Function at 0x4095c9
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
mov eax, 0x434a04
call fcn.00433ea0
sub esp, 0x10
lea ecx, [ebp + 8]
push ebx
xor eax, eax
push esi
test ecx, ecx
push edi
jne 0x409cf7
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
mov ebx, 0x4db
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409638
call esi
test eax, eax
je 0x409624
cmp byte [ebp - 0xf], 0x3a
jne 0x409624
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40964f
call esi
test eax, eax
je 0x40964f
cmp byte [ebp - 0xf], 0x3a
jne 0x40964f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409691
call esi
test eax, eax
je 0x40967d
cmp byte [ebp - 0xf], 0x3a
jne 0x40967d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4096a8
call esi
test eax, eax
je 0x4096a8
cmp byte [ebp - 0xf], 0x3a
jne 0x4096a8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4096ea
call esi
test eax, eax
je 0x4096d6
cmp byte [ebp - 0xf], 0x3a
jne 0x4096d6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409701
call esi
test eax, eax
je 0x409701
cmp byte [ebp - 0xf], 0x3a
jne 0x409701
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40973f
call esi
test eax, eax
je 0x40972b
cmp byte [ebp - 0xf], 0x3a
jne 0x40972b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409756
call esi
test eax, eax
je 0x409756
cmp byte [ebp - 0xf], 0x3a
jne 0x409756
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409796
call esi
test eax, eax
je 0x409782
cmp byte [ebp - 0xf], 0x3a
jne 0x409782
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4097ad
call esi
test eax, eax
je 0x4097ad
cmp byte [ebp - 0xf], 0x3a
jne 0x4097ad
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4097ef
call esi
test eax, eax
je 0x4097db
cmp byte [ebp - 0xf], 0x3a
jne 0x4097db
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409806
call esi
test eax, eax
je 0x409806
cmp byte [ebp - 0xf], 0x3a
jne 0x409806
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409849
call esi
test eax, eax
je 0x409835
cmp byte [ebp - 0xf], 0x3a
jne 0x409835
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409860
call esi
test eax, eax
je 0x409860
cmp byte [ebp - 0xf], 0x3a
jne 0x409860
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4098a3
call esi
test eax, eax
je 0x40988f
cmp byte [ebp - 0xf], 0x3a
jne 0x40988f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4098ba
call esi
test eax, eax
je 0x4098ba
cmp byte [ebp - 0xf], 0x3a
jne 0x4098ba
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4098fa
call esi
test eax, eax
je 0x4098e6
cmp byte [ebp - 0xf], 0x3a
jne 0x4098e6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409911
call esi
test eax, eax
je 0x409911
cmp byte [ebp - 0xf], 0x3a
jne 0x409911
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409971
call esi
test eax, eax
je 0x409940
cmp byte [ebp - 0xf], 0x3a
jne 0x409940
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40995d
cmp byte [ebp - 0xf], 0x3a
jne 0x40995d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409988
call esi
test eax, eax
je 0x409988
cmp byte [ebp - 0xf], 0x3a
jne 0x409988
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4099e8
call esi
test eax, eax
je 0x4099b7
cmp byte [ebp - 0xf], 0x3a
jne 0x4099b7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x4099d4
cmp byte [ebp - 0xf], 0x3a
jne 0x4099d4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4099ff
call esi
test eax, eax
je 0x4099ff
cmp byte [ebp - 0xf], 0x3a
jne 0x4099ff
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409a5f
call esi
test eax, eax
je 0x409a2e
cmp byte [ebp - 0xf], 0x3a
jne 0x409a2e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x409a4b
cmp byte [ebp - 0xf], 0x3a
jne 0x409a4b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409a76
call esi
test eax, eax
je 0x409a76
cmp byte [ebp - 0xf], 0x3a
jne 0x409a76
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409ad6
call esi
test eax, eax
je 0x409aa5
cmp byte [ebp - 0xf], 0x3a
jne 0x409aa5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x409ac2
cmp byte [ebp - 0xf], 0x3a
jne 0x409ac2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409aed
call esi
test eax, eax
je 0x409aed
cmp byte [ebp - 0xf], 0x3a
jne 0x409aed
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409b4a
call esi
test eax, eax
je 0x409b19
cmp byte [ebp - 0xf], 0x3a
jne 0x409b19
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x409b36
cmp byte [ebp - 0xf], 0x3a
jne 0x409b36
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409b61
call esi
test eax, eax
je 0x409b61
cmp byte [ebp - 0xf], 0x3a
jne 0x409b61
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409bc2
call esi
test eax, eax
je 0x409b91
cmp byte [ebp - 0xf], 0x3a
jne 0x409b91
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x409bae
cmp byte [ebp - 0xf], 0x3a
jne 0x409bae
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409bd9
call esi
test eax, eax
je 0x409bd9
cmp byte [ebp - 0xf], 0x3a
jne 0x409bd9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409c38
call esi
test eax, eax
je 0x409c07
cmp byte [ebp - 0xf], 0x3a
jne 0x409c07
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x409c24
cmp byte [ebp - 0xf], 0x3a
jne 0x409c24
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409c4f
call esi
test eax, eax
je 0x409c4f
cmp byte [ebp - 0xf], 0x3a
jne 0x409c4f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x409ce0
call esi
test eax, eax
je 0x409caf
cmp byte [ebp - 0xf], 0x3a
jne 0x409caf
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x409ccc
cmp byte [ebp - 0xf], 0x3a
jne 0x409ccc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x409cf7
call esi
test eax, eax
je 0x409cf7
cmp byte [ebp - 0xf], 0x3a
jne 0x409cf7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push 0x20
lea ecx, [ebp - 0x14]
pop ebx
mov dword [ebp - 0x10], 0x30
mov esi, ebx
call fcn.0042029f
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
push edi
push ebx
push 0x30
lea ecx, [ebp - 0x14]
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 0x18
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x30
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 8
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x30
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 4
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x30
call fcn.004202cb
test eax, eax
jne 0x409e0b
push edi
push ebx
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov esi, ebx
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 0x18
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push ebx
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 8
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push ebx
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 4
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push ebx
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 0x10
lea ecx, [ebp - 0x14]
pop eax
mov esi, ebx
push edi
push ebx
push eax
mov dword [ebp - 0x10], eax
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 0x18
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x10
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 8
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x10
call fcn.004202cb
test eax, eax
jne 0x409e0b
push 4
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x10
call fcn.004202cb
test eax, eax
jne 0x409e0b
xor esi, esi
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
test esi, esi
je 0x409e47
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ebp - 0x10]
call fcn.00420309
test eax, eax
je 0x409e47
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ecx], eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004202c4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc