Function at 0x41b15e
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
lea eax, [ebp - 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
mov dword [ecx], 0x436104
jne 0x41b88b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b1cf
call esi
test eax, eax
je 0x41b1bc
cmp byte [ebp - 3], 0x3a
jne 0x41b1bc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b1e6
call esi
test eax, eax
je 0x41b1e6
cmp byte [ebp - 3], 0x3a
jne 0x41b1e6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b228
call esi
test eax, eax
je 0x41b215
cmp byte [ebp - 3], 0x3a
jne 0x41b215
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b23f
call esi
test eax, eax
je 0x41b23f
cmp byte [ebp - 3], 0x3a
jne 0x41b23f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b281
call esi
test eax, eax
je 0x41b26e
cmp byte [ebp - 3], 0x3a
jne 0x41b26e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b298
call esi
test eax, eax
je 0x41b298
cmp byte [ebp - 3], 0x3a
jne 0x41b298
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b2d8
call esi
test eax, eax
je 0x41b2c5
cmp byte [ebp - 3], 0x3a
jne 0x41b2c5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b2ef
call esi
test eax, eax
je 0x41b2ef
cmp byte [ebp - 3], 0x3a
jne 0x41b2ef
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b330
call esi
test eax, eax
je 0x41b31d
cmp byte [ebp - 3], 0x3a
jne 0x41b31d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b347
call esi
test eax, eax
je 0x41b347
cmp byte [ebp - 3], 0x3a
jne 0x41b347
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b389
call esi
test eax, eax
je 0x41b376
cmp byte [ebp - 3], 0x3a
jne 0x41b376
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b3a0
call esi
test eax, eax
je 0x41b3a0
cmp byte [ebp - 3], 0x3a
jne 0x41b3a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b3e3
call esi
test eax, eax
je 0x41b3d0
cmp byte [ebp - 3], 0x3a
jne 0x41b3d0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b3fa
call esi
test eax, eax
je 0x41b3fa
cmp byte [ebp - 3], 0x3a
jne 0x41b3fa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b43d
call esi
test eax, eax
je 0x41b42a
cmp byte [ebp - 3], 0x3a
jne 0x41b42a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b454
call esi
test eax, eax
je 0x41b454
cmp byte [ebp - 3], 0x3a
jne 0x41b454
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b495
call esi
test eax, eax
je 0x41b482
cmp byte [ebp - 3], 0x3a
jne 0x41b482
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b4ac
call esi
test eax, eax
je 0x41b4ac
cmp byte [ebp - 3], 0x3a
jne 0x41b4ac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b50c
call esi
test eax, eax
je 0x41b4dc
cmp byte [ebp - 3], 0x3a
jne 0x41b4dc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b4f9
cmp byte [ebp - 3], 0x3a
jne 0x41b4f9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b523
call esi
test eax, eax
je 0x41b523
cmp byte [ebp - 3], 0x3a
jne 0x41b523
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b583
call esi
test eax, eax
je 0x41b553
cmp byte [ebp - 3], 0x3a
jne 0x41b553
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b570
cmp byte [ebp - 3], 0x3a
jne 0x41b570
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b59a
call esi
test eax, eax
je 0x41b59a
cmp byte [ebp - 3], 0x3a
jne 0x41b59a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b5fa
call esi
test eax, eax
je 0x41b5ca
cmp byte [ebp - 3], 0x3a
jne 0x41b5ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b5e7
cmp byte [ebp - 3], 0x3a
jne 0x41b5e7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b611
call esi
test eax, eax
je 0x41b611
cmp byte [ebp - 3], 0x3a
jne 0x41b611
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b671
call esi
test eax, eax
je 0x41b641
cmp byte [ebp - 3], 0x3a
jne 0x41b641
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b65e
cmp byte [ebp - 3], 0x3a
jne 0x41b65e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b688
call esi
test eax, eax
je 0x41b688
cmp byte [ebp - 3], 0x3a
jne 0x41b688
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b6e6
call esi
test eax, eax
je 0x41b6b6
cmp byte [ebp - 3], 0x3a
jne 0x41b6b6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b6d3
cmp byte [ebp - 3], 0x3a
jne 0x41b6d3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b6fd
call esi
test eax, eax
je 0x41b6fd
cmp byte [ebp - 3], 0x3a
jne 0x41b6fd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b75e
call esi
test eax, eax
je 0x41b72e
cmp byte [ebp - 3], 0x3a
jne 0x41b72e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b74b
cmp byte [ebp - 3], 0x3a
jne 0x41b74b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b775
call esi
test eax, eax
je 0x41b775
cmp byte [ebp - 3], 0x3a
jne 0x41b775
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b7d4
call esi
test eax, eax
je 0x41b7a4
cmp byte [ebp - 3], 0x3a
jne 0x41b7a4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b7c1
cmp byte [ebp - 3], 0x3a
jne 0x41b7c1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b7eb
call esi
test eax, eax
je 0x41b7eb
cmp byte [ebp - 3], 0x3a
jne 0x41b7eb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b874
call esi
test eax, eax
je 0x41b844
cmp byte [ebp - 3], 0x3a
jne 0x41b844
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b861
cmp byte [ebp - 3], 0x3a
jne 0x41b861
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b88b
call esi
test eax, eax
je 0x41b88b
cmp byte [ebp - 3], 0x3a
jne 0x41b88b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [0x43c3d0]
push ebx
push ebx
push 1
push ebx
call dword [eax + 0x68]
mov esi, dword [ebp - 0xc]
push 0x104
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x110]
mov dword [esi + 0x1c], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push eax
mov eax, dword [0x43c3d0]
push ebx
call dword [eax + 0x74]
push ebx
push 0x80
push 3
push ebx
push 1
lea eax, [ebp - 0x110]
push 0x80000000
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x50]
mov edi, eax
cmp edi, 0xffffffff
je 0x41b914
mov eax, dword [0x43c3d0]
push ebx
push edi
call dword [eax + 0x38]
push eax
mov dword [esi + 8], eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [esi + 4], eax
lea ecx, [ebp - 0xc]
push ebx
push ecx
push dword [esi + 8]
push eax
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 0x4c]
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 0x44]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret