joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6730
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x58], 0x103
mov qword [rsp + 0x60], 0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x4d67a7
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x58]
cmp eax, 0x103
je 0x4d67dd
test eax, eax
js 0x4d67b8
mov rax, qword [rsp + 0x60]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x4d67d0
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xd8
pop rdi
pop rsi
ret
mov byte [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
lea rax, str.I_O_error:_operation_failed_to_complete_synchronously
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 1
mov qword [rsp + 0xa8], 0
lea rax, str.ntdll.dll
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x68], rax
lea rax, [0x0042b4d0]
mov qword [rsp + 0x70], rax
lea rax, str.fatal_runtime_error:__n
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x78]
call fcn.004d3200
mov rcx, rax
call fcn.004beb90
mov ecx, 7
int 0x29
ud2

Function at 0x4d68b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x4d68e6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.004d6110]
mov qword [rsp + 0x48], rax
lea rax, [0x00535320]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rdx, str.library_std_src_sys_windows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.0042fe10
ud2
Function at 0x4d6970
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x4d69ee
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x4d6a2f
cmp dword [rsp + 0x2c], 0
je 0x4d6a13
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4d6a57
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x00572138]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x00572138], rsi
jne 0x4d69d0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x4d6a25
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x4d6aad
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x4d6a18
mov edi, dword [rsp + 0x28]
jmp 0x4d6a25
mov edi, dword [rsi + 0x18]
jmp 0x4d6a23
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], 0
lea rdx, [0x00535370]
lea r9, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.004d51c0
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x30], 0
lea rax, str.ntdll.dll
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rdx, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.0042fe10
ud2
mov qword [rsp + 0x30], 0
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rax, str.ntdll.dll
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.004d5280
ud2
Function at 0x4d6e30
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r15d, 0xffffffff
xor esi, esi
xor ebp, ebp
cmp r8, 0x201
jae 0x4d6ed0
jmp 0x4d6eaf
jae 0x4d6f75
cmp r8, 0x201
jae 0x4d6ed0
lea r13, [rsp + 0xa8]
mov ebx, 0x200
mov r12, r8
jmp 0x4d6f16
sub r8, rbp
sub rsi, rbp
cmp rsi, r8
jae 0x4d6ef7
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.004b2340
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rdi, r15
mov ebp, 0xffffffff
cmovb rbp, rdi
mov qword [rsp + 0x48], rbp
mov rsi, rdi
mov r13, qword [rsp + 0x28]
mov rbx, rbp
mov r12, rbp
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_GetSystemDirectoryW
mov r14d, eax
test eax, eax
jne 0x4d6f3c
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4d7066
mov r8d, r14d
cmp r12, r8
jne 0x4d6ea0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4d708a
add r12, r12
cmp r12, r15
cmovae r12, r15
mov r8, r12
cmp r8, 0x201
jb 0x4d6eaf
jmp 0x4d6ed0
cmp rbx, r8
jb 0x4d70a4
lea rcx, [rsp + 0x88]
mov rdx, r13
call fcn.004bfe30
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x50]
call fcn.004bc6c0
mov rax, qword [rsp + 0x78]
cmp byte [rax], 0
jne 0x4d6fe2
lea rdx, str.exeNULcmd.exe__
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.004bd790
mov rbx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x88]
mov rdx, rbx
call fcn.004e2ee0
cmp qword [rsp + 0x50], 0
je 0x4d7015
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], 0
test rdi, rdi
je 0x4d7051
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, qword [rsp + 0x28]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov qword [rcx], 1
test rdi, rdi
jne 0x4d703e
jmp 0x4d7051
lea rcx, str.internal_error:_entered_unreachable_codeN
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042fe50
jmp 0x4d70b9
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.004312c0
ud2
Function at 0x4d7510
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
mov ebx, 0xffffffff
xor esi, esi
xor r14d, r14d
cmp r8, 0x201
jae 0x4d7590
jmp 0x4d757f
jae 0x4d7635
cmp r8, 0x201
jae 0x4d7590
lea r15, [rsp + 0x68]
mov r12d, 0x200
mov r13, r8
jmp 0x4d75d7
sub r8, r14
sub rsi, r14
cmp rsi, r8
jae 0x4d75b7
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.004b2340
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp rdi, rbx
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x40], r14
mov rsi, rdi
mov r15, qword [rsp + 0x20]
mov r12, r14
mov r13, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r13d
mov rdx, r15
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x4d75fc
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4d768e
mov r8d, ebp
cmp r13, r8
jne 0x4d7570
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4d76ae
add r13, r13
cmp r13, rbx
cmovae r13, rbx
mov r8, r13
cmp r8, 0x201
jb 0x4d757f
jmp 0x4d7590
cmp r12, r8
jb 0x4d76c8
lea rcx, [rsp + 0x48]
mov rdx, r15
call fcn.004bfe30
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x4d7679
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x4d7666
jmp 0x4d7679
lea rcx, str.internal_error:_entered_unreachable_codeN
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042fe50
jmp 0x4d76dd
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.004312c0
ud2
Function at 0x4d7700
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r15d, 0xffffffff
xor esi, esi
xor ebp, ebp
cmp r8, 0x201
jae 0x4d77a0
jmp 0x4d777f
jae 0x4d7845
cmp r8, 0x201
jae 0x4d77a0
lea r13, [rsp + 0xa8]
mov ebx, 0x200
mov r12, r8
jmp 0x4d77e6
sub r8, rbp
sub rsi, rbp
cmp rsi, r8
jae 0x4d77c7
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.004b2340
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rdi, r15
mov ebp, 0xffffffff
cmovb rbp, rdi
mov qword [rsp + 0x48], rbp
mov rsi, rdi
mov r13, qword [rsp + 0x28]
mov rbx, rbp
mov r12, rbp
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_GetWindowsDirectoryW
mov r14d, eax
test eax, eax
jne 0x4d780c
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4d7936
mov r8d, r14d
cmp r12, r8
jne 0x4d7770
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4d795a
add r12, r12
cmp r12, r15
cmovae r12, r15
mov r8, r12
cmp r8, 0x201
jb 0x4d777f
jmp 0x4d77a0
cmp rbx, r8
jb 0x4d7974
lea rcx, [rsp + 0x88]
mov rdx, r13
call fcn.004bfe30
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x50]
call fcn.004bc6c0
mov rax, qword [rsp + 0x78]
cmp byte [rax], 0
jne 0x4d78b2
lea rdx, str.exeNULcmd.exe__
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.004bd790
mov rbx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x88]
mov rdx, rbx
call fcn.004e2ee0
cmp qword [rsp + 0x50], 0
je 0x4d78e5
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], 0
test rdi, rdi
je 0x4d7921
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, qword [rsp + 0x28]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov qword [rcx], 1
test rdi, rdi
jne 0x4d790e
jmp 0x4d7921
lea rcx, str.internal_error:_entered_unreachable_codeN
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042fe50
jmp 0x4d7989
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.004312c0
ud2
Function at 0x4d79c0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r14d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r14, 0x201
jae 0x4d7a40
jmp 0x4d7a2f
jae 0x4d7af1
cmp r14, 0x201
jae 0x4d7a40
lea r15, [rsp + 0x48]
mov r13d, 0x200
mov rbp, r14
jmp 0x4d7a8f
sub r14, r12
sub rbx, r12
cmp rbx, r14
jae 0x4d7a6a
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r8, r14
call fcn.004b2340
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x40], r12
mov rbx, rdi
mov r15, qword [rsp + 0x20]
mov r13, r12
mov rbp, r12
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r15
mov edx, ebp
call sub.kernel32.dll_GetSystemDirectoryW
mov esi, eax
test eax, eax
jne 0x4d7ab3
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4d7b3e
mov r14d, esi
cmp rbp, r14
jne 0x4d7a20
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4d7bb5
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
cmovae rbp, rax
mov r14, rbp
cmp r14, 0x201
jb 0x4d7a2f
jmp 0x4d7a40
cmp r13, r14
jb 0x4d7bcf
test esi, esi
je 0x4d7b62
lea r12, [r14 + r14]
mov rcx, qword [0x00572170]
test rcx, rcx
jne 0x4d7b26
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4d7be3
mov rcx, rax
mov qword [0x00572170], rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4d7be3
mov rsi, rax
jmp 0x4d7b6a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], 0
test rdi, rdi
jne 0x4d7b8d
jmp 0x4d7ba0
mov esi, 2
xor r12d, r12d
mov rcx, rsi
mov rdx, r15
mov r8, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x28]
mov qword [rax], r14
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
test rdi, rdi
je 0x4d7ba0
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.internal_error:_entered_unreachable_codeN
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042fe50
jmp 0x4d7bf0
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r14
mov rdx, r13
call fcn.004312c0
jmp 0x4d7bf0
mov edx, 2
mov rcx, r12
call fcn.00404d20
ud2
Function at 0x4e2ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.004db780
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x4e2f24
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4e2f8b
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x4e2f81
mov rbx, qword [rsp + 0x20]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x4e2f79
lea rdi, [rbx - 1]
mov rcx, qword [rbx - 1]
mov rax, qword [rbx + 7]
call qword [rax]
mov rax, qword [rbx + 7]
cmp qword [rax + 8], 0
je 0x4e2f68
mov r8, qword [rdi]
cmp qword [rax + 0x10], 0x11
jb 0x4e2f5a
mov r8, qword [r8 - 8]
mov rcx, qword [0x00572170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov qword [rsi + 8], 0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsi + 8], 0
test rbx, rbx
je 0x4e2f81
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
Function at 0x4e4590
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x005721b8]
cmp rax, 3
jne 0x4c1c67
cmp rbx, 0x17f
ja 0x4c1c79
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x4c1bb9
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x4c1bcc
inc rdx
cmp rcx, rdx
jne 0x4c1ba0
mov rdx, r8
test rax, rax
jne 0x4c1bd6
jmp 0x4c1c30
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.00430df0
test rax, rax
jne 0x4c1bd6
jmp 0x4c1c30
mov eax, 1
test rax, rax
je 0x4c1c30
cmp rdx, rbx
jne 0x4c1c30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4c1c44
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x4c1c57
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x4c1c5a
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.004e6600
cmp rbx, 0x17f
jbe 0x4c1b78
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x4e4590
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.00404530
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x4e45ee
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x4e4665
mov rcx, qword [0x00572170]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4e4673
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x4e4665
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
jne 0x4e4654
jmp 0x4e4665
Function at 0x4e52f0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov rcx, qword [0x00572170]
test rcx, rcx
jne 0x4e5330
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4e53e1
mov rcx, rax
mov qword [0x00572170], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4e53e1
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x004e5440]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x4e53d4
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x4e53af
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x4e53a1
mov r8, qword [r8 - 8]
mov rcx, qword [0x00572170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x10
mov edx, 8
call fcn.00404d20
ud2

Function at 0x4e6450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov ecx, dword [0x004fe1b8]
test ecx, ecx
je 0x4e6483
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4e649c
mov rbx, rax
cmp qword [rax], 0
je 0x4e649c
add rbx, 8
jmp 0x4e65b1
lea rcx, [0x004fe1a0]
call fcn.004d6970
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4e6471
mov ecx, dword [0x004fe1b8]
test ecx, ecx
je 0x4e6592
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4e65af
mov rdi, rax
test rax, rax
jne 0x4e653e
mov qword [rsp + 0x20], 0
lea rax, [0x004fe1a0]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x00572170]
test rcx, rcx
jne 0x4e64fc
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4e65cf
mov rcx, rax
mov qword [0x00572170], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4e65cf
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x004fe1b8]
test ecx, ecx
je 0x4e65bc
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4e655f
mov rax, qword [rsi]
mov qword [rsi], 0
mov rdx, rax
test rax, rax
je 0x4e6563
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
jmp 0x4e6563
xor eax, eax
xor edx, edx
lea rbx, [rdi + 8]
cmp qword [rdi], 0
mov rcx, qword [rdi + 0x10]
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
je 0x4e65b1
test rcx, rcx
je 0x4e65b1
lock dec qword [rcx]
jne 0x4e65b1
call fcn.004dc450
jmp 0x4e65b1
lea rcx, [0x004fe1a0]
call fcn.004d6970
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4e64bb
xor ebx, ebx
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x004fe1a0]
call fcn.004d6970
mov ecx, eax
jmp 0x4e6536
mov ecx, 0x20
mov edx, 8
call fcn.00404d20
ud2