Function at 0x407700
Capabilities:
Create process on windows
Get thread local storage value
Hide graphical window
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7c81
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0xc]
push 2
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x110], 0
call fcn.0048fb2f
mov edi, eax
xor eax, eax
mov dword [ebp - 0xf0], edi
mov word [edi], ax
push 2
mov dword [ebp - 4], eax
call fcn.0048fb2f
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10c], ebx
mov word [ebx], ax
push 2
call fcn.0048fb2f
mov esi, eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x100], esi
mov word [esi], ax
mov eax, 0xdc
mov byte [ebp - 4], 2
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xec]
push eax
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov eax, dword [ebp - 0xf8]
cmp word [eax], 0x30
jne 0x4077d6
push 0x30
push 0x4b0220
push 0x4b0248
push dword [ebp - 0x108]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x407ea5
push 4
mov esi, eax
push 0x4afaa0
push esi
call fcn.00491219
add esp, 0xc
test eax, eax
jne 0x40788b
push 0x4b02c4
call fcn.0048faa4
mov esi, eax
mov eax, dword [ebp - 0xf8]
add eax, 8
mov dword [ebp - 0xf0], esi
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00418660
mov dword [ebp - 0xfc], edi
push dword [eax]
call fcn.0048faa4
push dword [ebp - 0xfc]
mov edi, eax
mov dword [ebp - 0xf0], edi
call fcn.0048faf7
push dword [ebp - 0xf4]
call fcn.0048faf7
push esi
call fcn.0048faf7
add esp, 0x20
lea eax, [ebp - 0x104]
push eax
push dword [0x4de020]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
push eax
mov eax, dword [ebp - 0xf8]
push 0
add eax, 0xa
push eax
push dword [section..data]
call fcn.00406320
add esp, 0x14
jmp 0x407ab8
push 4
push 0x4afa94
push esi
call fcn.00491219
add esp, 0xc
test eax, eax
jne 0x407928
push 0x4b02ec
call fcn.0048faa4
mov esi, eax
mov eax, dword [ebp - 0xf8]
add eax, 8
mov dword [ebp - 0xf4], esi
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.00418660
mov dword [ebp - 0xf4], edi
push dword [eax]
call fcn.0048faa4
push dword [ebp - 0xf4]
mov edi, eax
mov dword [ebp - 0xf0], edi
call fcn.0048faf7
push dword [ebp - 0xfc]
call fcn.0048faf7
push esi
call fcn.0048faf7
add esp, 0x20
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0xf8]
add eax, 0xa
push eax
push dword [0x4d5004]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp 0x407ab8
push 4
push 0x4afab4
push esi
call fcn.00491219
add esp, 0xc
test eax, eax
jne 0x4079c4
push 0x4b0314
call fcn.0048faa4
mov esi, eax
mov eax, dword [ebp - 0xf8]
add eax, 8
mov dword [ebp - 0xf4], esi
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.00418660
mov dword [ebp - 0xf4], edi
push dword [eax]
call fcn.0048faa4
push dword [ebp - 0xf4]
mov edi, eax
mov dword [ebp - 0xf0], edi
call fcn.0048faf7
push dword [ebp - 0xfc]
call fcn.0048faf7
push esi
call fcn.0048faf7
add esp, 0x20
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0xf8]
add eax, 0xa
push eax
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp 0x407ab8
push 4
push 0x4afa88
mov edi, esi
push edi
call fcn.00491219
add esp, 0xc
test eax, eax
jne 0x407a38
push 0x4b0340
call fcn.0048faa4
mov esi, eax
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0xf4]
mov dword [ebp - 0xf4], esi
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.00418660
add esp, 0x10
lea ecx, [ebp - 0xf0]
push eax
call fcn.00402190
push dword [ebp - 0xfc]
call fcn.0048faf7
push esi
call fcn.0048faf7
add esp, 8
lea eax, [ebp - 0x104]
push eax
lea eax, [edi + 0xa]
push eax
push SysReAllocStringLen
jmp 0x407aac
push 3
push 0x4afaac
push edi
call fcn.00491219
add esp, 0xc
test eax, eax
jne 0x407adf
push 0x4b0368
call fcn.0048faa4
mov esi, eax
lea eax, [edi + 6]
push eax
lea eax, [ebp - 0xf4]
mov dword [ebp - 0xf4], esi
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.00418660
add esp, 0x10
lea ecx, [ebp - 0xf0]
push eax
call fcn.00402190
push dword [ebp - 0xfc]
call fcn.0048faf7
push esi
call fcn.0048faf7
add esp, 8
lea eax, [ebp - 0x104]
push eax
lea eax, [edi + 8]
push eax
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, dword [ebp - 0xf0]
test eax, eax
je 0x407aeb
push 0x5c
push edi
call fcn.0049130d
add eax, 2
push 0x5c
push edi
mov dword [ebp - 0x110], eax
call fcn.0049130d
add esp, 0x10
xor ecx, ecx
mov word [eax], cx
jmp 0x407b14
push edi
lea ecx, [ebp - 0xf0]
call fcn.004021c0
push dword [ebp - 0x104]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push SysReAllocString
push 0x4afa48
lea ecx, [ebp - 0xf0]
call fcn.004021f0
mov edi, dword [ebp - 0xf0]
push 0
push 0x4b0380
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, eax
mov dword [ebp - 0xf8], ecx
test ecx, ecx
jne 0x407c51
mov eax, dword [0x4de02c]
test eax, eax
je 0x407b4e
push ecx
call eax
push 0x100
push dword [0x4de020]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x44
lea eax, [ebp - 0x164]
push 0
push eax
call fcn.004906c0
add esp, 0xc
mov dword [ebp - 0x164], 0x44
mov eax, 1
mov dword [ebp - 0x138], 1
mov word [ebp - 0x134], ax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, ebx
test eax, eax
jns 0x407b94
push 0x4b03a0
jmp 0x407b99
push 0x4b03cc
call fcn.0048faa4
mov ebx, eax
push esi
mov dword [ebp - 0x10c], ebx
call fcn.0048faf7
add esp, 8
lea eax, [ebp - 0xfc]
push ebx
push eax
call fcn.00410090
mov ecx, dword [ebp - 0x100]
mov dword [ebp - 0xf4], ecx
push dword [eax]
call fcn.0048faa4
push dword [ebp - 0xf4]
mov esi, eax
mov dword [ebp - 0x100], esi
call fcn.0048faf7
push dword [ebp - 0xfc]
call fcn.0048faf7
push esi
call fcn.00410170
add esp, 0x18
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x164]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407c36
push 0xffffffffffffffff
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x4b0380
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xf8], eax
jmp 0x407c81
lea eax, [ebp - 0xf4]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0xf4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0xf8]
test eax, eax
jne 0x407ca2
push 0x30
push 0x4b0220
push 0x4b0400
push dword [ebp - 0x108]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x407ea5
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 0xf8]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebx
push 0
push 0x4b04a0
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowExW]
push eax
mov dword [ebp - 0x108], eax
call ebx
mov esi, dword [ebp - 0x108]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push 0x10288
push 0x111
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ebx, 0x1e
lea esp, [esp]
push 0
push 0x25
push 0x100
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
dec ebx
jne 0x407d20
cmp word [edi], bx
mov eax, edi
mov ebx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0xf0], edi
je 0x407db4
mov esi, dword [ebp - 0x108]
movzx eax, word [eax]
cmp eax, 0x5c
jne 0x407d73
push 0
push 0x27
push 0x100
jmp 0x407d84
push eax
call fcn.00490ff4
add esp, 4
push 0
push eax
push 0x102
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0xf0]
add eax, 2
mov dword [ebp - 0xf0], eax
cmp word [eax], 0
jne 0x407d60
mov esi, dword [ebp - 0x100]
push 0xffffffffffffffff
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp dword [ebp - 0x110], 0
je 0x407e81
push 0
push 0x4b04bc
push 0
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_FindWindowExW]
push eax
mov dword [ebp - 0xf0], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0xf0]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x44], 8
jbe 0x407e0e
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x24
push 0x100
push dword [ebp - 0xf0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x110]
movzx eax, word [eax]
test ax, ax
je 0x407e81
mov esi, dword [ebp - 0x110]
mov ebx, dword [ebp - 0xf0]
lea ecx, [ecx]
movzx eax, ax
push eax
call fcn.00490ff4
add esp, 4
push 0
push eax
push 0x102
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
movzx eax, word [esi + 2]
lea esi, [esi + 2]
test ax, ax
jne 0x407e40
mov ebx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x100]
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0048faf7
push ebx
call fcn.0048faf7
push edi
call fcn.0048faf7
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret