Function at 0x412b20
Capabilities:
Access peb ldr_data
Allocate thread local storage
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b73f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4cf06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ebx, [edi + 0x18]
mov dword [edi], vtable.FastCopy.0
mov ecx, ebx
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00456470
mov dword [ebp - 4], 0
lea ecx, [edi + 0x7b0]
push 0
mov dword [edi + 0x7a8], 0
mov dword [edi + 0x7ac], 0
call fcn.00455d90
push 0
lea ecx, [edi + 0x7d0]
mov byte [ebp - 4], 1
call fcn.00455d90
push 0
lea ecx, [edi + 0x7f0]
mov byte [ebp - 4], 2
call fcn.00455d90
push 0
lea ecx, [edi + 0x810]
mov byte [ebp - 4], 3
call fcn.00455d90
mov dword [edi + 0x8d4], 0
mov dword [edi + 0x8d8], 0xffffffff
mov dword [edi + 0xb60], 0
mov dword [edi + 0xb64], 0
mov dword [edi + 0xb68], 0
mov dword [edi + 0xb6c], 0
mov dword [edi + 0xb70], 0
mov dword [edi + 0xb74], 0
mov dword [edi + 0xb78], 0
mov dword [edi + 0xb7c], 0
mov dword [edi + 0xb80], 0
lea esi, [edi + 0xb88]
mov byte [ebp - 4], 8
push 0
push 0
mov ecx, esi
mov byte [edi + 0xb84], 0
mov dword [ebp - 0x14], esi
call fcn.004593a0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
lea esi, [edi + 0xba4]
mov byte [ebp - 4], 9
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004593a0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
lea esi, [edi + 0xbc0]
mov byte [ebp - 4], 0xa
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004593a0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
push 0
push 0
lea ecx, [edi + 0xbdc]
mov byte [ebp - 4], 0xb
call fcn.004593a0
push 0
push 0
lea ecx, [edi + 0xbf0]
mov byte [ebp - 4], 0xc
call fcn.004593a0
push 0
push 0
lea ecx, [edi + 0xc04]
mov byte [ebp - 4], 0xd
call fcn.004593a0
push 0
push 0
lea ecx, [edi + 0xc18]
mov byte [ebp - 4], 0xe
call fcn.004593a0
push 0
push 0
lea ecx, [edi + 0xc2c]
mov byte [ebp - 4], 0xf
call fcn.004593a0
lea esi, [edi + 0xc40]
mov byte [ebp - 4], 0x10
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004593a0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
lea esi, [edi + 0xc5c]
mov byte [ebp - 4], 0x11
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004593a0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
lea esi, [edi + 0xc78]
mov byte [ebp - 4], 0x12
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004593a0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
push 0
push 0
lea ecx, [edi + 0xc94]
mov byte [ebp - 4], 0x13
call fcn.004593a0
push 0
lea ecx, [edi + 0xca8]
mov byte [ebp - 4], 0x14
push 0
call fcn.004593a0
push 0
push 0
lea ecx, [edi + 0xcbc]
mov byte [ebp - 4], 0x15
call fcn.004593a0
push 0
push 0
lea ecx, [edi + 0xcd0]
mov byte [ebp - 4], 0x16
call fcn.004593a0
lea eax, [edi + 0xce4]
mov dword [eax], 0
mov dword [eax], eax
mov dword [eax + 4], eax
lea ecx, [edi + 0xd18]
mov dword [eax + 8], 0
lea eax, [edi + 0xcf0]
mov dword [eax], 0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], 0
lea eax, [edi + 0xcfc]
mov dword [eax], 0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], 0
lea eax, [edi + 0xd08]
mov dword [eax], 0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], 0
lea eax, [ecx + 0xc]
mov dword [edi + 0xd14], 0x4c279c
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
mov dword [ecx + 8], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x10], eax
lea eax, [ecx + 0x18]
mov dword [ecx + 0x14], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], 0
mov dword [edi + 0xd3c], 0
mov dword [edi + 0xd40], 0
mov dword [edi + 0xd44], 0x4c279c
lea ecx, [edi + 0xd48]
lea eax, [ecx + 0xc]
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
mov dword [ecx + 8], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x10], eax
lea eax, [ecx + 0x18]
mov dword [ecx + 0x14], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], 0
mov dword [edi + 0xd6c], 0
mov dword [edi + 0xd70], 0
mov dword [edi + 0xd74], 0x4c279c
lea ecx, [edi + 0xd78]
lea eax, [ecx + 0xc]
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
mov dword [ecx + 8], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x10], eax
lea eax, [ecx + 0x18]
mov dword [ecx + 0x14], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], 0
mov dword [edi + 0xd9c], 0
mov dword [edi + 0xda0], 0
lea esi, [edi + 0xdd0]
mov byte [ebp - 4], 0x1a
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004593a0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [edi + 0xdf0], 0x4c27a4
lea ecx, [edi + 0xdf4]
lea eax, [ecx + 0xc]
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
mov dword [ecx + 8], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x10], eax
lea eax, [ecx + 0x18]
mov dword [ecx + 0x14], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], 0
mov dword [edi + 0xe18], 0
mov dword [edi + 0xe1c], 0
push 0
push 0
lea ecx, [edi + 0xe20]
mov byte [ebp - 4], 0x1c
call fcn.004593a0
mov dword [edi + 0xe38], 0x4c27d4
lea ecx, [edi + 0xe3c]
lea eax, [ecx + 0xc]
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
mov dword [ecx + 8], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x10], eax
lea eax, [ecx + 0x18]
mov dword [ecx + 0x14], 0
mov dword [eax + 4], 0
mov dword [eax], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], 0
mov dword [edi + 0xe60], 0
mov dword [edi + 0xe64], 0
lea ecx, [edi + 0xf00]
mov dword [edi + 0xef4], 0
mov dword [edi + 0xef8], 0
mov dword [edi + 0xefc], 0
call fcn.00454c00
lea ecx, [edi + 0xf28]
mov byte [ebp - 4], 0x1f
call fcn.00458ea0
lea ecx, [edi + 0xf4c]
mov byte [ebp - 4], 0x20
call fcn.00458ea0
lea ecx, [edi + 0xf70]
mov byte [ebp - 4], 0x21
call fcn.00458ea0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0xf94]
push eax
call esi
lea eax, [edi + 0xfac]
push eax
call esi
lea eax, [edi + 0xfc4]
push eax
call esi
lea esi, [edi + 0x101c]
mov byte [ebp - 4], 0x25
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.0045ea80
mov byte [ebp - 4], 0x26
push 0
push 0
lea ecx, [esi + 0x1c]
call fcn.004593a0
push 0x40
lea eax, [esi + 0x30]
push 0
push eax
call fcn.00481280
add esp, 0xc
lea esi, [edi + 0x108c]
mov byte [ebp - 4], 0x27
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.0045ea80
push 0
push 0
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 0x28
call fcn.004593a0
push 0x40
lea eax, [esi + 0x30]
push 0
push eax
call fcn.00481280
push ecx
lea ecx, [edi + 0x10fc]
mov byte [ebp - 4], 0x29
call fcn.00457c80
sub esp, 0x10
mov byte [ebp - 4], 0x2a
lea ecx, [edi + 0x1148]
call fcn.00457c80
sub esp, 0x10
mov byte [ebp - 4], 0x2b
lea ecx, [edi + 0x1194]
call fcn.00457c80
sub esp, 0x10
mov byte [ebp - 4], 0x2c
lea ecx, [edi + 0x11e0]
call fcn.00457c80
sub esp, 0x10
mov byte [ebp - 4], 0x2d
lea ecx, [edi + 0x122c]
call fcn.00457c80
sub esp, 0x10
mov byte [ebp - 4], 0x2e
lea ecx, [edi + 0x1278]
call fcn.00457c80
lea eax, [edi + 0x12d4]
mov dword [ebp - 0x14], eax
mov dword [eax + 4], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 1
mov dword [eax + 8], 0
mov dword [eax], vtable.TLinkHashTbl.0
push 0x78
mov byte [ebp - 4], 0x30
lea eax, [edi + 0xe7c]
push 0
push eax
mov dword [edi + 0xe78], 0
mov dword [edi + 0xe74], 0
mov dword [edi + 0xe70], 0
mov dword [edi + 0xe6c], 0
call fcn.00481280
add esp, 0xc
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x888], 1
mov ecx, str.SeBackupPrivilege
call fcn.0045afc0
test eax, eax
jne 0x41320f
mov dword [edi + 0x888], eax
mov ecx, str.SeRestorePrivilege
call fcn.0045afc0
test eax, eax
jne 0x413223
mov dword [edi + 0x888], eax
mov ecx, str.SeManageVolumePrivilege
mov dword [edi + 0x88c], 1
call fcn.0045afc0
test eax, eax
jne 0x413241
mov dword [edi + 0x88c], eax
mov ecx, str.SeSecurityPrivilege
mov dword [edi + 0x890], 1
call fcn.0045afc0
test eax, eax
jne 0x41325f
mov dword [edi + 0x890], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x41326f
mov dword [edi + 0x890], eax
mov ecx, str.SeCreateSymbolicLinkPrivilege
mov dword [edi + 0x894], 0
call fcn.0045afc0
lea esi, [edi + 0xf00]
push ebx
mov ecx, esi
call fcn.00454c60
push 0x10208
mov dword [ebx], esi
call fcn.0047d522
push 0x10208
mov dword [edi + 0x830], eax
call fcn.0047d522
push 0x10208
mov dword [edi + 0x834], eax
call fcn.0047d522
xor ecx, ecx
mov dword [edi + 0x838], eax
push pe_nt_image_headers32
push ecx
mov word [eax], cx
mov eax, dword [edi + 0x834]
mov word [eax], cx
mov eax, dword [edi + 0x830]
mov word [eax], cx
lea eax, [edi + 0x8e0]
push eax
mov dword [edi + 0x840], ecx
mov dword [edi + 0x848], ecx
mov dword [edi + 0x844], ecx
mov dword [edi + 0x84c], ecx
call fcn.00481280
push pe_nt_image_headers32
lea esi, [edi + 0xa18]
push 0
push esi
call fcn.00481280
mov dword [edi + 0xb50], esi
add esp, 0x24
mov dword [edi + 0x868], 0x4d0
mov dword [edi + 0xfdc], 0
mov dword [edi + 0xfe0], 0
mov dword [edi + 0xfe8], 0
mov dword [edi + 0xfe4], 0
mov dword [edi + 0xfec], 0
mov dword [edi + 0x83c], 0
mov eax, dword [0x4d3d8c]
cmp eax, 7
jae 0x413382
cmp eax, 6
jne 0x41337e
cmp dword [0x4d3d90], 1
jae 0x413382
xor eax, eax
jmp 0x413387
mov eax, 1
mov dword [edi + 0x898], eax
mov eax, dword [0x4d3d8c]
cmp eax, 7
jae 0x4133a9
cmp eax, 6
jne 0x4133a5
cmp dword [0x4d3d90], 1
jae 0x4133a9
xor eax, eax
jmp 0x4133ae
mov eax, 2
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0x89c], eax
mov dword [edi + 0x8a0], 4
call esi
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
call fcn.0045fff0
push ecx
push 0x400000
push 0x10000
lea ecx, [edi + 0xca8]
mov dword [edi + 0xbec], 1
mov dword [edi + 0xc00], 1
mov dword [edi + 0xc14], 1
mov dword [edi + 0xc28], 1
mov dword [edi + 0xc3c], 1
mov dword [edi + 0xde0], 1
mov dword [edi + 0xc50], 1
mov dword [edi + 0xc6c], 1
mov dword [edi + 0xc88], 1
mov dword [edi + 0xca4], 1
mov dword [edi + 0xcb8], 1
mov dword [edi + 0xccc], 1
mov dword [edi + 0xce0], 1
mov dword [edi + 0x110c], 1
mov dword [edi + 0x1158], 1
mov dword [edi + 0x11a4], 1
mov dword [edi + 0x11f0], 1
mov dword [edi + 0x123c], 1
mov dword [edi + 0x1288], 1
call fcn.00459420
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret