joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9d18
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400a9d48
xor eax, eax
jmp 0x1400a9e0b
mov rbp, rbx
cmp word [rax], si
je 0x1400a9d6d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400a9d54
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400a9d50
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400a81c8
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x1400a9dae
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
jmp 0x1400a9d41
call fcn.1400a4a00
mov rdi, rax
test rax, rax
jne 0x1400a9dc4
xor ecx, ecx
call fcn.1400a49a0
jmp 0x1400a9da3
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400a81c8
test eax, eax
jne 0x1400a9df5
mov rcx, rdi
call fcn.1400a49a0
jmp 0x1400a9dff
xor ecx, ecx
call fcn.1400a49a0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400a9e28
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400a9eaf
mov rsi, rbx
cmp word [rax], bp
je 0x1400a9e6e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400a9e58
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400a9e54
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400a4a00
mov rdi, rax
test rax, rax
je 0x1400a9e9c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400b3cf0
mov rbp, rdi
xor ecx, ecx
call fcn.1400a49a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ad5d8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov dword [rsp + 0x30], esi
mov rbx, rcx
test rcx, rcx
je 0x1400ad64b
cmp word [rcx], si
je 0x1400ad64b
lea rdx, [0x1400cad08]
call fcn.1400b214c
test eax, eax
je 0x1400ad64b
lea rdx, [0x1400cad20]
mov rcx, rbx
call fcn.1400b214c
test eax, eax
jne 0x1400ad641
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x1400ad668
mov eax, dword [rsp + 0x30]
jmp 0x1400ad67a
mov rcx, rbx
call fcn.1400a41a8
jmp 0x1400ad67a
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jne 0x1400ad66c
xor eax, eax
jmp 0x1400ad67a
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400ad67a
call qword [sym.imp.KERNEL32.DLL_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ad68c
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ebp, edx
mov dword [rax + 8], ebx
mov edi, ecx
call fcn.1400a4764
mov ecx, edi
lea r9d, [rbx + 2]
and ecx, 0x3ff
lea r8, [rsp + 0x30]
bts ecx, 0xa
mov edx, 0x20000001
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x1400ad72f
cmp edi, dword [rsp + 0x30]
je 0x1400ad728
test ebp, ebp
je 0x1400ad728
mov r9, qword [rsi + 0x98]
mov r8d, ebx
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jbe 0x1400ad704
sub dx, 0x61
cmp dx, 0x19
ja 0x1400ad710
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x1400ad6f1
or rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], bx
jne 0x1400ad714
cmp r8d, eax
setne bl
mov eax, ebx
jmp 0x1400ad731
mov eax, 1
jmp 0x1400ad731
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b38e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b3908
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b3908
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000eef0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000ecc4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ecc4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ecc4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ecc4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ecc4
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ecc4
cmp dword [rcx + 0xf8], esi
je 0x14000ecc4
mov ecx, r14d
call fcn.14000ee0c
mov ecx, 2
call fcn.14000b2a4
nop
cmp byte [0x140034140], 0
jne 0x14000ed8e
mov r15d, 1
mov eax, r15d
xchg dword [0x140034130], eax
test ebx, ebx
jne 0x14000ed37
mov rdi, qword [0x140032080]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140034138]
cmp rcx, rax
je 0x14000ed2e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140006c98]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140034278]
jmp 0x14000ed43
cmp ebx, r15d
jne 0x14000ed49
lea rcx, [0x140034290]
call fcn.14000f9c8
nop
test ebx, ebx
jne 0x14000ed60
lea rdx, [0x14001e380]
lea rcx, [0x14001e360]
call fcn.14000fc94
lea rdx, [0x14001e390]
lea rcx, [0x14001e388]
call fcn.14000fc94
movzx eax, byte [0x140034140]
test esi, esi
cmove eax, r15d
mov byte [0x140034140], al
jmp 0x14000ed8e
mov ecx, 2
call fcn.14000b2f8
test esi, esi
jne 0x14000eda5
mov ecx, r14d
call fcn.14000edc0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000ec54
Function at 0x1401e0cf0
Capabilities:
Terminate process

Disassembly:
xchg esp, eax
invalid
cld
pop r11
jmp 0x1401e0cfd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401e0d0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401e0cf5
lea eax, [rcx + 1]
jmp 0x1401e0d1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401e0d2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401e0d14
sub eax, 3
jb 0x1401e0d4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401e0d9d
sar eax, 1
movsxd rbp, eax
jb 0x1401e0d84
jmp 0x1401e0d5c
add ebx, ebx
jne 0x1401e0d5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401e0d84
inc ecx
add ebx, ebx
jne 0x1401e0d6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401e0d84
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401e0d7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401e0d6c
add ecx, 2
jmp 0x1401e0d89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401e0cb2
jmp 0x1401e0cfd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x1dc000]
mov eax, dword [rdi]
or eax, eax
je 0x1401e0e09
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1e11dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401e0dad
jns 0x1401e0de2
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1401e0dec
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401e0e03
mov qword [rbx], rax
add rbx, 8
jmp 0x1401e0dcd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401e0e4d
cmp al, 0xef
ja 0x1401e0e35
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401e0e15
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1401e0e24
mov eax, dword [rdi]
add rdi, 4
jmp 0x1401e0e24
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401e0ea1
sub rsp, 0xffffffffffffff80
jmp 0x14015a4ec
Function at 0x140007afc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov eax, dword [0x14000b2d8]
lea r9, [rsp + 0x20]
movups xmm0, xmmword [str.wu]
mov dword [rsp + 0x40], eax
xor r8d, r8d
movups xmm1, xmmword [0x14000b2c8]
mov al, byte [0x14000b2dc]
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x44], al
movups xmmword [rsp + 0x30], xmm1
mov eax, 0x24924925
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9], al
inc r9
cmp r8d, 0x25
jl 0x140007b3a
xor ebx, ebx
lea rdi, [0x14000b760]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
call fcn.140009530
cmp byte [rsp + 0x44], 0
je 0x140007bc3
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, 0x24924925
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9], al
inc r9
cmp r8d, 0x25
jl 0x140007b93
call fcn.140009544
mov r8d, eax
inc ebx
mov eax, 0x38e38e39
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*8]
shl ecx, 2
sub r8d, ecx
movsxd rcx, r8d
mov dl, byte [rsp + rcx + 0x20]
mov byte [rdi], dl
inc rdi
cmp ebx, 0xd
jb 0x140007b73
mov rbx, qword [rsp + 0x60]
mov al, 1
add rsp, 0x50
pop rdi
ret

Function at 0x1400093a8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x28], 0
lea rdx, [rbp - 0x28]
mov ecx, ecx
mov edi, r9d
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400094b5
and dword [rbp + 0x20], 0
mov rax, qword gs:[0x188]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rax + 0x98]
mov rax, qword [rbp - 0x28]
mov rbx, qword [rcx + 0x20]
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0x28]
mov cr3, rax
lea rax, [rbp + 0x20]
mov r9d, edi
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x28]
or rcx, 0xffffffffffffffff
call sub.ntoskrnl.exe_ZwProtectVirtualMemory
mov rcx, qword gs:[0x188]
mov rdx, qword [rcx + 0x98]
mov qword [rdx + 0x20], rbx
mov rcx, qword [rbx + 0x28]
mov cr3, rcx
test eax, eax
js 0x1400094b5
xorps xmm0, xmm0
mov dword [rbp - 0x20], 0xfc3942f1
movups xmmword [rbp - 0x18], xmm0
mov dword [rbp - 0x1c], 0xcd2f48c3
mov qword [rbp - 0x30], 0
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov edx, 0x39
mov rax, qword [rbp - 0x30]
sub cl, 0x7e
mov r8b, byte [rbp + rax - 0x20]
mov al, cl
and al, r8b
sub dl, al
add dl, dl
add dl, cl
mov rcx, qword [rbp - 0x30]
add dl, r8b
mov byte [rbp + rcx - 0x20], dl
mov rcx, qword [rbp - 0x30]
inc rcx
mov qword [rbp - 0x30], rcx
mov rcx, qword [rbp - 0x30]
cmp rcx, 0x18
jb 0x140009460
mov rdx, qword [rbp - 0x20]
xor rdx, qword [0x14000b648]
mov rcx, qword [rbp - 0x28]
call rdx
mov al, 1
jmp 0x1400094b7
xor al, al
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
Function at 0x140032ed4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14005d330]
test rax, rax
je 0x140032f1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140032f1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140032f1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140032f1e
cmp dword [rcx + 0x84], 0xe
jbe 0x140032f1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140032f20
xor al, al
add rsp, 0x28
ret

Function at 0x14003f130
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14003ef9b
xor ecx, ecx
call qword [0x14005d330]
test rax, rax
je 0x14003ef9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003ef9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003ef9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003ef9b
cmp dword [rcx + 0x84], 0xe
jbe 0x14003ef9b
cmp dword [rcx + 0xf8], 0
je 0x14003ef9b
mov ecx, ebx
call fcn.14003f04c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14003ee28
nop
cmp dword [rbp + 0x20], 0
je 0x14003efe9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14003eff4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14003ef2c
Function at 0x1800059c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800059f1
xor eax, eax
lea r8, [0x1800056e0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400223e0
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
lea rcx, [0x14007ed50]
call fcn.140003170
call fcn.14000cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [rbx + 8], 2
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rdx, [0x14006a078]
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400390e4
mov rdi, rax
test rax, rax
je 0x140022457
lea rax, vtable.intel_dal::CommandDispatcher.0
mov qword [rdi], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [rdi + 8], rax
jmp 0x140022468
xor edi, edi
lea edx, [rdi + 0x10]
lea rcx, str.JHI_memory_allocation_of_size__d_failed_.
call fcn.140003170
mov ecx, 0x1c0
call fcn.140038e18
mov rsi, rax
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x1c0
mov rcx, rax
call fcn.14003d8e0
lea rax, vtable.intel_dal::ICommandsServer.0
mov qword [rsi], rax
mov ecx, 8
call fcn.140038e18
mov rbx, rax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rbx], rax
xor r9d, r9d
mov edx, 0xa
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov qword [rbx], rax
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rdi
mov byte [rsi + 8], 0xa
lea rax, vtable.intel_dal::CommandsServerSocketsWin32.0
mov qword [rsi], rax
mov qword [rsi + 0x1b8], 0xffffffffffffffff
mov ecx, 0x202
lea rdx, [rsi + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002256f
cmp byte [rsi + 0x20], 2
jne 0x1400225a0
cmp byte [rsi + 0x21], 2
jne 0x1400225a0
mov qword [0x140091a30], rsi
lea rcx, str.opening_command_server_n
call fcn.1400031b0
mov rcx, qword [0x140091a30]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x140069610]
test al, al
jne 0x140022551
lea rcx, str.Error:_command_server_has_failed_to_open_a_connection_n
call fcn.140003170
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rcx, str.____jhi_start
call fcn.140003170
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error:__d_n
call fcn.140003170
lea rdx, str.WSAStartup_failed
lea rcx, [rsp + 0x20]
call fcn.140001ff0
lea rdx, [0x14008bf10]
lea rcx, [rsp + 0x20]
call fcn.14003da70
int3
lea rcx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
call fcn.140003170
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll
lea rcx, [rsp + 0x38]
call fcn.140001ff0
lea rdx, [0x14008bf10]
lea rcx, [rsp + 0x38]
call fcn.14003da70
int3
Function at 0x14002bba0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov ebp, r9d
mov rax, qword [0x140091a88]
mov rsi, r8
mov rdi, rdx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x14002bc03
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002bc38
mov ebx, 0xf0001000
jmp 0x14002bd4a
test rdi, rdi
je 0x14002bd45
test rsi, rsi
je 0x14002bd45
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.14002d990
test eax, eax
je 0x14002bd45
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 4
lea rcx, str.Beihai_Download__x_n
call fcn.14002d530
mov rcx, qword [0x14008ec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x14008ec48], rcx
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.14002f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.14002d530
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, rsi
mov edx, 0x28
call fcn.14002dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Download__x_ret__x_n
mov ebx, eax
cmove ebx, r8d
call fcn.14002d530
mov rax, qword [0x140091850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x14002bd3e
mov r8d, 0x4b1
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002bd4a
call fcn.140044cd0
jmp 0x14002bd4a
mov ebx, 0xf0001005
mov edx, ebx
call fcn.14002d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140038b50
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002bd80
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rax, qword [0x140091a88]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x14002bddb
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002be10
mov ebx, 0xf0001000
jmp 0x14002beed
test rdi, rdi
jne 0x14002be1f
mov ebx, 0xf0001005
jmp 0x14002beed
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.14002d990
test eax, eax
je 0x14002be15
mov rax, qword [0x14008ec48]
mov edx, 0xffffffff
mov rcx, qword [0x140092aa0]
mov qword [rsp + 0x68], rax
inc rax
mov qword [0x14008ec48], rax
mov dword [rsp + 0x80], 3
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.14002f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.14002d530
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x28]
call fcn.14002dba0
mov rcx, qword [rsp + 0x50]
test eax, eax
mov ebx, eax
mov rax, qword [0x140091850]
cmove ebx, dword [rsp + 0x3c]
test rax, rax
je 0x14002bee8
mov r8d, 0x48f
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002beed
call fcn.140044cd0
mov edx, ebx
call fcn.14002d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140038b50
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
Function at 0x14002eaa0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rax, qword [0x140091a88]
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x14002eb05
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002eb3a
mov eax, 0xf0001000
jmp 0x14002ecda
test rsi, rsi
je 0x14002ecd5
test rbp, rbp
je 0x14002ecd5
test r14d, r14d
je 0x14002ecd5
test rdi, rdi
je 0x14002ecd5
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.14002d990
test eax, eax
je 0x14002ecd5
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 5
lea rcx, str.Beihai_Query__x_n
call fcn.14002d530
mov rcx, qword [0x14008ec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x14008ec48], rcx
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.14002f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.14002d530
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, rbp
mov edx, 0x28
call fcn.14002dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Query__x_ret__x_n
mov esi, eax
cmove esi, r8d
call fcn.14002d530
test esi, esi
jne 0x14002eca4
movsxd rbx, dword [rsp + 0x40]
test ebx, ebx
je 0x14002ec96
cmp qword [rsp + 0x50], 0
je 0x14002ec92
mov rax, qword [0x140091858]
lea ecx, [rbx + 1]
test rax, rax
je 0x14002ec65
mov r8d, 0x4d5
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002ec6a
call fcn.14004c5b0
mov qword [rdi], rax
test rax, rax
je 0x14002ec8b
mov rdx, qword [rsp + 0x50]
mov r8, rbx
mov rcx, rax
call fcn.14003db70
mov rax, qword [rdi]
mov byte [rbx + rax], 0
jmp 0x14002eca4
mov esi, 0xf0001004
jmp 0x14002eca4
test ebx, ebx
jne 0x14002ec9f
mov qword [rdi], 0
jmp 0x14002eca4
mov esi, 0xf0001006
mov rax, qword [0x140091850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x14002eccc
mov r8d, 0x4e3
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
mov eax, esi
jmp 0x14002ecda
call fcn.140044cd0
mov eax, esi
jmp 0x14002ecda
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140038b50
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret