Function at 0x4b5d30
Capabilities:
Get common file path
Get file attributes
Get thread local storage value
Resolve function by parsing pe exports

Disassembly:
push r15
mov eax, 0x23c8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
movzx r9d, word [rdx + 0x60]
mov rbx, qword [rax]
mov qword [rsp + 0x23b8], rbx
xor ebx, ebx
mov rax, qword [0x005aabe0]
mov rbp, rcx
mov rsi, rdx
mov dword [r8], 0
lea rbx, [rsp + 0xa0]
mov rdi, r8
mov r8d, 0x1000
mov r12d, dword [rax]
lea rax, [rdx + 0x63]
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x70], rax
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4b6320
mov r9d, r12d
mov r8d, 0x102
mov rcx, rbx
call fcn.004af110
test eax, eax
js 0x4b6310
je 0x4b61c0
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 7
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov edx, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x4b6290
movzx r9d, word [rsi + 0x60]
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, rbp
call fcn.004b5cd0
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov r12, rax
mov eax, 0x4000
mov rcx, r13
mov word [r12 + 0x10], ax
lea rax, [r12 + 0x20]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x50]
mov byte [r12 + 0x62], 1
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0x10000
mov qword [rsp + 0x78], rax
call rax
mov edx, eax
test eax, eax
js 0x4b6200
mov r15, qword [rsp + 0x68]
lea rbx, [rsp + 0x20a0]
movabs rdi, 0xfe624e212ac18000
movabs rsi, 0xd6bf94d5e57a42bd
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8, [r15 + 0x44]
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x30c
mov r9d, dword [r15 + 0x3c]
shr r9d, 1
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x4b6378
movsxd r9, eax
mov rcx, rbp
mov r8, rbx
mov rdx, r12
call fcn.004b5cd0
mov ecx, dword [r15 + 0x38]
mov r14, rax
test ch, 4
jne 0x4b60f0
mov dword [rax + 0x14], 0
mov edx, dword [r15 + 0x40]
mov r8, rbx
call fcn.004b3740
mov word [r14 + 0x10], ax
and ax, 0xf000
cmp ax, 0x8000
je 0x4b60e0
cmp ax, 0x4000
je 0x4b6270
mov byte [r14 + 0x62], 3
mov edx, 0x1000
cmp ax, 0xa000
jne 0x4b60e5
mov qword [r14 + 0x28], rdx
mov ecx, dword [r15 + 0x14]
mov eax, dword [r15 + 0x10]
shl rcx, 0x20
add rcx, rax
add rcx, rdi
mov rax, rcx
imul rsi
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
mov qword [r14 + 0x30], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [r14 + 0x38], ecx
mov ecx, dword [r15 + 0x1c]
mov eax, dword [r15 + 0x18]
shl rcx, 0x20
add rcx, rax
add rcx, rdi
mov rax, rcx
imul rsi
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
mov qword [r14 + 0x40], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [r14 + 0x48], ecx
mov ecx, dword [r15 + 0xc]
mov eax, dword [r15 + 8]
shl rcx, 0x20
add rcx, rax
add rcx, rdi
mov rax, rcx
imul rsi
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x50], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [r14 + 0x58], ecx
mov qword [rax], r14
mov eax, dword [r15]
test eax, eax
jne 0x4b61a8
xor edx, edx
mov dword [rsp + 0x50], 0
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x40], 0
mov rcx, r13
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
mov dword [rsp + 0x30], 0x10000
call rax
mov edx, eax
test eax, eax
jns 0x4b6280
cmp eax, 0x80000006
jne 0x4b6228
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rdi, qword [rsp + 0x23b8]
xor rdi, qword [rax]
jne 0x4b63a4
mov rax, r12
add rsp, 0x23c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [r14 + 0x62], 2
mov rdx, qword [r15 + 0x28]
jmp 0x4b5f6a
mov edx, dword [r15 + 0x40]
mov dword [rax + 0x14], edx
cmp edx, 0xa000000c
jne 0x4b5f31
movzx r8d, word [r12 + 0x60]
movzx eax, word [rax + 0x60]
lea eax, [r8 + rax + 1]
cmp eax, 0x30a
jg 0x4b5f31
call fcn.004b33e0
test eax, eax
je 0x4b6197
movzx r8d, word [r12 + 0x60]
lea rdx, [r12 + 0x63]
mov rcx, rbx
mov dword [rsp + 0x88], r8d
call sub.msvcrt.dll_memcpy
mov r9d, dword [rsp + 0x88]
lea rdx, [r14 + 0x63]
movzx eax, r9w
mov r9, rax
mov byte [rsp + rax + 0x20a0], 0x2f
movzx r8d, word [r14 + 0x60]
add r9, 1
lea rcx, [rbx + r9]
mov qword [rsp + 0x88], r9
call sub.msvcrt.dll_memcpy
mov r9, qword [rsp + 0x88]
movzx eax, word [r14 + 0x60]
lea rdx, [rsp + 0x23c0]
add r9, rdx
mov byte [rax + r9 - 0x320], 0
mov edx, dword [r15 + 0x40]
mov ecx, dword [r15 + 0x38]
jmp 0x4b5f31
add r15, rax
lea rax, [r14 + 0x20]
mov qword [rsp + 0x60], rax
jmp 0x4b5ec6
mov rdx, rbx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [rax - 1]
cmp edx, 0xffe
jbe 0x4b5dc7
mov ebx, 0x26
test eax, eax
je 0x4b6390
call qword [sym.imp.msvcrt.dll__errno]
xor r12d, r12d
mov dword [rax], ebx
jmp 0x4b60ab
cmp eax, 0xc000000d
jne 0x4b6228
mov dword [rsp + 0x60], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [rsp + 0x60]
test al, 0x10
mov eax, 0x10b
cmove edx, eax
nop word [rax + rax]
movabs rax, 0x1ffffffff
movabs rcx, 0x100000000
and rax, qword [0x00576658]
cmp rax, rcx
jne 0x4b6340
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r12 + 0x18]
test rax, rax
cmove rax, r12
lock sub dword [rax + 0x28], 1
xor r12d, r12d
jmp 0x4b60ab
mov byte [r14 + 0x62], 1
mov rdx, qword [r15 + 0x28]
jmp 0x4b5f6a
mov r15, qword [rsp + 0x68]
jmp 0x4b61ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x14
mov dword [rdi], 1
mov ecx, eax
cmp eax, 0x10b
je 0x4b62b1
call fcn.004abd60
mov ebx, eax
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
movabs rdx, 0x100000000
mov dword [rax], ebx
movabs rax, 0x1ffffffff
and rax, qword [0x00576658]
cmp rax, rdx
je 0x4b6310
call rsi
mov rdi, qword [rsp + 0x70]
lea r9, str.fscache:_error__d___s_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x115
lea rcx, str.compat_win32_fscache.c
mov qword [rsp + 0x28], rdi
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
call fcn.0047ff50
nop dword [rax]
xor r12d, r12d
jmp 0x4b60ab
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x4b6310
call rbx
xor r12d, r12d
mov dword [rax], 0x26
jmp 0x4b60ab
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x20], edx
lea r9, str.fscache:_status__ld__unable_to_query_directory_contents__s_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x14d
lea rcx, str.compat_win32_fscache.c
mov qword [rsp + 0x28], rax
call fcn.0047ff50
jmp 0x4b624c
call qword [sym.imp.msvcrt.dll__errno]
mov r9, 0xffffffffffffffff
mov dword [rax], 0x22
jmp 0x4b5f08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004abd60
mov ebx, eax
jmp 0x4b61ea
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor r8d, r8d
add dword [rcx + 0x48], 1
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
lea r14, [rcx + 8]
mov r13, rcx
mov r15, rdx
mov rcx, r14
call fcn.00426c10
mov r12, rax
test rax, rax
je 0x4b6438
cmp word [rax + 0x10], 0
jne 0x4b6420
xor r12d, r12d
mov rax, qword [rsp + 0x28]
xor rax, qword [rbx]
jne 0x4b653d
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rax + 0x18]
test rax, rax
cmove rax, r12
lock add dword [rax + 0x28], 1
jmp 0x4b63fa
mov rdx, qword [r15 + 0x18]
test rdx, rdx
je 0x4b6470
xor r8d, r8d
mov rcx, r14
call fcn.00426c10
test rax, rax
je 0x4b6460
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
jmp 0x4b63fa
mov rdx, qword [r15 + 0x18]
test rdx, rdx
jne 0x4b6473
nop dword [rax]
mov rdx, r15
lea r8, [rsp + 0x24]
mov rcx, r13
call fcn.004b5d30
mov rsi, rax
test rax, rax
je 0x4b64f9
mov r12, qword [rax + 0x18]
add dword [r13 + 0x4c], 1
test r12, r12
cmove r12, rax
nop dword [rax + rax]
mov rdx, r12
mov rcx, r14
call fcn.00426ce0
mov r12, qword [r12 + 0x20]
test r12, r12
jne 0x4b64a0
cmp qword [r15 + 0x18], 0
je 0x4b64d6
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call fcn.00426c10
mov rsi, rax
test rax, rax
je 0x4b6451
cmp word [rsi + 0x10], 0
je 0x4b6451
mov rax, qword [rsi + 0x18]
test rax, rax
cmove rax, rsi
lock add dword [rax + 0x28], 1
mov r12, rsi
jmp 0x4b63fa
mov edx, dword [rsp + 0x24]
test edx, edx
je 0x4b63f7
mov rax, qword [r15 + 0x18]
test rax, rax
je 0x4b63f7
mov rdx, qword [rax + 0x18]
movzx r9d, word [rax + 0x60]
mov rcx, r13
lea r8, [rax + 0x63]
call fcn.004b5cd0
mov rcx, r14
mov rdx, rax
xor eax, eax
mov word [rdx + 0x10], ax
call fcn.00426ce0
jmp 0x4b63f7
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop
push r15
mov eax, 0x2100
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x20f8], rax
xor eax, eax
mov r12, rcx
mov r13, rdx
mov ecx, dword [0x005f2a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
test rax, rax
je 0x4b659c
mov eax, dword [rax]
test eax, eax
jg 0x4b65d0
mov rdx, r13
mov rcx, r12
call fcn.004b3810
mov rsi, qword [rsp + 0x20f8]
xor rsi, qword [rbx]
jne 0x4b673b
add rsp, 0x2100
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call fcn.004b5b80
test eax, eax
je 0x4b659c
add dword [r14 + 0x40], 1
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rcx, rax
mov r8d, eax
test eax, eax
je 0x4b6650
movsxd rdi, eax
movsx edx, byte [r12 + rdi - 1]
cmp edx, 0x2f
je 0x4b6708
mov rax, rdi
cmp edx, 0x5c
jne 0x4b662f
jmp 0x4b6708
cmp edx, 0x5c
je 0x4b663b
sub rax, 1
test eax, eax
je 0x4b6726
movsx edx, byte [r12 + rax - 1]
movsxd rcx, eax
lea r9d, [rax - 1]
cmp edx, 0x2f
jne 0x4b6618
sub r8d, ecx
movsxd r9, r9d
lea rsi, [r12 + rcx]
movsxd rdi, r8d
jmp 0x4b6658
mov rsi, r12
xor edi, edi
xor r9d, r9d
lea r15, [rsp + 0x20]
mov r8, r12
xor edx, edx
mov rcx, r15
lea r12, [rsp + 0x1088]
call fcn.004b5c40
mov rdx, r15
mov rcx, r12
mov r9, rdi
mov r8, rsi
call fcn.004b5c40
mov rdx, r12
mov rcx, r14
call 0x4b63b0
test rax, rax
je 0x4b6731
xor edx, edx
xor ecx, ecx
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [rax + 0x40]
mov word [r13 + 4], dx
movdqu xmm2, xmmword [rax + 0x50]
mov dword [r13 + 8], 1
movzx edx, word [rax + 0x10]
mov dword [r13], 0
mov word [r13 + 6], dx
mov rdx, qword [rax + 0x28]
mov dword [r13 + 0x10], 0
mov qword [r13 + 0x18], rdx
mov rdx, qword [rax + 0x18]
mov word [r13 + 0xc], cx
test rdx, rdx
movups xmmword [r13 + 0x20], xmm0
cmove rdx, rax
movups xmmword [r13 + 0x30], xmm1
movups xmmword [r13 + 0x40], xmm2
lock sub dword [rdx + 0x28], 1
xor eax, eax
jmp 0x4b65a7
mov r8d, ecx
sub r8d, 1
je 0x4b6650
movsxd rax, r8d
movsx edx, byte [r12 + rax - 1]
mov rdi, rax
jmp 0x4b662f
mov rsi, r12
xor r9d, r9d
jmp 0x4b6658
mov eax, 0xffffffff
jmp 0x4b65a7
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]
push r15
mov eax, 0x2100
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x20f8], rax
xor eax, eax
mov r13, rcx
mov ecx, dword [0x005f2a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x4b6799
mov eax, dword [rax]
test eax, eax
jg 0x4b67c8
mov rcx, r13
call fcn.004af7a0
mov rdi, qword [rsp + 0x20f8]
xor rdi, qword [rbx]
jne 0x4b68d1
add rsp, 0x2100
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [r13 + 0x10]
call fcn.004b5b80
test eax, eax
je 0x4b6799
mov rdx, qword [r13 + 8]
add dword [r12 + 0x40], 1
mov r8, qword [r13 + 0x10]
mov r10d, edx
test edx, edx
je 0x4b6850
movsxd rsi, edx
movsx eax, byte [r8 + rsi - 1]
cmp eax, 0x2f
je 0x4b68b0
mov rcx, rsi
cmp eax, 0x5c
je 0x4b68b0
lea rdx, [r8 + rcx - 2]
mov ecx, r10d
jmp 0x4b6830
cmp eax, 0x5c
je 0x4b6839
test r9d, r9d
je 0x4b68ca
movsx eax, byte [rdx]
mov ecx, r9d
sub rdx, 1
lea r9d, [rcx - 1]
cmp eax, 0x2f
jne 0x4b6818
sub r10d, ecx
movsxd rdi, ecx
movsxd r9, r9d
movsxd rsi, r10d
jmp 0x4b6857
xor edi, edi
xor esi, esi
xor r9d, r9d
lea r15, [rsp + 0x20]
xor edx, edx
lea r14, [rsp + 0x1088]
mov rcx, r15
call fcn.004b5c40
add rdi, qword [r13 + 0x10]
mov rdx, r15
mov rcx, r14
mov r9, rsi
mov r8, rdi
call fcn.004b5c40
mov rdx, r14
mov rcx, r12
call 0x4b63b0
test rax, rax
je 0x4b6799
cmp dword [rax + 0x14], 0xa0000003
sete al
movzx eax, al
jmp 0x4b67a1
mov r10d, edx
sub r10d, 1
je 0x4b6850
movsxd rcx, r10d
movsx eax, byte [r8 + rcx - 1]
mov rsi, rcx
jmp 0x4b6808
xor edi, edi
xor r9d, r9d
jmp 0x4b6857
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]
push r14
mov eax, 0x1098
push r13
push r12
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x1088], rax
xor eax, eax
mov r13, rcx
mov ecx, dword [0x005f2a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x4b6925
mov eax, dword [rax]
test eax, eax
jg 0x4b6950
mov rcx, r13
call fcn.004b5960
mov rdx, qword [rsp + 0x1088]
xor rdx, qword [rbx]
jne 0x4b69f7
add rsp, 0x1098
pop rbx
pop r12
pop r13
pop r14
ret
mov rcx, r13
call fcn.004b5b80
test eax, eax
je 0x4b6925
add dword [r12 + 0x44], 1
mov rcx, r13
call sub.msvcrt.dll_strlen
cmp eax, 1
je 0x4b69c8
xor r9d, r9d
test eax, eax
jne 0x4b69cf
lea r14, [rsp + 0x20]
mov r8, r13
xor edx, edx
mov rcx, r14
call fcn.004b5c40
mov rcx, r12
mov rdx, r14
call 0x4b63b0
mov r12, rax
test rax, rax
je 0x4b69f0
mov ecx, 0x20
call fcn.004996e0
lea rdx, [0x004b5b30]
mov qword [rax], rdx
lea rdx, [0x004b5b50]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], r12
jmp 0x4b692d
cmp byte [r13], 0x2e
je 0x4b69e2
movsxd r9, eax
movsx edx, byte [r13 + r9 - 1]
cmp edx, 0x2f
je 0x4b69e2
cmp edx, 0x5c
jne 0x4b6976
sub eax, 1
movsxd r9, eax
jmp 0x4b6976
xor eax, eax
jmp 0x4b692d
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]