Function at 0x405cb0
Capabilities:
Acquire debug privileges
Allocate thread local storage
Enumerate processes
Get common file path
Query environment variable
Set environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x540790], 0
jne 0x406186
push esi
push 0x4fc1d8
push 1
push 0x4fc1f8
mov byte [0x540790], 1
call fcn.0042f9d0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
call esi
push 0x4fc214
push 1
push 0x4fc1f8
mov dword [0x54000c], eax
call fcn.0042f9d0
add esp, 8
push eax
call esi
push 0x4fc234
push 1
push 0x4fc1f8
mov dword [0x540420], eax
call fcn.0042f9d0
add esp, 8
push eax
call esi
push 0x4fbe34
push 1
push 0x4fc254
mov dword [0x540424], eax
call fcn.0042f9d0
add esp, 8
push eax
call esi
mov dword [0x53ffe0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
push 0
mov dword [0x540000], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x104
push 0x53f750
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
movzx eax, word [ecx + 0x53f750]
lea ecx, [ecx + 2]
mov word [ecx + 0x54000e], ax
test ax, ax
jne 0x405d74
mov ecx, 0x540010
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x405d92
mov eax, dword [0x4fc288]
mov dword [ecx], eax
mov eax, dword [0x4fc28c]
mov dword [ecx + 4], eax
mov eax, dword [0x4fc290]
mov dword [ecx + 8], eax
mov eax, dword [0x4fc294]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4fc298]
push 0x104
push 0x540218
mov dword [ecx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x405df6
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ecx + 0x540010]
lea ecx, [ecx + 2]
mov word [ecx + 0x540216], ax
test ax, ax
jne 0x405de0
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push 0x53f958
push 0x4fc29c
call esi
mov ecx, 0x53f958
mov eax, 0x4fc29c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405e3d
test dx, dx
je 0x405e39
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405e3d
add eax, 4
add ecx, 4
test dx, dx
jne 0x405e17
xor eax, eax
jmp 0x405e42
sbb eax, eax
or eax, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x405e6a
push 0x104
push 0x53f958
push 0x4fc2bc
call esi
push 0x53f958
push 0x4fc2dc
call edi
push 0x104
push 0x53fb60
push 0x4fc2f8
call esi
push 0x4fc320
push 0x53f958
call fcn.004c5729
add esp, 8
test eax, eax
je 0x405eb4
push 0x4fc320
push 0x53f958
call fcn.004c5729
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0x53f958
push 0x4fc330
call edi
push 0x104
push 0x53fd68
push 0x4fc354
call esi
test eax, eax
jne 0x405efd
push 0x104
push 0x53fd68
push 0x4fc370
call esi
test eax, eax
jne 0x405efd
movzx eax, word [0x53f750]
push eax
push 0x4fc394
push 0x104
push 0x53fd68
call fcn.00404720
add esp, 0x10
push ebx
push 0xffffffffffffffff
push 0x4fc3b8
push 0x104
push 0x53fd68
call fcn.004c91a6
lea eax, [ebp - 0x234]
push 0x501794
push eax
call fcn.00414b30
mov esi, dword [0x540430]
mov edi, 0x4fbd20
mov ecx, dword [eax]
test ecx, ecx
mov eax, edi
cmovne eax, ecx
push eax
call fcn.004c8c20
push esi
mov dword [0x540430], eax
call fcn.004c8c7f
push dword [ebp - 0x234]
call fcn.004c8c7f
mov eax, dword [0x540430]
test eax, eax
mov esi, dword [0x540434]
cmovne edi, eax
push edi
call fcn.004c8c20
push esi
mov dword [0x540434], eax
call fcn.004c8c7f
mov edi, dword [0x540434]
add esp, 0x2c
cmp word [edi], 0
je 0x40600e
mov ebx, 0x3b
nop
push 0x3b
push edi
call fcn.004c55d8
mov esi, eax
add esp, 8
test esi, esi
je 0x405fa6
xor eax, eax
mov word [esi], ax
mov ecx, 0x540010
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405fb0
sub ecx, edx
sar ecx, 1
push ecx
push 0x540010
push edi
call fcn.004c94d0
add esp, 0xc
test eax, eax
jne 0x405ffe
mov ecx, 0x540218
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405fe0
sub ecx, edx
sar ecx, 1
push ecx
push 0x540218
push edi
call fcn.004c92c4
add esp, 0xc
test esi, esi
je 0x40600e
lea edi, [esi + 2]
mov word [esi], bx
cmp word [edi], 0
jne 0x405f90
push 0x53ffe4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4fbf9c
call fcn.004061a0
add esp, 4
test eax, eax
je 0x406183
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x406183
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x406180
lea esi, [ebp - 0x20c]
mov eax, esi
push 0x5c
push eax
call fcn.004c5688
add esp, 8
test eax, eax
je 0x406091
mov eax, esi
push 0x5c
push eax
call fcn.004c5688
mov esi, eax
add esp, 8
add esi, 2
je 0x4060a3
push 0x4fbfc0
push esi
call fcn.004c9380
add esp, 8
test eax, eax
je 0x4060c8
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x406066
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x406180
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0
push eax
push 0xa
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40617d
lea eax, [ebp - 0x234]
push eax
push 2
push 2
push 0
push 0xf01ff
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x406175
push 0x4fbfdc
call fcn.004061a0
add esp, 4
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40616d
push 0x4fc00c
call fcn.004061a0
push 0x4fbf9c
call fcn.004061a0
push 0x4fc034
call fcn.004061a0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x234]
call ebx
push dword [ebp - 0x238]
call ebx
push esi
call ebx
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret