joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ccc0
Capabilities:
Delete service

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14002cd15
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 5
jne 0x14002ccfd
lea rcx, str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.140020490
lea eax, [rbx + 2]
jmp 0x14002ce15
mov edx, eax
lea rcx, str.OpenSCManager_failed___d__n
call fcn.140020490
mov eax, 1
jmp 0x14002ce15
mov r8d, 0x10000
mov qword [rsp + 0x30], rdi
lea rdx, str.jhi_service
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002cd98
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 5
jne 0x14002cd60
lea rcx, str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.140020490
lea eax, [rdi + 2]
jmp 0x14002ce10
cmp eax, 0x424
jne 0x14002cd7d
lea rcx, str.Error:_the_service_does_not_exist._n
call fcn.140020490
mov eax, 4
jmp 0x14002ce10
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.140020490
mov eax, 1
jmp 0x14002ce10
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14002cdf0
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 5
jne 0x14002cdd5
lea rcx, str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.140020490
mov eax, 2
jmp 0x14002ce10
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.140020490
mov eax, 1
jmp 0x14002ce10
lea rcx, str.JHI_Service_removed_successfully_n
call fcn.140020490
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
xor eax, eax
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x14002eba0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, rdx
test rdx, rdx
jne 0x14002ebcb
lea eax, [rdx - 2]
jmp 0x14002ecda
mov qword [rsp + 0x1e0], rbx
sub ecx, 1
je 0x14002ec4b
cmp ecx, 1
je 0x14002ebe7
mov eax, 0xfffffffe
jmp 0x14002ecd2
lea rax, [0x14002f080]
xor ebx, ebx
mov qword [rdx], rax
lea rax, [0x14002f160]
mov qword [rdx + 8], rax
lea rax, [0x14002f3a0]
mov qword [rdx + 0x10], rax
lea rax, [0x14002f500]
mov qword [rdx + 0x18], rax
lea ecx, [rbx + 0x28]
lea rax, [0x14002f680]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 0x20], rax
call fcn.14004ed6c
mov rcx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
mov qword [0x1400966c8], rbx
xor eax, eax
mov dword [rdi + 0x28], 1
jmp 0x14002ecd2
lea rax, [0x14002ed00]
xor ebx, ebx
mov qword [rdx], rax
lea rcx, [rsp + 0x20]
lea rax, [0x14002ed40]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 8], rax
mov r8d, 0x198
lea rax, [0x14002eec0]
mov qword [rdx + 0x10], rax
lea rax, [0x14002ef40]
mov qword [rdx + 0x18], rax
lea rax, [0x14002eff0]
mov qword [rdx + 0x20], rax
xor edx, edx
call fcn.1400426d0
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002ecb5
mov dword [rdi + 0x28], 1
jmp 0x14002ecd0
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov dword [rdi + 0x28], ebx
mov ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14003d770
add rsp, 0x1d0
pop rdi
ret
Function at 0x14002fcb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov ebp, r9d
mov dword [rsp + 0x68], r13d
mov r14, r8
mov r12, rdx
mov r15d, ecx
cmp rdx, 0xffffffffffffffff
je 0x14002fe2e
test r8, r8
je 0x14002fe2e
test r9d, r9d
je 0x14002fe2e
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x14002fe2e
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
lea edx, [r13 + 8]
lea r8d, [r13 + 0x20]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14002fd4c
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov ebx, 1
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14002fe03
test r15d, r15d
jne 0x14002fd99
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, r14
mov rcx, r12
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x14002fdbb
mov qword [rsi], rdi
movzx eax, r13w
jmp 0x14002fd2f
cmp r15d, ebx
jne 0x14002fdbb
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, r14
mov rcx, r12
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x14002fd90
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e5
je 0x14002fd90
sub eax, 6
je 0x14002fdfe
sub eax, 0x19
je 0x14002fdf7
sub eax, 0x5b
je 0x14002fdf0
sub eax, 0x415
je 0x14002fde9
cmp eax, ebx
jne 0x14002fe03
mov ebx, 8
jmp 0x14002fe03
mov ebx, 3
jmp 0x14002fe03
mov ebx, listen
jmp 0x14002fe03
mov ebx, 5
jmp 0x14002fe03
mov ebx, 4
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14002fe12
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
movzx eax, bx
jmp 0x14002fd2f
mov eax, 4
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x140030060
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1d0
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ebp, edx
mov rsi, rcx
mov edi, 0x203
test r8, r8
je 0x140030244
xor eax, eax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
movups xmm0, xmmword [r8]
movups xmmword [rcx + 0x18], xmm0
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov ecx, edx
mov qword [0x1400966e0], rax
mov qword [0x1400966e8], rax
mov qword [0x1400966f0], rax
mov qword [0x1400966f8], rax
mov qword [0x140096700], rax
mov qword [0x140096708], rax
sub ecx, 1
je 0x140030172
cmp ecx, 1
jne 0x140030291
lea rax, [0x14002f080]
mov qword [rsp + 0x1e8], rbx
mov qword [0x1400966e0], rax
xor edi, edi
lea rax, [0x14002f160]
mov dword [0x140096708], edi
mov qword [0x1400966e8], rax
lea rax, [0x14002f3a0]
mov qword [0x1400966f0], rax
lea rax, [0x14002f500]
mov qword [0x1400966f8], rax
lea ecx, [rdi + 0x28]
lea rax, [0x14002f680]
mov qword [0x140096700], rax
call fcn.14004ed6c
mov rcx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
mov qword [0x1400966c8], rbx
mov rbx, qword [rsp + 0x1e8]
jmp 0x1400301ea
lea rax, [0x14002ed00]
xor edi, edi
mov qword [0x1400966e0], rax
lea rcx, [rsp + 0x20]
lea rax, [0x14002ed40]
mov dword [0x140096708], edi
mov qword [0x1400966e8], rax
xor edx, edx
lea rax, [0x14002eec0]
mov r8d, 0x198
mov qword [0x1400966f0], rax
lea rax, [0x14002ef40]
mov qword [0x1400966f8], rax
lea rax, [0x14002eff0]
mov qword [0x140096700], rax
call fcn.1400426d0
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14003026b
mov edx, 0x2710
mov dword [0x140096708], 1
mov eax, 0x2712
lea r9, [rsi + 0x40]
cmp ebp, 1
lea rcx, [0x1400966e0]
cmovne edx, eax
xor r8d, r8d
call qword [0x1400966e8]
test eax, eax
je 0x140030223
mov eax, 0x300
jmp 0x140030246
lea rax, [0x14002fff0]
mov qword [rsi + 0x28], rax
lea rax, [0x140030010]
mov qword [rsi + 0x30], rax
lea rax, [0x140030030]
mov qword [rsi + 0x38], rax
mov eax, edi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14003d770
lea r11, [rsp + 0x1d0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xorps xmm0, xmm0
mov qword [0x1400966e0], rdi
movdqu xmmword [0x1400966f0], xmm0
mov qword [0x1400966e8], rdi
mov qword [0x140096700], rdi
mov dword [0x140096708], edi
mov eax, 0x601
jmp 0x140030246
Function at 0x1400302c0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140096728]
mov rbx, rcx
test rax, rax
jne 0x1400302e9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp dword [0x1400966bc], 0
je 0x14003035b
mov rcx, qword [0x140096750]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov ecx, 0xf0001001
mov dword [0x140096758], 0
call fcn.140032810
mov ecx, dword [0x140096684]
call qword [0x140096710]
mov rcx, qword [0x140096740]
test rcx, rcx
je 0x14003034b
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140096740]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [0x1400966bc], 0
mov rcx, qword [0x140096728]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
lea rdx, [rbx + 0x40]
lea rcx, [0x1400966e0]
call qword [0x1400966f0]
test eax, eax
je 0x14003038b
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.140003050
lea rcx, [0x1400966e0]
call qword [0x1400966e0]
test eax, eax
jne 0x1400303a4
cmp dword [0x140096708], eax
je 0x1400303b2
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.140003050
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140031870
Function at 0x1400303c0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
mov ebp, r9d
mov qword [rsp + 0x30], rax
mov rsi, r8
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [0x140096728]
test rax, rax
jne 0x14003042f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140096728]
xor ebx, ebx
cmp dword [0x1400966bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140030464
mov ebx, 0xf0001000
jmp 0x14003051b
test rdi, rdi
je 0x140030516
test rsi, rsi
je 0x140030516
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.1400321b0
test eax, eax
je 0x140030516
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 4
lea rcx, str.Beihai_Download__x_n
call fcn.140031bc0
lea rcx, [rsp + 0x30]
call fcn.140031fc0
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, rsi
lea rcx, [rsp + 0x70]
mov edx, 0x28
call fcn.140032590
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Download__x_ret__x_n
mov ebx, eax
cmove ebx, r8d
call fcn.140031bc0
mov r9, qword [0x140096730]
mov rcx, qword [rsp + 0x50]
test r9, r9
je 0x14003050f
mov r8d, 0x4b1
lea rdx, str.d:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call r9
jmp 0x14003051b
call fcn.140047a50
jmp 0x14003051b
mov ebx, 0xf0001005
mov edx, ebx
call fcn.140031870
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003d770
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030550
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
mov rdi, rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [0x140096728]
test rax, rax
jne 0x1400305b7
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140096728]
xor ebx, ebx
cmp dword [0x1400966bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x1400305e9
mov ebx, 0xf0001000
jmp 0x140030667
test rdi, rdi
jne 0x1400305f5
mov ebx, 0xf0001005
jmp 0x140030667
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.1400321b0
test eax, eax
je 0x1400305ee
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x80], 3
call fcn.140031fc0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x70]
lea edx, [r9 + 0x28]
call fcn.140032590
mov rcx, qword [rsp + 0x50]
test eax, eax
mov ebx, eax
mov rax, qword [0x140096730]
cmove ebx, dword [rsp + 0x3c]
test rax, rax
je 0x140030662
mov r8d, 0x48f
lea rdx, str.d:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
jmp 0x140030667
call fcn.140047a50
mov edx, ebx
call fcn.140031870
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003d770
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
Function at 0x140030e90
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rsi, qword [rdx]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov rax, qword [0x140096728]
test rax, rax
jne 0x140030efc
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140096728]
xor ebx, ebx
cmp dword [0x1400966bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140030f31
mov edi, 0xf0001000
jmp 0x140031030
test rsi, rsi
jne 0x140030f40
mov edi, 0xf0001005
jmp 0x140031030
mov rcx, rsi
call fcn.140031c60
mov rbx, rax
test rax, rax
jne 0x140030f5a
mov edi, 0xf000100c
jmp 0x140031030
mov dword [rsp + 0x80], listen
lea rdx, [rsp + 0x38]
mov rax, qword [rax + 0x18]
lea rcx, str.Beihai_ForceCloseSession__x_n
mov qword [rsp + 0x88], rax
call fcn.140031bc0
lea rcx, [rsp + 0x38]
call fcn.140031fc0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x70]
lea edx, [r9 + 0x20]
call fcn.140032590
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x38]
test eax, eax
lea rcx, str.Beihai_ForceCloseSession__x_ret__x_n
mov edi, eax
cmove edi, r8d
call fcn.140031bc0
mov r9, qword [0x140096730]
mov rcx, qword [rsp + 0x58]
test r9, r9
je 0x140030fe6
mov r8d, 0x56b
lea rdx, str.d:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call r9
jmp 0x140030feb
call fcn.140047a50
mov rcx, qword [0x140096718]
mov edx, 0xffffffff
mov qword [rsp + 0x30], rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
sub dword [rbx + 8], 1
jne 0x14003101c
lea rdx, [rsp + 0x30]
call fcn.1400336b0
mov rcx, rbx
call fcn.140031be0
jmp 0x140031023
mov dword [rbx + 0x34], 1
mov rcx, qword [0x140096718]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov edx, edi
call fcn.140031870
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003d770
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140031060
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0xb0
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140096728]
mov rsi, qword [rdx]
test rax, rax
jne 0x1400310a2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140096728]
xor ebx, ebx
cmp dword [0x1400966bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x1400310d7
mov ebx, 0xf0001000
jmp 0x14003116d
test rsi, rsi
jne 0x1400310e6
mov ebx, 0xf0001005
jmp 0x14003116d
mov rcx, rsi
mov qword [rsp + 0xc0], rdi
call fcn.140031e60
mov rdi, rax
test rax, rax
jne 0x140031105
mov ebx, 0xf000100c
jmp 0x140031165
mov dword [rsp + 0x40], 7
lea rcx, str.Beihai_CloseSession__x_n
mov rax, qword [rax + 0x18]
mov rdx, rdi
mov qword [rsp + 0x48], rax
call fcn.140031bc0
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rcx, [rsp + 0x30]
lea edx, [r9 + 0x20]
call fcn.140032590
mov r8d, dword [rdi + 0xc]
mov ebx, eax
test eax, eax
jne 0x14003114b
mov ebx, r8d
mov rdx, rdi
lea rcx, str.Beihai_CloseSession__x_ret__x_n
call fcn.140031bc0
mov rdx, rsi
mov rcx, rdi
call fcn.140031f40
mov rdi, qword [rsp + 0xc0]
mov edx, ebx
call fcn.140031870
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14003d770
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rsi
ret
Function at 0x140032940
Capabilities:
Check mutex on windows
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140096728]
xor edi, edi
mov esi, edx
mov rbx, rcx
test rax, rax
jne 0x140032976
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov ecx, dword [0x1400966bc]
test ecx, ecx
jne 0x140032aff
cmp qword [0x140096760], rdi
jne 0x1400329af
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096760], rax
mov rax, qword [0x140096718]
test rax, rax
jne 0x1400329cf
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096718], rax
cmp qword [0x140096750], rdi
jne 0x1400329f6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [0x140096750], rax
mov rax, qword [0x140096718]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
call fcn.140033610
mov rcx, qword [0x140096718]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
cmp qword [0x140096740], rdi
mov rax, qword [rbx]
mov qword [0x140096738], rax
mov rax, qword [rbx + 8]
mov qword [0x140096720], rax
mov rax, qword [rbx + 0x10]
mov qword [0x140096710], rax
mov eax, dword [rbx + 0x18]
mov dword [0x140096758], eax
mov dword [0x140096684], eax
jne 0x140032a74
mov qword [rsp + 0x28], rdi
lea r8, [0x140032910]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140096740], rax
jmp 0x140032a81
mov rcx, qword [0x140096750]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [0x140096728]
mov ebx, edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test esi, esi
je 0x140032a9b
call fcn.140032b40
mov ebx, eax
mov rax, qword [0x140096728]
test rax, rax
jne 0x140032abb
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test ebx, ebx
jne 0x140032ada
mov edi, 1
mov dword [0x1400966bc], edi
jmp 0x140032b18
mov rcx, qword [0x140096750]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov ecx, 0xf0001001
mov dword [0x140096758], edi
call fcn.140032810
mov dword [0x1400966bc], edi
jmp 0x140032b18
cmp ecx, 1
jne 0x140032b0b
mov ebx, 0xf000100b
jmp 0x140032b18
cmp ecx, 2
mov ebx, edi
mov eax, 0xf0001001
cmove ebx, eax
mov rcx, qword [0x140096728]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400331c0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
mov rsi, r9
mov qword [rsp + 0x30], rax
mov r14d, r8d
mov qword [rsp + 0x38], rax
mov rbp, rdx
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [0x140096728]
test rax, rax
jne 0x140033231
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140096728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140096728]
xor ebx, ebx
cmp dword [0x1400966bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140033266
mov eax, 0xf0001000
jmp 0x1400333a9
test rdi, rdi
je 0x1400333a4
test rbp, rbp
je 0x1400333a4
test r14d, r14d
je 0x1400333a4
test rsi, rsi
je 0x1400333a4
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.1400321b0
test eax, eax
je 0x1400333a4
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 5
lea rcx, str.Beihai_Query__x_n
call fcn.140031bc0
lea rcx, [rsp + 0x30]
call fcn.140031fc0
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, rbp
lea rcx, [rsp + 0x70]
mov edx, 0x28
call fcn.140032590
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Query__x_ret__x_n
mov edi, eax
cmove edi, r8d
call fcn.140031bc0
test edi, edi
jne 0x140033377
mov rbx, qword [rsp + 0x40]
test ebx, ebx
je 0x140033369
cmp qword [rsp + 0x50], 0
je 0x140033365
mov rax, qword [0x140096748]
lea ecx, [rbx + 1]
test rax, rax
je 0x140033335
mov r8d, 0x4d5
lea rdx, str.d:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
jmp 0x14003333a
call fcn.14004ed6c
mov qword [rsi], rax
test rax, rax
je 0x14003335e
mov rdx, qword [rsp + 0x50]
mov rcx, rax
movsxd rbx, ebx
mov r8, rbx
call fcn.140041940
mov rax, qword [rsi]
mov byte [rbx + rax], 0
jmp 0x140033377
mov edi, 0xf0001004
jmp 0x140033377
test ebx, ebx
jne 0x140033372
mov qword [rsi], 0
jmp 0x140033377
mov edi, 0xf0001006
mov rax, qword [0x140096730]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x14003339b
mov r8d, 0x4e3
lea rdx, str.d:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
mov eax, edi
jmp 0x1400333a9
call fcn.140047a50
mov eax, edi
jmp 0x1400333a9
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003d770
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret