joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bfd50
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov r15d, 0xffffffff
xor edi, edi
xor ebp, ebp
cmp r8, 0x201
jae 0x4bfde0
jmp 0x4bfdbf
jae 0x4bfe84
cmp r8, 0x201
jae 0x4bfde0
lea r13, [rsp + 0x98]
mov r14d, 0x200
mov r12, r8
jmp 0x4bfe26
sub r8, rbp
sub rdi, rbp
cmp rdi, r8
jae 0x4bfe07
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.004eb4a0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rbx, r15
mov ebp, 0xffffffff
cmovb rbp, rbx
mov qword [rsp + 0x48], rbp
mov rdi, rbx
mov r13, qword [rsp + 0x28]
mov r14, rbp
mov r12, rbp
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_GetWindowsDirectoryW
mov esi, eax
test eax, eax
jne 0x4bfe4b
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4bff6b
mov r8d, esi
cmp r12, r8
jne 0x4bfdb0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4bff8f
add r12, r12
cmp r12, r15
cmovae r12, r15
mov r8, r12
cmp r8, 0x201
jb 0x4bfdbf
jmp 0x4bfde0
cmp r14, r8
jb 0x4bffa9
mov rax, qword [rsp + 0x70]
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rsp + 0x78]
mov rdx, r13
call fcn.004981b0
movups xmm0, xmmword [rsp + 0x78]
movups xmm1, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
lea rcx, [rsp + 0x50]
call fcn.0048ed70
cmp byte [rsi], 0
jne 0x4bfeea
lea rdx, [0x00645f68]
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.0048f8e0
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x78]
call fcn.004d80d0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
mov rsi, qword [rsp + 0x30]
je 0x4bff1d
mov rcx, qword [rsp + 0x58]
mov r8d, 1
call fcn.00422030
mov rax, qword [rsp + 0x88]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test rbx, rbx
je 0x4bff54
add rbx, rbx
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
call fcn.00422030
mov rax, rsi
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rbx, rbx
jne 0x4bff3e
jmp 0x4bff54
lea rcx, str.internal_error:_entered_unreachable_codedata_provided_contains_a_nul_byte
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.00532500
jmp 0x4bffbe
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.0053de60
ud2
Function at 0x4bfff0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov r14d, 0xffffffff
xor edi, edi
xor ebp, ebp
cmp r8, 0x201
jae 0x4c0080
jmp 0x4c006f
jae 0x4c0135
cmp r8, 0x201
jae 0x4c0080
lea r13, [rsp + 0x78]
mov esi, 0x200
mov r12, r8
jmp 0x4c00c6
sub r8, rbp
sub rdi, rbp
cmp rdi, r8
jae 0x4c00a7
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.004eb4a0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rbx, r14
mov ebp, 0xffffffff
cmovb rbp, rbx
mov qword [rsp + 0x48], rbp
mov rdi, rbx
mov r13, qword [rsp + 0x28]
mov rsi, rbp
mov r12, rbp
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rsp + 0x50]
mov rdx, r13
mov r8d, r12d
call sub.kernel32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x4c00f1
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4c0193
mov r8d, r15d
cmp r12, r8
jne 0x4c0060
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4c01b3
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov r14d, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x4c006f
jmp 0x4c0080
cmp rsi, r8
jb 0x4c01cd
lea rcx, [rsp + 0x58]
mov rdx, r13
call fcn.004981b0
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x4c017c
add rbx, rbx
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
call fcn.00422030
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rbx, rbx
jne 0x4c0166
jmp 0x4c017c
lea rcx, str.internal_error:_entered_unreachable_codedata_provided_contains_a_nul_byte
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.00532500
jmp 0x4c01e2
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.0053de60
ud2
Function at 0x4c0200
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov esi, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor edi, edi
xor r15d, r15d
cmp rsi, 0x201
jae 0x4c0280
jmp 0x4c026f
jae 0x4c032f
cmp rsi, 0x201
jae 0x4c0280
lea r13, [rsp + 0x48]
mov ebp, 0x200
mov r12, rsi
jmp 0x4c02cf
sub rsi, r15
sub rdi, r15
cmp rdi, rsi
jae 0x4c02aa
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, rsi
call fcn.004eb4a0
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rsp + 0x40], r15
mov rdi, rbx
mov r13, qword [rsp + 0x20]
mov rbp, r15
mov r12, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_GetSystemDirectoryW
mov r14d, eax
test eax, eax
jne 0x4c02f1
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4c035c
mov esi, r14d
cmp r12, rsi
jne 0x4c0260
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4c03d9
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov rsi, r12
cmp rsi, 0x201
jb 0x4c026f
jmp 0x4c0280
cmp rbp, rsi
jb 0x4c03f3
test r14d, r14d
je 0x4c0380
lea r14, [rsi + rsi]
mov edx, 2
mov rcx, r14
call fcn.00422020
test rax, rax
je 0x4c0407
mov r15, rax
jmp 0x4c0389
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rdi, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], 0
test rbx, rbx
jne 0x4c03ac
jmp 0x4c03c2
mov r15d, 2
xor r14d, r14d
mov rcx, r15
mov rdx, r13
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x28]
mov qword [rdi], rsi
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], rsi
test rbx, rbx
je 0x4c03c2
add rbx, rbx
mov r8d, 2
mov rcx, qword [rsp + 0x20]
mov rdx, rbx
call fcn.00422030
mov rax, rdi
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.internal_error:_entered_unreachable_codedata_provided_contains_a_nul_byte
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.00532500
