Function at 0x402d3b
Capabilities:
Allocate thread local storage
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x40d008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x40d444], 0
jne 0x403335
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x40d01c], eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x20c]
push str.yboxrunner
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
push str.libtcmalloc.dll
mov dword [0x40d440], eax
call esi
xor ebx, ebx
mov dword [0x40d474], eax
push ecx
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
call fcn.004033d2
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x403685
push eax
lea ecx, [ebp - 0x220]
call fcn.0040337e
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x40364a
push eax
lea ecx, [ebp - 0x220]
call fcn.0040337e
push str.ntdll.dll
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LdrUnloadDll
push eax
call esi
mov edi, eax
lea ecx, [ebp - 0x220]
test edi, edi
je 0x402e44
mov dword [ebp - 0x240], edi
lea eax, [ebp - 0x240]
jmp 0x402e55
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x244]
push eax
call fcn.0040337e
xor eax, eax
mov byte [ebp - 0x211], bl
mov ebx, dword [0x40d474]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
test ebx, ebx
je 0x4031b2
push str.tc_version
push ebx
call esi
lea ecx, [ebx + 0xa380]
mov dword [ebp - 0x230], ecx
lea esi, [ebx + 0xa0f0]
lea ecx, [ebx + 0x7270]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x234], ecx
xor ecx, ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x238]
push ecx
call eax
add esp, 0xc
lea ecx, [ebp - 0x224]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
push 0x100
lea ecx, [ebp - 0x224]
call dword [sym.imp.Common.dll_public:_wchar_t____thiscall_CTXStringW::GetBuffer_int_]
push 0x409f7c
lea ecx, [ebp - 0x224]
call dword [0x4090ac]
cmp dword [ebp - 0x238], 2
mov esi, dword [sym.imp.Common.dll_public:_void___cdecl_CTXStringW::AppendFormat_wchar_t_const__]
je 0x402f2b
push dword [ebp - 0x238]
lea eax, [ebp - 0x224]
push str.major_2__d_r_n
push eax
call esi
add esp, 0xc
cmp dword [ebp - 0xc], 4
je 0x402f45
push dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push str.minor_4__d_r_n
push eax
call esi
add esp, 0xc
push dword [ebp - 0x228]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
test eax, eax
je 0x402f6d
push dword [ebp - 0x228]
lea eax, [ebp - 0x224]
push str.strlen_patch__0__S_r_n
push eax
call esi
add esp, 0xc
mov eax, dword [ebp - 0x210]
cmp dword [eax], 0xa1ec8b55
je 0x402f8e
push dword [eax]
lea eax, [ebp - 0x224]
push str._DWORD_pfnDoMalloc_0xa1ec8b55__p_r_n
push eax
call esi
add esp, 0xc
mov eax, dword [ebp - 0x230]
cmp dword [eax], 0x6aec8b55
je 0x402faf
push dword [eax]
lea eax, [ebp - 0x224]
push str._DWORD_pfnDoFree_0x6aec8b55__p_r_n
push eax
call esi
add esp, 0xc
mov eax, dword [ebp - 0x234]
cmp dword [eax], 0x83ec8b55
je 0x402fd0
push dword [eax]
lea eax, [ebp - 0x224]
push str._DWORD_pfnInvalidSize_0x83ec8b55__p_r_n
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x224]
push 0x409f7c
push eax
call dword [sym.imp.Common.dll_bool___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
pop ecx
pop ecx
test al, al
je 0x40319e
push str.tc_malloc_size
push dword [0x40d474]
mov byte [ebp - 0x211], 1
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp - 0x210]
lea ecx, [ebp - 0x220]
mov dword [0x40d484], eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x210], esi
call fcn.0040337e
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040337e
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040337e
lea eax, [ebx + 0x70e9]
mov dword [0x40d488], eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040337e
mov eax, dword [ebp - 0x21c]
lea ecx, [ebx + 0x7070]
mov dword [ebp - 0x210], ecx
cmp dword [ebp - 0x218], eax
je 0x4030b3
mov dword [eax], ecx
mov eax, dword [ebp - 0x21c]
add eax, 4
mov dword [ebp - 0x21c], eax
jmp 0x4030cc
lea ecx, [ebp - 0x210]
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.004034c8
mov eax, dword [ebp - 0x21c]
lea ecx, [ebx + 0xfccf]
mov dword [ebp - 0x210], ecx
cmp dword [ebp - 0x218], eax
je 0x4030f3
mov dword [eax], ecx
mov ecx, dword [ebp - 0x21c]
add ecx, 4
mov dword [ebp - 0x21c], ecx
jmp 0x40310c
lea ecx, [ebp - 0x210]
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.004034c8
mov ecx, dword [ebp - 0x21c]
mov eax, dword [0x40d474]
add eax, 0xfcd4
mov dword [0x40d44c], eax
lea eax, [ebx + 0xf860]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x218], ecx
je 0x403142
mov dword [ecx], eax
mov eax, dword [ebp - 0x21c]
add eax, 4
mov dword [ebp - 0x21c], eax
jmp 0x40315b
lea eax, [ebp - 0x210]
push eax
push ecx
lea ecx, [ebp - 0x220]
call fcn.004034c8
mov eax, dword [ebp - 0x21c]
add ebx, 0xa0da
mov dword [ebp - 0x210], ebx
cmp dword [ebp - 0x218], eax
je 0x40317a
mov dword [eax], ebx
add dword [ebp - 0x21c], 4
jmp 0x40318d
lea ecx, [ebp - 0x210]
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.004034c8
mov eax, dword [0x40d474]
add eax, 0xa0df
mov dword [0x40d448], eax
jmp 0x4031a4
mov esi, dword [ebp - 0x210]
lea ecx, [ebp - 0x224]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x4031b4
mov esi, eax
mov ebx, dword [sym.imp.Common.dll_DetourFunctionWrapper]
test edi, edi
je 0x4031cb
push 0x40d470
push 0x4025c9
push edi
jmp 0x4031db
push 0x40d46c
push 0x402318
push dword [sym.imp.KERNEL32.dll_FreeLibrary]
call ebx
add esp, 0xc
cmp byte [ebp - 0x211], 0
je 0x4032e9
push 0x40d478
push 0x40295c
push esi
call ebx
push 0x40d47c
push 0x4029f4
push dword [ebp - 0x230]
call ebx
push 0x40d480
push 0x402a8c
push dword [ebp - 0x234]
call ebx
mov esi, dword [0x40d488]
mov eax, 0x402b1c
and dword [ebp - 0x228], 0
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x24
sub eax, 5
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], eax
call edi
lea ecx, [ebp - 0x228]
push ecx
push 5
lea ecx, [ebp - 0xc]
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov ecx, dword [ebp - 0x22c]
mov eax, 0x402bec
sub eax, ecx
sub eax, 0xa0df
mov dword [ebp - 0xb], eax
lea eax, [ecx + 0xa0da]
lea ecx, [ebp - 0x228]
push ecx
push 5
lea ecx, [ebp - 0xc]
push ecx
push eax
call edi
push eax
call esi
mov ecx, dword [ebp - 0x22c]
mov eax, 0x402b7f
sub eax, ecx
sub eax, 0xfcd4
mov dword [ebp - 0xb], eax
lea eax, [ecx + 0xfccf]
lea ecx, [ebp - 0x228]
push ecx
push 5
lea ecx, [ebp - 0xc]
push ecx
push eax
call edi
push eax
call esi
mov esi, dword [ebp - 0x22c]
push 0x40d48c
push 0x402c06
lea eax, [esi + 0x7070]
push eax
call ebx
push 0x40d490
lea eax, [esi + 0xf860]
push 0x402c68
push eax
call ebx
add esp, 0x18
push 0x40d494
push 0x402cc2
push 0x403685
call ebx
push 0x40d498
push 0x402cfc
push 0x40364a
call ebx
mov ecx, dword [ebp - 0x220]
add esp, 0x18
mov dword [0x40d444], 1
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x403335
mov edx, dword [ebp - 0x218]
sub edx, ecx
and edx, 0xfffffffc
call fcn.004035de
mov ecx, dword [ebp - 4]
mov eax, 0x40d464
xor ecx, ebp
call fcn.00407c04
leave
ret