joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6d8e82c00
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
cmp dword [rcx + 0x30], 0
mov rsi, rdx
mov rdi, rcx
je 0x7ff6d8e82c32
mov eax, 0xa
jmp 0x7ff6d8e82c6d
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x220], rbx
xor ebx, ebx
test rcx, rcx
je 0x7ff6d8e82c5a
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetMailslotInfo]
cmp dword [rsp + 0x30], ebx
ja 0x7ff6d8e82c8e
mov eax, 9
mov rbx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rsi, qword [rsp + 0x228]
add rsp, 0x200
pop rdi
ret
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 0x1a8
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x7ff6d8e82cb8
mov eax, 4
jmp 0x7ff6d8e82c65
mov eax, dword [rsp + 0x34]
cmp rax, 0x1aa
jae 0x7ff6d8e82ce3
lea rdx, [rsp + 0x40]
mov byte [rsp + rax + 0x40], bl
mov rcx, rsi
call fcn.7ff6d8e82cf0
test eax, eax
mov ecx, 0xb
cmove ebx, ecx
mov eax, ebx
jmp 0x7ff6d8e82c65
call fcn.7ff6d8e99214
int3
Function at 0x7ff6d8e88560
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x7ff6d8e885a7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x7ff6d8e88639
mov edx, eax
lea rcx, str.OpenSCManager_failed___d__n
call fcn.7ff6d8e7f150
lea eax, [rbx + 1]
jmp 0x7ff6d8e88687
mov r8d, 0x10000
lea rdx, str.jhi_service
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x7ff6d8e8860f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x7ff6d8e88639
cmp eax, 0x424
jne 0x7ff6d8e885f4
lea rcx, str.Error:_the_service_does_not_exist._n
call fcn.7ff6d8e7f150
lea eax, [rdi + 4]
jmp 0x7ff6d8e88687
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.7ff6d8e7f150
mov eax, 1
jmp 0x7ff6d8e88687
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_DeleteService]
test eax, eax
jne 0x7ff6d8e88667
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x7ff6d8e8864c
lea rcx, str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.7ff6d8e7f150
mov eax, 2
jmp 0x7ff6d8e88687
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.7ff6d8e7f150
mov eax, 1
jmp 0x7ff6d8e88687
lea rcx, str.JHI_Service_removed_successfully_n
call fcn.7ff6d8e7f150
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff6d8e8a2d0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, rdx
test rdx, rdx
jne 0x7ff6d8e8a2fb
lea eax, [rdx - 2]
jmp 0x7ff6d8e8a40a
mov qword [rsp + 0x1e0], rbx
sub ecx, 1
je 0x7ff6d8e8a37b
cmp ecx, 1
je 0x7ff6d8e8a317
mov eax, 0xfffffffe
jmp 0x7ff6d8e8a402
lea rax, [0x7ff6d8e8a7a0]
xor ebx, ebx
mov qword [rdx], rax
lea rax, [0x7ff6d8e8a880]
mov qword [rdx + 8], rax
lea rax, [0x7ff6d8e8ab80]
mov qword [rdx + 0x10], rax
lea rax, [0x7ff6d8e8acf0]
mov qword [rdx + 0x18], rax
lea ecx, [rbx + 0x28]
lea rax, [0x7ff6d8e8ae90]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 0x20], rax
call fcn.7ff6d8eac5b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov qword [0x7ff6d8ef1a48], rbx
xor eax, eax
mov dword [rdi + 0x28], 1
jmp 0x7ff6d8e8a402
lea rax, [0x7ff6d8e8a430]
xor ebx, ebx
mov qword [rdx], rax
lea rcx, [rsp + 0x20]
lea rax, [0x7ff6d8e8a470]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 8], rax
mov r8d, 0x198
lea rax, [0x7ff6d8e8a5f0]
mov qword [rdx + 0x10], rax
lea rax, [0x7ff6d8e8a670]
mov qword [rdx + 0x18], rax
lea rax, [0x7ff6d8e8a720]
mov qword [rdx + 0x20], rax
xor edx, edx
call fcn.7ff6d8e9d8e0
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x7ff6d8e8a3e5
mov dword [rdi + 0x28], 1
jmp 0x7ff6d8e8a400
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov dword [rdi + 0x28], ebx
mov ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.7ff6d8e98b50
add rsp, 0x1d0
pop rdi
ret
Function at 0x7ff6d8e8b2f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0xa0]
xor eax, eax
mov dword [rsp + 0x30], eax
mov ebp, r9d
mov rsi, r8
mov r12, rdx
mov r15d, ecx
cmp rdx, 0xffffffffffffffff
je 0x7ff6d8e8b491
test r8, r8
je 0x7ff6d8e8b491
test r9d, r9d
je 0x7ff6d8e8b491
test r14, r14
je 0x7ff6d8e8b491
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r13d, 8
mov r8d, 0x20
mov rcx, rax
mov edx, r13d
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x7ff6d8e8b3b2
lea eax, [rdi + 1]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff6d8e98b50
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
mov ebx, 1
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x7ff6d8e8b466
test r15d, r15d
jne 0x7ff6d8e8b3fd
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x7ff6d8e8b41f
mov qword [r14], rdi
xor eax, eax
jmp 0x7ff6d8e8b386
cmp r15d, ebx
jne 0x7ff6d8e8b41f
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x7ff6d8e8b3f6
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x7ff6d8e8b3f6
sub eax, 6
je 0x7ff6d8e8b461
sub eax, 0x19
je 0x7ff6d8e8b45a
sub eax, 0x5b
je 0x7ff6d8e8b453
sub eax, 0x415
je 0x7ff6d8e8b44c
cmp eax, ebx
jne 0x7ff6d8e8b466
movzx ebx, r13w
jmp 0x7ff6d8e8b466
mov ebx, 3
jmp 0x7ff6d8e8b466
mov ebx, 0xb
jmp 0x7ff6d8e8b466
mov ebx, 5
jmp 0x7ff6d8e8b466
mov ebx, 4
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x7ff6d8e8b475
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_HeapFree]
movzx eax, bx
jmp 0x7ff6d8e8b386
mov eax, 4
jmp 0x7ff6d8e8b398
Function at 0x7ff6d8e8ba80
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x7ff6d8ef1a88]
mov rbx, rcx
test rax, rax
jne 0x7ff6d8e8baa9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6d8ef1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [0x7ff6d8ef1a6c], 0
je 0x7ff6d8e8bb22
mov rcx, qword [0x7ff6d8ef1a70]
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
mov ecx, 0xf0001001
mov dword [0x7ff6d8ef1a68], 0
call fcn.7ff6d8e8ddc0
mov ecx, dword [0x7ff6d8ef2a90]
mov rax, qword [0x7ff6d8ef2aa8]
call qword [0x7ff6d8ec9610]
mov rcx, qword [0x7ff6d8ef1a78]
test rcx, rcx
je 0x7ff6d8e8bb12
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6d8ef1a78]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x7ff6d8ef1a6c], 0
mov rcx, qword [0x7ff6d8ef1a88]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [0x7ff6d8ef1830]
lea rdx, [rbx + 0x40]
lea rcx, [0x7ff6d8ef1820]
call qword [0x7ff6d8ec9610]
test eax, eax
je 0x7ff6d8e8bb59
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.7ff6d8e631b0
mov rax, qword [0x7ff6d8ef1820]
lea rcx, [0x7ff6d8ef1820]
call qword [0x7ff6d8ec9610]
test eax, eax
jne 0x7ff6d8e8bb79
cmp dword [0x7ff6d8ef1848], eax
je 0x7ff6d8e8bb87
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.7ff6d8e631b0
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.7ff6d8e8d1b0
Function at 0x7ff6d8e8bba0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov ebp, r9d
mov rax, qword [0x7ff6d8ef1a88]
mov rsi, r8
mov rdi, rdx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x7ff6d8e8bc03
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6d8ef1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6d8ef1a88]
xor ebx, ebx
cmp dword [0x7ff6d8ef1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff6d8e8bc38
mov ebx, 0xf0001000
jmp 0x7ff6d8e8bd4a
test rdi, rdi
je 0x7ff6d8e8bd45
test rsi, rsi
je 0x7ff6d8e8bd45
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.7ff6d8e8d990
test eax, eax
je 0x7ff6d8e8bd45
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 4
lea rcx, str.Beihai_Download__x_n
call fcn.7ff6d8e8d530
mov rcx, qword [0x7ff6d8eeec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x7ff6d8eeec48], rcx
mov rcx, qword [0x7ff6d8ef2aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.7ff6d8e8f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.7ff6d8e8d530
mov rcx, qword [0x7ff6d8ef2aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, rsi
mov edx, 0x28
call fcn.7ff6d8e8dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Download__x_ret__x_n
mov ebx, eax
cmove ebx, r8d
call fcn.7ff6d8e8d530
mov rax, qword [0x7ff6d8ef1850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x7ff6d8e8bd3e
mov r8d, 0x4b1
lea rdx, str.D:_buildagent_cd_8811p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6d8ec9610]
jmp 0x7ff6d8e8bd4a
call fcn.7ff6d8ea4cd0
jmp 0x7ff6d8e8bd4a
mov ebx, 0xf0001005
mov edx, ebx
call fcn.7ff6d8e8d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff6d8e8bd80
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rax, qword [0x7ff6d8ef1a88]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x7ff6d8e8bddb
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6d8ef1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6d8ef1a88]
xor ebx, ebx
cmp dword [0x7ff6d8ef1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff6d8e8be10
mov ebx, 0xf0001000
jmp 0x7ff6d8e8beed
test rdi, rdi
jne 0x7ff6d8e8be1f
mov ebx, 0xf0001005
jmp 0x7ff6d8e8beed
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.7ff6d8e8d990
test eax, eax
je 0x7ff6d8e8be15
mov rax, qword [0x7ff6d8eeec48]
mov edx, 0xffffffff
mov rcx, qword [0x7ff6d8ef2aa0]
mov qword [rsp + 0x68], rax
inc rax
mov qword [0x7ff6d8eeec48], rax
mov dword [rsp + 0x80], 3
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.7ff6d8e8f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.7ff6d8e8d530
mov rcx, qword [0x7ff6d8ef2aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x28]
call fcn.7ff6d8e8dba0
mov rcx, qword [rsp + 0x50]
test eax, eax
mov ebx, eax
mov rax, qword [0x7ff6d8ef1850]
cmove ebx, dword [rsp + 0x3c]
test rax, rax
je 0x7ff6d8e8bee8
mov r8d, 0x48f
lea rdx, str.D:_buildagent_cd_8811p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6d8ec9610]
jmp 0x7ff6d8e8beed
call fcn.7ff6d8ea4cd0
mov edx, ebx
call fcn.7ff6d8e8d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
Function at 0x7ff6d8e8c8c0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x7ff6d8ef1a88]
mov rsi, qword [rdx]
test rax, rax
jne 0x7ff6d8e8c907
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6d8ef1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6d8ef1a88]
xor ebx, ebx
cmp dword [0x7ff6d8ef1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff6d8e8c939
mov edi, 0xf0001000
jmp 0x7ff6d8e8c97a
test rsi, rsi
jne 0x7ff6d8e8c945
mov edi, 0xf0001005
jmp 0x7ff6d8e8c97a
mov rcx, rsi
call fcn.7ff6d8e8d550
mov rbx, rax
test rax, rax
je 0x7ff6d8e8c975
mov rcx, qword [rax + 0x28]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [rbx + 0x34], 0
je 0x7ff6d8e8c9a6
mov rdx, rsi
mov rcx, rbx
call fcn.7ff6d8e8d630
mov edi, 0xf000100c
mov edx, edi
call fcn.7ff6d8e8d1b0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff6d8e98b50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x40], 7
lea rcx, str.Beihai_CloseSession__x_n
mov rax, qword [rbx + 0x18]
mov rdx, rbx
mov qword [rsp + 0x48], rax
call fcn.7ff6d8e8d530
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rcx, [rsp + 0x30]
lea edx, [r9 + 0x20]
call fcn.7ff6d8e8dba0
mov r8d, dword [rbx + 0xc]
mov edi, eax
test eax, eax
jne 0x7ff6d8e8c9ec
mov edi, r8d
mov rdx, rbx
lea rcx, str.Beihai_CloseSession__x_ret__x_n
call fcn.7ff6d8e8d530
mov rdx, rsi
mov rcx, rbx
call fcn.7ff6d8e8d730
jmp 0x7ff6d8e8c97a
Function at 0x7ff6d8e8eaa0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rax, qword [0x7ff6d8ef1a88]
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x7ff6d8e8eb05
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6d8ef1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6d8ef1a88]
xor ebx, ebx
cmp dword [0x7ff6d8ef1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff6d8e8eb3a
mov eax, 0xf0001000
jmp 0x7ff6d8e8ecda
test rsi, rsi
je 0x7ff6d8e8ecd5
test rbp, rbp
je 0x7ff6d8e8ecd5
test r14d, r14d
je 0x7ff6d8e8ecd5
test rdi, rdi
je 0x7ff6d8e8ecd5
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.7ff6d8e8d990
test eax, eax
je 0x7ff6d8e8ecd5
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 5
lea rcx, str.Beihai_Query__x_n
call fcn.7ff6d8e8d530
mov rcx, qword [0x7ff6d8eeec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x7ff6d8eeec48], rcx
mov rcx, qword [0x7ff6d8ef2aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.7ff6d8e8f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.7ff6d8e8d530
mov rcx, qword [0x7ff6d8ef2aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, rbp
mov edx, 0x28
call fcn.7ff6d8e8dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Query__x_ret__x_n
mov esi, eax
cmove esi, r8d
call fcn.7ff6d8e8d530
test esi, esi
jne 0x7ff6d8e8eca4
movsxd rbx, dword [rsp + 0x40]
test ebx, ebx
je 0x7ff6d8e8ec96
cmp qword [rsp + 0x50], 0
je 0x7ff6d8e8ec92
mov rax, qword [0x7ff6d8ef1858]
lea ecx, [rbx + 1]
test rax, rax
je 0x7ff6d8e8ec65
mov r8d, 0x4d5
lea rdx, str.D:_buildagent_cd_8811p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6d8ec9610]
jmp 0x7ff6d8e8ec6a
call fcn.7ff6d8eac5b0
mov qword [rdi], rax
test rax, rax
je 0x7ff6d8e8ec8b
mov rdx, qword [rsp + 0x50]
mov r8, rbx
mov rcx, rax
call fcn.7ff6d8e9db70
mov rax, qword [rdi]
mov byte [rbx + rax], 0
jmp 0x7ff6d8e8eca4
mov esi, 0xf0001004
jmp 0x7ff6d8e8eca4
test ebx, ebx
jne 0x7ff6d8e8ec9f
mov qword [rdi], 0
jmp 0x7ff6d8e8eca4
mov esi, 0xf0001006
mov rax, qword [0x7ff6d8ef1850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x7ff6d8e8eccc
mov r8d, 0x4e3
lea rdx, str.D:_buildagent_cd_8811p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6d8ec9610]
mov eax, esi
jmp 0x7ff6d8e8ecda
call fcn.7ff6d8ea4cd0
mov eax, esi
jmp 0x7ff6d8e8ecda
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7ff6d8e98b50
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff6d8e8ed00
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x7ff6d8ef1a88]
mov r15d, r9d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rax, rax
jne 0x7ff6d8e8ed4d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6d8ef1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6d8ef1a88]
xor ebx, ebx
cmp dword [0x7ff6d8ef1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff6d8e8ed82
mov eax, 0xf0001000
jmp 0x7ff6d8e8ef21
test rdi, rdi
je 0x7ff6d8e8ef1c
test r14, r14
je 0x7ff6d8e8ef1c
test rbp, rbp
jne 0x7ff6d8e8eda2
test r15d, r15d
jne 0x7ff6d8e8ef1c
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.7ff6d8e8d990
test eax, eax
je 0x7ff6d8e8ef1c
mov rax, qword [0x7ff6d8ef1858]
mov ecx, 0x38
test rax, rax
je 0x7ff6d8e8eddd
mov r8d, 0x4fd
lea rdx, str.D:_buildagent_cd_8811p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6d8ec9610]
jmp 0x7ff6d8e8ede2
call fcn.7ff6d8eac5b0
mov rbx, rax
test rax, rax
jne 0x7ff6d8e8edf4
mov eax, 0xf0001004
jmp 0x7ff6d8e8ef21
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [rbx + 0x28], rax
mov rcx, rbx
test rax, rax
jne 0x7ff6d8e8ee45
mov rax, qword [0x7ff6d8ef1850]
test rax, rax
je 0x7ff6d8e8ee36
mov r8d, 0x504
lea rdx, str.D:_buildagent_cd_8811p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6d8ec9610]
mov eax, 0xf000100a
jmp 0x7ff6d8e8ef21
call fcn.7ff6d8ea4cd0
mov eax, 0xf000100a
jmp 0x7ff6d8e8ef21
mov qword [rsp + 0xb8], rsi
mov dword [rbx + 8], 1
mov qword [rbx + 0x30], 1
call fcn.7ff6d8e8d830
mov r8, rax
mov dword [rsp + 0x40], 6
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x__llx_n
mov rsi, rax
call fcn.7ff6d8e8d530
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x30]
mov r8, rbp
mov r9d, r15d
mov edx, 0x28
call fcn.7ff6d8e8dba0
mov r8d, dword [rbx + 0xc]
mov edi, eax
test eax, eax
jne 0x7ff6d8e8eea5
mov edi, r8d
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x_ret__x_n
call fcn.7ff6d8e8d530
mov rax, qword [0x7ff6d8ef1850]
mov rcx, qword [rbx + 0x20]
test rax, rax
je 0x7ff6d8e8eed9
mov r8d, 0x517
lea rdx, str.D:_buildagent_cd_8811p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6d8ec9610]
jmp 0x7ff6d8e8eede
call fcn.7ff6d8ea4cd0
mov qword [rbx + 0x20], 0
mov rdx, rsi
mov rcx, rbx
test edi, edi
jne 0x7ff6d8e8ef04
mov qword [r14], rsi
call fcn.7ff6d8e8d630
mov rsi, qword [rsp + 0xb8]
mov eax, edi
jmp 0x7ff6d8e8ef21
call fcn.7ff6d8e8d730
mov rsi, qword [rsp + 0xb8]
mov eax, edi
mov qword [r14], 0
jmp 0x7ff6d8e8ef21
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff6d8e98b50
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x7ff6d8e94280
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r12d, r12d
lea r13, [0x7ff6d8ef18a0]
mov qword [rsp + 0x30], r12
lea rbp, [rcx + rcx*4]
shl rbp, 4
mov rdi, r13
add rdi, rbp
mov r15d, edx
mov r14, rcx
mov qword [r13 + rbp + 8], r12
mov qword [r13 + rbp + 0x30], r12
mov dword [r13 + rbp + 0x38], r12d
mov rsi, qword [rdi + 0x20]
mov rbx, qword [rsi + 8]
cmp byte [rbx + 0x19], r12b
jne 0x7ff6d8e9430a
mov r8, qword [rbx + 0x10]
lea rdx, [rdi + 0x20]
lea rcx, [rdi + 0x20]
call fcn.7ff6d8e8f5a0
mov rcx, rbx
mov edx, 0x30
mov rbx, qword [rbx]
call fcn.7ff6d8e98b74
cmp byte [rbx + 0x19], r12b
je 0x7ff6d8e942e3
mov qword [rsi + 8], rsi
lea rdx, [rsp + 0x30]
mov qword [rsi], rsi
xorps xmm0, xmm0
mov qword [rsi + 0x10], rsi
mov ecx, r15d
mov rax, qword [0x7ff6d8ef3ac8]
mov qword [rdi + 0x28], r12
movups xmmword [r13 + rbp + 0x3c], xmm0
call qword [0x7ff6d8ec9610]
test eax, eax
je 0x7ff6d8e94342
mov ebx, 0xd
jmp 0x7ff6d8e94377
mov rax, qword [rsp + 0x30]
lea r8, [0x7ff6d8e941c0]
mov qword [rsp + 0x28], r12
mov r9, r14
xor edx, edx
mov qword [r13 + rbp + 8], rax
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [r13 + rbp + 0x30], rax
test rax, rax
jne 0x7ff6d8e9439c
lea ebx, [rax + 0xb]
mov rax, qword [r13 + rbp + 8]
test rax, rax
je 0x7ff6d8e94398
mov rax, qword [0x7ff6d8ef3ad0]
mov rcx, qword [r13 + rbp + 8]
call qword [0x7ff6d8ec9610]
mov qword [r13 + rbp + 8], r12
mov eax, ebx
jmp 0x7ff6d8e9439f
mov eax, r12d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret