joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6180
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x00502170]
test ecx, ecx
je 0x4c61b2
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4c61cb
mov rcx, rax
cmp qword [rax], 0
je 0x4c61cb
add rcx, 8
jmp 0x4c62df
lea rcx, [0x00502158]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4c61a0
mov ecx, dword [0x00502170]
test ecx, ecx
je 0x4c62c0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4c62dd
mov rdi, rax
test rax, rax
jne 0x4c6259
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x4c6216
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4c62fc
mov rcx, rax
mov qword [0x00576170], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4c62fc
mov rdi, rax
mov qword [rax], 0
lea rax, [0x00502158]
mov qword [rdi + 0x18], rax
mov ecx, dword [0x00502170]
test ecx, ecx
je 0x4c62e9
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4c6276
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x4c62ab
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x4c62a6
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x4c62ab
call fcn.004dadb0
mov qword [rdi], 1
lea rcx, [rdi + 8]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
jmp 0x4c62df
lea rcx, [0x00502158]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4c61ea
xor ecx, ecx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x00502158]
call fcn.004dae70
mov ecx, eax
jmp 0x4c6251
mov ecx, 0x20
mov edx, 8
call fcn.004043b0
ud2

Function at 0x4c6ad0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.004db150
mov rsi, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x4c6b83
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.004d8e00
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x4c6b83
mov rcx, rdi
xor edx, edx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x4c6b57
test rsi, rsi
je 0x4c6b81
mov rcx, qword [0x00576170]
xor esi, esi
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
jmp 0x4c6b83
call sub.kernel32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x4c6b7c
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rsi, rbx
jmp 0x4c6b83
xor esi, esi
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x4dac30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x58], 0x103
mov qword [rsp + 0x60], 0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x4daca7
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x58]
cmp eax, 0x103
je 0x4dacdd
test eax, eax
js 0x4dacb8
mov rax, qword [rsp + 0x60]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x4dacd0
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xd8
pop rdi
pop rsi
ret
mov byte [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
lea rax, str.I_O_error:_operation_failed_to_complete_synchronously
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 1
mov qword [rsp + 0xa8], 0
lea rax, str.ntdll.dll
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x68], rax
lea rax, [0x0042a890]
mov qword [rsp + 0x70], rax
lea rax, str.fatal_runtime_error:
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x78]
call fcn.004d7700
mov rcx, rax
call fcn.004c3070
mov ecx, 7
int 0x29
ud2

Function at 0x4dadb0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x4dade6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.004da610]
mov qword [rsp + 0x48], rax
lea rax, [0x00539650]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rdx, str.library_std_src_sys_windows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.0042f1d0
ud2
Function at 0x4dae70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x4daeee
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x4daf2f
cmp dword [rsp + 0x2c], 0
je 0x4daf13
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4daf57
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x00576138]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x00576138], rsi
jne 0x4daed0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x4daf25
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x4dafad
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x4daf18
mov edi, dword [rsp + 0x28]
jmp 0x4daf25
mov edi, dword [rsi + 0x18]
jmp 0x4daf23
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], 0
lea rdx, [0x005396a0]
lea r9, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.004d96c0
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x30], 0
lea rax, str.ntdll.dll
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rdx, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.0042f1d0
ud2
mov qword [rsp + 0x30], 0
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rax, str.ntdll.dll
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.004d9780
ud2
Function at 0x4db330
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r15d, 0xffffffff
xor esi, esi
xor ebp, ebp
cmp r8, 0x201
jae 0x4db3d0
jmp 0x4db3af
jae 0x4db475
cmp r8, 0x201
jae 0x4db3d0
lea r13, [rsp + 0xa8]
mov ebx, 0x200
mov r12, r8
jmp 0x4db416
sub r8, rbp
sub rsi, rbp
cmp rsi, r8
jae 0x4db3f7
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.004b6820
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rdi, r15
mov ebp, 0xffffffff
cmovb rbp, rdi
mov qword [rsp + 0x48], rbp
mov rsi, rdi
mov r13, qword [rsp + 0x28]
mov rbx, rbp
mov r12, rbp
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_GetSystemDirectoryW
mov r14d, eax
test eax, eax
jne 0x4db43c
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4db566
mov r8d, r14d
cmp r12, r8
jne 0x4db3a0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4db58a
add r12, r12
cmp r12, r15
cmovae r12, r15
mov r8, r12
cmp r8, 0x201
jb 0x4db3af
jmp 0x4db3d0
cmp rbx, r8
jb 0x4db5a4
lea rcx, [rsp + 0x88]
mov rdx, r13
call fcn.004c4310
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x50]
call fcn.004c0ba0
mov rax, qword [rsp + 0x78]
cmp byte [rax], 0
jne 0x4db4e2
lea rdx, str.exeNULcmd.exe__
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.004c1c70
mov rbx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x88]
mov rdx, rbx
call fcn.004e73e0
cmp qword [rsp + 0x50], 0
je 0x4db515
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], 0
test rdi, rdi
je 0x4db551
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, qword [rsp + 0x28]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov qword [rcx], 1
test rdi, rdi
jne 0x4db53e
jmp 0x4db551
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042f210
jmp 0x4db5b9
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.00430740
ud2
Function at 0x4dba10
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
mov ebx, 0xffffffff
xor esi, esi
xor r14d, r14d
cmp r8, 0x201
jae 0x4dba90
jmp 0x4dba7f
jae 0x4dbb35
cmp r8, 0x201
jae 0x4dba90
lea r15, [rsp + 0x68]
mov r12d, 0x200
mov r13, r8
jmp 0x4dbad7
sub r8, r14
sub rsi, r14
cmp rsi, r8
jae 0x4dbab7
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.004b6820
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp rdi, rbx
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x40], r14
mov rsi, rdi
mov r15, qword [rsp + 0x20]
mov r12, r14
mov r13, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r13d
mov rdx, r15
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x4dbafc
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4dbb8e
mov r8d, ebp
cmp r13, r8
jne 0x4dba70
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4dbbae
add r13, r13
cmp r13, rbx
cmovae r13, rbx
mov r8, r13
cmp r8, 0x201
jb 0x4dba7f
jmp 0x4dba90
cmp r12, r8
jb 0x4dbbc8
lea rcx, [rsp + 0x48]
mov rdx, r15
call fcn.004c4310
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x4dbb79
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x4dbb66
jmp 0x4dbb79
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042f210
jmp 0x4dbbdd
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.00430740
ud2
Function at 0x4dbc00
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r15d, 0xffffffff
xor esi, esi
xor ebp, ebp
cmp r8, 0x201
jae 0x4dbca0
jmp 0x4dbc7f
jae 0x4dbd45
cmp r8, 0x201
jae 0x4dbca0
lea r13, [rsp + 0xa8]
mov ebx, 0x200
mov r12, r8
jmp 0x4dbce6
sub r8, rbp
sub rsi, rbp
cmp rsi, r8
jae 0x4dbcc7
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.004b6820
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rdi, r15
mov ebp, 0xffffffff
cmovb rbp, rdi
mov qword [rsp + 0x48], rbp
mov rsi, rdi
mov r13, qword [rsp + 0x28]
mov rbx, rbp
mov r12, rbp
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_GetWindowsDirectoryW
mov r14d, eax
test eax, eax
jne 0x4dbd0c
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4dbe36
mov r8d, r14d
cmp r12, r8
jne 0x4dbc70
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4dbe5a
add r12, r12
cmp r12, r15
cmovae r12, r15
mov r8, r12
cmp r8, 0x201
jb 0x4dbc7f
jmp 0x4dbca0
cmp rbx, r8
jb 0x4dbe74
lea rcx, [rsp + 0x88]
mov rdx, r13
call fcn.004c4310
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x50]
call fcn.004c0ba0
mov rax, qword [rsp + 0x78]
cmp byte [rax], 0
jne 0x4dbdb2
lea rdx, str.exeNULcmd.exe__
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.004c1c70
