Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x524
push 0
push 0x32fee44
call fcn.0041fa80
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x32fee48], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x32fee44], eax
mov eax, 0x4d82cc
mov dword [0x32fee58], eax
call fcn.0040975d
call fcn.00440110
call fcn.0043f547
call fcn.0043f020
call fcn.0043d7c0
call fcn.0043b5d2
call fcn.0043ae00
call fcn.0043a6d2
call fcn.00439d2e
call fcn.00439669
call fcn.00439304
call fcn.00439068
call fcn.00435b1e
call fcn.004354f2
call fcn.004341c0
call fcn.00433528
call fcn.004334f5
call fcn.004332f8
call fcn.00431d89
call fcn.00431a67
call fcn.0042f0d9
call fcn.0042e5ac
call fcn.0042db14
call fcn.0042d138
call fcn.0042c82a
call fcn.0042c41b
call fcn.0042c320
mov edx, 0x4d709c
lea ecx, [0x32fee78]
call fcn.00409008
mov dword [0x32fee4c], 0
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
lea eax, [0x32fee70]
push eax
call fcn.00440170
mov edx, 0x4d5028
lea ecx, [0x32fee74]
call fcn.00409008
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push 0x3e8
call fcn.0043dab0
lea eax, [0x32fee54]
push eax
call fcn.00440170
push 0x3e8
mov eax, dword [0x32fee54]
push eax
mov eax, 0x4d7026
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.00440140
pop edx
push eax
mov edx, dword [0x32fee54]
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.004401e0
mov edx, 0x4d7d8c
push edx
call fcn.004401e0
call fcn.00409522
add dword [esp], edx
call fcn.0043369c
call fcn.00409540
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4011c1
jl 0x4011bd
cmp ebx, 0
ja 0x4011c1
xor eax, eax
jmp 0x4011c6
mov eax, 1
or eax, eax
je 0x4011f7
mov edx, dword [0x32fee54]
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.004401e0
mov edx, 0x4d5894
push edx
call fcn.004401e0
lea eax, [0x32fee74]
push eax
call fcn.00440170
jmp 0x401222
mov edx, dword [0x32fee54]
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.004401e0
mov edx, 0x4d6714
push edx
call fcn.004401e0
lea eax, [0x32fee74]
push eax
call fcn.00440170
push 0xb
mov eax, 0x4d5368
push eax
push 0
call fcn.0043f644
push 8
mov eax, 0x4d5368
push eax
push 1
call fcn.0043f644
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.004337f3
call fcn.00440230
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.00409522
add dword [esp + 4], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x40131b
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d5228
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x40131b
jmp 0x401322
mov eax, 1
jmp 0x401324
xor eax, eax
and eax, eax
jne 0x401382
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d522c
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x401382
jmp 0x401389
mov eax, 1
jmp 0x40138b
xor eax, eax
and eax, eax
jne 0x4013e9
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d5214
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x4013e9
jmp 0x4013f0
mov eax, 1
jmp 0x4013f2
xor eax, eax
and eax, eax
jne 0x401450
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d532e
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x401450
jmp 0x401457
mov eax, 1
jmp 0x401459
xor eax, eax
and eax, eax
jne 0x4014b7
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d567a
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x4014b7
jmp 0x4014be
mov eax, 1
jmp 0x4014c0
xor eax, eax
and eax, eax
jne 0x40151e
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d56ac
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x40151e
jmp 0x401525
mov eax, 1
jmp 0x401527
xor eax, eax
and eax, eax
jne 0x401585
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d550c
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x401585
jmp 0x40158c
mov eax, 1
jmp 0x40158e
xor eax, eax
and eax, eax
jne 0x4015ec
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d5544
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x4015ec
jmp 0x4015f3
mov eax, 1
jmp 0x4015f5
xor eax, eax
and eax, eax
jne 0x401653
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d51e0
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x401653
jmp 0x40165a
mov eax, 1
jmp 0x40165c
xor eax, eax
and eax, eax
jne 0x4016ba
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d520c
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
call fcn.00409522
add dword [esp], edx
call fcn.0043db80
call fcn.00409540
mov ebx, eax
and ebx, ebx
jg 0x4016ba
jmp 0x4016c1
mov eax, 1
jmp 0x4016c3
xor eax, eax
and eax, eax
je 0x40174e
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
call fcn.0042c859
call fcn.00409522
add dword [esp], edx
call fcn.00433613
lea eax, [0x32fee64]
push eax
call fcn.00440170
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push dword [0x32fee64]
mov eax, 0x4d7192
push eax
call fcn.0042c622
lea eax, [0x32fee70]
push eax
call fcn.00440170
push dword [0x32fee70]
mov edx, 0x4d5028
pop ecx
call fcn.00409550
je 0x40174e
jmp 0x401c1d
mov eax, 0x4d5228
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x40177e
mov eax, 0x4d522c
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x40177e
jmp 0x401785
mov eax, 1
jmp 0x401787
xor eax, eax
and eax, eax
jne 0x4017a4
mov eax, 0x4d5214
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x4017a4
jmp 0x4017ab
mov eax, 1
jmp 0x4017ad
xor eax, eax
and eax, eax
jne 0x4017ca
mov eax, 0x4d532e
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x4017ca
jmp 0x4017d1
mov eax, 1
jmp 0x4017d3
xor eax, eax
and eax, eax
jne 0x4017f0
mov eax, 0x4d567a
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x4017f0
jmp 0x4017f7
mov eax, 1
jmp 0x4017f9
xor eax, eax
and eax, eax
jne 0x401816
mov eax, 0x4d56ac
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x401816
jmp 0x40181d
mov eax, 1
jmp 0x40181f
xor eax, eax
and eax, eax
jne 0x40183c
mov eax, 0x4d550c
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x40183c
jmp 0x401843
mov eax, 1
jmp 0x401845
xor eax, eax
and eax, eax
jne 0x401862
mov eax, 0x4d5544
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x401862
jmp 0x401869
mov eax, 1
jmp 0x40186b
xor eax, eax
and eax, eax
jne 0x401888
mov eax, 0x4d51e0
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x401888
jmp 0x40188f
mov eax, 1
jmp 0x401891
xor eax, eax
and eax, eax
jne 0x4018ae
mov eax, 0x4d520c
push eax
push dword [0x32fee70]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jg 0x4018ae
jmp 0x4018b5
mov eax, 1
jmp 0x4018b7
xor eax, eax
and eax, eax
je 0x4018c0
jmp 0x40124c
push 0x5a
push 0x18e
push 0
push 0
call fcn.00401c97
push 1
push 3
call fcn.0042f17d
push 1
push 4
call fcn.0042f17d
push 0xffffffff
push 0xffffffff
push 1
call fcn.0042f1bc
push 0xa
push 1
push 0x40a
push 1
call fcn.0042f1f8
push eax
call sub.USER32.dll_SendMessageW
call fcn.00431ab7
mov ebx, eax
cmp ebx, 0x50
jle 0x401b36
push edx
call fcn.00440140
pop edx
push eax
mov edx, dword [0x32fee70]
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.004401e0
mov edx, 0x4d68be
push edx
call fcn.004401e0
call fcn.00409522
add dword [esp], edx
call fcn.0043369c
call fcn.00409540
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401987
jl 0x401983
cmp ebx, 0
ja 0x401987
xor eax, eax
jmp 0x40198c
mov eax, 1
or eax, eax
je 0x401b36
push edx
call fcn.00440140
pop edx
push eax
mov edx, dword [0x32fee70]
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.004401e0
mov edx, 0x4d68be
push edx
call fcn.004401e0
call fcn.00440230
push 0
call fcn.00409522
add dword [esp + 4], edx
call fcn.004344a0
call fcn.00409540
and eax, eax
je 0x401b36
mov edx, 0x4d5028
lea ecx, [0x32fee6c]
call fcn.00409008
push 0
call fcn.00434620
mov dword [0x32fee5c], eax
push 0
call fcn.00434670
mov ebx, eax
and ebx, ebx
jne 0x401aa8
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
push 0
call fcn.004347f0
mov edx, 0x4d79ac
push edx
call fcn.004401e0
lea eax, [0x32fee50]
push eax
call fcn.00440170
mov eax, 0x4d5b38
push eax
push dword [0x32fee50]
call fcn.0043db80
mov ebx, eax
and ebx, ebx
jle 0x401aa3
mov edx, dword [0x32fee6c]
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.004401e0
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.00440140
pop edx
push eax
mov eax, 0x4d5028
push eax
mov eax, 0x4d5818
push eax
push dword [0x32fee50]
call fcn.0043def0
pop eax
lea eax, [0x32fee6c]
push eax
call fcn.00440170
jmp 0x4019ff
push 0
call fcn.004340d0
push dword [0x32fee6c]
mov edx, 0x4d5028
pop ecx
call fcn.00409550
jne 0x401b36
push edx
call fcn.00440140
pop edx
push eax
push 2
mov eax, 0x4d5028
push eax
push edx
call fcn.00440140
pop edx
push eax
mov edx, 0x4d6f04
push edx
call fcn.004401e0
mov edx, dword [0x32fee6c]
push edx
call fcn.004401e0
call fcn.00440230
mov edx, dword [0x32fee74]
push edx
call fcn.00440140
pop edx
push eax
push edx
call fcn.004401e0
mov edx, 0x4d751e
push edx
call fcn.004401e0
call fcn.00409522
add dword [esp], edx
call fcn.00409522
add dword [esp + 4], edx
call fcn.0042c8f2
call fcn.00409540
push 0
lea eax, [0x401ecf]
push eax
call fcn.0042c378
mov dword [0x32fee4c], eax
call fcn.00431df4
mov dword [0x32fee68], eax
push dword [0x32fee68]
call fcn.00402036
mov ebx, dword [0x32fee4c]
and ebx, ebx
jne 0x401c0b
push dword [0x32fee70]
mov edx, 0x4d5028
pop ecx
call fcn.00409550
je 0x401bf7
push 0
push 3
call fcn.0042f17d
push 0
push 4
call fcn.0042f17d
push 1
push 1
call fcn.0042f17d
push 1
push 2
call fcn.0042f17d
push 0xffff0001
push 0
call fcn.00431e43
mov ebx, eax
add ebx, 0xffffffd8
push ebx
push 0xffff0001
push 0x14
push 0
call fcn.0042f33b
mov eax, 0x4d5bbe
push eax
push 0
call fcn.0042f374
push 3
call fcn.0042f3c1
mov dword [0x32fee4c], 0xff
mov ebx, dword [0x32fee68]
cmp ebx, 0x333c
jne 0x401b4c