Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x524
push 0
push 0x3d1555c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x3d15560], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x3d1555c], eax
mov eax, 0x468270
mov dword [0x3d15570], eax
call fcn.0041c400
call fcn.0041b8c4
call fcn.0041b3d0
call fcn.00419ba0
call fcn.00417adc
call fcn.00417380
call fcn.00416960
call fcn.004158c9
call fcn.004151eb
call fcn.00414e9b
call fcn.00414c16
call fcn.00411a6c
call fcn.004114cd
call fcn.00410240
call fcn.0040f562
call fcn.0040e345
call fcn.0040b953
call fcn.0040ae1c
call fcn.0040a4ba
call fcn.00409a45
call fcn.00409165
call fcn.00408d91
call fcn.00408c99
mov edx, 0x465662
lea ecx, [0x3d15590]
call fcn.00408008
mov dword [0x3d15564], 0
mov edx, 0x465024
lea ecx, [0x3d15588]
call fcn.00408008
mov edx, 0x465024
lea ecx, [0x3d1558c]
call fcn.00408008
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push 0x3e8
call fcn.00419e50
push 0x3d1556c
call fcn.0041c490
push 0x3e8
mov eax, dword [0x3d1556c]
push eax
mov eax, 0x46704e
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041c450
pop edx
push eax
mov edx, dword [0x3d1556c]
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c520
mov edx, 0x467d34
push edx
call fcn.0041c520
call fcn.00408322
add dword [esp], edx
call fcn.0040f6ee
call fcn.00408340
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40117d
jl 0x401179
cmp ebx, 0
ja 0x40117d
xor eax, eax
jmp 0x401182
mov eax, 1
or eax, eax
je 0x4011b1
mov edx, dword [0x3d1556c]
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c520
mov edx, 0x4658c2
push edx
call fcn.0041c520
push 0x3d1558c
call fcn.0041c490
jmp 0x4011da
mov edx, dword [0x3d1556c]
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c520
mov edx, 0x466772
push edx
call fcn.0041c520
push 0x3d1558c
call fcn.0041c490
push 0xb
mov eax, 0x465354
push eax
push 0
call fcn.0041b9da
push 8
mov eax, 0x465354
push eax
push 1
call fcn.0041b9da
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
call fcn.0040f845
call fcn.0041c580
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
call fcn.00409194
call fcn.00408322
add dword [esp], edx
call fcn.0040f8a8
call fcn.00408322
add dword [esp], edx
call fcn.00408322
add dword [esp + 4], edx
call fcn.00419f60
call fcn.00408340
mov ebx, eax
and ebx, ebx
jle 0x4012f8
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
call fcn.00409194
call fcn.00408322
add dword [esp], edx
call fcn.0040f8a8
push 0x3d1557c
call fcn.0041c490
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push dword [0x3d1557c]
mov eax, 0x465e98
push eax
call fcn.00408e0e
push 0x3d15588
call fcn.0041c490
push dword [0x3d15588]
mov edx, 0x465024
pop ecx
call fcn.00408350
je 0x4012f8
jmp 0x401646
push 0x5a
push 0x18e
push 0
push 0
call fcn.004016b6
push 1
push 3
call fcn.0040b9f9
push 1
push 4
call fcn.0040b9f9
push 0xffffffff
push 1
call fcn.0040ba37
push 0xa
push 1
push 0x40a
push 1
call fcn.0040ba6f
push eax
call sub.USER32.DLL_SendMessageW
call fcn.0040e081
mov ebx, eax
cmp ebx, 0x50
jle 0x40155f
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
call fcn.0040f845
mov edx, 0x465678
push edx
call fcn.0041c520
call fcn.0041c580
push 0x6f
call fcn.00408322
add dword [esp + 4], edx
call fcn.00410470
call fcn.00408340
and eax, eax
je 0x40155f
mov ebp, 0x3d126de
mov ebx, ebp
mov ebp, 0x3d11f52
sub ebx, ebp
push ebx
mov ebp, 0x3d11f52
push ebp
push 0x6f
call fcn.004106c0
push 0x6f
call fcn.00410170
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
call fcn.0040f845
mov edx, 0x465678
push edx
call fcn.0041c520
call fcn.0041c580
push 0
call fcn.00408322
add dword [esp + 4], edx
call fcn.00410540
call fcn.00408340
and eax, eax
je 0x4014ee
push 0
call fcn.00410730
mov dword [0x3d15574], eax
push 0
call fcn.00410780
mov ebx, eax
and ebx, ebx
jne 0x4014e4
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
push 0
call fcn.00410930
mov edx, 0x467954
push edx
call fcn.0041c520
push 0x3d15568
call fcn.0041c490
mov eax, 0x465b66
push eax
push dword [0x3d15568]
call fcn.00419f60
mov ebx, eax
and ebx, ebx
jle 0x4014df
mov edx, dword [0x3d15584]
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c520
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c450
pop edx
push eax
mov eax, 0x465024
push eax
mov eax, 0x465846
push eax
push dword [0x3d15568]
call fcn.0041a2c0
pop eax
push 0x3d15584
call fcn.0041c490
jmp 0x40143f
push 0
call fcn.00410170
push edx
call fcn.0041c450
pop edx
push eax
push 2
mov eax, 0x465024
push eax
push edx
call fcn.0041c450
pop edx
push eax
mov edx, 0x466f2c
push edx
call fcn.0041c520
mov edx, dword [0x3d15584]
push edx
call fcn.0041c520
call fcn.0041c580
mov edx, dword [0x3d1558c]
push edx
call fcn.0041c450
pop edx
push eax
push edx
call fcn.0041c520
mov edx, 0x4674c6
push edx
call fcn.0041c520
call fcn.00408322
add dword [esp], edx
call fcn.00408322
add dword [esp + 4], edx
call fcn.00409233
call fcn.00408340
push 0
lea eax, [0x4018f5]
push eax
call fcn.00408cf1
mov dword [0x3d15564], eax
call fcn.0040e3b0
mov dword [0x3d15580], eax
push dword [0x3d15580]
call fcn.00401a43
mov ebx, dword [0x3d15564]
and ebx, ebx
jne 0x401634
push dword [0x3d15588]
mov edx, 0x465024
pop ecx
call fcn.00408350
je 0x401620
push 0
push 3
call fcn.0040b9f9
push 0
push 4
call fcn.0040b9f9
push 1
push 1
call fcn.0040b9f9
push 1
push 2
call fcn.0040b9f9
push 0xffff0001
push 0
call fcn.0040e3ff
mov ebx, eax
add ebx, 0xffffffd8
push ebx
push 0xffff0001
push 0x14
push 0
call fcn.0040bbb2
mov eax, 0x465bec
push eax
push 0
call fcn.0040bbeb
push 3
call fcn.0040bc36
mov dword [0x3d15564], 0xff
mov ebx, dword [0x3d15580]
cmp ebx, 0x333c
jne 0x401575
push 0
call 0x401665
call fcn.0041c430
push dword [0x3d1555c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00408c57
call fcn.00409a33
call fcn.0040a3ba
call fcn.0040ae10
call fcn.0040b8fd
call fcn.0040e322
call fcn.0040f551
call fcn.0040f927
call fcn.00410230
call fcn.004114af
call fcn.004151df
call fcn.00416953
call fcn.00419bc0
call fcn.0041ba31
call fcn.0041ba97
call fcn.0041b3c0
ret