Function at 0x4aa0a0
Capabilities:
Allocate thread local storage
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov dword [sym.ProcessHacker.exe_PhInstanceHandle], edx
push ebx
push esi
push edi
push 0
push 0
push 0x100000
push 0x200000
push 0
push 0x1002
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x54b674], eax
test eax, eax
jne 0x4aa0e4
mov eax, 0xc000009a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x11c
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
jns 0x4aa10e
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x7fffffff
jmp 0x4aa21d
mov eax, dword [ebp - 0x144]
lea esi, [ebp - 0x148]
mov ecx, 0x47
mov edi, sym.ProcessHacker.exe_PhOsVersion
rep movsd dword es:[edi], dword [esi]
cmp eax, 6
jne 0x4aa162
mov eax, dword [ebp - 0x140]
cmp eax, 1
jne 0x4aa140
mov eax, 0x3d
jmp 0x4aa1e6
cmp eax, 2
jne 0x4aa14f
mov eax, 0x3e
jmp 0x4aa1e6
cmp eax, 3
jne 0x4aa1e1
mov eax, 0x3f
jmp 0x4aa1e6
cmp eax, 0xa
jne 0x4aa1e1
cmp dword [ebp - 0x140], 0
jne 0x4aa1e1
mov eax, dword [ebp - 0x13c]
cmp eax, 0x3ad7
ja 0x4aa1b0
je 0x4aa1a9
cmp eax, 0x2800
je 0x4aa1a2
cmp eax, 0x295a
je 0x4aa19b
cmp eax, 0x3839
jne 0x4aa1be
mov eax, 0x66
jmp 0x4aa1e6
mov eax, 0x65
jmp 0x4aa1e6
mov eax, 0x64
jmp 0x4aa1e6
mov eax, 0x67
jmp 0x4aa1e6
cmp eax, 0x3fab
je 0x4aa1da
cmp eax, 0x42ee
je 0x4aa1d3
mov eax, 0x42ee
cmp eax, dword [sym.ProcessHacker.exe_WindowsVersion]
sbb eax, eax
and eax, 5
add eax, 0x64
jmp 0x4aa1e6
mov eax, 0x69
jmp 0x4aa1e6
mov eax, 0x68
jmp 0x4aa1e6
mov eax, 0x7fffffff
mov dword [sym.ProcessHacker.exe_WindowsVersion], eax
mov dword [sym.ProcessHacker.exe_ProcessQueryAccess], 0x1000
mov dword [sym.ProcessHacker.exe_ProcessAllAccess], 0x1f1fff
mov dword [sym.ProcessHacker.exe_ThreadQueryAccess], 0x800
mov dword [sym.ProcessHacker.exe_ThreadSetAccess], 0x400
mov dword [sym.ProcessHacker.exe_ThreadAllAccess], 0x1f0fff
push 0
push 0x2c
push sym.ProcessHacker.exe_PhSystemBasicInformation
push 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push 0
push 0
push 0xf0003
push 0x54b028
call dword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
test eax, eax
js 0x4aa457
mov al, 1
cmp al, byte [0x54b668]
push 0x54bbf8
sbb eax, eax
and eax, 0xfa0
mov dword [0x547cec], eax
call dword [sym.imp.ntdll.dll_RtlInitializeSListHead]
push 0x54bbe0
call dword [sym.imp.ntdll.dll_RtlInitializeSListHead]
xor eax, eax
mov dword [0x54bbe8], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push 0x28
mov dword [0x54bbec], 0x200
mov dword [0x54bbf0], 0x38
mov dword [0x5496a0], eax
mov dword [0x54b7e0], eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, eax
mov ebx, 1
xor eax, eax
mov word [ecx], ax
mov eax, ebx
lock xadd dword [0x5496a8], eax
inc eax
sub al, bl
mov dword [ecx + 4], 0
movzx edx, al
mov byte [ecx + 2], al
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], str.Type
cmp edx, 0x100
jae 0x4aa44c
push ecx
movzx eax, al
push 0x28
mov dword [edx*4 + 0x54b7e0], ecx
mov dword [0x5496a0], ecx
mov word [ecx - 8], ax
mov dword [ecx + 4], ebx
call sym.ProcessHacker.exe_PhCreateObject
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
lock xadd dword [0x5496a8], ecx
inc ecx
dec cl
mov dword [eax + 4], 0
mov byte [eax + 2], cl
movzx ecx, cl
mov dword [eax + 8], 0
mov dword [eax + 0xc], str.Alloc
cmp ecx, 0x100
jae 0x4aa44c
mov dword [ecx*4 + 0x54b7e0], eax
mov dword [0x5496a4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x54ae94], eax
cmp eax, 0xffffffff
je 0x4aa457
call fcn.004a4d40
test al, al
je 0x4aa457
push dword [0x5496a0]
push 0x28
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
mov ecx, ebx
mov word [edi], bx
lock xadd dword [0x5496a8], ecx
inc ecx
dec cl
mov dword [edi + 4], 0
movzx eax, cl
mov byte [edi + 2], cl
mov dword [edi + 8], 0x4aa610
mov dword [edi + 0xc], str.FileStream
cmp eax, 0x100
jae 0x4aa44c
lea esi, [edi + 0x10]
mov dword [eax*4 + 0x54b7e0], edi
push esi
call dword [sym.imp.ntdll.dll_RtlInitializeSListHead]
push dword [0x5496a0]
mov dword [esi + 8], 0
push 0x28
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 0x30
mov dword [0x54b628], edi
call sym.ProcessHacker.exe_PhCreateObject
xor ecx, ecx
mov word [eax], cx
lock xadd dword [0x5496a8], ebx
inc ebx
dec bl
mov dword [eax + 4], ecx
movzx ecx, bl
mov byte [eax + 2], bl
mov dword [eax + 8], 0x4ab150
mov dword [eax + 0xc], str.SymbolProvider
cmp ecx, 0x100
jae 0x4aa44c
mov dword [ecx*4 + 0x54b7e0], eax
mov dword [0x54b624], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xc0000001
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
pop edi
pop esi
mov eax, 0xc0000001
pop ebx
mov esp, ebp
pop ebp
ret 8