Function at 0x41dbc0
Capabilities:
Acquire debug privileges
Allocate thread local storage
Get common file path
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e106
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x1004618]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf4], ecx
push 0
push 0x1006410
call fcn.0041daa0
add esp, 8
push 0x1006410
mov ecx, 0x10067fc
call fcn.00428160
push 0
push 0x1a
push 0x104
mov ecx, 0x10067f8
call fcn.004285b0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, 0x10067f8
call fcn.00428010
push 1
push 0x5babe0
call fcn.0041db30
add esp, 8
mov dword [0x10062f8], 0x114
push 0x10062f8
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0054d82c
mov eax, dword [eax + 4]
mov dword [ebp - 0xcc], eax
call fcn.0054d82c
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xd0], ecx
mov edx, 0x80
movzx eax, dx
push eax
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [0x10062f4], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xf4]
add eax, 0xa4
push eax
call sub.gdiplus.dll_GdiplusStartup
push 0
call fcn.0054c9ff
add esp, 4
push 0
lea ecx, [ebp - 0x98]
push ecx
call fcn.0042e5d0
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x98]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0xd4], eax
xor ecx, ecx
cmp dword [ebp - 0xd4], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x41dd17
mov eax, dword [ebp - 0x98]
push eax
call fcn.0042fd40
add esp, 4
jmp 0x41dd24
push 0x5baba4
call fcn.0042fd40
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00402640
mov dword [ebp - 0xb4], vtable.VObj.0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], vtable.ExprItem.0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb4], vtable.AnyArray.0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xdc], ecx
mov edx, dword [ebp - 0xdc]
mov dword [edx], 0
mov eax, dword [ebp - 0xdc]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0xb4]
mov eax, dword [edx + 4]
mov dword [0x10062f0], eax
lea ecx, [ebp - 0xb4]
call fcn.0041de90
push 0
call fcn.0056366d
add esp, 4
push eax
call fcn.005618b1
add esp, 4
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ecx + 0x44]
push edx
call fcn.004f9d50
add esp, 4
call fcn.004731b0
call fcn.004c6300
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1006624], eax
push 0
lea ecx, [ebp - 0x94]
call fcn.00429e60
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0x94]
mov dword [eax + 0x20], ecx
push 0
mov edx, 0x66
movzx eax, dx
push eax
lea ecx, [ebp - 0x94]
call fcn.0054236e
push 0
lea ecx, [ebp - 0x94]
call fcn.00544a80
mov ecx, dword [0x1006624]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x1006624], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.005419b7
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret