Function at 0x45b390
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
mov eax, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
push esi
push edi
test eax, eax
jne 0x45b408
cmp byte [0x54aeda], cl
jne 0x45b3db
push ecx
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1a
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x45b3cc
cmp dword [ebp - 0xc], 0
setne byte [0x54aed9]
xor ecx, ecx
lea eax, [ebp - 8]
lock or dword [eax], ecx
mov byte [0x54aeda], 1
cmp byte [0x54aed9], 0
je 0x45b3f4
mov dword [ebp - 0x14], 0x480046
mov dword [ebp - 0x10], str.BaseNamedObjectsPhSvcWow64ApiPort
jmp 0x45b402
mov dword [ebp - 0x14], 0x3e003c
mov dword [ebp - 0x10], str.BaseNamedObjectsPhSvcApiPort
lea eax, [ebp - 0x14]
mov dword [ebp - 8], eax
test ebx, ebx
jne 0x45b41d
mov dword [ebp - 0x1c], 0xf70f2e80
lea ebx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0xffffffff
push dword [0x5496a0]
push 0x28
call sym.ProcessHacker.exe_PhCreateObject
mov edx, eax
mov ecx, 1
xor eax, eax
mov word [edx], ax
lock xadd dword [0x5496a8], ecx
inc ecx
mov dword [edx + 4], eax
dec cl
movzx eax, cl
push 2
push 0x546b94
mov byte [edx + 2], cl
mov dword [eax*4 + 0x54b7e0], edx
lea eax, [ebp - 0x2c]
mov dword [edx + 8], 0x45b320
mov dword [edx + 0xc], str.Client
push eax
mov dword [0x54c148], edx
mov dword [0x54c154], 0x54c150
mov dword [0x54c150], 0x54c150
call dword [sym.imp.ntdll.dll_RtlInitializeSid]
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
push 1
mov dword [eax], 0x20
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
push 0x544b3c
mov dword [eax], 0x220
call dword [sym.imp.ntdll.dll_RtlLengthSid]
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
add eax, 0x34
add esi, eax
push esi
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 1
push eax
mov dword [ebp - 0xc], eax
lea edi, [eax + 0x14]
call dword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
push 2
lea ecx, [esi - 0x14]
push ecx
push edi
call dword [sym.imp.ntdll.dll_RtlCreateAcl]
lea eax, [ebp - 0x2c]
push eax
push 0x1f0001
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0x544b3c
push 1
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0
push edi
mov edi, dword [ebp - 0xc]
push 1
push edi
call dword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
cmp byte [0x54aeda], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
jne 0x45b584
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1a
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x45b575
cmp dword [ebp - 0xc], 0
setne byte [0x54aed9]
xor ecx, ecx
lea eax, [ebp - 8]
lock or dword [eax], ecx
mov byte [0x54aeda], 1
cmp byte [0x54aed9], 0
mov ecx, 0xb0
push 0
mov eax, 0xa0
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x44]
push eax
push 0x54c15c
call dword [sym.imp.ntdll.dll_NtCreatePort]
push edi
push 0
push dword [0x54b674]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
js 0x45b6b6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x54c158], eax
mov esi, 2
jmp 0x45b5e0
push 0
push 0x45ae30
call sym.ProcessHacker.exe_PhCreateThread2
sub esi, 1
jne 0x45b5e0
push 1
push 1
push esi
push 0x1f0003
push 0x54c140
call dword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x45b6b8
push esi
push 1
push esi
push 0x1f0003
push 0x54c144
call dword [sym.imp.ntdll.dll_NtCreateEvent]
mov edi, eax
test edi, edi
jns 0x45b63f
push dword [0x54c140]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
test esi, esi
je 0x45b670
mov eax, dword [0x54c140]
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, dword [0x54c144]
mov dword [esi + 8], eax
lea eax, [ebp - 0xc]
lock or dword [eax], ecx
cmp byte [esi], cl
je 0x45b670
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push dword [0x54c140]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test esi, esi
je 0x45b689
cmp byte [esi], 0
jne 0x45b6ab
push ebx
push 0
push dword [0x54c144]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov edi, eax
test esi, esi
je 0x45b6a3
cmp byte [esi], 0
jne 0x45b6ab
cmp edi, 0x102
jne 0x45b670
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4