0xc
mov esi, dword [esi + 0x10]
add esi, dword [ebp + 8]
mov dword [ebp + 8], esi
xor eax, eax
mov ecx, esi
cmp dword [esi], eax
jmp 0x401386
inc eax
add ecx, edi
cmp dword [ecx], 0
mov dword [ebp + 0xc], eax
jne 0x401380
push eax
push str.cFuncs___1_d__n
push ebx
push edi
call fcn.00405a24
add esp, 0x10
cmp dword [esi], 0
je 0x4014d5
push dword [esi]
push str.pThunk__u1.Function__0x_1_x__n
push ebx
push edi
call fcn.00405a24
push dword [ebp - 0x1c]
push str.pfnOriginalProc__0x_1_x__n
push ebx
push edi
call fcn.00405a24
push dword [ebp + 0x18]
push str.pfnNewProc__0x_1_x__n
push ebx
push edi
call fcn.00405a24
add esp, 0x30
mov eax, dword [ebp - 0x1c]
cmp dword [esi], eax
jne 0x4014ae
push str.Found_the_entry_point._n
push ebx
push edi
call fcn.00405a24
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x18]
mov dword [esi], eax
jmp 0x401493
mov dword [ebp - 4], 0xfffffffe
push str.Set_alternative_function._n
push ebx
push edi
call fcn.00405a24
add esp, 0xc
mov eax, dword [ebp - 0x1c]
jmp 0x4014d7
add esi, edi
mov dword [ebp + 8], esi
jmp 0x40139b
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.004387e5
ret 0x14