Function at 0x409e60
Capabilities:
Create process on windows
Get thread local storage value
Hide graphical window
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eeabb
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 2
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], 0
call fcn.004c8d7a
mov edi, eax
mov dword [ebp - 0xf4], eax
xor eax, eax
mov dword [ebp - 0xf0], edi
mov word [edi], ax
push 2
mov dword [ebp - 4], eax
call fcn.004c8d7a
mov esi, eax
add esp, 8
xor eax, eax
mov dword [ebp - 0x100], esi
mov word [esi], ax
mov eax, 0xdc
mov byte [ebp - 4], 1
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xec]
push eax
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp word [ebx], 0x30
jne 0x409f22
push 0x30
push 0x4fa6f4
push 0x4fa718
push dword [ebp - 0x108]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40a67f
push 4
push 0x4f9e6c
push ebx
call fcn.004c936a
add esp, 0xc
mov edi, 0x4f9d20
test eax, eax
jne 0x40a00b
push 0x4fa794
call fcn.004c8d00
push 0
mov ebx, eax
call fcn.004c8d5f
mov ecx, dword [ebp - 0xf8]
mov edx, edi
add ecx, 8
cmovne edx, ecx
push edx
call fcn.004c8d00
push 0
mov esi, eax
call fcn.004c8d5f
test ebx, ebx
mov eax, edi
cmovne eax, ebx
push eax
call fcn.004c8d00
push 0
mov dword [ebp - 0xf0], eax
call fcn.004c8d5f
add esp, 0x18
lea ecx, [ebp - 0xf0]
push esi
call fcn.004050e0
push esi
call fcn.004c8d5f
mov esi, dword [ebp - 0xf0]
mov eax, edi
test esi, esi
cmovne eax, esi
push eax
call fcn.004c8d00
push dword [ebp - 0xf4]
mov edi, eax
mov dword [ebp - 0xf0], edi
call fcn.004c8d5f
push esi
call fcn.004c8d5f
push ebx
call fcn.004c8d5f
add esp, 0x14
push dword [0x539fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea ecx, [ebp - 0x104]
push ecx
push eax
mov eax, dword [ebp - 0xf8]
push 0
add eax, 0xa
push eax
push dword [0x52ea0c]
call fcn.004086c0
add esp, 0x14
jmp 0x40a272
push 4
push 0x4f9e60
push ebx
call fcn.004c936a
add esp, 0xc
test eax, eax
jne 0x40a0d9
push 0x4fa7bc
call fcn.004c8d00
push 0
mov ebx, eax
call fcn.004c8d5f
mov ecx, dword [ebp - 0xf8]
mov edx, edi
add ecx, 8
cmovne edx, ecx
push edx
call fcn.004c8d00
push 0
mov esi, eax
call fcn.004c8d5f
test ebx, ebx
mov eax, edi
cmovne eax, ebx
push eax
call fcn.004c8d00
push 0
mov dword [ebp - 0xf0], eax
call fcn.004c8d5f
add esp, 0x18
lea ecx, [ebp - 0xf0]
push esi
call fcn.004050e0
push esi
call fcn.004c8d5f
mov esi, dword [ebp - 0xf0]
mov eax, edi
test esi, esi
cmovne eax, esi
push eax
call fcn.004c8d00
push dword [ebp - 0xf4]
mov edi, eax
mov dword [ebp - 0xf0], edi
call fcn.004c8d5f
push esi
call fcn.004c8d5f
push ebx
call fcn.004c8d5f
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0xf8]
add eax, 0xa
push eax
push dword [0x52ea10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp 0x40a272
push 4
push 0x4f9e80
push ebx
call fcn.004c936a
add esp, 0xc
test eax, eax
jne 0x40a172
push 0x4fa7e4
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0xf8], esi
call fcn.004c8d5f
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.00404ec0
mov ecx, edi
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004c8d00
push dword [ebp - 0xf4]
mov edi, eax
mov dword [ebp - 0xf0], edi
call fcn.004c8d5f
push dword [ebp - 0xfc]
call fcn.004c8d5f
push esi
call fcn.004c8d5f
add esp, 0x24
lea eax, [ebp - 0x104]
push eax
lea eax, [ebx + 0xa]
push eax
push htons
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp 0x40a272
push 4
push 0x4f9e54
push ebx
call fcn.004c936a
add esp, 0xc
test eax, eax
jne 0x40a1eb
push 0x4fa810
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0xfc], esi
call fcn.004c8d5f
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00404ec0
add esp, 0x14
lea ecx, [ebp - 0xf0]
push eax
call fcn.00404e30
push dword [ebp - 0xf4]
call fcn.004c8d5f
push esi
call fcn.004c8d5f
add esp, 8
lea eax, [ebp - 0x104]
push eax
lea eax, [ebx + 0xa]
push eax
push SysReAllocStringLen
jmp 0x40a266
push 3
push 0x4f9e78
push ebx
call fcn.004c936a
add esp, 0xc
test eax, eax
jne 0x40a29e
push 0x4fa838
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0xfc], esi
call fcn.004c8d5f
lea eax, [ebx + 6]
push eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00404ec0
add esp, 0x14
lea ecx, [ebp - 0xf0]
push eax
call fcn.00404e30
push dword [ebp - 0xf4]
call fcn.004c8d5f
push esi
call fcn.004c8d5f
add esp, 8
lea eax, [ebp - 0x104]
push eax
lea eax, [ebx + 8]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, dword [ebp - 0xf0]
test eax, eax
je 0x40a2c6
push 0x5c
push edi
call fcn.004c5767
add eax, 2
push 0x5c
push edi
mov dword [ebp - 0x10c], eax
call fcn.004c5767
add esp, 0x10
mov esi, 0x4f9d20
xor ecx, ecx
mov word [eax], cx
jmp 0x40a2ed
mov esi, 0x4f9d20
test ebx, ebx
mov eax, esi
cmovne eax, ebx
push eax
call fcn.004c8d00
push dword [ebp - 0xf4]
mov dword [ebp - 0xf0], eax
call fcn.004c8d5f
add esp, 8
jmp 0x40a2cb
mov esi, 0x4f9d20
push dword [ebp - 0x104]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4f9dfc
lea ecx, [ebp - 0xf0]
call fcn.004050e0
mov edi, dword [ebp - 0xf0]
push 0
push 0x4fa850
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, dword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [ebp - 0xf8], eax
test eax, eax
jne 0x40a433
mov eax, dword [0x539fdc]
test eax, eax
je 0x40a32c
push 0
call eax
push 0x100
push dword [0x539fd0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov dword [ebp - 0x160], 0x44
xorps xmm0, xmm0
mov word [ebp - 0x11e], ax
mov eax, 1
movlpd qword [ebp - 0x15c], xmm0
mov word [ebp - 0x130], ax
lea eax, [ebp - 0xfc]
push 0x4fa870
push eax
movlpd qword [ebp - 0x154], xmm0
movlpd qword [ebp - 0x14c], xmm0
movlpd qword [ebp - 0x144], xmm0
movlpd qword [ebp - 0x13c], xmm0
movlpd qword [ebp - 0x12e], xmm0
movlpd qword [ebp - 0x126], xmm0
mov dword [ebp - 0x134], 1
call fcn.00414b20
mov ebx, dword [ebp - 0x100]
mov eax, dword [eax]
test eax, eax
cmovne esi, eax
push esi
call fcn.004c8d00
mov esi, eax
push ebx
mov dword [ebp - 0x100], esi
call fcn.004c8d5f
push dword [ebp - 0xfc]
call fcn.004c8d5f
push esi
call fcn.00414c20
add esp, 0x18
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x160]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
je 0x40a418
push 0xffffffffffffffff
push dword [ebp - 0x11c]
call ebx
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x4fa850
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xf8], eax
jmp 0x40a463
lea ecx, [ebp - 0xfc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0xfc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0xf8]
test eax, eax
jne 0x40a484
push 0x30
push 0x4fa6f4
push 0x4fa8a8
push dword [ebp - 0x108]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40a67f
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 0xf8]
mov edi, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call edi
push 0
push 0x4fa948
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowExW]
push eax
mov dword [ebp - 0x108], eax
call edi
mov esi, dword [ebp - 0x108]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push dword [ebp - 0x11c]
call ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x10288
push 0x111
push dword [ebp - 0xf8]
call ebx
push 0xffffffffffffffff
push dword [ebp - 0x11c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edi, 0x1e
nop dword [eax]
push 0
push 0x25
push 0x100
push esi
call ebx
push 0xffffffffffffffff
push dword [ebp - 0x11c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
sub edi, 1
jne 0x40a500
mov edi, dword [ebp - 0xf0]
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0xf4], edi
movzx eax, word [edi]
test ax, ax
je 0x40a596
mov esi, dword [ebp - 0x108]
mov ecx, eax
cmp cx, 0x5c
jne 0x40a552
push 0
push 0x27
push 0x100
jmp 0x40a566
push ecx
call fcn.004c8eed
add esp, 4
movzx eax, ax
push 0
push eax
push 0x102
push esi
call ebx
push 0xffffffffffffffff
push dword [ebp - 0x11c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edx, dword [ebp - 0xf4]
add edx, 2
mov dword [ebp - 0xf4], edx
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x40a541
mov esi, dword [ebp - 0x100]
push 0xffffffffffffffff
push dword [ebp - 0x11c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp dword [ebp - 0x10c], 0
je 0x40a65f
push 0
push 0x4f9f3c
push 0
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_FindWindowExW]
push eax
mov dword [ebp - 0xf4], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0xf4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x44], 8
jbe 0x40a5f0
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x24
push 0x100
push dword [ebp - 0xf4]
call ebx
mov eax, dword [ebp - 0x10c]
movzx eax, word [eax]
test ax, ax
je 0x40a65f
mov esi, dword [ebp - 0x10c]
mov ecx, eax
mov edi, dword [ebp - 0xf4]
nop dword [eax]
push ecx
call fcn.004c8eed
add esp, 4
movzx eax, ax
push 0
push eax
push 0x102
push edi
call ebx
push 0xffffffffffffffff
push dword [ebp - 0x11c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
movzx eax, word [esi + 2]
lea esi, [esi + 2]
mov ecx, eax
test ax, ax
jne 0x40a620
mov edi, dword [ebp - 0xf0]
mov esi, dword [ebp - 0x100]
mov ebx, dword [ebp - 0xf8]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004c8d5f
push edi
call fcn.004c8d5f
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret