Function at 0x410de4
Capabilities:
Allocate thread local storage
Enumerate files on windows
Get file size
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov dword [ebp - 0x54], 0xd9
mov dword [ebp - 0x18], 0xe7
mov dword [ebp - 0x58], 0xc4
mov dword [ebp - 0x9c], 0xd7
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x40], 0xd0
mov dword [ebp - 0xc8], 0x57
mov dword [ebp - 0xb8], 0xe5
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x1c], 0x29
jmp 0x410e69
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e
jae 0x410e98
mov dword [ebp - 0x50], 0
mov dword [ebp - 0xb0], 0xc6
mov dword [ebp - 0xd8], 0
mov ecx, dword [ebp - 0xb0]
add ecx, dword [ebp - 0x50]
mov dword [ebp - 0x50], ecx
jmp 0x410e60
push str.sFLEtLpVnB.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x40]
push edx
push str.zzqYPj
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x410edc
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x410ebf
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
push str.zjQVLznyGd
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x5c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x58], eax
push 0
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410f1b
mov dword [ebp - 0x5c], 0x25c6
push 0
push 0xffffffffffffffff
push str.zqxktwsda
push 0xffffffffffffffff
push str.cixvxif
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], 2
jmp 0x410f4d
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x49
jae 0x411206
mov dword [ebp - 0x60], 0x9e
mov dword [ebp - 0xdc], 6
mov dword [ebp - 0x28], 0xaa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov ecx, dword [0x4217e4]
sub ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x24]
or edx, dword [ebp - 0x60]
cmp ecx, edx
je 0x410f99
mov dword [ebp - 0x64], 1
jmp 0x410fa0
mov dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 0
je 0x410fdb
mov eax, dword [ebp - 0xa0]
or eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x98]
xor ecx, dword [ebp - 0x10]
cmp eax, ecx
jne 0x410fc5
mov dword [ebp - 0x68], 1
jmp 0x410fcc
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0
je 0x410fdb
mov dword [ebp - 0x6c], 1
jmp 0x410fe2
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0x6c], 0
je 0x41101a
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
sub eax, dword [0x4217e4]
cmp edx, eax
jae 0x411004
mov dword [ebp - 0x70], 1
jmp 0x41100b
mov dword [ebp - 0x70], 0
cmp dword [ebp - 0x70], 0
je 0x41101a
mov dword [ebp - 0x74], 1
jmp 0x411021
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 0
je 0x411051
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x2c]
cmp ecx, edx
jae 0x411040
mov dword [ebp - 0x78], 1
jmp 0x411047
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0
jne 0x411201
mov dword [ebp - 0xbc], 0x2c
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x90]
or eax, dword [ebp - 0xb4]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x4217e0]
and ecx, dword [ebp - 0x28]
jne 0x4110ae
mov edx, dword [0x4217f8]
or edx, dword [ebp - 8]
jne 0x4110ae
mov dword [ebp - 0x7c], 0
jmp 0x4110b5
mov dword [ebp - 0x7c], 1
cmp dword [ebp - 0x7c], 0
je 0x4110f4
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x2c]
mov ecx, dword [0x4217e8]
add ecx, dword [ebp - 0xb8]
cmp eax, ecx
je 0x4110db
mov dword [ebp - 0x80], 1
jmp 0x4110e2
mov dword [ebp - 0x80], 0
cmp dword [ebp - 0x80], 0
je 0x4110f4
mov dword [ebp - 0x84], 1
jmp 0x4110fe
mov dword [ebp - 0x84], 0
cmp dword [ebp - 0x84], 0
je 0x41114b
mov edx, dword [0x42181c]
xor edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x14]
sub eax, dword [0x42180c]
cmp edx, eax
jne 0x41112c
mov dword [ebp - 0x88], 1
jmp 0x411136
mov dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 0
je 0x41114b
mov dword [ebp - 0x8c], 1
jmp 0x411155
mov dword [ebp - 0x8c], 0
cmp dword [ebp - 0x8c], 0
je 0x4111b6
mov ecx, dword [ebp - 0xc0]
xor ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
or edx, dword [ebp - 0x90]
cmp ecx, edx
jae 0x411180
mov dword [ebp - 0x94], 1
jmp 0x41118a
mov dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0
je 0x4111b6
mov dword [ebp - 0xe0], 0x42
mov dword [ebp - 0xe4], 0x89
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov dword [ebp - 0x18], eax
jmp 0x4111e6
mov dword [ebp - 0xe8], 0xe9
mov dword [ebp - 0x34], 0
mov dword [ebp - 0xec], 0xec
mov dword [ebp - 0xf0], 0
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
jmp 0x411201
mov edx, dword [0x4217e0]
push edx
mov eax, dword [0x4217e0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
jmp 0x410f7d
jmp 0x410f44
mov dword [ebp - 0x38], 0x40
jmp 0x411218
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0x6b
jae 0x41127e
mov dword [ebp - 0xf4], 0xa0
mov dword [ebp - 0xf8], 0xf5
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x3c], 0
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
and eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0xc4]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x3c], ecx
jmp 0x41120f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
push str.AcCvMmms.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
push str.xMJtlGZWiYo
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax]
mov dword [ebp - 0x98], ecx
push 0
push 0xffffffffffffffff
push str.bsuxnvya
push 0xffffffffffffffff
push str.ijxmsp
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0xc8], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x9c], eax
mov edx, dword [ebp - 0x9c]
movzx eax, word [edx]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0xa4], ecx
cmp dword [ebp - 0xa4], 0x19
je 0x411315
cmp dword [ebp - 0xa4], 0xd5
je 0x411335
jmp 0x411352
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov eax, dword [0x421824]
push eax
mov ecx, dword [0x4217fc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
mov dword [0x4217f0], eax
jmp 0x411417
mov dword [ebp - 0xc], 0x55
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xac], 0
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0xac]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0xcc]
push ecx
push str.mdrhPMa
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4113db
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x4113b8
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0xac], edx
push 0
push 0xffffffffffffffff
push str.zzsmqjhaq
push 0xffffffffffffffff
push str.zvlulogmex
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040c884
add esp, 8