Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0xec
push 0
push 0x599ff8
call fcn.00449b30
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x599ffc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x599ff8], eax
mov eax, 0x58ca7c
mov dword [0x59a040], eax
call fcn.0043340a
call fcn.00472040
call fcn.0047143d
call fcn.00470f30
call fcn.0046fa00
call fcn.0046da1a
call fcn.0046d130
call fcn.0046ca08
call fcn.0046bf4a
call fcn.0046b6b5
call fcn.0046b5e1
call fcn.0046b345
call fcn.0046ae12
call fcn.0046a81e
call fcn.0046a1f2
call fcn.00468e90
call fcn.00468672
call fcn.00466e48
call fcn.0046562d
call fcn.00465306
call fcn.0045d462
call fcn.0045d295
call fcn.0045d0c0
call fcn.0045bf7d
call fcn.0045b81f
call fcn.0045aa8c
call fcn.00457b0e
call fcn.004577cb
call fcn.00457175
call fcn.0045642e
mov dword [section..data], 8
mov ebp, 0x401569
push ebp
call fcn.0045cea0
mov dword [section..data], 9
mov edx, 0x5800a8
lea ecx, [0x59a034]
call fcn.00433008
mov dword [section..data], 0x1000cd
lea eax, [0x422b3d]
push eax
pop dword [0x59a044]
mov dword [section..data], 0x159
push 7
push 0x58c9f4
lea eax, [0x59a0c4]
push eax
push 0x71
call fcn.0046bf69
mov dword [section..data], 0x15a
push 7
push 0x58ca68
lea eax, [0x59a0cc]
push eax
push 0x10
call fcn.0046bf69
mov dword [section..data], 0x15b
push 7
push 0x58ca40
lea eax, [0x59a0d4]
push eax
push 0x1c
call fcn.0046bf69
mov dword [section..data], 0x15c
push 7
push 0x58ca34
lea eax, [0x59a0dc]
push eax
push 8
call fcn.0046bf69
mov dword [section..data], 0x15d
mov dword [0x59a070], 0
mov dword [section..data], 0x15e
mov edx, str.Version_6.07
lea ecx, [0x59a0b4]
call fcn.00433008
mov dword [section..data], 0x15f
mov dword [0x59a0b8], 0
mov dword [section..data], 0x160
xor edx, edx
lea ecx, [0x59a05c]
call fcn.00433008
mov dword [section..data], 0x161
xor edx, edx
lea ecx, [0x59a04c]
call fcn.00433008
mov dword [section..data], 0x162
xor edx, edx
lea ecx, [0x59a064]
call fcn.00433008
mov dword [section..data], 0x163
xor edx, edx
lea ecx, [0x59a084]
call fcn.00433008
mov dword [section..data], 0x164
xor edx, edx
lea ecx, [0x59a080]
call fcn.00433008
mov dword [section..data], 0x165
xor edx, edx
lea ecx, [0x59a058]
call fcn.00433008
mov dword [section..data], 0x166
mov dword [0x59a098], 0
mov dword [section..data], 0x167
mov dword [0x59a024], 0xa
mov dword [section..data], 0x168
mov dword [0x59a028], 0xa
mov dword [section..data], 0x169
mov dword [0x59a054], 0x2a8
mov dword [section..data], 0x16a
mov dword [0x59a03c], 0x2f8
mov dword [section..data], 0x16b
mov edx, str.notepad.exe
lea ecx, [0x59a02c]
call fcn.00433008
mov dword [section..data], 0x16c
mov edx, str.notepad.exe
lea ecx, [0x59a0a0]
call fcn.00433008
mov dword [section..data], 0x16d
mov edx, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell_ise.exe
lea ecx, [0x59a0b0]
call fcn.00433008
mov dword [section..data], 0x16e
mov edx, str.notepad.exe
lea ecx, [0x59a038]
call fcn.00433008
mov dword [section..data], 0x16f
mov edx, str.notepad.exe
lea ecx, [0x59a050]
call fcn.00433008
mov dword [section..data], 0x170
mov edx, str.notepad.exe
lea ecx, [0x59a07c]
call fcn.00433008
mov dword [section..data], 0x171
mov edx, str.notepad.exe
lea ecx, [0x59a090]
call fcn.00433008
mov dword [section..data], 0x172
mov edx, str.notepad.exe
lea ecx, [0x59a078]
call fcn.00433008
mov dword [section..data], 0x173
xor edx, edx
lea ecx, [0x59a060]
call fcn.00433008
mov dword [section..data], 0x174
mov dword [0x59a0a8], 0x4e4
mov dword [section..data], 0x175
mov byte [0x59a0c0], 1
mov dword [section..data], 0x177
mov dword [0x59a010], 1
mov dword [0x59a014], 0
mov dword [section..data], 0x178
mov dword [0x59a018], 1
mov dword [0x59a01c], 0
mov dword [section..data], 0x179
mov dword [0x59a000], 1
mov dword [0x59a004], 0
mov dword [section..data], 0x17a
mov dword [0x59a008], 0
mov dword [0x59a00c], 0
mov dword [section..data], 0x17c
push edx
call fcn.00472070
pop edx
push eax
push edx
call fcn.00472070
pop edx
push eax
mov eax, str.WINDIR
push eax
call fcn.0045b84e
push 0x59a020
call fcn.004720a0
mov dword [section..data], 0x17e
mov edx, dword [0x59a020]
push edx
call fcn.00472070
pop edx
push eax
push edx
call fcn.00472110
mov edx, str.SysWOW64_amsi.dll
push edx
call fcn.00472110
push 0x59a06c
call fcn.004720a0
mov dword [section..data], 0x182
mov dword [0x59a0a4], 1
mov dword [section..data], 0x500005
mov dword [0x59a0ac], 0
mov dword [section..data], 0x500006
mov dword [0x59a088], 0
mov dword [section..data], 0x500007
mov dword [0x59a0bc], 0
mov dword [section..data], 0xf52
call fcn.00413b96
and eax, eax
je 0x401550
mov dword [section..data], 0xf53
call fcn.00423b3b
mov dword [section..data], 0xf54
call fcn.004228e0
mov dword [section..data], 0xf55
mov dword [section..data], 0xf58
jmp 0x401668
push 0
call 0x401687
call fcn.00472020
push dword [0x599ff8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0045639e
call fcn.00457789
call fcn.0045bf6b
call fcn.0045cf30
call fcn.0045d0b4
call fcn.0045d287
call fcn.0045d406
call sub.ole32.dll_OleUninitialize
call fcn.0046560a
call fcn.00468666
call fcn.0046875d
call fcn.00468e80
call fcn.0046a1d4
call fcn.0046ae01
call fcn.0046b6a9
call fcn.0046c9fb
call fcn.0046fa20
call fcn.004714cb
call fcn.004715e1
call fcn.00470f20
ret