Function at 0x401000
Capabilities:
Allocate thread local storage
Get session integrity level
Inspect section memory permissions

Disassembly:
push 0x230
push 0
push 0x11de664
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x11de668], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x11de664], eax
mov eax, 0x4225dc
mov dword [0x11de704], eax
call fcn.0041a720
call fcn.004198c0
call fcn.004198a8
call fcn.00418f29
call fcn.00418de7
call fcn.00418d5b
call fcn.00413634
call fcn.00413155
call fcn.00412650
call fcn.00411bcc
call fcn.00410c2a
call fcn.0040cb2e
call fcn.0040b681
call fcn.0040b07f
call fcn.0040ab6e
call fcn.00409779
call fcn.004092d8
call fcn.00409100
call fcn.00408140
mov dword [0x11de718], 7
mov dword [0x11de798], 5
mov dword [0x11de774], 6
mov dword [0x11de804], 3
mov dword [0x11de6e0], 9
mov dword [0x11de7f0], 2
mov dword [0x11de83c], 1
mov dword [0x11de7fc], 0xd
mov dword [0x11de790], 0xb
mov dword [0x11de7a4], 0
mov dword [0x11de744], 4
mov dword [0x11de728], 0xc
mov dword [0x11de794], 8
mov dword [0x11de7dc], 0x20
mov dword [0x11de6b4], 0x100
mov dword [0x11de7d8], 0x1000
mov dword [0x11de6bc], 0x100
mov dword [0x11de6dc], 0x200
mov dword [0x11de7b4], 0x300
mov dword [0x11de6d4], 0x400
mov dword [0x11de78c], 0x800
mov dword [0x11de82c], 0xc00
mov dword [0x11de680], 0x80
mov dword [0x11de724], 0x40
mov dword [0x11de7d4], 0
mov dword [0x11de808], 0x8000
mov dword [0x11de7ec], 0x2000
mov dword [0x11de6c0], 0x4000
mov dword [0x11de780], 0x333c
mov dword [0x11de720], 1
mov dword [0x11de684], 0
mov dword [0x11de754], 2
mov dword [0x11de844], 0x332d
mov dword [0x11de770], 0x332e
mov dword [0x11de7b8], 0x333d
mov dword [0x11de818], 0x333e
mov dword [0x11de7c8], 0x3331
mov dword [0x11de7cc], 0x332c
mov dword [0x11de854], 0x80ca0000
mov dword [0x11de698], 0x800000
mov dword [0x11de7a8], 0x80000000
mov dword [0x11de75c], 0xc00000
mov dword [0x11de830], 0x2000000
mov dword [0x11de814], 0x4000000
mov dword [0x11de858], 0x8000000
mov dword [0x11de7e8], 0x400000
mov dword [0x11de6e4], 0x100000
mov dword [0x11de6f8], 0x1000000
mov dword [0x11de7e4], 0x10000
mov dword [0x11de6a4], 0x20000000
mov dword [0x11de700], 0x20000
mov dword [0x11de6f4], 0
mov dword [0x11de74c], 0xcf0000
mov dword [0x11de824], 0x80880000
mov dword [0x11de79c], 0x40000
mov dword [0x11de730], 0x80000
mov dword [0x11de768], 0x40000
mov dword [0x11de840], 0x200000
mov dword [0x11de7f4], 0x10000000
mov dword [0x11de820], 0x40000000
mov dword [0x11de77c], 0x20000
mov dword [0x11de68c], 0x10000
mov dword [0x11de6fc], 0x80
mov dword [0x11de674], 0x200
mov dword [0x11de72c], 0x2000
mov dword [0x11de740], 0x10
mov dword [0x11de7bc], 0x40000
mov dword [0x11de810], 0x200
mov dword [0x11de848], 0x400
mov dword [0x11de850], 1
mov dword [0x11de750], 0x40
mov dword [0x11de7f8], 0x300
mov dword [0x11de73c], 0x20000
mov dword [0x11de828], 8
mov dword [0x11de838], 0x20
mov dword [0x11de7b0], 0x80
mov dword [0x11de7d0], 0x100
mov dword [0x11de764], 0x80000
mov dword [0x11de7ac], 0x10000
call fcn.0041a770
push eax
call fcn.00405760
lea ebp, [0x11de85c]
lea eax, [ebp]
push eax
call fcn.0041a7b0
call fcn.0041a770
push eax
call fcn.004057bd
lea ebp, [0x11de85c]
lea eax, [ebp + 4]
push eax
call fcn.0041a7b0
call fcn.0041a770
push eax
call fcn.00402b71
lea ebp, [0x11de85c]
lea eax, [ebp + 8]
push eax
call fcn.0041a7b0
call fcn.0041a770
push eax
call fcn.00404f69
lea ebp, [0x11de85c]
lea eax, [ebp + 0xc]
push eax
call fcn.0041a7b0
call fcn.0041a770
push eax
push eax
push 0x420106
mov edx, dword [ebp]
call fcn.0041a770
push eax
call fcn.0041a840
mov edx, dword [ebp + 4]
call fcn.0041a840
mov edx, dword [ebp + 8]
call fcn.0041a840
mov edx, dword [ebp + 0xc]
call fcn.0041a840
call fcn.0041a8b2
add dword [esp], edx
call fcn.00409980
push 0x11de6c4
call fcn.0041a7b0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x421bce
call fcn.0041a840
call fcn.0041a8b2
add dword [esp], edx
call fcn.00411d87
call fcn.0041a8d0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x421bce
call fcn.0041a840
push 0x11de788
call fcn.0041a7b0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x421bce
call fcn.0041a840
call fcn.0041a920
push dword [0x11de6b8]
call fcn.0041a8b2
add dword [esp + 4], edx
call fcn.004127f0
call fcn.0041a8d0
mov ebp, 0x42aa0c
mov ebx, ebp
mov ebp, 0x42260c
sub ebx, ebp
push ebx
mov ebp, 0x42260c
push ebp
push dword [0x11de6b8]
call fcn.00412a40
push dword [0x11de6b8]
call fcn.004125d0
mov edx, 0x421e98
lea ecx, [0x11de678]
call fcn.00408008
mov edx, 0x420f00
lea ecx, [0x11de66c]
call fcn.00408008
mov edx, 0x42170e
lea ecx, [0x11de834]
call fcn.00408008
mov dword [0x11de800], 0
mov dword [0x11de7c0], 0
mov edx, 0x4213e0
lea ecx, [0x11de81c]
call fcn.00408008
mov edx, 0x4213e0
lea ecx, [0x11de670]
call fcn.00408008
mov dword [0x11de694], 0x50
mov edx, 0x421f6a
lea ecx, [0x11de778]
call fcn.00408008
mov dword [0x11de6c8], 0x19
mov edx, 0x420020
lea ecx, [0x11de6ec]
call fcn.00408008
mov edx, 0x420020
lea ecx, [0x11de6b0]
call fcn.00408008
mov dword [0x11de690], 0
mov edx, 0x420020
lea ecx, [0x11de708]
call fcn.00408008
call sub.SHELL32.DLL_IsUserAnAdmin
and eax, eax
je 0x40161e
jmp 0x40163c
push 5
push 0x4208d2
push 0x420430
push 0x40030
call fcn.004035e4
jmp fcn.00401c36
mov edx, 0x4211b8
lea ecx, [0x11de738]
call fcn.00408008
push dword [0x11de738]
push 1
push 0
push 0
call sub.KERNEL32.dll_CreateSemaphoreW
mov dword [0x11de67c], eax
mov ebx, dword [0x11de67c]
and ebx, ebx
je 0x40168b
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x40168b
mov eax, 1
jmp 0x40168d
xor eax, eax
and eax, eax
je 0x4016a1
push dword [0x11de67c]
call sub.KERNEL32.dll_CloseHandle
jmp fcn.00401c36
push 0x1000
push 0x2710
call fcn.004021af
push 0x100
push 0xa
push 0x421192
push 0
call fcn.00411be0
push 0x100
push 9
push 0x421192
push 1
call fcn.00411be0
push 0x100
push 0x18
push 0x421192
push 2
call fcn.00411be0
push 7
push 0x421192
push 3
call fcn.00411cc4
push 0x100
push 8
push 0x421192
push 4
call fcn.00411be0
push 0x100
push 6
push 0x421192
push 5
call fcn.00411be0
push 0x100
push 9
push 0x421192
push 6
call fcn.00411be0
push 0x1000
push 0x2710
call fcn.00402d8f
call fcn.004026af
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210de
call fcn.0041a840
call fcn.0041a8b2
add dword [esp], edx
call fcn.00411d87
call fcn.0041a8d0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210c4
call fcn.0041a840
call fcn.0041a8b2
add dword [esp], edx
call fcn.00411d87
call fcn.0041a8d0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210c4
call fcn.0041a840
call fcn.0041a8b2
add dword [esp], edx
call fcn.00411d87
call fcn.0041a8d0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210c4
call fcn.0041a840
push 0x11de70c
call fcn.0041a7b0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210c4
call fcn.0041a840
call fcn.0041a920
push dword [0x11de71c]
call fcn.0041a8b2
add dword [esp + 4], edx
call fcn.004127f0
call fcn.0041a8d0
mov ebp, 0x11d32da
mov ebx, ebp
mov ebp, 0xc98e0c
sub ebx, ebp
push ebx
mov ebp, 0xc98e0c
push ebp
push dword [0x11de71c]
call fcn.00412a40
push dword [0x11de71c]
call fcn.004125d0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210de
call fcn.0041a840
call fcn.0041a8b2
add dword [esp], edx
call fcn.00411d87
call fcn.0041a8d0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210de
call fcn.0041a840
push 0x11de760
call fcn.0041a7b0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210de
call fcn.0041a840
call fcn.0041a920
push dword [0x11de748]
call fcn.0041a8b2
add dword [esp + 4], edx
call fcn.004127f0
call fcn.0041a8d0
mov ebp, 0xc98e0c
mov ebx, ebp
mov ebp, 0x42aa0c
sub ebx, ebp
push ebx
mov ebp, 0x42aa0c
push ebp
push dword [0x11de748]
call fcn.00412a40
push dword [0x11de748]
call fcn.004125d0
push 0x10c80001
push 0x4215e8
push 0x55
push 0xe6
push 0
push 0
push 0x3e8
call fcn.00410f3a
mov dword [0x11de84c], eax
push 0x420026
push 0x28
push 0xbe
push 0xa
push 0x14
push 0xbba
call fcn.0040cda0
mov dword [0x11de69c], eax
push 0x4203a4
push 0x1e
push 0xb4
push 0x32
push 0x1e
push 0xbb9
call fcn.0040d040
mov dword [0x11de6cc], eax
push 0x42074c
push 0xbb9
call fcn.0040d156
push 0
push 0x3e8
call fcn.0041100d
lea eax, [0x403357]
push eax
push 0xea60
push 0
push 0
call sub.USER32.DLL_SetTimer
lea eax, [0x404c4b]
push eax
push 0x64
push 0
push 0
call sub.USER32.DLL_SetTimer
lea eax, [0x405fa8]
push eax
push 0x16e360
push 0
push 0
call sub.USER32.DLL_SetTimer
push 1
call fcn.00410a56
call fcn.0040581a
mov dword [0x11de710], eax
push dword [0x11de710]
mov ebx, dword [0x11de780]
cmp ebx, dword [esp]
jne 0x401aee
call fcn.0041a770
push eax
push 0x421bce
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0041205a
call fcn.0041a8d0
jmp fcn.00401c36
mov ebx, dword [0x11de7cc]
cmp ebx, dword [esp]
jne 0x401c30
call fcn.00405033
push eax
mov ebx, 0xbba
cmp ebx, dword [esp]
jne 0x401c2f
push 0xbb9
call fcn.0040d1a8
mov ebx, eax
cmp ebx, 1
jne 0x401bb7
push 1
push 0x3e8
call fcn.0041100d
call fcn.0040710a
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210de
call fcn.0041a840
push 0x11de80c
call fcn.0041a7b0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
call fcn.0041a920
push 0x421212
push dword [0x11de80c]
call fcn.0041a8b2
add dword [esp + 8], edx
call fcn.0040b530
call fcn.0041a8d0
jmp fcn.00401c36
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
mov edx, 0x4210de
call fcn.0041a840
push 0x11de80c
call fcn.0041a7b0
call fcn.0041a770
push eax
push eax
call fcn.0041a770
push eax
push eax
call fcn.00411cf6
call fcn.0041a8b2
add dword [esp], edx
call fcn.0040756e
call fcn.0041a920
push 0x421212
push dword [0x11de80c]
call fcn.0041a8b2
add dword [esp + 8], edx
call fcn.0040b530
call fcn.0041a8d0
jmp fcn.00401c36
pop eax
pop eax
jmp 0x401a96