Function at 0x40ce00
Capabilities:
Allocate thread local storage
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x452004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x118
mov dword [0x453ac8], eax
lea eax, [ebp - 0x128]
push 0
push eax
mov dword [0x453acc], 0x43375c
call fcn.00415060
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
js 0x40cfb7
mov eax, dword [ebp - 0x128]
lea esi, [ebp - 0x12c]
mov ecx, 0x47
mov edi, 0x453b00
rep movsd dword es:[edi], dword [esi]
cmp eax, 6
jne 0x40cec5
mov eax, dword [ebp - 0x124]
cmp eax, 1
jne 0x40ce94
mov dword [0x452a50], 0x3d
jmp 0x40cfc1
cmp eax, 2
jne 0x40cea8
mov dword [0x452a50], 0x3e
jmp 0x40cfc1
cmp eax, 3
jne 0x40cfb7
mov dword [0x452a50], 0x3f
jmp 0x40cec0
jmp 0x40cfc1
cmp eax, 0xa
jne 0x40cfb7
cmp dword [ebp - 0x124], 0
jne 0x40cfb7
mov eax, dword [ebp - 0x120]
cmp eax, 0x4a62
jb 0x40cef7
mov dword [0x452a50], 0x6e
jmp 0x40cfc1
cmp eax, 0x4a61
jb 0x40cf0d
mov dword [0x452a50], 0x6d
jmp 0x40cfc1
cmp eax, 0x47bb
jb 0x40cf25
mov dword [0x452a50], 0x6c
mov edi, edi
jmp 0x40cfc1
cmp eax, 0x47ba
jb 0x40cf3b
mov dword [0x452a50], 0x6b
jmp 0x40cfc1
jmp 0x40cf40
cmp eax, 0x4563
jb 0x40cf53
mov dword [0x452a50], 0x6a
jmp 0x40cfc1
cmp eax, 0x42ee
jb 0x40cf66
mov dword [0x452a50], 0x69
jmp 0x40cfc1
cmp eax, 0x3fab
jb 0x40cf79
mov dword [0x452a50], 0x68
jmp 0x40cfc1
lea esp, [esp]
cmp eax, 0x3ad7
jb 0x40cf93
mov dword [0x452a50], 0x67
jmp 0x40cfc1
cmp eax, 0x3839
jb 0x40cfa6
mov dword [0x452a50], 0x66
jmp 0x40cfc1
cmp eax, 0x295a
sbb eax, eax
add eax, 0x65
mov dword [0x452a50], eax
jmp 0x40cfc1
mov dword [0x452a50], 0xffffffff
push 0
push 0x2c
push 0x453ad0
push 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp dword [0x452a50], 0x3e
jb 0x40cff7
push 0
push 0
push 0
push 0
push 0
push 0x1102
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x453afc], eax
jmp 0x40cffc
mov eax, dword [0x453afc]
lea esp, [esp]
test eax, eax
jne 0x40d04e
push eax
push eax
push 0x100000
push 0x200000
push eax
push 0x1002
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x453afc], eax
test eax, eax
je 0x40d1df
cmp dword [0x452a50], 0x3c
jb 0x40d04e
push 4
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x130], 2
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlSetHeapInformation]
push 0
push 0
push 0xf0003
push 0x453e18
call dword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
test eax, eax
js 0x40d1df
mov al, 1
cmp al, byte [0x453af8]
push 0x454258
sbb eax, eax
and eax, 0xfa0
mov dword [0x452c2c], eax
call dword [sym.imp.ntdll.dll_RtlInitializeSListHead]
push 0x454240
call dword [sym.imp.ntdll.dll_RtlInitializeSListHead]
xor eax, eax
mov dword [0x454248], 0
mov dword [ebp - 0x15c], eax
mov ecx, 0x28
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x15c]
mov edx, eax
mov dword [0x45424c], 0x200
mov dword [0x454250], 0x38
mov dword [0x453ab4], eax
mov dword [0x453e40], eax
call fcn.00409c00
mov edx, eax
mov ebx, 1
xor eax, eax
mov word [edx], ax
mov eax, ebx
lock xadd dword [0x453ab8], eax
inc eax
dec al
mov dword [edx + 4], 0
movzx esi, al
mov byte [edx + 2], al
mov dword [edx + 8], 0
mov dword [edx + 0xc], str.Type
cmp esi, 0x100
jae 0x40d1d4
movzx eax, al
lea ecx, [ebx + 0x27]
mov dword [esi*4 + 0x453e40], edx
mov dword [0x453ab4], edx
mov word [edx - 8], ax
mov dword [edx + 4], ebx
call fcn.00409c00
xor ecx, ecx
mov word [eax], cx
lock xadd dword [0x453ab8], ebx
inc ebx
dec bl
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
movzx ecx, bl
mov byte [eax + 2], bl
mov dword [eax + 0xc], str.Alloc
cmp ecx, 0x100
jae 0x40d1d4
mov dword [ecx*4 + 0x453e40], eax
mov dword [0x453ab0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x453c5c], eax
cmp eax, 0xffffffff
je 0x40d1df
call fcn.00409e40
test al, al
je 0x40d1df
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00413aae
mov esp, ebp
pop ebp
ret 0xc
push 0xc0000001
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, dword [ebp - 8]
mov eax, 0xc0000001
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413aae
mov esp, ebp
pop ebp
ret 0xc