joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0cec
Capabilities:
Query service status
Stop service

Disassembly:
push 0x3c
mov eax, 0x5094e1
call fcn.004fb730
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push SysReAllocString
xor ebx, ebx
mov dword [ebp - 0x38], eax
push ebx
push ebx
mov dword [ebp - 0x3c], edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4b0e4d
push 0x24
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x4b0e42
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4b0e42
cmp dword [ebp - 0x30], 1
je 0x4b0e42
jmp 0x4b0dd3
mov eax, dword [ebp - 0x1c]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x2710
cmp eax, ecx
jbe 0x4b0d84
mov eax, ecx
jmp 0x4b0d8e
mov ecx, 0x3e8
cmp eax, ecx
cmovb eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4b0e42
cmp dword [ebp - 0x30], 1
je 0x4b0e42
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x38]
sbb edx, dword [ebp - 0x3c]
test edx, edx
ja 0x4b0e42
jb 0x4b0dd3
cmp eax, 0x7530
ja 0x4b0e42
cmp dword [ebp - 0x30], 3
je 0x4b0d6d
lea eax, [ebp - 0x34]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4b0e42
cmp dword [ebp - 0x30], 1
je 0x4b0e42
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4b0e39
cmp dword [ebp - 0x30], 1
je 0x4b0e39
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebx
sbb edx, edi
test edx, edx
ja 0x4b0e39
jb 0x4b0e33
cmp eax, 0x7530
ja 0x4b0e39
cmp dword [ebp - 0x30], 1
jne 0x4b0df6
mov edi, dword [ebp - 0x44]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [ebp - 4], 0
test esi, esi
je 0x4b0e4d
push esi
call ebx
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4b0e58
push edi
call ebx
call fcn.004fb6da
ret

Function at 0x4b0fc3
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x14]
mov eax, dword [edi]
cmp eax, 1
jne 0x4b0ffc
lea ecx, [esi + 0x24]
call fcn.004af3e6
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4b0ff7
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 2
pop eax
xchg dword [edi], eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x4b13f9
Capabilities:
Create thread

Disassembly:
push 0xf4
mov eax, 0x50970b
call fcn.004fb730
mov esi, ecx
lea edi, [esi + 0x14]
mov eax, dword [edi]
test eax, eax
jne 0x4b149a
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
push ebx
push esi
push 0x4b1132
push ebx
push ebx
call fcn.004e493e
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x4b14c5
xor eax, eax
inc eax
xchg dword [edi], eax
lea ecx, [esi + 0x18]
mov eax, dword [ecx]
push 0x1388
call dword [eax + 4]
cmp eax, 0x102
jne 0x4b1480
push str.WT::System::Win32::CThread::ThreadStart
push 0x1a
push str.E:_bamboo_agent_home_2xml_data_build_dirPGSC_MON_JOB1monolith_sourcePhoenixWtSystemWin32Thread.cpp
push ecx
push ecx
mov ecx, esp
push str.ThreadStart_timeout_waiting_for_m_StartedEvent
call fcn.004591ee
lea ecx, [ebp - 0x6c]
call fcn.004b3e15
mov dword [ebp - 4], 5
jmp 0x4b1534
cmp dword [ebp + 0xc], ebx
je 0x4b1492
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004b104f
call fcn.004fb6da
ret 8
push str.WT::System::Win32::CThread::ThreadStart
push 0x24
push str.E:_bamboo_agent_home_2xml_data_build_dirPGSC_MON_JOB1monolith_sourcePhoenixWtSystemWin32Thread.cpp
push ecx
push ecx
mov ecx, esp
push str.Thread_already_started
call fcn.004591ee
lea ecx, [ebp - 0x6c]
call fcn.004b3e15
mov dword [ebp - 4], 6
jmp 0x4b1534
call fcn.004da3af
lea ecx, [ebp - 0x9c]
mov edx, dword [eax]
call fcn.004b1575
mov dword [ebp - 4], ebx
mov edx, str._beginthreadex_failure__errno_
push eax
lea ecx, [ebp - 0x84]
call fcn.004aefff
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.0045a2d3
push str.WT::System::Win32::CThread::ThreadStart
push 0x12
push str.E:_bamboo_agent_home_2xml_data_build_dirPGSC_MON_JOB1monolith_sourcePhoenixWtSystemWin32Thread.cpp
push dword [eax + 4]
lea ecx, [ebp - 0x6c]
push dword [eax]
call fcn.004b3e15
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.00455dd2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9c]
call fcn.00455dd2
lea ecx, [ebp - 0x6c]
call fcn.004b4228
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xf8]
call fcn.004b3c43
push 0x5626ac
lea eax, [ebp - 0xf8]
push eax
call fcn.004d4a8e
int3
Function at 0x4b66a8
Capabilities:
Read .ini file

Disassembly:
push 0xb0c
mov eax, 0x50a794
call fcn.004fb730
mov esi, edx
mov dword [ebp - 0xb0c], esi
mov edi, ecx
mov dword [ebp - 0xb10], edi
mov ecx, esi
call fcn.004b6ea9
mov ecx, edi
call fcn.004ad51b
test al, al
je 0x4b678e
cmp dword [edi + 0x14], 8
lea ebx, [ebp - 0xa38]
mov eax, edi
jb 0x4b66ed
mov eax, dword [edi]
push eax
push 0x513
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
cmp word [ebp - 0xa38], 0
je 0x4b677f
mov edi, esi
push ebx
lea ecx, [ebp - 0xa50]
call fcn.00455432
mov dword [ebp - 4], 1
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0xb18]
mov ecx, edi
push eax
call fcn.004b62e1
push 0x569860
mov ecx, dword [eax]
add ecx, 0x28
call fcn.004b65c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa50]
call fcn.00455d7e
mov esi, ebx
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x4b6759
sub esi, ecx
sar esi, 1
lea ebx, [ebx + esi*2]
add ebx, 2
cmp word [ebx], dx
jne 0x4b670c
mov edi, dword [ebp - 0xb10]
mov esi, dword [ebp - 0xb0c]
mov edx, esi
mov ecx, edi
call fcn.004b681b
call fcn.004fb6da
ret
push str.WT::CommonAppLogic::CIniFile::LoadFile
push 0xd4
push str.E:_bamboo_agent_home_2xml_data_build_dirPGSC_MON_JOB1monolith_sourcePhoenixWtCommonAppLogicIniFile.cpp
push ecx
push ecx
mov ecx, esp
push str.File_does_not_exist_in_CIniFile::LoadFile
call fcn.00457fc7
lea ecx, [ebp - 0xaac]
call fcn.004b3ef8
and dword [ebp - 4], 0
lea ecx, [ebp - 0xaac]
call fcn.004b4228
lea eax, [ebp - 0xaac]
push eax
lea ecx, [ebp - 0xb08]
call fcn.004b3c43
push 0x5626ac
lea eax, [ebp - 0xb08]
push eax
call fcn.004d4a8e
int3
Function at 0x4b7a8d
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x50aa78
call fcn.004fb730
mov dword [ebp - 0x44], edx
mov ebx, ecx
mov eax, dword [ebx + 4]
xor ecx, ecx
sub eax, dword [ebx]
mov dword [ebp - 0x30], ecx
push ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x40], cl
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], 0xf
call fcn.0040d324
and dword [ebp - 4], 0
mov esi, 0x5353f0
mov eax, dword [ebx + 4]
lea edi, [ebp - 0x24]
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebx]
sub eax, esi
je 0x4b7b05
mov eax, edx
and eax, 0xf
mov cl, byte [ebp + eax - 0x24]
lea eax, [ebp - 0x40]
xor cl, byte [esi + edx]
cmp dword [ebp - 0x2c], 0x10
cmovae eax, dword [ebp - 0x40]
mov byte [eax + edx], cl
inc edx
mov eax, dword [ebx + 4]
mov esi, dword [ebx]
sub eax, esi
cmp edx, eax
jb 0x4b7adf
mov esi, dword [ebp - 0x44]
lea edi, [ebp - 0x28]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x44]
lea esi, [ebp - 0x40]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4b7b59
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b7b50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b7b6e
push edx
push ecx
call fcn.0047834a
pop ecx
pop ecx
and dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.004fb6da
ret
call fcn.004d7bfa
int3
Function at 0x4b8c8a
Capabilities:
Create thread

Disassembly:
push 0xc0
mov eax, 0x50af7a
call fcn.004fb730
mov esi, ecx
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x14], eax
test eax, eax
je 0x4b8cfc
push edi
push edi
push esi
push 0x4b8d8c
push edi
push edi
call fcn.004e493e
add esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
jne 0x4b8cf6
push str.WT::CommonAppLogic::IPCQueue::CIPCQueue::StartThread
push 0x1bc
push str.E:_bamboo_agent_home_2xml_data_build_dirPGSC_MON_JOB1monolith_sourcePhoenixWtCommonAppLogicIPCQueue.cpp
push ecx
push ecx
mov ecx, esp
push str.CIPCQueue::StartThread___:_Failed_to_create_thread
call fcn.00457fc7
lea ecx, [ebp - 0x6c]
call fcn.004b3ef8
mov dword [ebp - 4], 1
jmp 0x4b8d24
call fcn.004fb6da
ret
push str.WT::CommonAppLogic::IPCQueue::CIPCQueue::StartThread
push 0x1b0
push str.E:_bamboo_agent_home_2xml_data_build_dirPGSC_MON_JOB1monolith_sourcePhoenixWtCommonAppLogicIPCQueue.cpp
push ecx
push ecx
mov ecx, esp
push str.CIPCQueue::StartThread___:_Failed_to_create_thread_stop_event
call fcn.00457fc7
lea ecx, [ebp - 0x6c]
call fcn.004b3ef8
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x6c]
call fcn.004b4228
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.004b3c43
push 0x5626ac
lea eax, [ebp - 0xc8]
push eax
call fcn.004d4a8e
int3
Function at 0x4ba281
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0x40
mov eax, 0x50b4d4
call fcn.004fb730
mov ebx, ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], ebx
call fcn.004ba5ea
mov byte [ebp - 0x44], al
and dword [ebp - 4], 0
test al, al
je 0x4ba3cc
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.004ba613
mov esi, eax
cmp esi, 0xffffffff
je 0x4ba3cc
mov ecx, dword [ebp + 0xc]
sub dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3c], 1
cmp ebx, 0x100000
jbe 0x4ba3b3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
jbe 0x4ba3a7
xor eax, eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], eax
sub edi, ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x25]
push eax
push edi
call fcn.0045b6ea
mov byte [ebp - 4], 1
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
lea eax, [ebp - 0x38]
push ebx
push eax
push edi
push dword [ebp - 0x34]
mov dword [ebp - 0x38], ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ba360
cmp dword [ebp - 0x38], edi
jne 0x4ba360
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x14
mov ecx, esi
call fcn.004bb565
push ebx
lea eax, [ebp - 0x4c]
push eax
push edi
push dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x4ba36a
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.004baf2c
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4ba3c0
mov edx, dword [ebp - 0x2c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4ba393
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ba3ee
push edx
push ecx
call fcn.0047834a
pop ecx
pop ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
jmp 0x4ba3c0
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.004baf2c
jmp 0x4ba3c0
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
mov ecx, esi
call fcn.004bb565
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x40]
jmp 0x4ba3d0
mov byte [ebp - 0x3c], 0
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x44], 0
je 0x4ba3e3
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 0x3c]
call fcn.004fb6da
ret 8
call fcn.004d7bfa
int3

Function at 0x4ba572
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x56a070], 0
jne 0x4ba5b5
push esi
xor edx, edx
push edi
push 8
mov esi, edx
pop edi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov esi, ecx
xor esi, 0xedb88320
and al, 1
cmove esi, ecx
sub edi, 1
jne 0x4ba584
mov dword [edx*4 + 0x569c70], esi
inc edx
cmp edx, 0x100
jb 0x4ba57f
pop edi
mov byte [0x56a070], 1
pop esi
ret
Function at 0x4baf2c
Capabilities:
Clear file content

Disassembly:
xor eax, eax
mov dword [edx + 0x10], eax
push esi
mov esi, ecx
mov dword [edx + 4], eax
mov dword [edx], 1
mov dword [edx + 8], 0x14
mov dword [edx + 0xc], eax
call fcn.004bb565
test al, al
jne 0x4baf52
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov al, 1
pop esi
ret

Function at 0x4bb2cf
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x50b5d0
call fcn.004fb6fc
mov esi, ecx
lea ecx, [esi + 0x40]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
mov dword [ebp - 4], edi
cmp byte [esi + 0x5c], 0
je 0x4bb303
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
xor al, al
jmp 0x4bb336
mov byte [esi + 0x5c], 1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
push edi
push esi
push 0x4bb33e
push edi
push edi
mov dword [esi + 0x68], eax
mov dword [ebp - 0x14], edi
call fcn.004e493e
mov dword [esi + 0x60], eax
add esp, 0x18
mov al, 1
call fcn.004fb6c5
ret 4

Function at 0x4bb39d
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x50b60a
call fcn.004fb730
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], edi
call fcn.004ba5ea
mov bh, al
mov byte [ebp - 0x44], bh
and dword [ebp - 4], 0
test bh, bh
je 0x4bb484
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.004ba613
mov esi, eax
cmp esi, 0xffffffff
je 0x4bb484
push esi
lea ecx, [ebp - 0x40]
call fcn.0045c011
mov byte [ebp - 4], 1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x4bb407
xor bl, bl
jmp 0x4bb476
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov ecx, edi
push dword [ebp - 0x3c]
push eax
call fcn.004b9fc1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x34]
and dword [ebp - 0x28], 0
push 0
push ecx
push eax
push dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4bb468
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], eax
jne 0x4bb468
inc dword [ebp - 0x20]
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.004bb565
test al, al
je 0x4bb468
mov bl, 1
jmp 0x4bb46a
xor bl, bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.0045b5a3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004cb455
jmp 0x4bb486
xor bl, bl
or dword [ebp - 4], 0xffffffff
test bh, bh
je 0x4bb497
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, bl
call fcn.004fb6da
ret 8
Function at 0x4bb530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov edx, dword [edi]
test esi, esi
je 0x4bb55c
movzx ecx, byte [ebx]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x569c70]
inc ebx
sub esi, 1
jne 0x4bb544
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4bdcc1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x4bdcc9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4bdcdc
test al, 0x10
je 0x4bdcdc
mov al, 1
ret
xor al, al
ret
Function at 0x4c6b84
Capabilities:
Create thread

Disassembly:
push 0xc8
mov eax, 0x50d78e
call fcn.004fb730
mov esi, ecx
mov ecx, dword [esi + 0x2ec]
add ecx, 0x9c
mov dword [ebp - 0xcc], ecx
mov eax, dword [ecx]
call dword [eax + 4]
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [esi + 0x2ec]
lock inc dword [eax + 4]
mov eax, dword [esi + 0x2ec]
mov dword [eax + 0x98], edx
mov eax, dword [esi + 0x2ec]
mov byte [eax + 0xe2], dl
cmp dword [esi + 0x2dc], edx
jne 0x4c6c17
mov eax, dword [esi + 0x2ec]
lea ecx, [ebp - 0xd0]
push ecx
push edx
push eax
push 0x4c6c7e
push 0xfa0
push edx
mov dword [esi + 0x2e4], 1
mov dword [ebp - 0xd0], edx
call fcn.004e493e
add esp, 0x18
mov dword [esi + 0x2dc], eax
test eax, eax
je 0x4c6c2c
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx]
call dword [eax + 8]
call fcn.004fb6da
ret
push str.WT::System::Net::CHttpWebRequest::StartDownloadFromMainThread
push 0x462
push str.E:_bamboo_agent_home_2xml_data_build_dirPGSC_MON_JOB1monolith_sourcePhoenixWtSystemNetHttpWebRequest.cpp
push ecx
push ecx
mov ecx, esp
push str._beginthreadex_failure
call fcn.004591ee
lea ecx, [ebp - 0x6c]
call fcn.004b3e15
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.004b4228
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.004b3c43
push 0x5626ac
lea eax, [ebp - 0xc8]
push eax
call fcn.004d4a8e
int3
Function at 0x4c9341
Capabilities:
Check if file exists
Get file version info

Disassembly:
push 0x24
mov eax, 0x50dc0f
call fcn.004fb6fc
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x24], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
cmp dword [esi + 0x10], ebx
je 0x4c94a8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4c936c
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c94a8
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x14], ebx
jb 0x4c9388
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4c94a6
xor eax, eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00464599
mov dword [ebp - 4], 1
cmp dword [esi + 0x14], 8
jb 0x4c93c6
mov esi, dword [esi]
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x14]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
xor ebx, ebx
test eax, eax
je 0x4c9469
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push eax
push 0x548a84
push dword [ebp - 0x30]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c9469
mov eax, dword [ebp - 0x18]
movzx esi, word [eax + 0x12]
movzx edx, word [eax + 0x10]
movzx ecx, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
push ecx
push edx
push esi
push str._ld._ld._ld._ld
push edi
call fcn.004b2326
add esp, 0x18
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], bl
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x4c94ca
mov ecx, dword [ebp - 0x28]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x4c9455
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c94d2
push ecx
push edx
call fcn.0047834a
pop ecx
pop ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x4c94ca
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x4c94a8
mov edx, dword [ebp - 0x28]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4c9492
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c94d2
push edx
push ecx
call fcn.0047834a
pop ecx
pop ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x4c94a8
xor ebx, ebx
xor esi, esi
mov dword [edi + 0x10], ebx
inc esi
mov dword [edi + 0x14], 0xf
push esi
push 0x53431c
mov ecx, edi
mov byte [edi], bl
call fcn.004592f7
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
mov eax, edi
call fcn.004fb6c5
ret
call fcn.004d7bfa
int3
Function at 0x4ca31b
Capabilities:
Read .ini file

Disassembly:
push 0x48
mov eax, 0x50de55
call fcn.004fb730
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x50], esi
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], eax
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [ebp - 4], edx
xor ecx, ecx
push edx
add eax, 2
mov word [ebp - 0x28], cx
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], edx
push eax
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 7
call fcn.0046082a
mov dword [ebp - 4], 1
call fcn.004ca299
mov ecx, eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
cmp dword [ebx + 0x14], 8
jb 0x4ca399
mov ebx, dword [ebx]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [edi + 0x14], 8
jb 0x4ca3ac
mov edi, dword [edi]
push ebx
push dword [ebp - 0x48]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ecx]
call dword [eax + 8]
xor edi, edi
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push 0
push edi
call fcn.004afec0
mov ebx, eax
cmp ebx, edi
je 0x4ca430
cmp ebx, 0xffffffff
je 0x4ca430
sub eax, edi
lea ecx, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
call fcn.0045d1a7
mov ecx, eax
mov byte [ebp - 4], 3
mov eax, dword [esi + 4]
push ecx
cmp eax, dword [esi + 8]
je 0x4ca417
mov ecx, eax
call fcn.00455bff
add dword [esi + 4], 0x18
jmp 0x4ca41f
push eax
mov ecx, esi
call fcn.0046057d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00455d7e
lea edi, [ebx + 1]
jmp 0x4ca3ca
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4ca469
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4ca460
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ca484
push edx
push ecx
call fcn.0047834a
pop ecx
pop ecx
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, esi
call fcn.004fb6da
ret 8
call fcn.004d7bfa
int3

Function at 0x4ca8f7
Capabilities:
Encode data using xor

Disassembly:
push 8
pop edx
lea eax, [ecx + 8]
cmp dword [ecx + 4], edx
jbe 0x4ca928
xor dword [eax], 0xf05643b7
add edx, 0x10
xor dword [eax + 4], 0x3759814b
xor dword [eax + 8], 0x93aad9e1
xor dword [eax + 0xc], 0x903622a2
lea eax, [edx + ecx]
cmp edx, dword [ecx + 4]
jb 0x4ca902
ret