Function at 0x419ac0
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x41a1e4
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419b28
call esi
test eax, eax
je 0x419b15
cmp byte [ebp - 3], 0x3a
jne 0x419b15
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419b3f
call esi
test eax, eax
je 0x419b3f
cmp byte [ebp - 3], 0x3a
jne 0x419b3f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419b81
call esi
test eax, eax
je 0x419b6e
cmp byte [ebp - 3], 0x3a
jne 0x419b6e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419b98
call esi
test eax, eax
je 0x419b98
cmp byte [ebp - 3], 0x3a
jne 0x419b98
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419bda
call esi
test eax, eax
je 0x419bc7
cmp byte [ebp - 3], 0x3a
jne 0x419bc7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419bf1
call esi
test eax, eax
je 0x419bf1
cmp byte [ebp - 3], 0x3a
jne 0x419bf1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419c31
call esi
test eax, eax
je 0x419c1e
cmp byte [ebp - 3], 0x3a
jne 0x419c1e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419c48
call esi
test eax, eax
je 0x419c48
cmp byte [ebp - 3], 0x3a
jne 0x419c48
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419c89
call esi
test eax, eax
je 0x419c76
cmp byte [ebp - 3], 0x3a
jne 0x419c76
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419ca0
call esi
test eax, eax
je 0x419ca0
cmp byte [ebp - 3], 0x3a
jne 0x419ca0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419ce2
call esi
test eax, eax
je 0x419ccf
cmp byte [ebp - 3], 0x3a
jne 0x419ccf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419cf9
call esi
test eax, eax
je 0x419cf9
cmp byte [ebp - 3], 0x3a
jne 0x419cf9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419d3c
call esi
test eax, eax
je 0x419d29
cmp byte [ebp - 3], 0x3a
jne 0x419d29
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419d53
call esi
test eax, eax
je 0x419d53
cmp byte [ebp - 3], 0x3a
jne 0x419d53
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419d96
call esi
test eax, eax
je 0x419d83
cmp byte [ebp - 3], 0x3a
jne 0x419d83
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419dad
call esi
test eax, eax
je 0x419dad
cmp byte [ebp - 3], 0x3a
jne 0x419dad
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419dee
call esi
test eax, eax
je 0x419ddb
cmp byte [ebp - 3], 0x3a
jne 0x419ddb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419e05
call esi
test eax, eax
je 0x419e05
cmp byte [ebp - 3], 0x3a
jne 0x419e05
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419e65
call esi
test eax, eax
je 0x419e35
cmp byte [ebp - 3], 0x3a
jne 0x419e35
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x419e52
cmp byte [ebp - 3], 0x3a
jne 0x419e52
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419e7c
call esi
test eax, eax
je 0x419e7c
cmp byte [ebp - 3], 0x3a
jne 0x419e7c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419edc
call esi
test eax, eax
je 0x419eac
cmp byte [ebp - 3], 0x3a
jne 0x419eac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x419ec9
cmp byte [ebp - 3], 0x3a
jne 0x419ec9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419ef3
call esi
test eax, eax
je 0x419ef3
cmp byte [ebp - 3], 0x3a
jne 0x419ef3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419f53
call esi
test eax, eax
je 0x419f23
cmp byte [ebp - 3], 0x3a
jne 0x419f23
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x419f40
cmp byte [ebp - 3], 0x3a
jne 0x419f40
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419f6a
call esi
test eax, eax
je 0x419f6a
cmp byte [ebp - 3], 0x3a
jne 0x419f6a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x419fca
call esi
test eax, eax
je 0x419f9a
cmp byte [ebp - 3], 0x3a
jne 0x419f9a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x419fb7
cmp byte [ebp - 3], 0x3a
jne 0x419fb7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x419fe1
call esi
test eax, eax
je 0x419fe1
cmp byte [ebp - 3], 0x3a
jne 0x419fe1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a03f
call esi
test eax, eax
je 0x41a00f
cmp byte [ebp - 3], 0x3a
jne 0x41a00f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41a02c
cmp byte [ebp - 3], 0x3a
jne 0x41a02c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41a056
call esi
test eax, eax
je 0x41a056
cmp byte [ebp - 3], 0x3a
jne 0x41a056
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a0b7
call esi
test eax, eax
je 0x41a087
cmp byte [ebp - 3], 0x3a
jne 0x41a087
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41a0a4
cmp byte [ebp - 3], 0x3a
jne 0x41a0a4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41a0ce
call esi
test eax, eax
je 0x41a0ce
cmp byte [ebp - 3], 0x3a
jne 0x41a0ce
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a12d
call esi
test eax, eax
je 0x41a0fd
cmp byte [ebp - 3], 0x3a
jne 0x41a0fd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41a11a
cmp byte [ebp - 3], 0x3a
jne 0x41a11a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41a144
call esi
test eax, eax
je 0x41a144
cmp byte [ebp - 3], 0x3a
jne 0x41a144
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a1cd
call esi
test eax, eax
je 0x41a19d
cmp byte [ebp - 3], 0x3a
jne 0x41a19d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41a1ba
cmp byte [ebp - 3], 0x3a
jne 0x41a1ba
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41a1e4
call esi
test eax, eax
je 0x41a1e4
cmp byte [ebp - 3], 0x3a
jne 0x41a1e4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x1fbd4]
mov dword [ecx], eax
cmp dword [esi + 0x1fbd4], ebx
jle 0x41a22d
mov eax, dword [ebp + 8]
mov edi, 0x104
mov dword [ebp + 8], eax
lea eax, [esi + 4]
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
mov eax, dword [0x43c3d0]
push dword [ebp + 8]
call dword [eax + 0x1e8]
add dword [ebp + 0xc], edi
add dword [ebp + 8], edi
inc ebx
pop ecx
cmp ebx, dword [esi + 0x1fbd4]
pop ecx
jl 0x41a20b
pop edi
pop esi
pop ebx
leave
ret 8