Function at 0x405cf0
Capabilities:
Acquire debug privileges
Allocate thread local storage
Enumerate processes
Get common file path
Query environment variable
Set environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53a760], 0
jne 0x4061c6
push esi
push 0x4fa1d8
push 1
push 0x4fa1f8
mov byte [0x53a760], 1
call fcn.0042f970
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
call esi
push 0x4fa214
push 1
push 0x4fa1f8
mov dword [0x539fdc], eax
call fcn.0042f970
add esp, 8
push eax
call esi
push 0x4fa234
push 1
push 0x4fa1f8
mov dword [0x53a3f0], eax
call fcn.0042f970
add esp, 8
push eax
call esi
push 0x4f9e34
push 1
push 0x4fa254
mov dword [0x53a3f4], eax
call fcn.0042f970
add esp, 8
push eax
call esi
mov dword [0x539fb0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
push 0
mov dword [0x539fd0], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x104
push 0x539720
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
movzx eax, word [ecx + 0x539720]
lea ecx, [ecx + 2]
mov word [ecx + 0x539fde], ax
test ax, ax
jne 0x405db4
mov ecx, 0x539fe0
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x405dd2
mov eax, dword [0x4fa288]
mov dword [ecx], eax
mov eax, dword [0x4fa28c]
mov dword [ecx + 4], eax
mov eax, dword [0x4fa290]
mov dword [ecx + 8], eax
mov eax, dword [0x4fa294]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4fa298]
push 0x104
push 0x53a1e8
mov dword [ecx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x405e36
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ecx + 0x539fe0]
lea ecx, [ecx + 2]
mov word [ecx + 0x53a1e6], ax
test ax, ax
jne 0x405e20
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push 0x539928
push 0x4fa29c
call esi
mov ecx, 0x539928
mov eax, 0x4fa29c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405e7d
test dx, dx
je 0x405e79
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405e7d
add eax, 4
add ecx, 4
test dx, dx
jne 0x405e57
xor eax, eax
jmp 0x405e82
sbb eax, eax
or eax, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x405eaa
push 0x104
push 0x539928
push 0x4fa2bc
call esi
push 0x539928
push 0x4fa2dc
call edi
push 0x104
push 0x539b30
push 0x4fa2f8
call esi
push 0x4fa320
push 0x539928
call fcn.004c580a
add esp, 8
test eax, eax
je 0x405ef4
push 0x4fa320
push 0x539928
call fcn.004c580a
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0x539928
push 0x4fa330
call edi
push 0x104
push 0x539d38
push 0x4fa354
call esi
test eax, eax
jne 0x405f3d
push 0x104
push 0x539d38
push 0x4fa370
call esi
test eax, eax
jne 0x405f3d
movzx eax, word [0x539720]
push eax
push 0x4fa394
push 0x104
push 0x539d38
call fcn.00404780
add esp, 0x10
push ebx
push 0xffffffffffffffff
push 0x4fa3b8
push 0x104
push 0x539d38
call fcn.004c9286
lea eax, [ebp - 0x234]
push 0x4ff794
push eax
call fcn.00414b20
mov esi, dword [0x53a400]
mov edi, 0x4f9d20
mov ecx, dword [eax]
test ecx, ecx
mov eax, edi
cmovne eax, ecx
push eax
call fcn.004c8d00
push esi
mov dword [0x53a400], eax
call fcn.004c8d5f
push dword [ebp - 0x234]
call fcn.004c8d5f
mov eax, dword [0x53a400]
test eax, eax
mov esi, dword [0x53a404]
cmovne edi, eax
push edi
call fcn.004c8d00
push esi
mov dword [0x53a404], eax
call fcn.004c8d5f
mov edi, dword [0x53a404]
add esp, 0x2c
cmp word [edi], 0
je 0x40604e
mov ebx, 0x3b
nop
push 0x3b
push edi
call fcn.004c56b8
mov esi, eax
add esp, 8
test esi, esi
je 0x405fe6
xor eax, eax
mov word [esi], ax
mov ecx, 0x539fe0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405ff0
sub ecx, edx
sar ecx, 1
push ecx
push 0x539fe0
push edi
call fcn.004c95b0
add esp, 0xc
test eax, eax
jne 0x40603e
mov ecx, 0x53a1e8
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406020
sub ecx, edx
sar ecx, 1
push ecx
push 0x53a1e8
push edi
call fcn.004c93a4
add esp, 0xc
test esi, esi
je 0x40604e
lea edi, [esi + 2]
mov word [esi], bx
cmp word [edi], 0
jne 0x405fd0
push 0x539fb4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4f9f9c
call fcn.004061e0
add esp, 4
test eax, eax
je 0x4061c3
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x4061c3
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4061c0
lea esi, [ebp - 0x20c]
mov eax, esi
push 0x5c
push eax
call fcn.004c5767
add esp, 8
test eax, eax
je 0x4060d1
mov eax, esi
push 0x5c
push eax
call fcn.004c5767
mov esi, eax
add esp, 8
add esi, 2
je 0x4060e3
push 0x4f9fc0
push esi
call fcn.004c9460
add esp, 8
test eax, eax
je 0x406108
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4060a6
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4061c0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0
push eax
push 0xa
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4061bd
lea eax, [ebp - 0x234]
push eax
push 2
push 2
push 0
push 0xf01ff
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4061b5
push 0x4f9fdc
call fcn.004061e0
add esp, 4
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4061ad
push 0x4fa00c
call fcn.004061e0
push 0x4f9f9c
call fcn.004061e0
push 0x4fa034
call fcn.004061e0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x234]
call ebx
push dword [ebp - 0x238]
call ebx
push esi
call ebx
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret