Function at 0x408de7
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
lea eax, [ebp - 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x40950e
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x408e52
call esi
test eax, eax
je 0x408e3f
cmp byte [ebp - 3], 0x3a
jne 0x408e3f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x408e69
call esi
test eax, eax
je 0x408e69
cmp byte [ebp - 3], 0x3a
jne 0x408e69
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x408eab
call esi
test eax, eax
je 0x408e98
cmp byte [ebp - 3], 0x3a
jne 0x408e98
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x408ec2
call esi
test eax, eax
je 0x408ec2
cmp byte [ebp - 3], 0x3a
jne 0x408ec2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x408f04
call esi
test eax, eax
je 0x408ef1
cmp byte [ebp - 3], 0x3a
jne 0x408ef1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x408f1b
call esi
test eax, eax
je 0x408f1b
cmp byte [ebp - 3], 0x3a
jne 0x408f1b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x408f5b
call esi
test eax, eax
je 0x408f48
cmp byte [ebp - 3], 0x3a
jne 0x408f48
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x408f72
call esi
test eax, eax
je 0x408f72
cmp byte [ebp - 3], 0x3a
jne 0x408f72
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x408fb3
call esi
test eax, eax
je 0x408fa0
cmp byte [ebp - 3], 0x3a
jne 0x408fa0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x408fca
call esi
test eax, eax
je 0x408fca
cmp byte [ebp - 3], 0x3a
jne 0x408fca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40900c
call esi
test eax, eax
je 0x408ff9
cmp byte [ebp - 3], 0x3a
jne 0x408ff9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x409023
call esi
test eax, eax
je 0x409023
cmp byte [ebp - 3], 0x3a
jne 0x409023
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x409066
call esi
test eax, eax
je 0x409053
cmp byte [ebp - 3], 0x3a
jne 0x409053
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40907d
call esi
test eax, eax
je 0x40907d
cmp byte [ebp - 3], 0x3a
jne 0x40907d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4090c0
call esi
test eax, eax
je 0x4090ad
cmp byte [ebp - 3], 0x3a
jne 0x4090ad
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4090d7
call esi
test eax, eax
je 0x4090d7
cmp byte [ebp - 3], 0x3a
jne 0x4090d7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x409118
call esi
test eax, eax
je 0x409105
cmp byte [ebp - 3], 0x3a
jne 0x409105
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40912f
call esi
test eax, eax
je 0x40912f
cmp byte [ebp - 3], 0x3a
jne 0x40912f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40918f
call esi
test eax, eax
je 0x40915f
cmp byte [ebp - 3], 0x3a
jne 0x40915f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40917c
cmp byte [ebp - 3], 0x3a
jne 0x40917c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4091a6
call esi
test eax, eax
je 0x4091a6
cmp byte [ebp - 3], 0x3a
jne 0x4091a6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x409206
call esi
test eax, eax
je 0x4091d6
cmp byte [ebp - 3], 0x3a
jne 0x4091d6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4091f3
cmp byte [ebp - 3], 0x3a
jne 0x4091f3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40921d
call esi
test eax, eax
je 0x40921d
cmp byte [ebp - 3], 0x3a
jne 0x40921d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40927d
call esi
test eax, eax
je 0x40924d
cmp byte [ebp - 3], 0x3a
jne 0x40924d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40926a
cmp byte [ebp - 3], 0x3a
jne 0x40926a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x409294
call esi
test eax, eax
je 0x409294
cmp byte [ebp - 3], 0x3a
jne 0x409294
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4092f4
call esi
test eax, eax
je 0x4092c4
cmp byte [ebp - 3], 0x3a
jne 0x4092c4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4092e1
cmp byte [ebp - 3], 0x3a
jne 0x4092e1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40930b
call esi
test eax, eax
je 0x40930b
cmp byte [ebp - 3], 0x3a
jne 0x40930b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x409369
call esi
test eax, eax
je 0x409339
cmp byte [ebp - 3], 0x3a
jne 0x409339
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x409356
cmp byte [ebp - 3], 0x3a
jne 0x409356
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x409380
call esi
test eax, eax
je 0x409380
cmp byte [ebp - 3], 0x3a
jne 0x409380
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4093e1
call esi
test eax, eax
je 0x4093b1
cmp byte [ebp - 3], 0x3a
jne 0x4093b1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4093ce
cmp byte [ebp - 3], 0x3a
jne 0x4093ce
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4093f8
call esi
test eax, eax
je 0x4093f8
cmp byte [ebp - 3], 0x3a
jne 0x4093f8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x409457
call esi
test eax, eax
je 0x409427
cmp byte [ebp - 3], 0x3a
jne 0x409427
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x409444
cmp byte [ebp - 3], 0x3a
jne 0x409444
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40946e
call esi
test eax, eax
je 0x40946e
cmp byte [ebp - 3], 0x3a
jne 0x40946e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4094f7
call esi
test eax, eax
je 0x4094c7
cmp byte [ebp - 3], 0x3a
jne 0x4094c7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4094e4
cmp byte [ebp - 3], 0x3a
jne 0x4094e4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40950e
call esi
test eax, eax
je 0x40950e
cmp byte [ebp - 3], 0x3a
jne 0x40950e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov esi, dword [ebp - 0xc]
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e8]
mov eax, dword [0x43c3d0]
pop ecx
pop ecx
push 1
push ebx
lea ecx, [ebp - 0x110]
push 0x2e
push ecx
lea edi, [eax + 0x21c]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call dword [edi]
add esp, 0xc
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.0040ae5f
test eax, eax
je 0x40957f
push dword [esi + 0x19118]
lea eax, [esi + 0x118]
push eax
lea eax, [esi + 4]
push dword [esi + 0x10c]
push dword [esi + 0x108]
push eax
jmp 0x4095bd
lea eax, [ebp - 0x110]
lea edi, [esi + 4]
push eax
push edi
mov ecx, esi
call fcn.0040a692
test eax, eax
je 0x4095c4
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.0040b5bf
push dword [esi + 0x19118]
lea eax, [esi + 0x118]
push eax
push dword [esi + 0x10c]
push dword [esi + 0x108]
push edi
mov ecx, esi
call fcn.00409e64
pop edi
pop esi
pop ebx
leave
ret