joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4000cb30
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
mov dword [edi + 4], 0x7dff
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x30]
mov dword [edi], vtable.SafeMachine::Thread.0
mov dword [edi + 0xbc], ebp
mov dword [edi + 0xc0], ebx
mov dword [edi + 0xd0], eax
mov byte [edi + 0xd8], bl
cmp ebp, ebx
jne 0x4000cb75
pop ebp
mov dword [edi + 4], 0x7d02
mov eax, edi
pop ebx
add esp, 0x24
ret 8
mov ecx, dword [0x40477438]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0xc
push ebx
push ecx
call esi
cmp eax, ebx
je 0x4000cb9a
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], vtable.SafeMachine::Stack_struct_SafeMachine::CpuContext_.0
jmp 0x4000cb9c
xor eax, eax
mov dword [edi + 0xcc], eax
cmp eax, ebx
jne 0x4000cbb8
pop esi
pop ebp
mov dword [edi + 4], 0x7d05
mov eax, edi
pop ebx
add esp, 0x24
ret 8
push 0x24
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.40001a40
add esp, 0xc
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x10]
push 4
push 0x1000
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 0xb0], eax
cmp eax, ebx
jne 0x4000cc00
pop esi
pop ebp
mov dword [edi + 4], 0x7d07
mov eax, edi
pop ebx
add esp, 0x24
ret 8
mov edx, dword [0x40477438]
push 0x18
push ebx
push edx
call esi
mov esi, eax
cmp esi, ebx
je 0x4000cc1f
mov eax, dword [esp + 0x38]
mov ecx, ebp
call fcn.40001010
jmp 0x4000cc21
xor eax, eax
mov dword [edi + 0xc0], eax
cmp eax, ebx
je 0x4000cba6
mov eax, dword [eax + 4]
cmp eax, 0x7d00
je 0x4000cc47
pop esi
pop ebp
mov dword [edi + 4], eax
mov eax, edi
pop ebx
add esp, 0x24
ret 8
mov eax, dword [0x40477438]
push 0xc
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
je 0x4000cc68
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], vtable.SafeMachine::Stack_struct_SafeMachine::TaskMachineData_.0
jmp 0x4000cc6a
xor eax, eax
mov dword [edi + 0xc4], eax
cmp eax, ebx
je 0x4000cba6
push 0xa8
lea ecx, [edi + 8]
push ebx
push ecx
call fcn.40001a40
add esp, 0xc
pop esi
pop ebp
mov dword [edi + 4], 0x7d00
mov eax, edi
pop ebx
add esp, 0x24
ret 8

Function at 0x4000cde0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
push 0x24
lea eax, [esp + 8]
push 0
push eax
call fcn.40001a40
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x2c]
cmp edx, dword [esp + 8]
jb 0x4000ce15
push 0x7d00
push 0xb
call fcn.4000f040
mov eax, dword fs:[0x18]
mov dword [esp], eax
mov ecx, dword [esp]
mov edx, dword [ecx + 4]
mov eax, dword [esi + 0xb0]
mov dword [eax + 4], edx
mov ecx, dword [esp]
mov edx, dword [ecx + 8]
mov eax, dword [esi + 0xb0]
mov dword [eax + 8], edx
mov ecx, dword [esp]
mov edx, dword [ecx + 0x2c]
mov eax, dword [esi + 0xb0]
mov dword [eax + 0x2c], edx
mov eax, dword [esp]
mov ecx, dword [esi + 0xb0]
push 0x100
add eax, 0xe14
add ecx, 0xe14
push eax
push ecx
call fcn.40001a60
mov eax, 0x7d00
add esp, 0x34
ret 4
Function at 0x4000cfc0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40477460]
push esi
mov esi, 0x7d03
test eax, eax
je 0x4000cfe6
mov ecx, dword [esp + 8]
push ecx
push eax
call fcn.4000b240
mov esi, eax
cmp esi, 0x7d00
jne 0x4000cfe6
pop esi
ret
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
or esi, 0x10000000
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4000d0d0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
test esi, esi
jne 0x4000d0e0
mov eax, 0x7d02
add esp, 0x28
ret
push 0x24
lea eax, [esp + 8]
push 0
push eax
call fcn.40001a40
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x40477460]
mov edx, dword [esp + 8]
call fcn.4000b5d0
mov ecx, eax
test ebx, ebx
je 0x4000d0d7
mov eax, dword fs:[0]
mov dword [esp], eax
mov eax, dword [esp]
push edx
push ecx
push edi
mov dword [ebx], eax
call fcn.40001a60
add esp, 0xc
mov eax, dword fs:[0]
mov dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [eax + 4]
mov dword [eax + 4], 0x4000d040
mov eax, dword [edi]
mov dword [esi], ecx
test eax, eax
je 0x4000d0d7
mov ecx, eax
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4000d15a
mov ecx, eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x4000d151
mov dword [edi], ecx
mov eax, 0x7d00
add esp, 0x28
ret
Function at 0x4000ddc0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x40075970]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4000de06
cmp esi, 0xeeeeeeee
je 0x4000de06
cmp byte [esi + 0xd8], 0
push edi
mov edi, 0x7d00
je 0x4000ddff
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 0xd8], 0
mov eax, edi
pop edi
pop esi
ret 4
mov eax, 0x7dff
pop esi
ret 4

Function at 0x4000de10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x40075970]
sub esp, 8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4000de6c
cmp esi, 0xeeeeeeee
je 0x4000de6c
cmp byte [esi + 0xd8], 0
push edi
mov edi, 0x7d00
jne 0x4000de7d
mov ecx, dword [ebx + 0x14]
mov edx, dword [ecx + 0x60]
mov eax, dword [ebx + 0x24]
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x4000de76
lea eax, [edi + 0xb]
pop edi
pop esi
add esp, 8
ret
mov eax, 0x7dff
pop esi
add esp, 8
ret
mov byte [esi + 0xd8], 1
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x4000de90
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x40075970]
sub esp, 0x90
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
test ebp, ebp
je 0x4000deb4
cmp ebp, 0xeeeeeeee
jne 0x4000dec6
mov eax, 0x7dff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x14
cmp byte [ebp + 0xd8], 0
je 0x4000dee6
mov ebx, dword [esp + 0xa4]
call fcn.4000f1a0
cmp eax, 0x7d00
jne 0x4000e096
push 0x90
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.40001a40
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0xbc]
mov esi, eax
mov ecx, 0x10
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x9c], edx
mov edx, dword [eax + 0x28]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x9c], edx
call fcn.4000e580
mov edi, edi
mov edi, dword [esp + 0xa4]
mov ebx, edi
call fcn.4000de10
mov ebx, eax
cmp ebx, 0x7d00
jne 0x4000e07e
mov ecx, edi
call fcn.4000ec40
mov ebx, eax
cmp ebx, 0x7d00
jne 0x4000df9e
mov ecx, dword [0x40075970]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4000df97
cmp esi, 0xeeeeeeee
je 0x4000df97
cmp byte [esi + 0xd8], 0
je 0x4000dfd2
mov edx, dword [edi + 0x24]
push edx
jmp 0x4000dfc5
mov ebx, 0x7dff
jmp 0x4000dfd2
mov eax, dword [0x40075970]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4000dfd2
cmp esi, 0xeeeeeeee
je 0x4000dfd2
cmp byte [esi + 0xd8], 0
je 0x4000dfd2
mov ecx, dword [edi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 0xd8], 0
cmp ebx, 0x7d00
jne 0x4000e07e
mov ebx, dword [ebp + 0xa8]
cmp ebx, 0x7d00
jne 0x4000e062
mov eax, dword [ebp + 0xa0]
test eax, eax
je 0x4000e01b
mov esi, dword [ebp + 0xa4]
mov ecx, dword [edi + 0x14]
mov edx, dword [ecx]
push esi
push eax
mov eax, dword [edx]
call eax
mov ebx, eax
cmp ebx, 0x7d00
jne 0x4000e07e
mov dword [ebp + 0xa0], 0
mov eax, dword [ebp + 0x90]
test eax, eax
je 0x4000df40
cmp eax, 0x10
jne 0x4000e073
mov eax, dword [ebp + 0xac]
mov esi, eax
lea edi, [ebp + 0xc]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x40477438]
push eax
xor esi, esi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp + 0xac], esi
mov dword [ebp + 0x90], esi
jmp 0x4000df40
mov edx, dword [ebp + 0x90]
mov eax, dword [esp + 0xb4]
mov dword [eax], edx
jmp 0x4000e07e
mov edx, dword [esp + 0xb4]
mov ecx, eax
mov dword [edx], ecx
mov edi, dword [esp + 0xa8]
lea esi, [ebp + 0xc]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
call fcn.4000e600
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x14
Function at 0x4000e580
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x40075970]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x40477438]
push 0x90
push 0
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4000e5b8
mov esi, dword [esp + 0x10]
mov ecx, 0x24
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x4000e5ba
xor eax, eax
mov edx, dword [ebx + 0xc4]
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x4000e5d7
mov edi, dword [ecx]
test edi, edi
je 0x4000e5d7
lea esi, [ebx + 0xc]
mov ecx, 0x24
rep movsd dword es:[edi], dword [esi]
mov esi, eax
lea edi, [ebx + 0xc]
mov ecx, 0x24
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0xc4]
mov edi, eax
call fcn.4000c3a0
