joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff649562c00
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
cmp dword [rcx + 0x30], 0
mov rsi, rdx
mov rdi, rcx
je 0x7ff649562c32
mov eax, 0xa
jmp 0x7ff649562c6d
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x220], rbx
xor ebx, ebx
test rcx, rcx
je 0x7ff649562c5a
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetMailslotInfo]
cmp dword [rsp + 0x30], ebx
ja 0x7ff649562c8e
mov eax, 9
mov rbx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.7ff649578b50
mov rsi, qword [rsp + 0x228]
add rsp, 0x200
pop rdi
ret
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 0x1a8
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x7ff649562cb8
mov eax, 4
jmp 0x7ff649562c65
mov eax, dword [rsp + 0x34]
cmp rax, 0x1aa
jae 0x7ff649562ce3
lea rdx, [rsp + 0x40]
mov byte [rsp + rax + 0x40], bl
mov rcx, rsi
call fcn.7ff649562cf0
test eax, eax
mov ecx, 0xb
cmove ebx, ecx
mov eax, ebx
jmp 0x7ff649562c65
call fcn.7ff649579214
int3
Function at 0x7ff649568560
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x7ff6495685a7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x7ff649568639
mov edx, eax
lea rcx, str.OpenSCManager_failed___d__n
call fcn.7ff64955f150
lea eax, [rbx + 1]
jmp 0x7ff649568687
mov r8d, 0x10000
lea rdx, str.jhi_service
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x7ff64956860f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x7ff649568639
cmp eax, 0x424
jne 0x7ff6495685f4
lea rcx, str.Error:_the_service_does_not_exist._n
call fcn.7ff64955f150
lea eax, [rdi + 4]
jmp 0x7ff649568687
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.7ff64955f150
mov eax, 1
jmp 0x7ff649568687
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_DeleteService]
test eax, eax
jne 0x7ff649568667
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x7ff64956864c
lea rcx, str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.7ff64955f150
mov eax, 2
jmp 0x7ff649568687
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.7ff64955f150
mov eax, 1
jmp 0x7ff649568687
lea rcx, str.JHI_Service_removed_successfully_n
call fcn.7ff64955f150
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff64956a2d0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, rdx
test rdx, rdx
jne 0x7ff64956a2fb
lea eax, [rdx - 2]
jmp 0x7ff64956a40a
mov qword [rsp + 0x1e0], rbx
sub ecx, 1
je 0x7ff64956a37b
cmp ecx, 1
je 0x7ff64956a317
mov eax, 0xfffffffe
jmp 0x7ff64956a402
lea rax, [0x7ff64956a7a0]
xor ebx, ebx
mov qword [rdx], rax
lea rax, [0x7ff64956a880]
mov qword [rdx + 8], rax
lea rax, [0x7ff64956ab80]
mov qword [rdx + 0x10], rax
lea rax, [0x7ff64956acf0]
mov qword [rdx + 0x18], rax
lea ecx, [rbx + 0x28]
lea rax, [0x7ff64956ae90]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 0x20], rax
call fcn.7ff64958c5b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov qword [0x7ff6495d1a48], rbx
xor eax, eax
mov dword [rdi + 0x28], 1
jmp 0x7ff64956a402
lea rax, [0x7ff64956a430]
xor ebx, ebx
mov qword [rdx], rax
lea rcx, [rsp + 0x20]
lea rax, [0x7ff64956a470]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 8], rax
mov r8d, 0x198
lea rax, [0x7ff64956a5f0]
mov qword [rdx + 0x10], rax
lea rax, [0x7ff64956a670]
mov qword [rdx + 0x18], rax
lea rax, [0x7ff64956a720]
mov qword [rdx + 0x20], rax
xor edx, edx
call fcn.7ff64957d8e0
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x7ff64956a3e5
mov dword [rdi + 0x28], 1
jmp 0x7ff64956a400
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov dword [rdi + 0x28], ebx
mov ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.7ff649578b50
add rsp, 0x1d0
pop rdi
ret
Function at 0x7ff64956b2f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0xa0]
xor eax, eax
mov dword [rsp + 0x30], eax
mov ebp, r9d
mov rsi, r8
mov r12, rdx
mov r15d, ecx
cmp rdx, 0xffffffffffffffff
je 0x7ff64956b491
test r8, r8
je 0x7ff64956b491
test r9d, r9d
je 0x7ff64956b491
test r14, r14
je 0x7ff64956b491
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r13d, 8
mov r8d, 0x20
mov rcx, rax
mov edx, r13d
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x7ff64956b3b2
lea eax, [rdi + 1]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff649578b50
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
mov ebx, 1
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x7ff64956b466
test r15d, r15d
jne 0x7ff64956b3fd
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x7ff64956b41f
mov qword [r14], rdi
xor eax, eax
jmp 0x7ff64956b386
cmp r15d, ebx
jne 0x7ff64956b41f
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x7ff64956b3f6
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x7ff64956b3f6
sub eax, 6
je 0x7ff64956b461
sub eax, 0x19
je 0x7ff64956b45a
sub eax, 0x5b
je 0x7ff64956b453
sub eax, 0x415
je 0x7ff64956b44c
cmp eax, ebx
jne 0x7ff64956b466
movzx ebx, r13w
jmp 0x7ff64956b466
mov ebx, 3
jmp 0x7ff64956b466
mov ebx, 0xb
jmp 0x7ff64956b466
mov ebx, 5
jmp 0x7ff64956b466
mov ebx, 4
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x7ff64956b475
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_HeapFree]
movzx eax, bx
jmp 0x7ff64956b386
mov eax, 4
jmp 0x7ff64956b398
Function at 0x7ff64956ba80
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x7ff6495d1a88]
mov rbx, rcx
test rax, rax
jne 0x7ff64956baa9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6495d1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [0x7ff6495d1a6c], 0
je 0x7ff64956bb22
mov rcx, qword [0x7ff6495d1a70]
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
mov ecx, 0xf0001001
mov dword [0x7ff6495d1a68], 0
call fcn.7ff64956ddc0
mov ecx, dword [0x7ff6495d2a90]
mov rax, qword [0x7ff6495d2aa8]
call qword [0x7ff6495a9610]
mov rcx, qword [0x7ff6495d1a78]
test rcx, rcx
je 0x7ff64956bb12
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6495d1a78]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x7ff6495d1a6c], 0
mov rcx, qword [0x7ff6495d1a88]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [0x7ff6495d1830]
lea rdx, [rbx + 0x40]
lea rcx, [0x7ff6495d1820]
call qword [0x7ff6495a9610]
test eax, eax
je 0x7ff64956bb59
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.7ff6495431b0
mov rax, qword [0x7ff6495d1820]
lea rcx, [0x7ff6495d1820]
call qword [0x7ff6495a9610]
test eax, eax
jne 0x7ff64956bb79
cmp dword [0x7ff6495d1848], eax
je 0x7ff64956bb87
mov edx, eax
lea rcx, str.transport_interface_Teardown_error__result__0x_X
call fcn.7ff6495431b0
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.7ff64956d1b0
Function at 0x7ff64956bba0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov ebp, r9d
mov rax, qword [0x7ff6495d1a88]
mov rsi, r8
mov rdi, rdx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x7ff64956bc03
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6495d1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6495d1a88]
xor ebx, ebx
cmp dword [0x7ff6495d1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff64956bc38
mov ebx, 0xf0001000
jmp 0x7ff64956bd4a
test rdi, rdi
je 0x7ff64956bd45
test rsi, rsi
je 0x7ff64956bd45
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.7ff64956d990
test eax, eax
je 0x7ff64956bd45
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 4
lea rcx, str.Beihai_Download__x_n
call fcn.7ff64956d530
mov rcx, qword [0x7ff6495cec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x7ff6495cec48], rcx
mov rcx, qword [0x7ff6495d2aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.7ff64956f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.7ff64956d530
mov rcx, qword [0x7ff6495d2aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, rsi
mov edx, 0x28
call fcn.7ff64956dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Download__x_ret__x_n
mov ebx, eax
cmove ebx, r8d
call fcn.7ff64956d530
mov rax, qword [0x7ff6495d1850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x7ff64956bd3e
mov r8d, 0x4b1
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6495a9610]
jmp 0x7ff64956bd4a
call fcn.7ff649584cd0
jmp 0x7ff64956bd4a
mov ebx, 0xf0001005
mov edx, ebx
call fcn.7ff64956d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff64956bd80
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rax, qword [0x7ff6495d1a88]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x7ff64956bddb
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6495d1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6495d1a88]
xor ebx, ebx
cmp dword [0x7ff6495d1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff64956be10
mov ebx, 0xf0001000
jmp 0x7ff64956beed
test rdi, rdi
jne 0x7ff64956be1f
mov ebx, 0xf0001005
jmp 0x7ff64956beed
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.7ff64956d990
test eax, eax
je 0x7ff64956be15
mov rax, qword [0x7ff6495cec48]
mov edx, 0xffffffff
mov rcx, qword [0x7ff6495d2aa0]
mov qword [rsp + 0x68], rax
inc rax
mov qword [0x7ff6495cec48], rax
mov dword [rsp + 0x80], 3
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.7ff64956f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.7ff64956d530
mov rcx, qword [0x7ff6495d2aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x28]
call fcn.7ff64956dba0
mov rcx, qword [rsp + 0x50]
test eax, eax
mov ebx, eax
mov rax, qword [0x7ff6495d1850]
cmove ebx, dword [rsp + 0x3c]
test rax, rax
je 0x7ff64956bee8
mov r8d, 0x48f
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6495a9610]
jmp 0x7ff64956beed
call fcn.7ff649584cd0
mov edx, ebx
call fcn.7ff64956d1b0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
Function at 0x7ff64956c8c0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x7ff6495d1a88]
mov rsi, qword [rdx]
test rax, rax
jne 0x7ff64956c907
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6495d1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6495d1a88]
xor ebx, ebx
cmp dword [0x7ff6495d1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff64956c939
mov edi, 0xf0001000
jmp 0x7ff64956c97a
test rsi, rsi
jne 0x7ff64956c945
mov edi, 0xf0001005
jmp 0x7ff64956c97a
mov rcx, rsi
call fcn.7ff64956d550
mov rbx, rax
test rax, rax
je 0x7ff64956c975
mov rcx, qword [rax + 0x28]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [rbx + 0x34], 0
je 0x7ff64956c9a6
mov rdx, rsi
mov rcx, rbx
call fcn.7ff64956d630
mov edi, 0xf000100c
mov edx, edi
call fcn.7ff64956d1b0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff649578b50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x40], 7
lea rcx, str.Beihai_CloseSession__x_n
mov rax, qword [rbx + 0x18]
mov rdx, rbx
mov qword [rsp + 0x48], rax
call fcn.7ff64956d530
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rcx, [rsp + 0x30]
lea edx, [r9 + 0x20]
call fcn.7ff64956dba0
mov r8d, dword [rbx + 0xc]
mov edi, eax
test eax, eax
jne 0x7ff64956c9ec
mov edi, r8d
mov rdx, rbx
lea rcx, str.Beihai_CloseSession__x_ret__x_n
call fcn.7ff64956d530
mov rdx, rsi
mov rcx, rbx
call fcn.7ff64956d730
jmp 0x7ff64956c97a
Function at 0x7ff64956eaa0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rax, qword [0x7ff6495d1a88]
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x7ff64956eb05
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6495d1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6495d1a88]
xor ebx, ebx
cmp dword [0x7ff6495d1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff64956eb3a
mov eax, 0xf0001000
jmp 0x7ff64956ecda
test rsi, rsi
je 0x7ff64956ecd5
test rbp, rbp
je 0x7ff64956ecd5
test r14d, r14d
je 0x7ff64956ecd5
test rdi, rdi
je 0x7ff64956ecd5
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.7ff64956d990
test eax, eax
je 0x7ff64956ecd5
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x80], 5
lea rcx, str.Beihai_Query__x_n
call fcn.7ff64956d530
mov rcx, qword [0x7ff6495cec48]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rcx
inc rcx
mov qword [0x7ff6495cec48], rcx
mov rcx, qword [0x7ff6495d2aa0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rsp + 0x68]
call fcn.7ff64956f1d0
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, str.rrmap_add__llx__x_n
mov rdx, qword [rsp + 0x68]
call fcn.7ff64956d530
mov rcx, qword [0x7ff6495d2aa0]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, rbp
mov edx, 0x28
call fcn.7ff64956dba0
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x30]
test eax, eax
lea rcx, str.Beihai_Query__x_ret__x_n
mov esi, eax
cmove esi, r8d
call fcn.7ff64956d530
test esi, esi
jne 0x7ff64956eca4
movsxd rbx, dword [rsp + 0x40]
test ebx, ebx
je 0x7ff64956ec96
cmp qword [rsp + 0x50], 0
je 0x7ff64956ec92
mov rax, qword [0x7ff6495d1858]
lea ecx, [rbx + 1]
test rax, rax
je 0x7ff64956ec65
mov r8d, 0x4d5
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6495a9610]
jmp 0x7ff64956ec6a
call fcn.7ff64958c5b0
mov qword [rdi], rax
test rax, rax
je 0x7ff64956ec8b
mov rdx, qword [rsp + 0x50]
mov r8, rbx
mov rcx, rax
call fcn.7ff64957db70
mov rax, qword [rdi]
mov byte [rbx + rax], 0
jmp 0x7ff64956eca4
mov esi, 0xf0001004
jmp 0x7ff64956eca4
test ebx, ebx
jne 0x7ff64956ec9f
mov qword [rdi], 0
jmp 0x7ff64956eca4
mov esi, 0xf0001006
mov rax, qword [0x7ff6495d1850]
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x7ff64956eccc
mov r8d, 0x4e3
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6495a9610]
mov eax, esi
jmp 0x7ff64956ecda
call fcn.7ff649584cd0
mov eax, esi
jmp 0x7ff64956ecda
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7ff649578b50
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff64956ed00
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x7ff6495d1a88]
mov r15d, r9d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rax, rax
jne 0x7ff64956ed4d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [0x7ff6495d1a88], rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x7ff6495d1a88]
xor ebx, ebx
cmp dword [0x7ff6495d1a6c], 1
sete bl
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test ebx, ebx
jne 0x7ff64956ed82
mov eax, 0xf0001000
jmp 0x7ff64956ef21
test rdi, rdi
je 0x7ff64956ef1c
test r14, r14
je 0x7ff64956ef1c
test rbp, rbp
jne 0x7ff64956eda2
test r15d, r15d
jne 0x7ff64956ef1c
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.7ff64956d990
test eax, eax
je 0x7ff64956ef1c
mov rax, qword [0x7ff6495d1858]
mov ecx, 0x38
test rax, rax
je 0x7ff64956eddd
mov r8d, 0x4fd
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6495a9610]
jmp 0x7ff64956ede2
call fcn.7ff64958c5b0
mov rbx, rax
test rax, rax
jne 0x7ff64956edf4
mov eax, 0xf0001004
jmp 0x7ff64956ef21
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [rbx + 0x28], rax
mov rcx, rbx
test rax, rax
jne 0x7ff64956ee45
mov rax, qword [0x7ff6495d1850]
test rax, rax
je 0x7ff64956ee36
mov r8d, 0x504
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6495a9610]
mov eax, 0xf000100a
jmp 0x7ff64956ef21
call fcn.7ff649584cd0
mov eax, 0xf000100a
jmp 0x7ff64956ef21
mov qword [rsp + 0xb8], rsi
mov dword [rbx + 8], 1
mov qword [rbx + 0x30], 1
call fcn.7ff64956d830
mov r8, rax
mov dword [rsp + 0x40], 6
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x__llx_n
mov rsi, rax
call fcn.7ff64956d530
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x30]
mov r8, rbp
mov r9d, r15d
mov edx, 0x28
call fcn.7ff64956dba0
mov r8d, dword [rbx + 0xc]
mov edi, eax
test eax, eax
jne 0x7ff64956eea5
mov edi, r8d
mov rdx, rbx
lea rcx, str.Beihai_CreateSession__x_ret__x_n
call fcn.7ff64956d530
mov rax, qword [0x7ff6495d1850]
mov rcx, qword [rbx + 0x20]
test rax, rax
je 0x7ff64956eed9
mov r8d, 0x517
lea rdx, str.D:_buildagent_cd_8811workspace11934_thirdparty_bhplugin1Beihai_toolsjhi_libBeihaiPlugin.cpp
call qword [0x7ff6495a9610]
jmp 0x7ff64956eede
call fcn.7ff649584cd0
mov qword [rbx + 0x20], 0
mov rdx, rsi
mov rcx, rbx
test edi, edi
jne 0x7ff64956ef04
mov qword [r14], rsi
call fcn.7ff64956d630
mov rsi, qword [rsp + 0xb8]
mov eax, edi
jmp 0x7ff64956ef21
call fcn.7ff64956d730
mov rsi, qword [rsp + 0xb8]
mov eax, edi
mov qword [r14], 0
jmp 0x7ff64956ef21
mov eax, 0xf0001005
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff649578b50
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x7ff649574280
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r12d, r12d
lea r13, [0x7ff6495d18a0]
mov qword [rsp + 0x30], r12
lea rbp, [rcx + rcx*4]
shl rbp, 4
mov rdi, r13
add rdi, rbp
mov r15d, edx
mov r14, rcx
mov qword [r13 + rbp + 8], r12
mov qword [r13 + rbp + 0x30], r12
mov dword [r13 + rbp + 0x38], r12d
mov rsi, qword [rdi + 0x20]
mov rbx, qword [rsi + 8]
cmp byte [rbx + 0x19], r12b
jne 0x7ff64957430a
mov r8, qword [rbx + 0x10]
lea rdx, [rdi + 0x20]
lea rcx, [rdi + 0x20]
call fcn.7ff64956f5a0
mov rcx, rbx
mov edx, 0x30
mov rbx, qword [rbx]
call fcn.7ff649578b74
cmp byte [rbx + 0x19], r12b
je 0x7ff6495742e3
mov qword [rsi + 8], rsi
lea rdx, [rsp + 0x30]
mov qword [rsi], rsi
xorps xmm0, xmm0
mov qword [rsi + 0x10], rsi
mov ecx, r15d
mov rax, qword [0x7ff6495d3ac8]
mov qword [rdi + 0x28], r12
movups xmmword [r13 + rbp + 0x3c], xmm0
call qword [0x7ff6495a9610]
test eax, eax
je 0x7ff649574342
mov ebx, 0xd
jmp 0x7ff649574377
mov rax, qword [rsp + 0x30]
lea r8, [0x7ff6495741c0]
mov qword [rsp + 0x28], r12
mov r9, r14
xor edx, edx
mov qword [r13 + rbp + 8], rax
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [r13 + rbp + 0x30], rax
test rax, rax
jne 0x7ff64957439c
lea ebx, [rax + 0xb]
mov rax, qword [r13 + rbp + 8]
test rax, rax
je 0x7ff649574398
mov rax, qword [0x7ff6495d3ad0]
mov rcx, qword [r13 + rbp + 8]
call qword [0x7ff6495a9610]
mov qword [r13 + rbp + 8], r12
mov eax, ebx
jmp 0x7ff64957439f
mov eax, r12d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret