Function at 0x41487d
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x414fa4
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4148e8
call esi
test eax, eax
je 0x4148d5
cmp byte [ebp - 3], 0x3a
jne 0x4148d5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4148ff
call esi
test eax, eax
je 0x4148ff
cmp byte [ebp - 3], 0x3a
jne 0x4148ff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414941
call esi
test eax, eax
je 0x41492e
cmp byte [ebp - 3], 0x3a
jne 0x41492e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414958
call esi
test eax, eax
je 0x414958
cmp byte [ebp - 3], 0x3a
jne 0x414958
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41499a
call esi
test eax, eax
je 0x414987
cmp byte [ebp - 3], 0x3a
jne 0x414987
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4149b1
call esi
test eax, eax
je 0x4149b1
cmp byte [ebp - 3], 0x3a
jne 0x4149b1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4149f1
call esi
test eax, eax
je 0x4149de
cmp byte [ebp - 3], 0x3a
jne 0x4149de
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414a08
call esi
test eax, eax
je 0x414a08
cmp byte [ebp - 3], 0x3a
jne 0x414a08
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414a49
call esi
test eax, eax
je 0x414a36
cmp byte [ebp - 3], 0x3a
jne 0x414a36
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414a60
call esi
test eax, eax
je 0x414a60
cmp byte [ebp - 3], 0x3a
jne 0x414a60
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414aa2
call esi
test eax, eax
je 0x414a8f
cmp byte [ebp - 3], 0x3a
jne 0x414a8f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414ab9
call esi
test eax, eax
je 0x414ab9
cmp byte [ebp - 3], 0x3a
jne 0x414ab9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414afc
call esi
test eax, eax
je 0x414ae9
cmp byte [ebp - 3], 0x3a
jne 0x414ae9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414b13
call esi
test eax, eax
je 0x414b13
cmp byte [ebp - 3], 0x3a
jne 0x414b13
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414b56
call esi
test eax, eax
je 0x414b43
cmp byte [ebp - 3], 0x3a
jne 0x414b43
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414b6d
call esi
test eax, eax
je 0x414b6d
cmp byte [ebp - 3], 0x3a
jne 0x414b6d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414bae
call esi
test eax, eax
je 0x414b9b
cmp byte [ebp - 3], 0x3a
jne 0x414b9b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414bc5
call esi
test eax, eax
je 0x414bc5
cmp byte [ebp - 3], 0x3a
jne 0x414bc5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414c25
call esi
test eax, eax
je 0x414bf5
cmp byte [ebp - 3], 0x3a
jne 0x414bf5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414c12
cmp byte [ebp - 3], 0x3a
jne 0x414c12
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414c3c
call esi
test eax, eax
je 0x414c3c
cmp byte [ebp - 3], 0x3a
jne 0x414c3c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414c9c
call esi
test eax, eax
je 0x414c6c
cmp byte [ebp - 3], 0x3a
jne 0x414c6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414c89
cmp byte [ebp - 3], 0x3a
jne 0x414c89
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414cb3
call esi
test eax, eax
je 0x414cb3
cmp byte [ebp - 3], 0x3a
jne 0x414cb3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414d13
call esi
test eax, eax
je 0x414ce3
cmp byte [ebp - 3], 0x3a
jne 0x414ce3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414d00
cmp byte [ebp - 3], 0x3a
jne 0x414d00
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414d2a
call esi
test eax, eax
je 0x414d2a
cmp byte [ebp - 3], 0x3a
jne 0x414d2a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414d8a
call esi
test eax, eax
je 0x414d5a
cmp byte [ebp - 3], 0x3a
jne 0x414d5a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414d77
cmp byte [ebp - 3], 0x3a
jne 0x414d77
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414da1
call esi
test eax, eax
je 0x414da1
cmp byte [ebp - 3], 0x3a
jne 0x414da1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414dff
call esi
test eax, eax
je 0x414dcf
cmp byte [ebp - 3], 0x3a
jne 0x414dcf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414dec
cmp byte [ebp - 3], 0x3a
jne 0x414dec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414e16
call esi
test eax, eax
je 0x414e16
cmp byte [ebp - 3], 0x3a
jne 0x414e16
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414e77
call esi
test eax, eax
je 0x414e47
cmp byte [ebp - 3], 0x3a
jne 0x414e47
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414e64
cmp byte [ebp - 3], 0x3a
jne 0x414e64
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414e8e
call esi
test eax, eax
je 0x414e8e
cmp byte [ebp - 3], 0x3a
jne 0x414e8e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414eed
call esi
test eax, eax
je 0x414ebd
cmp byte [ebp - 3], 0x3a
jne 0x414ebd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414eda
cmp byte [ebp - 3], 0x3a
jne 0x414eda
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414f04
call esi
test eax, eax
je 0x414f04
cmp byte [ebp - 3], 0x3a
jne 0x414f04
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414f8d
call esi
test eax, eax
je 0x414f5d
cmp byte [ebp - 3], 0x3a
jne 0x414f5d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414f7a
cmp byte [ebp - 3], 0x3a
jne 0x414f7a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x414fa4
call esi
test eax, eax
je 0x414fa4
cmp byte [ebp - 3], 0x3a
jne 0x414fa4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp + 0xc]
push ebx
push 2
mov dword [eax], ebx
mov eax, dword [0x43c3d0]
call dword [eax + 0xc]
mov edi, eax
cmp edi, 0xffffffff
je 0x415073
mov esi, 0x128
lea eax, [ebp - 0x134]
push esi
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x134]
mov dword [ebp - 0x134], esi
push eax
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 8]
test eax, eax
je 0x415073
mov esi, dword [ebp - 0xc]
push 0x104
lea eax, [ebp - 0x238]
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
push dword [ebp - 0x12c]
call fcn.0041611c
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.00415888
test eax, eax
je 0x415048
lea eax, [ebp - 0x238]
lea ecx, [esi + 4]
push eax
call fcn.00419339
lea eax, [ebp - 0x134]
push eax
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 4]
test eax, eax
jne 0x414ff8
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 0x44]
push dword [ebp + 0xc]
lea ecx, [esi + 4]
push dword [ebp + 8]
call fcn.00419ac0
pop edi
pop esi
pop ebx
leave
ret 8