pop edi
pop esi
pop ebx
ret 4

Function at 0x4000e600
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x40075970]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [esp + 4]
push ecx
call fcn.4000cd30
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [esp + 4]
mov edx, dword [esi + 0x84]
push eax
mov eax, dword [esi + 0x80]
push edx
push eax
call fcn.400033d0
mov ecx, dword [0x40477438]
add esp, 0xc
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ecx
ret
Function at 0x4000e710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
sub esp, 0x74
push ebx
mov ebx, dword [ecx + 0x10]
push esi
mov esi, dword [eax + 0xd0]
mov eax, dword [ebx + 0xc]
mov edx, esi
and edx, 0x7ff
cmp dword [eax + edx*8], esi
push edi
lea edi, [eax + edx*8]
jne 0x4000e743
mov esi, dword [edi + 4]
jmp 0x4000e76a
push esi
push ebx
call fcn.40008e00
test eax, eax
je 0x4000e852
mov ecx, dword [ebx + 8]
mov edx, dword [eax]
and ecx, esi
mov eax, dword [edx + ecx*4]
test eax, eax
je 0x4000e765
mov dword [edi], esi
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov esi, eax
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 0xc
test byte [eax*4 + 0x40077248], 0x10
lea ebx, [eax*4 + 0x40077248]
jne 0x4000e7b9
lea ecx, [esp + 0x40]
push ecx
call fcn.40001bc0
mov edx, dword [esi]
mov eax, dword [ebp + 0x10]
mov edx, dword [edx + 4]
push eax
mov ecx, esi
call edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x40477424], 0
je 0x4000e7b3
push eax
push edi
call fcn.40002e10
add esp, 8
or dword [ebx], 0x10
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
push 0x4000e890
lea edx, [edi + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [ecx + 0x10]
push edx
lea eax, [edi - 0x800]
push ecx
mov dword [esp + 0x2c], edi
call fcn.40001ff0
test esi, esi
je 0x4000e878
mov edx, dword [esi + 8]
cmp dword [edx], 0x90909090
jne 0x4000e878
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
or edi, 0xffffffff
push eax
lea ebx, [esp + 0x18]
xor eax, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.4000f610
cmp eax, 0x7d00
jne 0x4000e878
mov ecx, dword [esp + 0x14]
cmp ecx, edi
je 0x4000e878
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4000e878
mov edx, dword [esi + 0x14]
mov esi, dword [esi + 8]
lea edx, [edx + esi + 0x2f]
add eax, 0x2f
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
cmp eax, edx
jbe 0x4000e859
push 0x7d20
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
jmp 0x4000e765
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x34]
push edx
push ecx
lea ebx, [esp + 0x20]
lea esi, [esp + 0x24]
lea edi, [esp + 0x1c]
call fcn.4000db20
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4000f040
Capabilities:
Get thread local storage value
Terminate process

Disassembly:
mov eax, dword [0x40075970]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4000f057
cmp eax, 0xeeeeeeee
jne 0x4000f05f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [eax + 0xd0], 0
je 0x4000f070
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [eax + 0xd8], 0
jne 0x4000f07e
add eax, 8
jmp 0x4000f083
mov eax, 0x4047730c
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [eax + 0xa0], ecx
mov dword [eax + 0x88], edx
add eax, 0x44
push eax
call fcn.40001af0
pop ecx
ret 8
Function at 0x4000f100
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x40075970]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4000f11a
cmp eax, 0xeeeeeeee
jne 0x4000f121
mov eax, 0x7dff
pop ebx
ret
push esi
push edi
mov edi, dword [ebx + 0xc]
add eax, 8
push 0xa8
mov esi, eax
push 0xee
add edi, 0x14
mov ecx, 0x2a
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.40001a40
mov eax, dword [ebx + 0xc]
and dword [eax + 0x14], 0xfffff8ff
mov ecx, dword [ebx + 0xc]
add esp, 0xc
push 0
mov dword [ecx + 0xb4], 0x7d00
mov edx, dword [ebx + 0xc]
mov eax, dword [edx + 0xa4]
mov ebx, dword [0x40477440]
push 0x40025e90
push 0xfedcba98
push eax
push str.SafeMachine
mov ecx, str.TaskEpilog
call fcn.40008800
pop edi
pop esi
mov eax, 0x7d00
pop ebx
ret

Function at 0x4000f1a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x40075970]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x4000f1bb
cmp edi, 0xeeeeeeee
jne 0x4000f1c2
mov eax, 0x7dff
pop edi
ret
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 0xa4]
push esi
call fcn.40008900
mov esi, dword [ebx + 0xc]
add esi, 0x14
add edi, 8
mov ecx, 0x2a
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0xc]
push 0xa8
push 0xee
add edx, 0x14
push edx
call fcn.40001a40
add esp, 0xc
pop esi
mov eax, 0x7d00
pop edi
ret
Function at 0x40010680
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebx, eax
cmp byte [ebx + 0x17], 0
mov eax, dword [ebx + 0x38]
push esi
mov esi, dword [ebx + 0x20]
push edi
je 0x400106b5
test eax, eax
je 0x400106a9
mov ax, word [eax + 0x16]
shr ax, 0xd
and al, 1
je 0x400106a9
mov edi, esi
jmp 0x400106cc
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x400106ca
mov edi, dword [eax + 0x34]
jmp 0x400106cc
test eax, eax
je 0x400106ca
mov cx, word [eax + 0x16]
shr cx, 0xd
and cl, 1
je 0x400106ac
mov edi, esi
jmp 0x400106cc
xor edi, edi
push 0x24
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.40001a40
add esp, 0xc
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
mov ebp, eax
cmp edi, eax
jb 0x4001078b
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x40010700
mov eax, dword [eax + 0x50]
jmp 0x40010702
xor eax, eax
add eax, edi
cmp eax, 0x7fffffff
ja 0x4001078b
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x4001071b
mov edx, dword [eax + 0x50]
jmp 0x4001071d
xor edx, edx
mov ecx, esi
mov eax, edi
call fcn.40001260
cmp eax, 0x7d00
jne 0x40010790
mov esi, edi
nop
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x4001073c
mov eax, dword [eax + 0x50]
jmp 0x4001073e
xor eax, eax
add eax, edi
cmp esi, eax
jae 0x40010757
push 4
push 0x2000
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esi, ebp
jmp 0x40010730
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x40010763
mov eax, dword [eax + 0x50]
jmp 0x40010765
xor eax, eax
lea ecx, [eax + edi - 1]
cmp edi, ecx
jae 0x4001077e
mov eax, edi
mov ebx, 2
mov edi, 0x40001670
call fcn.40001540
pop edi
pop esi
pop ebp
mov eax, 0x7d00
pop ebx
add esp, 0x28
ret
mov eax, 0x7d2d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x40010fe0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push 0x24
lea ecx, [esp + 4]
mov dword [esi + 4], 0x7dff
push 0
push ecx
mov dword [esi + 8], eax
mov dword [esi], vtable.SafeMachine::WinApi.0
call fcn.40001a40
add esp, 0xc
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 4]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [esi + 0xc], eax
test eax, eax
mov eax, esi
jne 0x4001102d
mov dword [esi + 4], 0x7d23
mov dword [esi + 4], 0x7d00
add esp, 0x24
ret

Function at 0x40013240
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edi
mov esi, esi
mov ebx, ebx
mov ecx, ecx
mov edx, edx
cmp dword [ebp + 8], 0x20
ja 0x400132cb
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x40477250]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xffffffff
jne 0x400132b9
mov dword [ebp - 8], 0
cmp dword [0x40477400], 0
je 0x400132b9
mov edx, dword [ebp + 8]
push edx
call dword [0x40477400]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x400132b9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x400132b9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x40477250], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebp - 4], 0xffffffff
je 0x400132cb
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x400132cd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40013520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edi
mov esi, esi
mov ebx, ebx
mov ecx, ecx
mov edx, edx
call fcn.40001000
push eax
xor ecx, ecx
lea esi, [ebp - 4]
call fcn.4000b560
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x7d00
jne 0x40013577
mov eax, dword [ebp - 4]
call fcn.40008ff0
mov dword [eax + 0x88], 0xd
mov eax, dword [ebp - 4]
call fcn.40008ff0
add eax, 0x44
push eax
call fcn.40001af0
add esp, 4
jmp 0x40013582
push 0x7d20
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40013590
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x40477438]
sub esp, 0x24
push ebx
push 0xc
xor ebx, ebx
push ebx
push eax
mov dword [esi], 0x7dff
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
je 0x400135b9
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
jmp 0x400135bb
xor eax, eax
mov dword [esi + 4], eax
push 0x24
lea ecx, [esp + 8]
push ebx
push ecx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
mov dword [esi], 0x7d00
call fcn.40001a40
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 8]
push 4
push 0x1000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, ebx
mov dword [esi + 0x14], eax
pop ebx
jne 0x4001361f
mov dword [esi], 0x7d1c
mov eax, esi
add esp, 0x24
ret
add eax, 0x24
mov dword [esi + 0x18], eax
mov eax, esi
add esp, 0x24
ret
Function at 0x40014a70
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
cmp dword [esi + 0x24], 0
jne 0x40014b33
push ebx
push ebp
push edi
push 0x24
lea eax, [esp + 0x18]
push 0
push eax
mov ebx, 0x77000000
call fcn.40001a40
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call ebp
lea edi, [esp + 0x13]
mov eax, ebx
mov byte [esp + 0x13], 0
call fcn.40001380
cmp byte [esp + 0x13], 0
jne 0x40014b24
mov edi, dword [esp + 0x18]
cmp ebx, 0x7fff0000
jae 0x40014b10
add ebx, edi
mov edx, ebx
shr edx, 0xc
mov esi, dword [edx*4 + 0x40077248]
push 0x24
lea eax, [esp + 0x18]
push 0
and esi, 0xfffff000
push eax
add esi, ebx
call fcn.40001a40
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call ebp
cmp esi, dword [esp + 0x18]
mov esi, dword [esp + 0x3c]
setb al
test al, al
je 0x40014ac3
cmp ebx, 0x7fff0000
jb 0x40014b24
pop edi
pop ebp
mov dword [esi + 0x24], 0x2000
mov eax, dword [esi + 0x24]
pop ebx
pop esi
add esp, 0x28
ret 4
pop edi
pop ebp
mov dword [esi + 0x24], ebx
mov eax, ebx
pop ebx
pop esi
add esp, 0x28
ret 4
mov eax, dword [esi + 0x24]
pop esi
add esp, 0x28
ret 4

Function at 0x40014ea0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x40477438]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
xor edi, edi
push 0xc
push edi
push eax
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi], 0x7d00
call ebp
cmp eax, edi
je 0x40014ed3
mov dword [eax], vtable.SafeMachine::List_struct_SafeMachine::ApiCaller::Invocation_.0
mov dword [eax + 4], edi
mov dword [eax + 8], edi
jmp 0x40014ed5
xor eax, eax
mov dword [esi + 4], eax
cmp eax, edi
jne 0x40014ee7
pop edi
mov dword [esi], 0x7d05
mov eax, esi
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0x18]
push ecx
call ebx
lea edx, [esi + 0x30]
push edx
call ebx
push edi
push 0x400
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x14], eax
pop ebx
cmp eax, edi
je 0x40014f5f
mov eax, dword [0x40477438]
push 0xc
push edi
push eax
call ebp
cmp eax, edi
je 0x40014f2d
mov dword [eax], vtable.SafeMachine::List_void__.0
mov dword [eax + 4], edi
mov dword [eax + 8], edi
jmp 0x40014f2f
xor eax, eax
mov dword [esi + 8], eax
cmp eax, edi
je 0x40014edc
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x40014f5f
push edi
push edi
push esi
push 0x40015020
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
cmp eax, edi
jne 0x40014f65
mov dword [esi], 0x7d23
pop edi
mov eax, esi
pop ebp
ret
Function at 0x40014f70
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0xc]
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40014f9e
mov edx, dword [edi + 0xc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov eax, dword [edi + 8]
mov dword [edi + 0xc], 0
test eax, eax
je 0x4001500a
cmp dword [eax + 8], 0
jbe 0x40014ff4
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [edi + 8]
mov esi, dword [ecx + 4]
mov edx, dword [esi]
mov eax, dword [edx]
push eax
call ebx
mov ecx, dword [esi]
mov edx, dword [0x40477438]
push ecx
push 0
push edx
call ebp
mov edx, esi
mov esi, dword [edi + 8]
call fcn.4000c4a0
mov eax, dword [edi + 8]
cmp dword [eax + 8], 0
ja 0x40014fc5
pop ebp
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x40015003
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x30]
push ecx
call esi
add edi, 0x18
push edi
call esi
pop edi
pop esi
pop ebx
ret

Function at 0x4001a06e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4006f01c]
jne 0x4001a078
repz ret
jmp fcn.4001a0f8