jmp 0x4c0414
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, rsi
mov rdx, rbp
call fcn.0053de60
jmp 0x4c0414
mov edx, 2
mov rcx, r14
call fcn.0050fe70
ud2
Function at 0x4c0c00
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r14, qword [rdx]
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor r15d, r15d
mov r12d, 0xffffffff
xor edi, edi
xor esi, esi
cmp r8, 0x201
jae 0x4c0d23
jmp 0x4c0c83
jae 0x4c0d6e
cmp r8, 0x201
jae 0x4c0d23
lea rbp, [rsp + 0x68]
mov ebx, 0x200
mov r13, r8
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov dword [rsp + 0x48], r13d
mov rcx, r14
mov rdx, rbp
lea r8, [rsp + 0x48]
call sub.userenv.dll_GetUserProfileDirectoryW
test eax, eax
je 0x4c0cc0
mov ecx, dword [rsp + 0x48]
dec ecx
test ecx, ecx
jne 0x4c0cef
jmp 0x4c0ce0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4c0ce0
mov ecx, dword [rsp + 0x48]
test ecx, ecx
jne 0x4c0cef
nop word cs:[rax + rax]
call sub.kernel32.dll_GetLastError
xor ecx, ecx
test eax, eax
jne 0x4c0dcc
mov r8d, ecx
cmp r13, r8
jne 0x4c0c70
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4c0dec
add r13, r13
cmp r13, r12
cmovae r13, r12
mov r8, r13
cmp r8, 0x201
jb 0x4c0c83
sub r8, rsi
sub rdi, rsi
cmp rdi, r8
jae 0x4c0d4a
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.004eb4a0
mov r15, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp r15, r12
mov esi, 0xffffffff
cmovb rsi, r15
mov qword [rsp + 0x40], rsi
mov rdi, r15
mov rbp, qword [rsp + 0x20]
mov rbx, rsi
mov r13, rsi
jmp 0x4c0c90
cmp rbx, r8
jb 0x4c0e06
lea rcx, [rsp + 0x48]
mov rdx, rbp
call fcn.004981b0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rsi, qword [rsp + 0x28]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r15, r15
je 0x4c0db5
add r15, r15
mov r8d, 2
mov rcx, qword [rsp + 0x20]
mov rdx, r15
call fcn.00422030
mov rax, rsi
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x28]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r15, r15
jne 0x4c0d9f
jmp 0x4c0db5
lea rcx, str.internal_error:_entered_unreachable_codedata_provided_contains_a_nul_byte
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.00532500
jmp 0x4c0e1b
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.0053de60
ud2
Function at 0x4d80d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.004c90e0
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x4d8114
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4d8167
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x4d8188
mov rbx, qword [rsp + 0x20]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x4d815d
lea rdi, [rbx - 1]
mov rcx, qword [rbx - 1]
mov rax, qword [rbx + 7]
call qword [rax]
mov rax, qword [rbx + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x4d814a
mov r8, qword [rax + 0x10]
mov rcx, qword [rdi]
call fcn.00422030
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.00422030
mov qword [rsi + 8], 0
jmp 0x4d8188
mov qword [rsi + 8], 0
test rbx, rbx
je 0x4d8188
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.00422030
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x4dbdd0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov r14, r9
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.0050e5a0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x4dbe22
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x4dbebd
mov r8d, 1
jmp 0x4dbeb8
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
movzx ebp, word [r14]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4dbe8e
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x4dbeac
jmp 0x4dbebd
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x4dbebd
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.00422030
mov rax, rsi
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x4dd3d0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdx, qword [r8 + 8]
mov rsi, qword [r8 + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x4dd4a5
mov rdi, r8
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x30], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx]
lea rax, [0x004dd660]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x4dd47c
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4dd440
mov ecx, dword [rsp + 0x34]
test ecx, ecx
jne 0x4dd483
mov eax, dword [rsp + 0x38]
add rsi, rax
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
xor eax, eax
jmp 0x4dd49e
call sub.kernel32.dll_GetLastError
mov ecx, eax
mov rsi, rcx
shl rsi, 0x20
or rsi, 2
call fcn.004be5e0
mov ecx, eax
xor eax, eax
cmp cl, 0xb
cmovne rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret
lea r8, [0x00647ae0]
mov rcx, rsi
call fcn.0053ddd0
ud2

Function at 0x4ddbe0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x4ddceb
mov rsi, rcx
mov rbx, qword [rdi + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x4ddc17
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x4ddcb0
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x4ddcce
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x20]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x4ddc6d
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x4ddc89
jmp 0x4ddc7e
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x4ddc84
cmp eax, 0x6d
jne 0x4ddca0
mov byte [rsi + 1], 0
jmp 0x4ddc94
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x4ddc96
mov r8d, 0x10
mov rcx, rbx
call fcn.004eb240
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x4ddc24
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.004eb240
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x4ddc24
mov qword [rsp + 0x40], 0
lea rax, str.library_std_src_sys_windows_pipe.rs
mov qword [rsp + 0x20], rax
lea r8, [0x00647e08]
lea r9, [rsp + 0x30]
xor ecx, ecx
mov rdx, rdi
call fcn.004bbb70
ud2
Function at 0x4dde10
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov ecx, 0x10
mov edx, 8
call fcn.00422020
test rax, rax
je 0x4dded3
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x004ddf30]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x4ddec6
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x4dde9f
mov r8, qword [rax + 0x10]
mov rcx, qword [rsi]
call fcn.00422030
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call fcn.00422030
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x10
mov edx, 8
call fcn.0050fe70
ud2

Function at 0x4e11a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x4e11d0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4e11e5
cmp byte [rax + 8], 0
je 0x4e11e5
add rax, 9
jmp 0x4e126a
mov rcx, rdi
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4e11c1
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x4e1253
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4e1268
mov rbx, rax
test rax, rax
jne 0x4e1230
mov ecx, 0x10
mov edx, 8
call fcn.00422020
test rax, rax
je 0x4e127e
mov rbx, rax
mov qword [rax], rdi
mov byte [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x4e1272
dec ecx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
xor ecx, ecx
test rsi, rsi
je 0x4e1246
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rbx + 9]
mov byte [rbx + 8], 1
mov byte [rbx + 9], cl
jmp 0x4e126a
mov rcx, rdi
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4e11f9
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.004be160
mov ecx, eax
jmp 0x4e1228
mov ecx, 0x10
mov edx, 8
call fcn.0050fe70
ud2
Function at 0x4e1290
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x00545230]
jmp 0x4e1290
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x4e12c3
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4e12d8
mov rcx, rax
cmp qword [rax], 0
je 0x4e12d8
add rcx, 8
jmp 0x4e13b9
mov rcx, rbx
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4e12b1
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x4e139e
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4e13b7
mov rdi, rax
test rax, rax
jne 0x4e1337
mov ecx, 0x20
mov edx, 8
call fcn.00422020
test rax, rax
je 0x4e13d3
mov rdi, rax
mov qword [rax], 0
mov qword [rax + 0x18], rbx
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x4e13c4
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4e1354
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x4e1389
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x4e1384
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x4e1389
call fcn.004be0a0
mov qword [rdi], 1
lea rcx, [rdi + 8]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
jmp 0x4e13b9
mov rcx, rbx
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4e12f4
xor ecx, ecx
mov rax, rcx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.004be160
mov ecx, eax
jmp 0x4e132f
mov ecx, 0x20
mov edx, 8
call fcn.0050fe70
ud2
Function at 0x4e13f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x4e14ed
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4e1422
mov rdi, rax
cmp qword [rax], 0
jne 0x4e14e7
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x4e150b
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4e1524
mov rdi, rax
test rax, rax
jne 0x4e1495
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], rbx
mov ecx, 0x18
mov edx, 8
call fcn.00422020
test rax, rax
je 0x4e1540
mov rdi, rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x4e1531
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4e14af
mov rax, qword [rsi]
mov qword [rsi], 0
test rax, rax
je 0x4e14b1
mov rax, qword [rsi + 8]
jmp 0x4e14b1
xor eax, eax
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rdi], 1
mov qword [rdi + 8], rax
test rdx, rdx
je 0x4e14e7
test rcx, rcx
je 0x4e14e7
lock dec qword [rcx]
jne 0x4e14e7
lea rcx, [rsp + 0x30]
call fcn.004cb0f0
add rdi, 8
jmp 0x4e1526
mov rcx, rbx
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4e1415
jmp 0x4e1422
mov rcx, rbx
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4e143e
xor edi, edi
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.004be160
mov ecx, eax
jmp 0x4e148d
mov ecx, 0x18
mov edx, 8
call fcn.0050fe70
ud2

Function at 0x4e16f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x4e1720
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4e1735
cmp qword [rax], 0
je 0x4e1735
add rax, 8
jmp 0x4e17c8
mov rcx, rdi
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4e1711
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x4e17b1
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4e17c6
mov rbx, rax
test rax, rax
jne 0x4e1784
mov ecx, 0x18
mov edx, 8
call fcn.00422020
test rax, rax
je 0x4e17dc
mov rbx, rax
mov qword [rax], 0
mov qword [rax + 0x10], rdi
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x4e17d0
dec ecx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4e179e
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x4e17a0
mov rcx, qword [rsi + 8]
jmp 0x4e17a0
xor ecx, ecx
lea rax, [rbx + 8]
mov qword [rbx], 1
mov qword [rbx + 8], rcx
jmp 0x4e17c8
mov rcx, rdi
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4e1749
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.004be160
mov ecx, eax
jmp 0x4e177c
mov ecx, 0x18
mov edx, 8
call fcn.0050fe70
ud2