mov rbx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x88]
mov rdx, rbx
call fcn.004e73e0
cmp qword [rsp + 0x50], 0
je 0x4dbde5
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], 0
test rdi, rdi
je 0x4dbe21
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, qword [rsp + 0x28]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov qword [rcx], 1
test rdi, rdi
jne 0x4dbe0e
jmp 0x4dbe21
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042f210
jmp 0x4dbe89
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.00430740
ud2
Function at 0x4dbec0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r14d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r14, 0x201
jae 0x4dbf40
jmp 0x4dbf2f
jae 0x4dbff1
cmp r14, 0x201
jae 0x4dbf40
lea r15, [rsp + 0x48]
mov r13d, 0x200
mov rbp, r14
jmp 0x4dbf8f
sub r14, r12
sub rbx, r12
cmp rbx, r14
jae 0x4dbf6a
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r8, r14
call fcn.004b6820
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x40], r12
mov rbx, rdi
mov r15, qword [rsp + 0x20]
mov r13, r12
mov rbp, r12
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r15
mov edx, ebp
call sub.kernel32.dll_GetSystemDirectoryW
mov esi, eax
test eax, eax
jne 0x4dbfb3
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4dc03e
mov r14d, esi
cmp rbp, r14
jne 0x4dbf20
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4dc0b5
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
cmovae rbp, rax
mov r14, rbp
cmp r14, 0x201
jb 0x4dbf2f
jmp 0x4dbf40
cmp r13, r14
jb 0x4dc0cf
test esi, esi
je 0x4dc062
lea r12, [r14 + r14]
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x4dc026
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4dc0e3
mov rcx, rax
mov qword [0x00576170], rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4dc0e3
mov rsi, rax
jmp 0x4dc06a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], 0
test rdi, rdi
jne 0x4dc08d
jmp 0x4dc0a0
mov esi, 2
xor r12d, r12d
mov rcx, rsi
mov rdx, r15
mov r8, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x28]
mov qword [rax], r14
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
test rdi, rdi
je 0x4dc0a0
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0042f210
jmp 0x4dc0f0
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r14
mov rdx, r13
call fcn.00430740
jmp 0x4dc0f0
mov edx, 2
mov rcx, r12
call fcn.004043b0
ud2
Function at 0x4e73e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.004dfc80
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x4e7424
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4e748b
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x4e7481
mov rbx, qword [rsp + 0x20]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x4e7479
lea rdi, [rbx - 1]
mov rcx, qword [rbx - 1]
mov rax, qword [rbx + 7]
call qword [rax]
mov rax, qword [rbx + 7]
cmp qword [rax + 8], 0
je 0x4e7468
mov r8, qword [rdi]
cmp qword [rax + 0x10], 0x11
jb 0x4e745a
mov r8, qword [r8 - 8]
mov rcx, qword [0x00576170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov qword [rsi + 8], 0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsi + 8], 0
test rbx, rbx
je 0x4e7481
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
Function at 0x4e8a90
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x005761b8]
cmp rax, 3
jne 0x4c6147
cmp rbx, 0x17f
ja 0x4c6159
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x4c6099
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x4c60ac
inc rdx
cmp rcx, rdx
jne 0x4c6080
mov rdx, r8
test rax, rax
jne 0x4c60b6
jmp 0x4c6110
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.00430270
test rax, rax
jne 0x4c60b6
jmp 0x4c6110
mov eax, 1
test rax, rax
je 0x4c6110
cmp rdx, rbx
jne 0x4c6110
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4c6124
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x4c6137
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x4c613a
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.004eab00
cmp rbx, 0x17f
jbe 0x4c6058
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x4e8a90
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.00403bc0
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x4e8aee
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x4e8b65
mov rcx, qword [0x00576170]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4e8b73
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x4e8b65
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
jne 0x4e8b54
jmp 0x4e8b65