Function at 0x468000
Capabilities:
Allocate thread local storage
Check mutex on windows

Disassembly:
push 0x1f0
push 0
push 0x4654c4
call fcn.00401160
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4654c8], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4654c4], eax
call fcn.00401138
call fcn.0040c750
call fcn.0040c608
call fcn.0040c460
call fcn.0040b4e0
call fcn.0040b17a
call fcn.0040b010
call fcn.0040a72b
call fcn.0040a222
call fcn.0040a078
call fcn.00409e23
call fcn.00409d28
call fcn.00409190
call fcn.00409095
call fcn.00408780
call fcn.00407c1f
call fcn.00407bda
call fcn.00407af5
call fcn.0040710c
call fcn.00406d1d
call fcn.00405c2f
call fcn.00404538
call fcn.00403b19
call fcn.00403455
call fcn.004031b4
call fcn.0040135d
call fcn.00409a5b
call fcn.004049b6
mov dword [0x46554c], 0
push 0xc
mov eax, str.Tahoma
push eax
push 0
call fcn.0040c706
push 0x58
push 0
call sub.USER32.dll_GetDC
push eax
call sub.GDI32.dll_GetDeviceCaps
mov dword [esp - 4], eax
fild dword [esp - 4]
fdiv qword [0x4619bc]
fstp qword [0x4654dc]
push 0x5a
push 0
call sub.USER32.dll_GetDC
push eax
call sub.GDI32.dll_GetDeviceCaps
mov dword [esp - 4], eax
fild dword [esp - 4]
fdiv qword [0x4619bc]
fstp qword [0x4654e4]
call fcn.00471f11
mov dword [0x4655b8], 0x7530
push 0x4656ac
push 0x461a80
push 7
push 1
push 0xc
call fcn.00409be4
mov dword [0x465554], 0
push 0x4656a4
push 0
push 7
push 0xa
push 8
call fcn.00409be4
call fcn.004049b6
mov dword [0x465530], 0x7530
mov edx, str.AutoLogoff
lea ecx, [0x465584]
call fcn.004010f8
mov eax, dword [0x465584]
push eax
push 1
push 0
call sub.KERNEL32.dll_CreateMutexW
mov dword [0x465568], eax
mov dword [0x46557c], 0
mov ebx, dword [0x465568]
and ebx, ebx
je 0x4681f4
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x4681f4
mov eax, 1
jmp 0x4681f6
xor eax, eax
and eax, eax
je 0x4681ff
jmp 0x468447
push dword [0x465e94]
push 2
mov eax, 0x45f052
push eax
push dword [0x465e94]
mov edx, str._delete__tn__AutoLogoff_
push edx
call fcn.0040c820
push dword [0x465e94]
push dword [0x465e94]
call fcn.00406ffe
pop eax
mov edx, str.___f
push edx
call fcn.0040c820
add dword [0x465e94], 2
mov eax, str.schtasks.exe
push eax
mov edx, dword [0x464b40]
add dword [esp + 4], edx
call fcn.00403a64
pop dword [0x465e94]
push dword [0x465e94]
push 2
mov eax, 0x45f052
push eax
push dword [0x465e94]
mov edx, str._create__tn__AutoLogoff_
push edx
call fcn.0040c820
push dword [0x465e94]
push dword [0x465e94]
call fcn.00406ffe
pop eax
mov edx, 0x45f348
push edx
call fcn.0040c820
push dword [0x465e94]
push dword [0x465e94]
call fcn.00403484
pop eax
mov edx, str.___sc_MINUTE__mo_5__f
push edx
call fcn.0040c820
add dword [0x465e94], 2
mov eax, str.schtasks.exe
push eax
mov edx, dword [0x464b40]
add dword [esp + 4], edx
call fcn.00403a64
pop dword [0x465e94]
call fcn.0046d788
call fcn.0046d759
push 0xa
call fcn.004078dd
mov dword [0x465580], eax
cmp dword [0x4655e4], 0
je 0x468366
cmp dword [0x4655c4], 0
je 0x46830d
xor eax, eax
jmp 0x468312
mov eax, 1
and eax, eax
je 0x468356
cmp dword [0x4655d8], 0
je 0x468323
xor eax, eax
jmp 0x468328
mov eax, 1
and eax, eax
je 0x468349
cmp dword [0x4655c0], 0
je 0x468339
xor eax, eax
jmp 0x46833e
mov eax, 1
and eax, eax
je 0x468349
mov eax, 1
jmp 0x46834b
xor eax, eax
and eax, eax
je 0x468356
mov eax, 1
jmp 0x468358
xor eax, eax
and eax, eax
je 0x468366
mov dword [0x46557c], 1
cmp dword [0x46557c], 0
je 0x4682e8
push dword [0x465570]
push dword [0x465570]
call fcn.00407646
push dword [0x465570]
call fcn.00407a84
push eax
call fcn.0046a562
push dword [0x465578]
call sub.USER32.dll_UnhookWindowsHookEx
push dword [0x465574]
call sub.USER32.dll_UnhookWindowsHookEx
push dword [0x465570]
push 0
call fcn.0040785b
lea ebp, [0x465670]
cmp dword [ebp + 0x18], 0
je 0x468442
push dword [0x46554c]
mov ebx, 8
cmp ebx, dword [esp]
jne 0x4683ed
mov dword [0x4655bc], 9
push 4
call fcn.0046b3d6
jmp 0x468441
mov ebx, 0xc
cmp ebx, dword [esp]
jne 0x46840d
mov dword [0x4655bc], 0xd
push 1
call fcn.0046a026
jmp 0x468441
mov ebx, 0xa
cmp ebx, dword [esp]
jne 0x46842d
mov dword [0x4655bc], 0xb
push 1
call fcn.0046b171
jmp 0x468441
mov dword [0x4655bc], 9
push 4
call fcn.0046b3d6
pop eax
call fcn.0046de0c
push 0
call 0x468466
call fcn.0040c790
push dword [0x4654c4]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00401369
call fcn.00403a7e
call fcn.0040452c
call fcn.00405cd3
call sub.ole32.dll_OleUninitialize
call fcn.004070e9
call fcn.00407b64
call fcn.00407c46
call fcn.004083b5
call fcn.00408770
call fcn.0040916d
call fcn.0040a06c
call fcn.0040a751
call fcn.00404620
call fcn.0040c5fc
call fcn.00404620
call fcn.0040c450
ret