joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ba80
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140091a88]
mov rbx, rcx
test rax, rax
jne 0x14002baa9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [0x140091a6c], 0
je 0x14002bb22
mov rcx, qword [0x140091a70]
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
mov ecx, 0xf0001001
mov dword [0x140091a68], 0
call fcn.14002ddc0
mov ecx, dword [0x140092a90]
mov rax, qword [0x140092aa8]
call qword [0x140069610]
mov rcx, qword [0x140091a78]
test rcx, rcx
je 0x14002bb12
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a78]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x140091a6c], 0
mov rcx, qword [0x140091a88]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [0x140091830]
lea rdx, [rbx + 0x40]
lea rcx, [0x140091820]
call qword [0x140069610]
test eax, eax
je 0x14002bb59
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.1400031b0
mov rax, qword [0x140091820]
lea rcx, [0x140091820]
call qword [0x140069610]
test eax, eax
jne 0x14002bb79
cmp dword [0x140091848], eax
je 0x14002bb87
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.1400031b0
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.14002d1b0
Function at 0x14002bba0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov ebp, r9d
mov rax, qword [0x140091a88]
mov rsi, r8
mov rdi, rdx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x14002bc03
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002bc38
mov ebx, 0xf0001000
jmp 0x14002bd4a
test rdi, rdi
je 0x14002bd45
test rsi, rsi
je 0x14002bd45
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.14002d990
test eax, eax
je 0x14002bd45
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 4
lea rcx, str.Beihai_Download__x_n
call fcn.14002d530
mov rcx, qword [0x14008ec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x14008ec48], rcx
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.14002f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.14002d530
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, rsi
mov edx, 0x28
call fcn.14002dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Download__x_ret__x_n
mov ebx, eax
cmove ebx, r8d
call fcn.14002d530
mov rax, qword [0x140091850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x14002bd3e
mov r8d, 0x4b1
lea rdx, str.D:_buildagent_cd_8816p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002bd4a
call fcn.140044cd0
jmp 0x14002bd4a
mov ebx, 0xf0001005
mov edx, ebx
call fcn.14002d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140038b50
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002bd80
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rax, qword [0x140091a88]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x14002bddb
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002be10
mov ebx, 0xf0001000
jmp 0x14002beed
test rdi, rdi
jne 0x14002be1f
mov ebx, 0xf0001005
jmp 0x14002beed
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.14002d990
test eax, eax
je 0x14002be15
mov rax, qword [0x14008ec48]
mov edx, 0xffffffff
mov rcx, qword [0x140092aa0]
mov qword [rsp + 0x68], rax
inc rax
mov qword [0x14008ec48], rax
mov dword [rsp + 0x80], 3
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.14002f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.14002d530
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x28]
call fcn.14002dba0
mov rcx, qword [rsp + 0x50]
test eax, eax
mov ebx, eax
mov rax, qword [0x140091850]
cmove ebx, dword [rsp + 0x3c]
test rax, rax
je 0x14002bee8
mov r8d, 0x48f
lea rdx, str.D:_buildagent_cd_8816p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002beed
call fcn.140044cd0
mov edx, ebx
call fcn.14002d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140038b50
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
Function at 0x14002c8c0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140091a88]
mov rsi, qword [rdx]
test rax, rax
jne 0x14002c907
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002c939
mov edi, 0xf0001000
jmp 0x14002c97a
test rsi, rsi
jne 0x14002c945
mov edi, 0xf0001005
jmp 0x14002c97a
mov rcx, rsi
call fcn.14002d550
mov rbx, rax
test rax, rax
je 0x14002c975
mov rcx, qword [rax + 0x28]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [rbx + 0x34], 0
je 0x14002c9a6
mov rdx, rsi
mov rcx, rbx
call fcn.14002d630
mov edi, 0xf000100c
mov edx, edi
call fcn.14002d1b0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140038b50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x40], 7
lea rcx, str.Beihai_CloseSession__x_n
mov rax, qword [rbx + 0x18]
mov rdx, rbx
mov qword [rsp + 0x48], rax
call fcn.14002d530
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rcx, [rsp + 0x30]
lea edx, [r9 + 0x20]
call fcn.14002dba0
mov r8d, dword [rbx + 0xc]
mov edi, eax
test eax, eax
jne 0x14002c9ec
mov edi, r8d
mov rdx, rbx
lea rcx, str.Beihai_CloseSession__x_ret__x_n
call fcn.14002d530
mov rdx, rsi
mov rcx, rbx
call fcn.14002d730
jmp 0x14002c97a
Function at 0x14002eaa0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rax, qword [0x140091a88]
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x14002eb05
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002eb3a
mov eax, 0xf0001000
jmp 0x14002ecda
test rsi, rsi
je 0x14002ecd5
test rbp, rbp
je 0x14002ecd5
test r14d, r14d
je 0x14002ecd5
test rdi, rdi
je 0x14002ecd5
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.14002d990
test eax, eax
je 0x14002ecd5
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 5
lea rcx, str.Beihai_Query__x_n
call fcn.14002d530
mov rcx, qword [0x14008ec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x14008ec48], rcx
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.14002f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.14002d530
mov rcx, qword [0x140092aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, rbp
mov edx, 0x28
call fcn.14002dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Query__x_ret__x_n
mov esi, eax
cmove esi, r8d
call fcn.14002d530
test esi, esi
jne 0x14002eca4
movsxd rbx, dword [rsp + 0x40]
test ebx, ebx
je 0x14002ec96
cmp qword [rsp + 0x50], 0
je 0x14002ec92
mov rax, qword [0x140091858]
lea ecx, [rbx + 1]
test rax, rax
je 0x14002ec65
mov r8d, 0x4d5
lea rdx, str.D:_buildagent_cd_8816p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002ec6a
call fcn.14004c5b0
mov qword [rdi], rax
test rax, rax
je 0x14002ec8b
mov rdx, qword [rsp + 0x50]
mov r8, rbx
mov rcx, rax
call fcn.14003db70
mov rax, qword [rdi]
mov byte [rbx + rax], 0
jmp 0x14002eca4
mov esi, 0xf0001004
jmp 0x14002eca4
test ebx, ebx
jne 0x14002ec9f
mov qword [rdi], 0
jmp 0x14002eca4
mov esi, 0xf0001006
mov rax, qword [0x140091850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x14002eccc
mov r8d, 0x4e3
lea rdx, str.D:_buildagent_cd_8816p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
mov eax, esi
jmp 0x14002ecda
call fcn.140044cd0
mov eax, esi
jmp 0x14002ecda
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140038b50
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002ed00
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140091a88]
mov r15d, r9d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rax, rax
jne 0x14002ed4d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x140091a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140091a88]
xor ebx, ebx
cmp dword [0x140091a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x14002ed82
mov eax, 0xf0001000
jmp 0x14002ef21
test rdi, rdi
je 0x14002ef1c
test r14, r14
je 0x14002ef1c
test rbp, rbp
jne 0x14002eda2
test r15d, r15d
jne 0x14002ef1c
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14002d990
test eax, eax
je 0x14002ef1c
mov rax, qword [0x140091858]
mov ecx, 0x38
test rax, rax
je 0x14002eddd
mov r8d, 0x4fd
lea rdx, str.D:_buildagent_cd_8816p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002ede2
call fcn.14004c5b0
mov rbx, rax
test rax, rax
jne 0x14002edf4
mov eax, 0xf0001004
jmp 0x14002ef21
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [rbx + 0x28], rax
mov rcx, rbx
test rax, rax
jne 0x14002ee45
mov rax, qword [0x140091850]
test rax, rax
je 0x14002ee36
mov r8d, 0x504
lea rdx, str.D:_buildagent_cd_8816p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
mov eax, 0xf000100a
jmp 0x14002ef21
call fcn.140044cd0
mov eax, 0xf000100a
jmp 0x14002ef21
mov qword [rsp + 0xb8], rsi
mov dword [rbx + 8], 1
mov qword [rbx + 0x30], 1
call fcn.14002d830
mov r8, rax
mov dword [rsp + 0x40], 6
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x__llx_n
mov rsi, rax
call fcn.14002d530
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x30]
mov r8, rbp
mov r9d, r15d
mov edx, 0x28
call fcn.14002dba0
mov r8d, dword [rbx + 0xc]
mov edi, eax
test eax, eax
jne 0x14002eea5
mov edi, r8d
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x_ret__x_n
call fcn.14002d530
mov rax, qword [0x140091850]
mov rcx, qword [rbx + 0x20]
test rax, rax
je 0x14002eed9
mov r8d, 0x517
lea rdx, str.D:_buildagent_cd_8816p4218434198_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x140069610]
jmp 0x14002eede
call fcn.140044cd0
mov qword [rbx + 0x20], 0
mov rdx, rsi
mov rcx, rbx
test edi, edi
jne 0x14002ef04
mov qword [r14], rsi
call fcn.14002d630
mov rsi, qword [rsp + 0xb8]
mov eax, edi
jmp 0x14002ef21
call fcn.14002d730
mov rsi, qword [rsp + 0xb8]
mov eax, edi
mov qword [r14], 0
jmp 0x14002ef21
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140038b50
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x140034280
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r12d, r12d
lea r13, [0x1400918a0]
mov qword [rsp + 0x30], r12
lea rbp, [rcx + rcx*4]
shl rbp, 4
mov rdi, r13
add rdi, rbp
mov r15d, edx
mov r14, rcx
mov qword [r13 + rbp + 8], r12
mov qword [r13 + rbp + 0x30], r12
mov dword [r13 + rbp + 0x38], r12d
mov rsi, qword [rdi + 0x20]
mov rbx, qword [rsi + 8]
cmp byte [rbx + 0x19], r12b
jne 0x14003430a
mov r8, qword [rbx + 0x10]
lea rdx, [rdi + 0x20]
lea rcx, [rdi + 0x20]
call fcn.14002f5a0
mov rcx, rbx
mov edx, 0x30
mov rbx, qword [rbx]
call fcn.140038b74
cmp byte [rbx + 0x19], r12b
je 0x1400342e3
mov qword [rsi + 8], rsi
lea rdx, [rsp + 0x30]
mov qword [rsi], rsi
xorps xmm0, xmm0
mov qword [rsi + 0x10], rsi
mov ecx, r15d
mov rax, qword [0x140093ac8]
mov qword [rdi + 0x28], r12
movups xmmword [r13 + rbp + 0x3c], xmm0
call qword [0x140069610]
test eax, eax
je 0x140034342
mov ebx, reloc.WS2_32.dll_listen
jmp 0x140034377
mov rax, qword [rsp + 0x30]
lea r8, [0x1400341c0]
mov qword [rsp + 0x28], r12
mov r9, r14
xor edx, edx
mov qword [r13 + rbp + 8], rax
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [r13 + rbp + 0x30], rax
test rax, rax
jne 0x14003439c
lea ebx, [rax + 0xb]
mov rax, qword [r13 + rbp + 8]
test rax, rax
je 0x140034398
mov rax, qword [0x140093ad0]
mov rcx, qword [r13 + rbp + 8]
call qword [0x140069610]
mov qword [r13 + rbp + 8], r12
mov eax, ebx
jmp 0x14003439f
mov eax, r12d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140038b50
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400344c0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov esi, 1
lea rbx, [0x140091910]
mov ebp, esi
lea r12, [0x1400918a0]
xor r15d, r15d
nop word [rax + rax]
mov qword [rbx + 0x10], r15
movsxd rax, ebp
lea rcx, [rax + rax*4]
add rcx, rcx
mov dword [r12 + rcx*8 + 0x38], r15d
mov qword [r12 + rcx*8 + 8], r15
mov r14, qword [rbx]
mov rdi, qword [r14 + 8]
cmp byte [rdi + 0x19], r15b
jne 0x140034555
nop word [rax + rax]
mov r8, qword [rdi + 0x10]
mov rdx, rbx
mov rcx, rbx
call fcn.14002f5a0
mov rcx, rdi
mov edx, 0x30
mov rdi, qword [rdi]
call fcn.140038b74
cmp byte [rdi + 0x19], r15b
je 0x140034530
mov qword [r14 + 8], r14
xor r8d, r8d
mov qword [r14], r14
xor edx, edx
mov qword [r14 + 0x10], r14
xor ecx, ecx
mov qword [rbx + 8], r15
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov qword [rbx - 0x20], rax
test rax, rax
je 0x1400345e0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov qword [rbx - 0x10], rax
test rax, rax
je 0x1400345e0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov qword [rbx - 8], rax
test rax, rax
je 0x1400345e0
inc ebp
add rbx, 0x50
cmp ebp, 5
jl 0x140034500
lea rbx, [0x1400800e4]
nop dword [rax]
mov edx, dword [rbx]
movsxd rcx, esi
call fcn.140034280
mov edi, eax
test eax, eax
jne 0x1400345e5
inc esi
add rbx, 4
cmp esi, 4
jl 0x1400345c0
jmp 0x14003466f
mov edi, listen
lea rbx, [0x140091920]
mov esi, 3
mov rax, qword [rbx - 0x28]
test rax, rax
je 0x14003462a
mov rax, qword [0x140093ad0]
mov rcx, qword [rbx - 0x28]
call qword [0x140069610]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140034621
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rbx], r15
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14003463d
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rbx - 0x18], r15
mov rcx, qword [rbx - 0x20]
test rcx, rcx
je 0x140034650
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rbx - 0x20], r15
mov rcx, qword [rbx - 0x30]
test rcx, rcx
je 0x140034663
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rbx - 0x30], r15
add rbx, 0x50
sub rsi, 1
jne 0x1400345f1
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400367a0
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xd0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov r14, rdx
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [r11 - 0x38], eax
mov eax, dword [0x140092a94]
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
cmp eax, 1
je 0x1400367fd
mov eax, 1
jmp 0x140036892
test rcx, rcx
je 0x1400369c4
test r14, r14
je 0x1400369c4
lea rdx, [rsp + 0x58]
call fcn.140037e20
test eax, eax
je 0x1400369c4
mov ecx, 0x38
mov qword [rsp + 0xf0], rbx
call fcn.14004c5b0
mov rbx, rax
test rax, rax
jne 0x140036840
lea eax, [rbx + 5]
jmp 0x14003688a
mov qword [rsp + 0xf8], rbp
xor r8d, r8d
xor ebp, ebp
xor edx, edx
mov qword [rax], rbp
xor ecx, ecx
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rbp
mov qword [rax + 0x28], rbp
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x1400368ac
mov rcx, rbx
call fcn.140044cd0
lea eax, [rbp + 0xb]
mov rbp, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140038b50
add rsp, 0xd0
pop r14
ret
mov qword [rsp + 0xc8], rsi
mov rdx, rbx
mov ecx, 2
mov qword [rsp + 0xc0], rdi
mov dword [rbx + 0x28], 1
mov dword [rbx + 0x20], 1
call fcn.1400337d0
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x50], listen
mov rsi, rax
mov dword [rsp + 0x20], ebp
lea r8d, [r9 + 0x28]
lea ecx, [r9 + 2]
call fcn.140033cb0
mov edi, eax
test eax, eax
jne 0x140036909
mov edi, dword [rbx + 8]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003691b
call fcn.140044cd0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x30], rsi
mov edx, 0xffffffff
test edi, edi
jne 0x140036946
mov qword [r14], rsi
mov rcx, qword [0x140091958]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
add dword [rbx + 0x28], 0xffffffff
jne 0x1400369a0
cmp dword [rbx + 0x24], ebp
je 0x1400369a0
jmp 0x140036959
mov rcx, qword [0x140091958]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
add dword [rbx + 0x28], 0xffffffff
jne 0x140036999
lea rdx, [rsp + 0x30]
lea rcx, [0x140091960]
call fcn.140034e60
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14003697d
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rbx + 0x30], rbp
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003698f
call fcn.140044cd0
mov qword [rbx + 0x10], rbp
mov rcx, rbx
call fcn.140044cd0
jmp 0x1400369a0
mov dword [rbx + 0x24], 1
mov rcx, qword [0x140091958]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rsi, qword [rsp + 0xc8]
mov eax, edi
mov rdi, qword [rsp + 0xc0]
jmp 0x140036882
mov eax, 6
jmp 0x140036892
Function at 0x140038230
Capabilities:
Print debug messages

Disassembly:
test ecx, ecx
jg 0x1400382d2
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov qword [r11 - 0x18], rsi
mov rbx, rdx
lea rsi, [r11 + 0x18]
mov edi, ecx
call fcn.140001f80
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, qword [rax]
call fcn.140043ad4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov rsi, qword [rsp + 0x440]
test edi, edi
jne 0x1400382b9
lea rcx, [rsp + 0x30]
call fcn.14001f150
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140038b50
add rsp, 0x448
pop rdi
pop rbx
ret

Function at 0x140038238
Capabilities:
Print debug messages

Disassembly:
test ecx, ecx
jg 0x1400382d2
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov qword [r11 - 0x18], rsi
mov rbx, rdx
lea rsi, [r11 + 0x18]
mov edi, ecx
call fcn.140001f80
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, qword [rax]
call fcn.140043ad4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov rsi, qword [rsp + 0x440]
test edi, edi
jne 0x1400382b9
lea rcx, [rsp + 0x30]
call fcn.14001f150
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140038b50
add rsp, 0x448
pop rdi
pop rbx
ret

Function at 0x140045e64
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x140045e84
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.140049824
or eax, 0xffffffff
jmp 0x140045e86
xor eax, eax
add rsp, 0x28
ret