Function at 0x401722
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x404448
mov dword [0x404458], ebx
mov dword [0x404448], ebx
mov dword [0x404460], 1
mov dword [0x404464], ebx
mov dword [0x404470], 0x401438
mov dword [0x404084], esi
mov edi, 0x404470
mov ecx, dword [edi]
lea eax, [esi + 8]
push eax
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
push 1
push ecx
push esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
push 0x4016a2
add edi, 4
mov dword [esi + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov esi, dword [esi]
test esi, esi
jne 0x401768
mov esi, 0x404084
cmp dword [0x40447c], ebx
jne 0x4017e8
push 0x404058
push ebx
push ebx
push 0x4010c8
call dword [sym.imp.ntdll.dll_EtwEventRegister]
test eax, eax
jne 0x4017c5
mov dword [0x40447c], 1
mov ecx, dword [0x404084]
cmp ecx, esi
je 0x4017e8
test byte [ecx + 0x1c], 4
je 0x4017e8
push eax
push 0x4014c8
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0040158d
call fcn.00402835
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
jne 0x401829
mov eax, dword [0x404084]
cmp eax, esi
je 0x401829
test byte [eax + 0x1c], 1
je 0x401829
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x404084]
push 0x401428
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040158d
call dword [sym.imp.KERNEL32.dll_GetErrorMode]
or eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [reloc.ADVAPI32.dll_UnregisterTraceGuids], 0xffffffff
jne 0x40184d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [reloc.ADVAPI32.dll_UnregisterTraceGuids], eax
push 0x80000000
push ebx
push 0x401104
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov esi, eax
test esi, esi
je 0x401881
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x40187a
push edi
jmp 0x40187b
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
lea eax, [esp + 0x18]
push eax
call fcn.00401a79
mov edi, eax
test edi, edi
js 0x4018a8
lea eax, [esp + 0x18]
push eax
call fcn.00401955
mov edi, eax
test edi, edi
js 0x4018a8
call fcn.004021b6
mov edi, eax
cmp dword [0x40447c], ebx
je 0x4018f3
push dword [0x40405c]
push dword [0x404058]
call dword [sym.imp.ntdll.dll_EtwEventUnregister]
test eax, eax
jne 0x4018cc
mov dword [0x40447c], ebx
mov esi, dword [0x404084]
cmp esi, 0x404084
je 0x40192d
test byte [esi + 0x1c], 4
je 0x4018f9
push eax
push 0x4014c8
push DeleteCriticalSection
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.0040158d
mov esi, dword [0x404084]
cmp esi, 0x404084
je 0x40192d
jmp 0x40191f
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x40191d
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov esi, dword [esi]
test esi, esi
jne 0x401903
mov dword [0x404084], 0x404084
mov eax, dword [reloc.ADVAPI32.dll_UnregisterTraceGuids]
cmp eax, reloc.ADVAPI32.dll_UnregisterTraceGuids
je 0x401945
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [reloc.ADVAPI32.dll_UnregisterTraceGuids], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10