Function at 0x40dd61
Capabilities:
Allocate thread local storage
Enumerate files on windows
Get file attributes
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
mov dword [ebp - 0x2c], 0x52
mov dword [ebp - 0x9c], 0x6c
mov dword [ebp - 0x14], 0x70
mov dword [ebp - 0x4c], 0x28
mov dword [ebp - 0x18], 0xee
mov dword [ebp - 0xc8], 0x82
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x1c], 0x86
mov dword [ebp - 4], 0
mov eax, dword [0x41912c]
or eax, dword [0x4190c8]
mov ecx, dword [0x41911c]
or ecx, dword [ebp - 0x14]
cmp eax, ecx
jne 0x40ddd0
mov dword [ebp - 0x38], 1
jmp 0x40ddd7
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 0
je 0x40de08
mov edx, dword [ebp - 4]
and edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
cmp edx, eax
jbe 0x40ddf7
mov dword [ebp - 0x3c], 1
jmp 0x40ddfe
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x3c], 0
jne 0x40e126
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x84], 0x1e
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x80], 0x72
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x20]
imul ecx, dword [0x41911c]
test ecx, ecx
jne 0x40de6a
mov edx, dword [0x419114]
xor edx, dword [ebp - 0x80]
jne 0x40de6a
mov dword [ebp - 0x40], 0
jmp 0x40de71
mov dword [ebp - 0x40], 1
cmp dword [ebp - 0x40], 0
jne 0x40deab
mov eax, dword [0x4190c0]
add eax, dword [0x4190d8]
mov ecx, dword [ebp - 0x4c]
and ecx, dword [ebp - 0x30]
cmp eax, ecx
jae 0x40de95
mov dword [ebp - 0x44], 1
jmp 0x40de9c
mov dword [ebp - 0x44], 0
cmp dword [ebp - 0x44], 0
jne 0x40deab
mov dword [ebp - 0x48], 0
jmp 0x40deb2
mov dword [ebp - 0x48], 1
cmp dword [ebp - 0x48], 0
jne 0x40deec
mov edx, dword [ebp - 0x4c]
sub edx, dword [0x4190c4]
mov eax, dword [0x4190dc]
sub eax, dword [ebp - 0x20]
cmp edx, eax
je 0x40ded6
mov dword [ebp - 0x50], 1
jmp 0x40dedd
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0
jne 0x40deec
mov dword [ebp - 0x54], 0
jmp 0x40def3
mov dword [ebp - 0x54], 1
cmp dword [ebp - 0x54], 0
jne 0x40df2d
mov ecx, dword [ebp - 0x84]
or ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x8c]
imul edx, dword [ebp - 0x20]
cmp ecx, edx
je 0x40df1c
mov dword [ebp - 0x58], 1
jmp 0x40df23
mov dword [ebp - 0x58], 0
cmp dword [ebp - 0x58], 0
je 0x40e0db
mov dword [ebp - 0xd0], 0x8e
mov dword [ebp - 0x28], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
push str.DvnrwGVKqq
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
lea edx, [ebp - 0xc4]
mov dword [0x4190dc], edx
mov eax, dword [0x4190dc]
mov dword [eax + 4], 0x40e371
mov ecx, dword [0x4190dc]
mov edx, dword [0x4190e0]
mov dword [ecx + 0x10], edx
mov eax, dword [0x4190dc]
mov dword [eax + 0x24], 0x41957c
mov ecx, dword [0x4190dc]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40e00b
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x40dfee
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x30]
push ecx
push str.aADcDrsaQbRSY
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40e068
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x40e048
push 0
mov edx, dword [0x4190e0]
push edx
push 0
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push str.GzdidvCBsohjZqKJoO
push str.CkEIHAtqwGOndccR
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4190d4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
push str.AUwBQWF.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x94], eax
push str.BCBPoruEO
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x28]
push edx
call fcn.00409011
add esp, 4
jmp 0x40e126
mov dword [ebp - 0x98], 0x38
mov eax, dword [ebp - 4]
imul eax, dword [0x419110]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0xd4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x4190dc], eax
mov edx, dword [0x4190d0]
or edx, dword [ebp - 0x10]
mov dword [0x4190c0], edx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x419114], eax
jmp 0x40ddaf
mov eax, dword [0x4190d4]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x9c]
sub ecx, dword [0x419120]
cmp eax, ecx
je 0x40e147
mov dword [ebp - 0x5c], 1
jmp 0x40e14e
mov dword [ebp - 0x5c], 0
cmp dword [ebp - 0x5c], 0
je 0x40e18b
mov edx, dword [ebp - 0x18]
and edx, dword [0x4190c0]
mov eax, dword [0x4190d8]
or eax, dword [0x4190d4]
cmp edx, eax
jbe 0x40e175
mov dword [ebp - 0x60], 1
jmp 0x40e17c
mov dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
je 0x40e18b
mov dword [ebp - 0x64], 1
jmp 0x40e192
mov dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 0
je 0x40e1d0
mov ecx, dword [ebp + 8]
sub ecx, dword [0x4190dc]
je 0x40e1ba
mov edx, dword [0x4190e4]
and edx, dword [0x4190d8]
je 0x40e1ba
mov dword [ebp - 0x68], 1
jmp 0x40e1c1
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0
je 0x40e1d0
mov dword [ebp - 0x6c], 1
jmp 0x40e1d7
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0x6c], 0
je 0x40e212
mov eax, dword [0x4190c0]
xor eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
imul ecx, dword [0x419128]
cmp eax, ecx
jbe 0x40e1fc
mov dword [ebp - 0x70], 1
jmp 0x40e203
mov dword [ebp - 0x70], 0
cmp dword [ebp - 0x70], 0
je 0x40e212
mov dword [ebp - 0x74], 1
jmp 0x40e219
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 0
je 0x40e2f4
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp - 0x1c]
test eax, eax
je 0x40e243
mov edx, dword [ebp - 4]
imul edx, dword [ebp - 4]
test edx, edx
je 0x40e243
mov dword [ebp - 0x78], 1
jmp 0x40e24a
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0
je 0x40e2f4
mov dword [ebp - 0xd8], 0xe3
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [0x419118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x419114], eax
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x10]
mov dword [0x4190bc], edx
mov eax, dword [0x4190c0]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ole32.dll_CoTreatAsClass]
cmp eax, dword [0x4190bc]
je 0x40e2be
mov dword [ebp - 0xdc], 0x93
mov dword [ebp - 0xe0], 0x2d
mov edx, dword [ebp - 0x18]
imul edx, dword [0x4190e4]
mov dword [0x41912c], edx
jmp 0x40e2f2
mov dword [ebp - 0xfc], 0xf1
mov eax, dword [0x419128]
push eax
mov ecx, dword [0x41912c]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4190e4], eax
mov edx, dword [0x4190dc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x4190c4], eax
jmp 0x40e359
mov dword [ebp - 0xe8], 0x74
mov dword [ebp - 0xec], 0x6c
mov dword [ebp - 0xf0], 0xd2
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x34], 0x5c
mov dword [ebp - 0xf8], 0
push str.lhEFSZ.Zgp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x7c], eax
push str.NbnuSOGy.rjE
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
and eax, dword [ebp - 0x7c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
or eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret