joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fe40
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1d0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ebp, edx
mov rsi, rcx
mov edi, 0x203
test r8, r8
je 0x140030024
xor eax, eax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
movups xmm0, xmmword [r8]
movups xmmword [rcx + 0x18], xmm0
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov ecx, edx
mov qword [0x1400956e0], rax
mov qword [0x1400956e8], rax
mov qword [0x1400956f0], rax
mov qword [0x1400956f8], rax
mov qword [0x140095700], rax
mov qword [0x140095708], rax
sub ecx, 1
je 0x14002ff52
cmp ecx, 1
jne 0x140030071
lea rax, [0x14002ee60]
mov qword [rsp + 0x1e8], rbx
mov qword [0x1400956e0], rax
xor edi, edi
lea rax, [0x14002ef40]
mov dword [0x140095708], edi
mov qword [0x1400956e8], rax
lea rax, [0x14002f180]
mov qword [0x1400956f0], rax
lea rax, [0x14002f2e0]
mov qword [0x1400956f8], rax
lea ecx, [rdi + 0x28]
lea rax, [0x14002f460]
mov qword [0x140095700], rax
call fcn.14004e41c
mov rcx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
mov qword [0x1400956c8], rbx
mov rbx, qword [rsp + 0x1e8]
jmp 0x14002ffca
lea rax, [0x14002eae0]
xor edi, edi
mov qword [0x1400956e0], rax
lea rcx, [rsp + 0x20]
lea rax, [0x14002eb20]
mov dword [0x140095708], edi
mov qword [0x1400956e8], rax
xor edx, edx
lea rax, [0x14002eca0]
mov r8d, 0x198
mov qword [0x1400956f0], rax
lea rax, [0x14002ed20]
mov qword [0x1400956f8], rax
lea rax, [0x14002edd0]
mov qword [0x140095700], rax
call fcn.140041d80
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14003004b
mov edx, 0x2710
mov dword [0x140095708], 1
mov eax, 0x2712
lea r9, [rsi + 0x40]
cmp ebp, 1
lea rcx, [0x1400956e0]
cmovne edx, eax
xor r8d, r8d
call qword [0x1400956e8]
test eax, eax
je 0x140030003
mov eax, 0x300
jmp 0x140030026
lea rax, [0x14002fdd0]
mov qword [rsi + 0x28], rax
lea rax, [0x14002fdf0]
mov qword [rsi + 0x30], rax
lea rax, [0x14002fe10]
mov qword [rsi + 0x38], rax
mov eax, edi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14003ce20
lea r11, [rsp + 0x1d0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xorps xmm0, xmm0
mov qword [0x1400956e0], rdi
movdqu xmmword [0x1400956f0], xmm0
mov qword [0x1400956e8], rdi
mov qword [0x140095700], rdi
mov dword [0x140095708], edi
mov eax, 0x601
jmp 0x140030026
Function at 0x1400300a0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140095728]
mov rbx, rcx
test rax, rax
jne 0x1400300c9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp dword [0x1400956bc], 0
je 0x14003013b
mov rcx, qword [0x140095750]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov ecx, 0xf0001001
mov dword [0x140095758], 0
call fcn.1400325d0
mov ecx, dword [0x140095684]
call qword [0x140095710]
mov rcx, qword [0x140095740]
test rcx, rcx
je 0x14003012b
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140095740]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [0x1400956bc], 0
mov rcx, qword [0x140095728]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
lea rdx, [rbx + 0x40]
lea rcx, [0x1400956e0]
call qword [0x1400956f0]
test eax, eax
je 0x14003016b
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.140003050
lea rcx, [0x1400956e0]
call qword [0x1400956e0]
test eax, eax
jne 0x140030184
cmp dword [0x140095708], eax
je 0x140030192
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.140003050
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140031630
Function at 0x1400301a0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
mov ebp, r9d
mov qword [rsp + 0x30], rax
mov rsi, r8
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [0x140095728]
test rax, rax
jne 0x14003020f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140095728]
xor ebx, ebx
cmp dword [0x1400956bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140030244
mov ebx, 0xf0001000
jmp 0x1400302fb
test rdi, rdi
je 0x1400302f6
test rsi, rsi
je 0x1400302f6
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.140031f70
test eax, eax
je 0x1400302f6
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 4
lea rcx, str.Beihai_Download__x_n
call fcn.140031980
lea rcx, [rsp + 0x30]
call fcn.140031d80
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, rsi
lea rcx, [rsp + 0x70]
mov edx, 0x28
call fcn.140032350
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Download__x_ret__x_n
mov ebx, eax
cmove ebx, r8d
call fcn.140031980
mov r9, qword [0x140095730]
mov rcx, qword [rsp + 0x50]
test r9, r9
je 0x1400302ef
mov r8d, 0x4b1
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call r9
jmp 0x1400302fb
call fcn.140047100
jmp 0x1400302fb
mov ebx, 0xf0001005
mov edx, ebx
call fcn.140031630
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003ce20
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030330
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
mov rdi, rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [0x140095728]
test rax, rax
jne 0x140030397
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140095728]
xor ebx, ebx
cmp dword [0x1400956bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x1400303c9
mov ebx, 0xf0001000
jmp 0x140030447
test rdi, rdi
jne 0x1400303d5
mov ebx, 0xf0001005
jmp 0x140030447
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.140031f70
test eax, eax
je 0x1400303ce
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x80], 3
call fcn.140031d80
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x70]
lea edx, [r9 + 0x28]
call fcn.140032350
mov rcx, qword [rsp + 0x50]
test eax, eax
mov ebx, eax
mov rax, qword [0x140095730]
cmove ebx, dword [rsp + 0x3c]
test rax, rax
je 0x140030442
mov r8d, 0x48f
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
jmp 0x140030447
call fcn.140047100
mov edx, ebx
call fcn.140031630
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003ce20
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
Function at 0x140030c50
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rsi, qword [rdx]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov rax, qword [0x140095728]
test rax, rax
jne 0x140030cbc
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140095728]
xor ebx, ebx
cmp dword [0x1400956bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140030cf1
mov edi, 0xf0001000
jmp 0x140030df0
test rsi, rsi
jne 0x140030d00
mov edi, 0xf0001005
jmp 0x140030df0
mov rcx, rsi
call fcn.140031a20
mov rbx, rax
test rax, rax
jne 0x140030d1a
mov edi, 0xf000100c
jmp 0x140030df0
mov dword [rsp + 0x80], recv
lea rdx, [rsp + 0x38]
mov rax, qword [rax + 0x18]
lea rcx, str.Beihai_ForceCloseSession__x_n
mov qword [rsp + 0x88], rax
call fcn.140031980
lea rcx, [rsp + 0x38]
call fcn.140031d80
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x70]
lea edx, [r9 + 0x20]
call fcn.140032350
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x38]
test eax, eax
lea rcx, str.Beihai_ForceCloseSession__x_ret__x_n
mov edi, eax
cmove edi, r8d
call fcn.140031980
mov r9, qword [0x140095730]
mov rcx, qword [rsp + 0x58]
test r9, r9
je 0x140030da6
mov r8d, 0x56b
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call r9
jmp 0x140030dab
call fcn.140047100
mov rcx, qword [0x140095718]
mov edx, 0xffffffff
mov qword [rsp + 0x30], rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
sub dword [rbx + 8], 1
jne 0x140030ddc
lea rdx, [rsp + 0x30]
call fcn.140033470
mov rcx, rbx
call fcn.1400319a0
jmp 0x140030de3
mov dword [rbx + 0x34], 1
mov rcx, qword [0x140095718]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov edx, edi
call fcn.140031630
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003ce20
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140030e20
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0xb0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140095728]
mov rsi, qword [rdx]
test rax, rax
jne 0x140030e62
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140095728]
xor ebx, ebx
cmp dword [0x1400956bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140030e97
mov ebx, 0xf0001000
jmp 0x140030f2d
test rsi, rsi
jne 0x140030ea6
mov ebx, 0xf0001005
jmp 0x140030f2d
mov rcx, rsi
mov qword [rsp + 0xc0], rdi
call fcn.140031c20
mov rdi, rax
test rax, rax
jne 0x140030ec5
mov ebx, 0xf000100c
jmp 0x140030f25
mov dword [rsp + 0x40], 7
lea rcx, str.Beihai_CloseSession__x_n
mov rax, qword [rax + 0x18]
mov rdx, rdi
mov qword [rsp + 0x48], rax
call fcn.140031980
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rcx, [rsp + 0x30]
lea edx, [r9 + 0x20]
call fcn.140032350
mov r8d, dword [rdi + 0xc]
mov ebx, eax
test eax, eax
jne 0x140030f0b
mov ebx, r8d
mov rdx, rdi
lea rcx, str.Beihai_CloseSession__x_ret__x_n
call fcn.140031980
mov rdx, rsi
mov rcx, rdi
call fcn.140031d00
mov rdi, qword [rsp + 0xc0]
mov edx, ebx
call fcn.140031630
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14003ce20
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rsi
ret
Function at 0x140032700
Capabilities:
Check mutex on windows
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140095728]
xor edi, edi
mov esi, edx
mov rbx, rcx
test rax, rax
jne 0x140032736
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov ecx, dword [0x1400956bc]
test ecx, ecx
jne 0x1400328bf
cmp qword [0x140095760], rdi
jne 0x14003276f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095760], rax
mov rax, qword [0x140095718]
test rax, rax
jne 0x14003278f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095718], rax
cmp qword [0x140095750], rdi
jne 0x1400327b6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [0x140095750], rax
mov rax, qword [0x140095718]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
call fcn.1400333d0
mov rcx, qword [0x140095718]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
cmp qword [0x140095740], rdi
mov rax, qword [rbx]
mov qword [0x140095738], rax
mov rax, qword [rbx + 8]
mov qword [0x140095720], rax
mov rax, qword [rbx + 0x10]
mov qword [0x140095710], rax
mov eax, dword [rbx + 0x18]
mov dword [0x140095758], eax
mov dword [0x140095684], eax
jne 0x140032834
mov qword [rsp + 0x28], rdi
lea r8, [0x1400326d0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140095740], rax
jmp 0x140032841
mov rcx, qword [0x140095750]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [0x140095728]
mov ebx, edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test esi, esi
je 0x14003285b
call fcn.140032900
mov ebx, eax
mov rax, qword [0x140095728]
test rax, rax
jne 0x14003287b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test ebx, ebx
jne 0x14003289a
mov edi, 1
mov dword [0x1400956bc], edi
jmp 0x1400328d8
mov rcx, qword [0x140095750]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov ecx, 0xf0001001
mov dword [0x140095758], edi
call fcn.1400325d0
mov dword [0x1400956bc], edi
jmp 0x1400328d8
cmp ecx, 1
jne 0x1400328cb
mov ebx, 0xf000100b
jmp 0x1400328d8
cmp ecx, 2
mov ebx, edi
mov eax, 0xf0001001
cmove ebx, eax
mov rcx, qword [0x140095728]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140032f80
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
mov rsi, r9
mov qword [rsp + 0x30], rax
mov r14d, r8d
mov qword [rsp + 0x38], rax
mov rbp, rdx
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [0x140095728]
test rax, rax
jne 0x140032ff1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140095728]
xor ebx, ebx
cmp dword [0x1400956bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140033026
mov eax, 0xf0001000
jmp 0x140033169
test rdi, rdi
je 0x140033164
test rbp, rbp
je 0x140033164
test r14d, r14d
je 0x140033164
test rsi, rsi
je 0x140033164
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.140031f70
test eax, eax
je 0x140033164
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 5
lea rcx, str.Beihai_Query__x_n
call fcn.140031980
lea rcx, [rsp + 0x30]
call fcn.140031d80
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, rbp
lea rcx, [rsp + 0x70]
mov edx, 0x28
call fcn.140032350
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Query__x_ret__x_n
mov edi, eax
cmove edi, r8d
call fcn.140031980
test edi, edi
jne 0x140033137
mov rbx, qword [rsp + 0x40]
test ebx, ebx
je 0x140033129
cmp qword [rsp + 0x50], 0
je 0x140033125
mov rax, qword [0x140095748]
lea ecx, [rbx + 1]
test rax, rax
je 0x1400330f5
mov r8d, 0x4d5
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
jmp 0x1400330fa
call fcn.14004e41c
mov qword [rsi], rax
test rax, rax
je 0x14003311e
mov rdx, qword [rsp + 0x50]
mov rcx, rax
movsxd rbx, ebx
mov r8, rbx
call fcn.140040ff0
mov rax, qword [rsi]
mov byte [rbx + rax], 0
jmp 0x140033137
mov edi, 0xf0001004
jmp 0x140033137
test ebx, ebx
jne 0x140033132
mov qword [rsi], 0
jmp 0x140033137
mov edi, 0xf0001006
mov rax, qword [0x140095730]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x14003315b
mov r8d, 0x4e3
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
mov eax, edi
jmp 0x140033169
call fcn.140047100
mov eax, edi
jmp 0x140033169
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14003ce20
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140033190
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140095728]
mov r15d, r9d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rax, rax
jne 0x1400331dd
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x140095728], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140095728]
xor ebx, ebx
cmp dword [0x1400956bc], 1
sete bl
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test ebx, ebx
jne 0x140033212
mov eax, 0xf0001000
jmp 0x1400333a5
test rdi, rdi
je 0x1400333a0
test r14, r14
je 0x1400333a0
test rbp, rbp
jne 0x140033232
test r15d, r15d
jne 0x1400333a0
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140031f70
test eax, eax
je 0x1400333a0
mov rax, qword [0x140095748]
mov ecx, 0x38
test rax, rax
je 0x140033269
mov r8d, 0x4fd
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
jmp 0x14003326e
call fcn.14004e41c
mov rbx, rax
test rax, rax
jne 0x140033280
mov eax, 0xf0001004
jmp 0x1400333a5
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [rbx + 0x28], rax
mov rcx, rbx
test rax, rax
jne 0x1400332cd
mov rax, qword [0x140095730]
test rax, rax
je 0x1400332be
mov r8d, 0x504
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
mov eax, 0xf000100a
jmp 0x1400333a5
call fcn.140047100
mov eax, 0xf000100a
jmp 0x1400333a5
mov qword [rsp + 0xb8], rsi
mov dword [rbx + 8], 1
mov qword [rbx + 0x30], 1
call fcn.140031d80
mov r8, rax
mov dword [rsp + 0x40], 6
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x__llx_n
mov rsi, rax
call fcn.140031980
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x30]
mov r8, rbp
mov r9d, r15d
mov edx, 0x28
call fcn.140032350
mov r8d, dword [rbx + 0xc]
mov edi, eax
test eax, eax
jne 0x14003332d
mov edi, r8d
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x_ret__x_n
call fcn.140031980
mov rax, qword [0x140095730]
mov rcx, qword [rbx + 0x20]
test rax, rax
je 0x14003335d
mov r8d, 0x517
lea rdx, str.d:_buildagent_prod_8811p41326310928_servicesdal_src_thirdparty_bhplugin1_beihai_toolsjhi_lib_beihaiplugin.cpp
call rax
jmp 0x140033362
call fcn.140047100
mov qword [rbx + 0x20], 0
mov rdx, rsi
mov rcx, rbx
test edi, edi
jne 0x140033388
mov qword [r14], rsi
call fcn.140031c80
mov rsi, qword [rsp + 0xb8]
mov eax, edi
jmp 0x1400333a5
call fcn.140031d00
mov rsi, qword [rsp + 0xb8]
mov eax, edi
mov qword [r14], 0
jmp 0x1400333a5
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14003ce20
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x140034430
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1d0
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, rcx
mov esi, 0x203
test r8, r8
je 0x1400345b9
xor eax, eax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
movups xmm0, xmmword [r8]
movups xmmword [rcx + 0x18], xmm0
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
sub edx, 1
je 0x14003450f
cmp edx, 1
jne 0x1400345ff
lea rax, [0x14002ee60]
mov qword [rsp + 0x1e8], rbx
mov qword [0x140095768], rax
lea ecx, [rdx + 0x27]
lea rax, [0x14002ef40]
xor esi, esi
mov qword [0x140095770], rax
lea rax, [0x14002f180]
mov qword [0x140095778], rax
lea rax, [0x14002f2e0]
mov qword [0x140095780], rax
lea rax, [0x14002f460]
mov qword [0x140095788], rax
mov dword [0x140095790], esi
call fcn.14004e41c
mov rcx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
mov qword [0x1400956c8], rbx
mov rbx, qword [rsp + 0x1e8]
jmp 0x140034583
lea rax, [0x14002eae0]
xor esi, esi
mov qword [0x140095768], rax
lea rcx, [rsp + 0x20]
lea rax, [0x14002eb20]
mov dword [0x140095790], esi
mov qword [0x140095770], rax
xor edx, edx
lea rax, [0x14002eca0]
mov r8d, 0x198
mov qword [0x140095778], rax
lea rax, [0x14002ed20]
mov qword [0x140095780], rax
lea rax, [0x14002edd0]
mov qword [0x140095788], rax
call fcn.140041d80
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400345dc
mov dword [0x140095790], 1
lea rax, [0x140034300]
mov qword [rdi + 0x28], rax
lea rax, [0x140034320]
mov qword [rdi + 0x30], rax
lea rax, [0x140034340]
mov qword [rdi + 0x38], rax
lea rax, [0x140034360]
mov qword [rdi + 0x40], rax
mov eax, esi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14003ce20
mov rsi, qword [rsp + 0x1f0]
add rsp, 0x1d0
pop rdi
ret
xorps xmm0, xmm0
mov qword [0x140095768], rsi
xorps xmm1, xmm1
mov dword [0x140095790], esi
movdqu xmmword [0x140095770], xmm0
movdqu xmmword [0x140095780], xmm1
mov eax, 0x601
jmp 0x1400345bb
Function at 0x140038c80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
lea rbx, [rcx + rcx*4]
xor r12d, r12d
shl rbx, 4
lea rbp, [0x1400967e0]
mov r14, rcx
mov qword [rsp + 0x60], r12
mov qword [rbx + rbp + 8], r12
lea rsi, [rbx + rbp]
mov qword [rbx + rbp + 0x30], r12
lea r15, [rbx + rbp]
lea rcx, [rbp + 0x20]
mov dword [rbx + rbp + 0x38], r12d
add rcx, rbx
mov edi, edx
call fcn.1400396c0
xor eax, eax
lea rdx, [rsp + 0x60]
mov qword [rbx + rbp + 0x3c], rax
mov ecx, edi
mov qword [rbx + rbp + 0x44], rax
call qword [0x1400957b0]
test eax, eax
je 0x140038cf9
lea ebx, [r12 + 0xd]
jmp 0x140038d2c
mov rax, qword [rsp + 0x60]
lea r8, [0x140038bd0]
mov qword [rsp + 0x28], r12
mov r9, r14
xor edx, edx
mov qword [rsi + 8], rax
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [r15 + 0x30], rax
test rax, rax
jne 0x140038d47
lea ebx, [rax + 0xb]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140038d43
mov rcx, qword [rsi + 8]
call qword [0x1400957b8]
mov qword [rsi + 8], r12
mov eax, ebx
jmp 0x140038d4a
mov eax, r12d
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret