joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515800
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
cmp dword [ebp + 8], 0
je 0x51582f
cmp dword [ebp + 0xc], 0
je 0x51582f
cmp dword [ebp + 0x10], 0
jne 0x515837
or eax, 0xffffffff
jmp 0x5159bf
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.006665c0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.00666cf0
add esp, 4
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00666cf0
add esp, 4
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00666ba0
add esp, 8
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x114]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x5158b7
push 0x757414
lea edx, [ebp - 0x110]
push edx
call fcn.00666bb0
add esp, 8
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00666bb0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00666bb0
add esp, 8
cmp dword [0x7dde14], 0xffffffff
jne 0x515918
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [0x7dde14], eax
cmp dword [0x7dde14], 0xffffffff
jne 0x515916
mov dword [ebp - 0x118], 0xfffffffe
jmp 0x515984
jmp 0x51593e
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [0x7dde14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x51593e
mov dword [ebp - 0x118], 0xfffffffd
jmp 0x515984
mov edx, dword [ebp - 0x258]
and edx, 0x10
je 0x515971
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [0x7dde14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x51596f
mov dword [ebp - 0x118], 0xfffffffc
jmp 0x515984
jmp 0x51593e
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00666bb0
add esp, 8
cmp dword [ebp + 0x14], 0
jne 0x515993
cmp dword [ebp - 0x118], 0
je 0x5159b9
mov ecx, dword [0x7dde14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [0x7dde14], 0xffffffff
cmp dword [ebp - 0x118], 0
je 0x5159b9
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x528a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aedfd
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.00455110
lea ecx, [ebp + 8]
call fcn.00489570
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x528ab7
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014d0
mov eax, dword [ebp - 0x11c]
jmp 0x528bad
push 0x75b7d4
lea ecx, [ebp + 8]
call fcn.00489570
push eax
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
push eax
call fcn.0066b830
add esp, 4
test eax, eax
jne 0x528b7f
push 0xff
push 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.006665c0
add esp, 0xc
mov edx, dword [ebp - 0x118]
push edx
push 0xff
lea eax, [ebp - 0x114]
push eax
call fcn.0066b6f8
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
call fcn.00666cf0
add esp, 4
test eax, eax
jbe 0x528b7a
push str.reboot
lea edx, [ebp - 0x114]
push edx
call fcn.00404520
add esp, 8
test eax, eax
jne 0x528b7a
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040dbe0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00454fa0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.004014d0
jmp 0x528ad3
mov edx, dword [ebp - 0x118]
push edx
call fcn.00669ba2
add esp, 4
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014d0
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x537e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax + 0x1c]
imul edx, dword [ecx + 0x18]
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], edx
cmp dword [ebp + 0xc], 0
jne 0x537eb8
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call fcn.005361f0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x537f6b
cmp dword [ebp + 8], 0
jne 0x537f2c
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x1c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00576bfc
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x1c]
shl edx, 1
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00668860
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00536230
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.0048c2f0
push ecx
mov ecx, esp
push 0x760a10
call fcn.0048c2f0
mov ecx, dword [ebp - 0x24]
add ecx, 0x20
push ecx
call fcn.00535290
add esp, 0x18
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
push eax
push 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00669854
add esp, 0x10
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 5], al
cmp dword [ebp - 4], 0
je 0x537fab
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00576bf1
add esp, 4
movzx eax, byte [ebp - 5]
test eax, eax
je 0x537fff
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 0x24]
add edx, dword [eax + 8]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x14], edx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x1c]
push eax
push 0x18
mov ecx, dword [ebp - 0x24]
add ecx, 0x24
push ecx
mov edx, esp
push ecx
mov ecx, edx
call fcn.004540f0
push ecx
mov ecx, esp
push 0x760a1c
call fcn.0048c2f0
mov eax, dword [ebp - 0x24]
add eax, 0x20
push eax
call fcn.00535290
add esp, 0x18
jmp 0x538007
mov ecx, dword [ebp - 0x24]
call fcn.00536b30
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 8
Function at 0x5433c0
Capabilities:
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x468]
cmp dword [eax], 0
je 0x5433f8
mov eax, 0x73
jmp 0x543574
mov ecx, dword [ebp + 8]
push ecx
push 0x10ac448
push 0x10ac340
push 0x763524
lea edx, [ebp - 0x408]
push edx
call fcn.0066926d
add esp, 0x14
lea eax, [ebp - 0x408]
push eax
push str.Xcb_command:_s_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov dword [ebp - 0x414], 0xc
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x40c], 1
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x468]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x543488
mov eax, 0x71
jmp 0x543574
push 0x44
push 0
lea ecx, [ebp - 0x460]
push ecx
call fcn.006665c0
add esp, 0xc
push 0
push 1
mov edx, dword [ebp - 0x468]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [ebp - 0x460], 0x44
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [ebp - 0x468]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x428], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x434], 0x100
xor edx, edx
mov word [ebp - 0x430], dx
mov eax, dword [ebp - 0x468]
add eax, 4
push eax
lea ecx, [ebp - 0x460]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x543553
mov eax, dword [ebp - 0x468]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x72
jmp 0x543574
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x468]
mov edx, dword [ebp - 0x468]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x464]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x543640
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x518], ecx
mov dword [ebp - 0x10c], 0
cmp dword [ebp + 8], 0
jne 0x543673
mov eax, 0x74
jmp 0x54382a
mov eax, dword [ebp + 8]
push eax
push str.connect__s
lea ecx, [ebp - 0x108]
push ecx
call fcn.0066926d
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp - 0x518]
call fcn.005433c0
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x5436b7
mov eax, dword [ebp - 0x10c]
jmp 0x54382a
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x543819
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea eax, [ebp - 0x514]
push eax
push 1
lea ecx, [ebp - 0x510]
push ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x5437dd
cmp dword [ebp - 0x514], 0
je 0x5437dd
push 0
lea ecx, [ebp - 0x514]
push ecx
push 0x3ff
lea edx, [ebp - 0x510]
push edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x543747
mov dword [ebp - 0x10c], 0x77
jmp 0x543819
mov edx, dword [ebp - 0x514]
mov byte [ebp + edx - 0x510], 0
lea eax, [ebp - 0x510]
push eax
push 0x763564
call fcn.0066610b
add esp, 8
cmp dword [ebp - 0x514], 0
je 0x5437db
push str.connected_to
lea ecx, [ebp - 0x510]
push ecx
call fcn.00404520
add esp, 8
test eax, eax
je 0x543791
jmp 0x543819
push str.unable_to_connect_to
lea edx, [ebp - 0x510]
push edx
call fcn.00404520
add esp, 8
test eax, eax
je 0x5437b7
mov dword [ebp - 0x10c], 0x76
jmp 0x543819
push 0x76359c
lea eax, [ebp - 0x510]
push eax
call fcn.00404520
add esp, 8
test eax, eax
je 0x5437db
mov dword [ebp - 0x10c], 0x77
jmp 0x543819
jmp 0x5437ff
push 0
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x5437ff
jmp 0x543819
cmp dword [0x10ac334], 0
jne 0x543814
mov dword [ebp - 0x10c], 0x7b
jmp 0x543819
jmp 0x5436c1
mov ecx, dword [ebp - 0x518]
call fcn.00543590
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x543840
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x114], 0
cmp dword [ebp + 8], 0
jne 0x543873
mov eax, 0x74
jmp 0x5439d7
mov eax, dword [ebp + 8]
push eax
push str.disconnect__s
lea ecx, [ebp - 0x110]
push ecx
call fcn.0066926d
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
mov ecx, dword [ebp - 0x520]
call fcn.005433c0
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x5438b7
mov eax, dword [ebp - 0x114]
jmp 0x5439d7
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x5439c6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea eax, [ebp - 0x51c]
push eax
push 1
lea ecx, [ebp - 0x518]
push ecx
mov edx, dword [ebp - 0x520]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x54398a
cmp dword [ebp - 0x51c], 0
je 0x54398a
push 0
lea ecx, [ebp - 0x51c]
push ecx
push 0x3ff
lea edx, [ebp - 0x518]
push edx
mov eax, dword [ebp - 0x520]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x543939
jmp 0x5439c6
mov edx, dword [ebp - 0x51c]
mov byte [ebp + edx - 0x518], 0
lea eax, [ebp - 0x518]
push eax
push 0x7635bc
call fcn.0066610b
add esp, 8
cmp dword [ebp - 0x51c], 0
je 0x543988
push 0x7635cc
lea ecx, [ebp - 0x518]
push ecx
call fcn.00404520
add esp, 8
test eax, eax
je 0x543988
mov dword [ebp - 0x114], 0x77
jmp 0x5439c6
jmp 0x5439ac
push 1
mov edx, dword [ebp - 0x520]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x5439ac
jmp 0x5439c6
cmp dword [0x10ac334], 0
jne 0x5439c1
mov dword [ebp - 0x114], 0x7b
jmp 0x5439c6
jmp 0x5438c1
mov ecx, dword [ebp - 0x520]
call fcn.00543590
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x543e70
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov byte [ebp - 0x108], 0
push 0xfe
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s__s_get_state
lea edx, [ebp - 0x108]
push edx
call fcn.0066926d
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x520]
call fcn.005433c0
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x543f08
mov eax, dword [ebp - 0x10c]
jmp 0x544099
mov dword [ebp - 0x10c], 0x77
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x544088
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea ecx, [ebp - 0x51c]
push ecx
push 1
lea edx, [ebp - 0x518]
push edx
mov eax, dword [ebp - 0x520]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x54404c
cmp dword [ebp - 0x51c], 0
je 0x54404c
push 0
lea edx, [ebp - 0x51c]
push edx
push 0x3ff
lea eax, [ebp - 0x518]
push eax
mov ecx, dword [ebp - 0x520]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x543f98
jmp 0x544088
mov eax, dword [ebp - 0x51c]
mov byte [ebp + eax - 0x518], 0
cmp dword [ebp - 0x51c], 0
je 0x54404a
push 0x7636b4
lea ecx, [ebp - 0x518]
push ecx
call fcn.00404520
add esp, 8
test eax, eax
je 0x543ff0
lea edx, [ebp - 0x518]
push edx
push 0x7636bc
call fcn.0066610b
add esp, 8
mov dword [ebp - 0x10c], 0
jmp 0x544088
push str.offline
lea eax, [ebp - 0x518]
push eax
call fcn.00404520
add esp, 8
test eax, eax
je 0x54402a
lea ecx, [ebp - 0x518]
push ecx
push 0x7636d4
call fcn.0066610b
add esp, 8
mov dword [ebp - 0x10c], 0x7c
jmp 0x544088
lea edx, [ebp - 0x518]
push edx
push 0x7636e4
call fcn.0066610b
add esp, 8
mov dword [ebp - 0x10c], 0xffffffff
jmp 0x544088
jmp 0x54406e
push 0
mov eax, dword [ebp - 0x520]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x54406e
jmp 0x544088
cmp dword [0x10ac334], 0
jne 0x544083
mov dword [ebp - 0x10c], 0x7b
jmp 0x544088
jmp 0x543f1c
mov ecx, dword [ebp - 0x520]
call fcn.00543590
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x5457c0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x618], ecx
cmp dword [ebp + 8], 0
jne 0x5457e9
mov eax, 0x74
jmp 0x5459bc
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.006665c0
add esp, 0xc
push 1
mov ecx, dword [ebp + 8]
push ecx
push str._s__s_env_set_persist.sys.wifi.password.type__d
lea edx, [ebp - 0x208]
push edx
call fcn.0066926d
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x618]
call fcn.005433c0
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x545856
mov eax, dword [ebp - 0x20c]
jmp 0x5459bc
mov ecx, dword [ebp - 0x618]
call fcn.00543590
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__s_env_set_persist.sys.wifi.password__s
lea eax, [ebp - 0x208]
push eax
call fcn.0066926d
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x618]
call fcn.005433c0
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x5458a9
mov eax, dword [ebp - 0x20c]
jmp 0x5459bc
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x5459ab
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea edx, [ebp - 0x614]
push edx
push 1
lea eax, [ebp - 0x610]
push eax
mov ecx, dword [ebp - 0x618]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x54596f
cmp dword [ebp - 0x614], 0
je 0x54596f
push 0
lea eax, [ebp - 0x614]
push eax
push 0x3ff
lea ecx, [ebp - 0x610]
push ecx
mov edx, dword [ebp - 0x618]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x545927
jmp 0x5459ab
mov ecx, dword [ebp - 0x614]
mov byte [ebp + ecx - 0x610], 0
lea edx, [ebp - 0x610]
push edx
push 0x763d14
call fcn.0066610b
add esp, 8
push str.invalid_item
lea eax, [ebp - 0x610]
push eax
call fcn.00404520
add esp, 8
test eax, eax
je 0x54596d
mov dword [ebp - 0x20c], 0x90
jmp 0x5459ab
jmp 0x545991
push 1
mov ecx, dword [ebp - 0x618]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x545991
jmp 0x5459ab
cmp dword [0x10ac334], 0
jne 0x5459a6
mov dword [ebp - 0x20c], 0x7b
jmp 0x5459ab
jmp 0x5458b3
mov ecx, dword [ebp - 0x618]
call fcn.00543590
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 8
Function at 0x5459d0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x618], ecx
cmp dword [ebp + 8], 0
jne 0x5459f9
mov eax, 0x74
jmp 0x545c0f
mov dword [ebp - 0x20c], 0xffffffff
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.006665c0
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x545a48
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s__s_write_imei__s__s
lea ecx, [ebp - 0x208]
push ecx
call fcn.0066926d
add esp, 0x14
jmp 0x545a64
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s__s_write_imei__s
lea ecx, [ebp - 0x208]
push ecx
call fcn.0066926d
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x618]
call fcn.005433c0
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x545a90
mov eax, dword [ebp - 0x20c]
jmp 0x545c0f
mov dword [ebp - 0x20c], 0xffffffff
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x545bcf
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea eax, [ebp - 0x614]
push eax
push 1
lea ecx, [ebp - 0x610]
push ecx
mov edx, dword [ebp - 0x618]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x545b93
cmp dword [ebp - 0x614], 0
je 0x545b93
push 0
lea ecx, [ebp - 0x614]
push ecx
push 0x3ff
lea edx, [ebp - 0x610]
push edx
mov eax, dword [ebp - 0x618]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x545b20
jmp 0x545bcf
mov edx, dword [ebp - 0x614]
mov byte [ebp + edx - 0x610], 0
cmp dword [ebp - 0x614], 0
je 0x545b91
push 0x763d60
lea eax, [ebp - 0x610]
push eax
call fcn.00404520
add esp, 8
test eax, eax
je 0x545b71
lea ecx, [ebp - 0x610]
push ecx
push 0x763d64
call fcn.0066610b
add esp, 8
mov dword [ebp - 0x20c], 0
jmp 0x545bcf
lea edx, [ebp - 0x610]
push edx
push 0x763d74
call fcn.0066610b
add esp, 8
mov dword [ebp - 0x20c], 0xffffffff
jmp 0x545bcf
jmp 0x545bb5
push 1
mov eax, dword [ebp - 0x618]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x545bb5
jmp 0x545bcf
cmp dword [0x10ac334], 0
jne 0x545bca
mov dword [ebp - 0x20c], 0x7b
jmp 0x545bcf
jmp 0x545aa4
cmp dword [ebp - 0x20c], 0
jne 0x545bfe
mov ecx, dword [ebp - 0x618]
call fcn.00543590
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x545bfc
mov dword [ebp - 0x20c], 0x98
jmp 0x545c09
mov ecx, dword [ebp - 0x618]
call fcn.00543590
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 0xc
Function at 0x545c20
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x618], ecx
cmp dword [ebp + 8], 0
jne 0x545c49
mov eax, 0x74
jmp 0x545df3
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__s_snkey_set_state__s
lea eax, [ebp - 0x208]
push eax
call fcn.0066926d
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x618]
call fcn.005433c0
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x545cb8
mov eax, dword [ebp - 0x20c]
jmp 0x545df3
mov ecx, dword [ebp - 0x618]
call fcn.00543590
mov edx, dword [ebp + 8]
push edx
push str._s__s_snkey_get_state
lea eax, [ebp - 0x208]
push eax
call fcn.0066926d
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x618]
call fcn.005433c0
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x545d07
mov eax, dword [ebp - 0x20c]
jmp 0x545df3
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x545de2
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea edx, [ebp - 0x614]
push edx
push 1
lea eax, [ebp - 0x610]
push eax
mov ecx, dword [ebp - 0x618]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x545da6
cmp dword [ebp - 0x614], 0
je 0x545da6
push 0
lea eax, [ebp - 0x614]
push eax
push 0x3ff
lea ecx, [ebp - 0x610]
push ecx
mov edx, dword [ebp - 0x618]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x545d82
jmp 0x545de2
mov ecx, dword [ebp - 0x614]
mov byte [ebp + ecx - 0x610], 0
lea edx, [ebp - 0x610]
push edx
push 0x763db8
call fcn.0066610b
add esp, 8
jmp 0x545dc8
push 1
mov eax, dword [ebp - 0x618]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x545dc8
jmp 0x545de2
cmp dword [0x10ac334], 0
jne 0x545ddd
mov dword [ebp - 0x20c], 0x7b
jmp 0x545de2
jmp 0x545d11
mov ecx, dword [ebp - 0x618]
call fcn.00543590
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 8