Function at 0x41d462
Capabilities:
Allocate thread local storage
Get system information on windows
Map section object

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x74
mov dword [esp], 0x4b5120
mov eax, dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
call eax
sub esp, 4
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
call eax
mov dword [0x4b5100], eax
mov eax, dword [0x4b5100]
test eax, eax
jne 0x41d49b
mov dword [esp], str.do_on_process_attach
call fcn.0041d804
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
call eax
sub esp, 4
test eax, eax
jne 0x41d4bb
mov dword [esp], str.do_on_process_attach
call fcn.0041d804
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
fild qword [ebp - 0x40]
fld qword [0x4bc070]
fdivrp st(1)
fstp qword [0x4b5108]
mov eax, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
not eax
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_EncodePointer]
call eax
sub esp, 4
mov edx, 0
imul ebx, edx, 0x7f4a7c15
imul ecx, eax, 0x9e3779b9
add ecx, ebx
mov ebx, 0x7f4a7c15
mul ebx
add ecx, edx
mov edx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
movzx eax, word [0x4b5192]
cmp ax, 0x2a
mov eax, dword [ebp - 0xc]
mov edx, 0
mov ecx, 0x4b5192
mov dword [esp + 0x10], str.0123456789ABCDEF
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 8
mov dword [esp], ecx
call fcn.0041d3d2
movzx eax, word [0x4b51a4]
cmp ax, 0x23
mov ecx, 0x4b51a4
mov dword [esp + 0x10], str.GHJKLMNPQRSTUWXY
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x10
mov dword [esp], ecx
call fcn.0041d3d2
movzx eax, word [0x4b51c4]
test ax, ax
mov dword [esp], 0x4b51cc
mov eax, dword [sym.imp.KERNEL32.DLL_BaseGetNamedObjectDirectory]
call eax
sub esp, 4
test eax, eax
jns 0x41d5b7
mov dword [esp], str.do_on_process_attach
call fcn.0041d804
mov eax, dword [0x4b51cc]
test eax, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x4b51e0
mov dword [esp + 8], 0x4b51c8
mov dword [esp + 4], 0xf0006
lea eax, [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.ntdll.dll_NtCreateSection]
call eax
sub esp, 0x1c
test eax, eax
jns 0x41d60e
mov dword [esp], str.do_on_process_attach
call fcn.0041d804
mov eax, dword [ebp - 0x2c]
test eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 2
lea edx, [ebp - 0x34]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea edx, [ebp - 0x30]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.ntdll.dll_NtMapViewOfSection]
call eax
sub esp, 0x28
test eax, eax
jns 0x41d687
mov dword [esp], str.do_on_process_attach
call fcn.0041d804
mov eax, dword [ebp - 0x30]
test eax, eax
mov eax, dword [ebp - 0x34]
cmp eax, 0x117f
mov eax, dword [ebp - 0x30]
mov dword [0x4b5144], eax
mov eax, dword [0x4b5144]
mov eax, dword [eax]
test eax, eax
je 0x41d705
mov eax, dword [0x4b5144]
mov eax, dword [eax]
mov dword [0x4b5144], eax
mov eax, dword [0x4b5144]
mov eax, dword [eax + 4]
cmp eax, 0x117f
ja 0x41d6ce
mov dword [esp], str.do_on_process_attach
call fcn.0041d804
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
call eax
sub esp, 8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ntdll.dll_NtClose]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jmp 0x41d757
mov eax, dword [0x4b5144]
mov edx, dword [0x4b5144]
mov dword [eax], edx
mov eax, dword [0x4b5144]
mov dword [eax + 4], 0x1180
mov ebx, dword [0x4b5144]
mov eax, dword [sym.imp.KERNEL32.DLL_TlsAlloc]
call eax
mov dword [ebx + 8], eax
mov eax, dword [0x4b5144]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
jne 0x41d747
mov dword [esp], str.do_on_process_attach
call fcn.0041d804
mov eax, dword [0x4b5144]
add eax, 0x10
mov dword [esp], eax
call fcn.0041be28
mov ebx, dword [ebp - 4]
leave
ret