joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1020aec3
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov bl, 0x23
jmp 0x1020af06
lea esp, [esp + 0xa]
cpuid
sub esp, 0x1f
mov dx, 0xc3db
not cx
mov dword [esp + 0x19], ebp
jmp 0x1020aef0

Function at 0x1020afd3
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 6]
jmp 0x1020beca
lea esp, [esp + 2]
xchg al, dl
pop bp
mov ah, dh
mov si, word [esp]
lea esi, [edi*4]
jmp 0x1020affb
mov cl, al
xchg dword [esp], eax
not edi
mov ax, 0x9c32
mov ax, 0xc7f9
bswap ebp
jmp 0x1020b011
rcl bx, 5
bsf edi, eax
mov dword [esp], ebx
cpuid
lea esp, [esp + 1]
lea esi, [ebp + 0xd5]
jmp 0x1020b04d
xchg edi, eax
lea ecx, [ecx + 0x21430316]
add esp, 4
setg ah
ror bx, 1
push word [esp + 1]
jmp 0x1020b228

Function at 0x1020b0c9
Capabilities:
Parse pe header

Disassembly:
add esp, 2
push bx
pop bx
jmp 0x1020b0d6
sub esp, 0xf
mov al, byte [esp + 2]
call 0x1020b100

Function at 0x1020b275
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
pushal
xchg dh, bh
mov dword [esp + 4], eax
popal
jmp 0x1020b27f
mov eax, dword fs:[0x30]
push esi
jmp 0x1020b243
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x1020b259
lea esi, [esi + 0xc]
mov eax, dword [esi]
pop esi
mov eax, dword [eax + 0x1c]
jmp 0x1020b35b
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1020b004

Function at 0x1020b2a3
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x18], esi
call fcn.1020b275

Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x10066107
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10066116
pop dword [ebp - 0x28]
mov eax, 0xac55f633
add eax, 0x63b06ae3
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x3777ca4d
add dword [ebp - 0x38], 0x16da7afe
mov dword [ebp - 0x34], 0x8122ec40
add dword [ebp - 0x34], 0xb1106005
mov dword [ebp - 0x30], 0x767f0dba
add dword [ebp - 0x30], 0xd5cd3674
mov dword [ebp - 0x2c], 0x4c786cc0
add dword [ebp - 0x2c], 0xb3879340
lea eax, [ebp - 0x38]
push eax
mov eax, 0xabb11d
sub eax, 0xf0a4b011
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xbc2ac180
sub dword [ebp - 0x38], 0x47b8582a
mov dword [ebp - 0x34], 0xeb7d547d
sub dword [ebp - 0x34], 0xaa10f308
mov dword [ebp - 0x30], 0xad97a501
add dword [ebp - 0x30], 0xb5d7c76b
mov dword [ebp - 0x2c], 0x1ba86ed1
add dword [ebp - 0x2c], 0xe457912f
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x86d9ff9a
sub eax, 0x76d2ff5a
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x6aeb2
push 0
call eax
mov ecx, 0x5646
mov edx, eax
mov edi, 0xee29aacc
add edi, 0x21dea134
add edi, dword [ebp - 0x28]
mov esi, 0xd5c904b3
add esi, 0xac13594
sub dword [ebp - 0x10], 0x173b8447
mov ebx, dword [edi]
xor dword [ebp - 0x24], esi
sub ebx, esi
xor dword [ebp - 0x18], 0x2173bd0a
mov dword [edx], ebx
sub dword [ebp - 8], 0xb717a703
add edx, 4
add edi, 4
loop 0x10066232
add eax, 0x63d68a98
sub eax, 0x63d53ead
mov ebx, eax
add eax, 0xda06db34
sub eax, 0xda06db2f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
not eax
je 0x401052
jmp 0x401030
test cl, 3
je 0x401052
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x441778]
add ecx, 1
sub esi, 1
jne 0x401030
cmp esi, 0x20
push ebx
push edi
jb 0x40123c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x441b78]
xor edx, dword [ebx*4 + 0x441f78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x441778]
add ecx, 4
xor edx, dword [eax*4 + 0x442378]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x441b78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x441f78]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x441778]
add ecx, 4
xor eax, dword [edx*4 + 0x442378]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x441b78]
xor edx, dword [ebx*4 + 0x441f78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x441778]
xor edx, dword [eax*4 + 0x442378]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x441b78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x441f78]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x441778]
xor eax, dword [edx*4 + 0x442378]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x441b78]
xor edx, dword [ebx*4 + 0x441f78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x441778]
xor edx, dword [eax*4 + 0x442378]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x441b78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x441f78]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x441778]
and edx, 0xff
xor eax, dword [edx*4 + 0x442378]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x441b78]
xor edx, dword [ebx*4 + 0x441f78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x441778]
add ecx, 4
xor edx, dword [eax*4 + 0x442378]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x441b78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x441f78]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x441778]
and edx, 0xff
xor eax, dword [edx*4 + 0x442378]
sub edi, 1
jne 0x401062
cmp esi, 4
jb 0x401289
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x441b78]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x441f78]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x441778]
and eax, 0xff
xor edi, dword [eax*4 + 0x442378]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x401246
test esi, esi
pop edi
pop ebx
je 0x4012ad
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x441778]
add ecx, 1
sub esi, 1
jne 0x401290
not eax
pop esi
ret
Function at 0x403ba0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x12c
mov eax, dword [0x44f008]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [esi + 0x10]
test eax, eax
push edi
je 0x403c0c
mov ecx, dword [esi]
test ecx, ecx
je 0x403c0c
push eax
mov eax, dword [esi + 0xc]
push 1
push ecx
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
mov edi, eax
add esp, 0x10
cmp edi, 1
je 0x403c0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push ecx
push edi
push eax
lea edx, [esp + 0x2c]
push 0x443a40
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x14
push 0
push 0x443a5c
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
add dword [esi + 8], 1
push str._d___r
lea ecx, [esp + 8]
push 0x4a43a4
push ecx
mov dword [esi], 0
call dword [sym.imp.MSVCP80.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x403c39
mov eax, dword [eax + 4]
jmp 0x403c3c
add eax, 4
mov edx, dword [esi + 8]
push edx
push eax
call dword [sym.imp.MSVCR80.dll_printf]
add esp, 8
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [0x4a4300]
fld dword [eax*4 + 0x454300]
sub esp, 8
fmul qword [0x445458]
fstp qword [esp]
push str._.1f
call fcn.00404080
mov ecx, dword [esp + 0x138]
add esp, 0xc
pop edi
xor ecx, esp
call fcn.00436b14
add esp, 0x12c
ret

Function at 0x403f30
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x43b802
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44f008]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x20]
mov edi, 0x10
cmp dword [esp + 0x34], edi
jae 0x403f6d
lea eax, [esp + 0x20]
push eax
call fcn.00403800
mov esi, eax
add esp, 4
test esi, esi
je 0x403fb1
cmp dword [esp + 0x50], edi
mov eax, dword [esp + 0x3c]
jae 0x403f8a
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x4c]
mov edi, dword [sym.imp.MSVCR80.dll_fwrite]
push esi
push 1
push ecx
push eax
call edi
push esi
push 1
push 1
push 0x44459c
call edi
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x24
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x403ff0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x68
mov eax, dword [0x44f008]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push 0x44458c
push str.pack.log
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x404067
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x74]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.MSVCR80.dll_vsprintf]
lea eax, [esp + 0x10]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404037
push esi
sub eax, edx
push 1
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
push esi
push 0x44459c
call dword [sym.imp.MSVCR80.dll_fputs]
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x1c
mov ecx, dword [esp + 0x68]
pop esi
xor ecx, esp
call fcn.00436b14
add esp, 0x68
ret
Function at 0x40f8c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
test ecx, ecx
ja 0x40f8ee
xor ecx, ecx
lea edx, [ecx*8]
sub edx, ecx
add edx, edx
add edx, edx
add esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], 0x10
jmp fcn.00420870
or eax, 0xffffffff
xor edx, edx
div ecx
cmp eax, 0x1c
jae 0x40f8cd
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call dword [sym.imp.MSVCR80.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x4481e4
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], vtable.std::bad_alloc.0
call sub.MSVCR80.dll__CxxThrowException
int3

Function at 0x40f990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
test ecx, ecx
ja 0x40f9b4
xor ecx, ecx
imul ecx, ecx, 0x75
add esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x10
jmp fcn.00420870
or eax, 0xffffffff
xor edx, edx
div ecx
cmp eax, 0x75
jae 0x40f99d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call dword [sym.imp.MSVCR80.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x4481e4
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], vtable.std::bad_alloc.0
call sub.MSVCR80.dll__CxxThrowException
int3

Function at 0x411400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x41140d
jmp fcn.004207d0
ret
Function at 0x411560
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x43b3d3
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44f008]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
xor edi, edi
mov dword [esi], vtable.ReferenceCount.0
mov dword [esi + 4], edi
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x4c], edi
lea ebx, [esi + 0x10]
mov dword [esi], vtable.BinaryBlock.0
mov dword [ebx], eax
mov dword [esi + 0x14], edi
mov byte [esp + 0x4c], 1
mov eax, dword [ebx]
push eax
push 0x10
call fcn.00420870
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
mov dword [esp + 0x60], eax
mov dword [esi + 0xc], eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::fpos_int____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
lea edx, [esp + 0x2c]
push edx
push 2
push edi
mov ecx, ebp
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_int__int_]
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::fpos_int____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
sub edi, ecx
sub esp, 0x18
mov eax, esp
mov dword [eax], edx
sub edi, edx
mov edx, dword [esp + 0x30]
add edi, dword [esp + 0x44]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov ecx, ebp
mov dword [esp + 0x70], edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_class_std::fpos_int__]
cmp dword [ebx], edi
mov eax, ebx
jl 0x41163e
lea eax, [esp + 0x58]
mov edx, dword [eax]
mov edi, dword [esp + 0x5c]
push edx
push edi
mov ecx, ebp
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___int_]
mov ebp, dword [ebp + 4]
mov eax, dword [ebx]
cmp ebp, eax
jge 0x411668
sub eax, ebp
push eax
lea eax, [edi + ebp]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov eax, esi
mov dword [ebx], ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
Function at 0x41a230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43b2ac
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44f008]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.ReferenceCount.0
mov dword [esi + 4], edi
mov eax, dword [esp + 0x20]
mov byte [esp + 0x14], 1
push eax
lea ecx, [esi + 8]
mov dword [esi], vtable.PackedSectionFile.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x24]
cmp ecx, edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], ecx
je 0x41a29a
add dword [ecx + 4], 1
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
cmp ecx, edi
mov dword [esp + 0x14], eax
je 0x41a2b2
add dword [ecx + 4], eax
jne 0x41a2b2
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0xc

Function at 0x41a340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43ba9f
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x44f008]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 2
mov ecx, dword [esi + 0x34]
xor ebx, ebx
cmp ecx, ebx
je 0x41a385
add dword [ecx + 4], 0xffffffff
jne 0x41a385
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x41a394
call fcn.004207d0
lea ecx, [esi + 8]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esp + 0x14], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov dword [esi], vtable.ReferenceCount.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x41a4e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edx]
test eax, eax
jle 0x41a520
mov al, byte [ecx]
cmp al, 1
jne 0x41a512
mov eax, 1
mov byte [ecx], 0
cmp dword [edx], eax
jle 0x41a516
jmp 0x41a500
xor byte [eax + ecx], 0x9c
add eax, 1
cmp eax, dword [edx]
jl 0x41a500
add dword [edx], 0xffffffff
lea eax, [ecx + 1]
ret
test al, al
jne 0x41a51d
add dword [edx], 0xffffffff
lea eax, [ecx + 1]
ret
movsx eax, al
push eax
call fcn.00411140
add esp, 4
xor eax, eax
ret
Function at 0x41dce0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SleepEx]
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [0x4a4348]
test eax, eax
je 0x41dd16
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x24]
mov edx, dword [0x4a4350]
cmp edx, eax
jne 0x41dd26
add dword [0x4a434c], 1
jmp 0x41dd5f
mov eax, 1
mov ecx, 0x4a4348
xchg dword [ecx], eax
test eax, eax
je 0x41dd36
add ebx, 1
test bl, 0x3f
jne 0x41dcf0
push 0
push 0
call esi
jmp 0x41dcf0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x24]
mov dword [0x4a434c], eax
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x24]
mov dword [0x4a4350], edx
mov dword [0x4a434c], 1
mov eax, dword [0x4547b4]
test eax, eax
jne 0x41ddc8
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0xc]
lea edx, [esi - 1]
test esi, edx
je 0x41dd84
call dword [sym.imp.MSVCR80.dll_abort]
mov dword [0x4547bc], 0x100000
mov dword [0x4547b8], esi
mov dword [0x4547c0], 0x40000
mov dword [0x4547c4], 0x200000
mov dword [0x4547c8], 7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0x55555550
and eax, 0xfffffff8
or eax, 8
mov dword [0x4547b4], eax
mov eax, dword [0x4a434c]
pop esi
sub eax, 1
pop ebx
mov dword [0x4a434c], eax
jne 0x41ddec
mov dword [0x4a4350], 0
xor ecx, ecx
mov edx, 0x4a4348
xchg dword [edx], ecx
mov eax, 1
add esp, 0x24
ret

Function at 0x420060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
jmp fcn.004207d0
Function at 0x420140
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
xor ebp, ebp
mov esi, eax
xor ebx, ebx
mov eax, dword [esi]
test eax, eax
je 0x42016d
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x24]
mov edx, dword [esi + 8]
cmp edx, eax
jne 0x42017a
add dword [esi + 4], 1
jmp 0x4201a9
mov eax, 1
mov ecx, esi
xchg dword [ecx], eax
test eax, eax
je 0x420188
add ebx, 1
test bl, 0x3f
jne 0x420150
push ebp
push ebp
call edi
jmp 0x420150
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x24]
mov dword [esi + 4], eax
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x24]
mov dword [esi + 8], edx
mov dword [esi + 4], 1
xor ebx, ebx
lea eax, [esi + 0x14]
mov edi, edi
cmp dword [eax], ebp
je 0x4201c2
add ebx, 1
add eax, 4
cmp ebx, 0x100
jl 0x4201b0
cmp ebx, 0x100
jne 0x4201de
add dword [esi + 4], 0xffffffff
jne 0x4201d7
mov dword [esi + 8], ebp
xor eax, eax
xchg dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esi + 0x418]
mov ecx, dword [0x4547b4]
cmp dword [eax + 0x24], ecx
je 0x4201f7
call dword [sym.imp.MSVCR80.dll_abort]
jmp 0x420222
push 0x68
call fcn.0041f6e0
mov edi, eax
add esp, 4
test edi, edi
je 0x420220
test byte [edi - 4], 1
jne 0x420213
test byte [edi - 8], 1
jne 0x420220
push 0x68
push 0
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ebp, edi
xor edi, edi
cmp ebp, edi
mov dword [esi + ebx*4 + 0x14], ebp
jne 0x420240
add dword [esi + 4], 0xffffffff
jne 0x420239
mov dword [esi + 8], edi
xor edx, edx
xchg dword [esi], edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
lea ecx, [esi + 0x418]
mov dword [ebp + 4], eax
cmp dword [ecx], 0
je 0x420262
add ecx, 4
add edi, 1
cmp dword [ecx], 0
jne 0x420257
cdq
idiv edi
mov dword [ebp], edx
add dword [esi + 4], 0xffffffff
jne 0x42027b
mov dword [esi + 8], 0
xor ecx, ecx
mov edx, esi
xchg dword [edx], ecx
mov eax, dword [esi + 0x414]
add ebx, 1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x420296
call dword [sym.imp.MSVCR80.dll_abort]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x420360
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x4547b4]
test eax, eax
jne 0x42036e
call fcn.0041dce0
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
xor ebp, ebp
xor ebx, ebx
jmp 0x420380
mov ecx, dword [0x4a4348]
test ecx, ecx
je 0x4203a7
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x24]
mov ecx, dword [0x4a4350]
cmp ecx, eax
jne 0x4203b7
add dword [0x4a434c], 1
jmp 0x4203ee
mov edx, 1
mov eax, 0x4a4348
xchg dword [eax], edx
test edx, edx
je 0x4203c5
add ebx, 1
test bl, 0x3f
jne 0x420380
push ebp
push ebp
call edi
jmp 0x420380
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x24]
mov dword [0x4a434c], edx
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x24]
mov dword [0x4a4350], ecx
mov dword [0x4a434c], 1
cmp dword [esi + 0x10], ebp
jne 0x420497
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi + 0x414], eax
je 0x420423
xor eax, eax
call fcn.0041f590
cmp eax, ebp
mov dword [esi + 0x418], eax
jne 0x42048a
mov edi, dword [sym.imp.MSVCR80.dll_abort]
call edi
mov eax, esi
call fcn.004200f0
mov eax, dword [esi + 0x418]
cmp eax, ebp
je 0x420447
call fcn.0041f610
mov dword [esi + 0x418], ebp
mov eax, dword [esi + 0x414]
cmp eax, ebp
je 0x420464
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x42045e
call edi
mov dword [esi + 0x414], ebp
mov edx, dword [0x4a434c]
sub edx, 1
mov dword [0x4a434c], edx
jne 0x420484
mov dword [0x4a4350], ebp
xor eax, eax
mov ecx, 0x4a4348
xchg dword [ecx], eax
pop edi
pop ebp
xor eax, eax
pop ebx
ret
mov dword [eax + 0x1d8], esi
mov dword [esi + 0x10], 0x10
mov edx, dword [0x4a434c]
sub edx, 1
mov dword [0x4a434c], edx
jne 0x4204b7
mov dword [0x4a4350], ebp
xor eax, eax
mov ecx, 0x4a4348
xchg dword [ecx], eax
pop edi
pop ebp
mov eax, 1
pop ebx
ret