Function at 0x1400e4ce0
Capabilities:
Check if file exists
Generate random numbers via winapi
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
sub rsp, 0x78
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax - 0x18], r13
xor r13d, r13d
or rbp, 0xffffffffffffffff
mov qword [rax + 8], r13
mov edi, r13d
mov qword [rax - 0x48], r13
mov qword [rax - 0x40], r13
mov qword [rax - 0x38], r13
test rcx, rcx
jne 0x1400e4d92
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov esi, eax
test eax, eax
jne 0x1400e4d34
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400eb5a0
jmp 0x1400e500a
lea rcx, [rsi + rsi]
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400e4d57
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], recvfrom
jmp 0x1400e500a
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov qword [rsp + 0x48], r13
mov r8, rbp
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], di
jne 0x1400e4d70
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1400e8bf0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1400e4dd4
mov r8, rbp
inc r8
cmp byte [rcx + r8], dil
jne 0x1400e4d95
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.1400e8850
test eax, eax
js 0x1400e500a
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp word [rcx + rax*2 - 2], 0x2f
je 0x1400e4dd4
lea rcx, [rsp + 0x40]
mov edx, gethostbyaddr
call fcn.1400e86d0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400e4e44
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x1400e4e01
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400eb5a0
jmp 0x1400e500a
mov rcx, qword [rsp + 0x40]
call fcn.1400ebe50
mov rdi, rax
test rax, rax
jne 0x1400e4e24
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], socket
jmp 0x1400e500a
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400e4e44
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400eb5a0
jmp 0x1400e500a
test al, 0x10
jne 0x1400e4e59
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], reloc.WS2_32.dll_sendto
jmp 0x1400e500a
mov rdx, qword [str.libarchive_]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0xa8], r12
call fcn.1400e8750
mov rdx, qword [str.XXXXXXXXXX]
lea rcx, [rsp + 0x40]
call fcn.1400e8750
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
lea r12, [rcx + rax*2]
mov rcx, qword [str.XXXXXXXXXX]
mov rax, rbp
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1400e4ea0
add rax, rax
lea rcx, [rsp + 0x90]
mov rsi, r12
mov r9d, 1
xor r8d, r8d
xor edx, edx
sub rsi, rax
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400e4eea
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400eb5a0
jmp 0x1400e5002
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
mov r14, r12
sub r14, rsi
mov r15, r14
sar r15, 1
mov rcx, qword [rsp + 0x90]
lea edx, [r15 + r15]
mov r8, rsi
mov rbx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400e4feb
lea r8, [r14 + 1]
mov r9, r13
shr r8, 1
cmp rsi, r12
cmova r8, r13
test r8, r8
je 0x1400e4f8b
movabs r13, 0x842108421084211
lea rbp, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop word [rax + rax]
movzx ecx, word [rbx]
mov rax, r13
inc r9
lea rbx, [rbx + 2]
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, word [rbp + rcx*2]
mov word [rbx - 2], ax
cmp r9, r8
jb 0x1400e4f50
or rbp, 0xffffffffffffffff
xor r13d, r13d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
call fcn.1400ebe50
mov rdi, rax
test rax, rax
je 0x1400e5070
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0010000
mov rcx, rax
mov dword [rsp + 0x28], 0x4000100
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400e5050
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x50
je 0x1400e4f00
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400eb5a0
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400e5034
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x40]
call fcn.1400e8bc0
mov eax, ebp
add rsp, 0x78
pop rdi
pop rbp
ret
mov edx, 0x8002
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400e4ff8
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400e4ff8
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], socket
jmp 0x1400e4ff8