Function at 0x40cb87
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x40d2a8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40cbec
call esi
test eax, eax
je 0x40cbd9
cmp byte [ebp - 3], 0x3a
jne 0x40cbd9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cc03
call esi
test eax, eax
je 0x40cc03
cmp byte [ebp - 3], 0x3a
jne 0x40cc03
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40cc45
call esi
test eax, eax
je 0x40cc32
cmp byte [ebp - 3], 0x3a
jne 0x40cc32
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cc5c
call esi
test eax, eax
je 0x40cc5c
cmp byte [ebp - 3], 0x3a
jne 0x40cc5c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40cc9e
call esi
test eax, eax
je 0x40cc8b
cmp byte [ebp - 3], 0x3a
jne 0x40cc8b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40ccb5
call esi
test eax, eax
je 0x40ccb5
cmp byte [ebp - 3], 0x3a
jne 0x40ccb5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ccf5
call esi
test eax, eax
je 0x40cce2
cmp byte [ebp - 3], 0x3a
jne 0x40cce2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cd0c
call esi
test eax, eax
je 0x40cd0c
cmp byte [ebp - 3], 0x3a
jne 0x40cd0c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40cd4d
call esi
test eax, eax
je 0x40cd3a
cmp byte [ebp - 3], 0x3a
jne 0x40cd3a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cd64
call esi
test eax, eax
je 0x40cd64
cmp byte [ebp - 3], 0x3a
jne 0x40cd64
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40cda6
call esi
test eax, eax
je 0x40cd93
cmp byte [ebp - 3], 0x3a
jne 0x40cd93
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cdbd
call esi
test eax, eax
je 0x40cdbd
cmp byte [ebp - 3], 0x3a
jne 0x40cdbd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ce00
call esi
test eax, eax
je 0x40cded
cmp byte [ebp - 3], 0x3a
jne 0x40cded
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40ce17
call esi
test eax, eax
je 0x40ce17
cmp byte [ebp - 3], 0x3a
jne 0x40ce17
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ce5a
call esi
test eax, eax
je 0x40ce47
cmp byte [ebp - 3], 0x3a
jne 0x40ce47
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40ce71
call esi
test eax, eax
je 0x40ce71
cmp byte [ebp - 3], 0x3a
jne 0x40ce71
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ceb2
call esi
test eax, eax
je 0x40ce9f
cmp byte [ebp - 3], 0x3a
jne 0x40ce9f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cec9
call esi
test eax, eax
je 0x40cec9
cmp byte [ebp - 3], 0x3a
jne 0x40cec9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40cf29
call esi
test eax, eax
je 0x40cef9
cmp byte [ebp - 3], 0x3a
jne 0x40cef9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40cf16
cmp byte [ebp - 3], 0x3a
jne 0x40cf16
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cf40
call esi
test eax, eax
je 0x40cf40
cmp byte [ebp - 3], 0x3a
jne 0x40cf40
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40cfa0
call esi
test eax, eax
je 0x40cf70
cmp byte [ebp - 3], 0x3a
jne 0x40cf70
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40cf8d
cmp byte [ebp - 3], 0x3a
jne 0x40cf8d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40cfb7
call esi
test eax, eax
je 0x40cfb7
cmp byte [ebp - 3], 0x3a
jne 0x40cfb7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40d017
call esi
test eax, eax
je 0x40cfe7
cmp byte [ebp - 3], 0x3a
jne 0x40cfe7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40d004
cmp byte [ebp - 3], 0x3a
jne 0x40d004
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40d02e
call esi
test eax, eax
je 0x40d02e
cmp byte [ebp - 3], 0x3a
jne 0x40d02e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40d08e
call esi
test eax, eax
je 0x40d05e
cmp byte [ebp - 3], 0x3a
jne 0x40d05e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40d07b
cmp byte [ebp - 3], 0x3a
jne 0x40d07b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40d0a5
call esi
test eax, eax
je 0x40d0a5
cmp byte [ebp - 3], 0x3a
jne 0x40d0a5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40d103
call esi
test eax, eax
je 0x40d0d3
cmp byte [ebp - 3], 0x3a
jne 0x40d0d3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40d0f0
cmp byte [ebp - 3], 0x3a
jne 0x40d0f0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40d11a
call esi
test eax, eax
je 0x40d11a
cmp byte [ebp - 3], 0x3a
jne 0x40d11a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40d17b
call esi
test eax, eax
je 0x40d14b
cmp byte [ebp - 3], 0x3a
jne 0x40d14b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40d168
cmp byte [ebp - 3], 0x3a
jne 0x40d168
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40d192
call esi
test eax, eax
je 0x40d192
cmp byte [ebp - 3], 0x3a
jne 0x40d192
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40d1f1
call esi
test eax, eax
je 0x40d1c1
cmp byte [ebp - 3], 0x3a
jne 0x40d1c1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40d1de
cmp byte [ebp - 3], 0x3a
jne 0x40d1de
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40d208
call esi
test eax, eax
je 0x40d208
cmp byte [ebp - 3], 0x3a
jne 0x40d208
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40d291
call esi
test eax, eax
je 0x40d261
cmp byte [ebp - 3], 0x3a
jne 0x40d261
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40d27e
cmp byte [ebp - 3], 0x3a
jne 0x40d27e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40d2a8
call esi
test eax, eax
je 0x40d2a8
cmp byte [ebp - 3], 0x3a
jne 0x40d2a8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push 0x7d
push 0x39
push 0x39
push 0x31
push 0x37
push 0x38
push 0x33
pop eax
push eax
push 0x32
push eax
push 0x36
push 0x32
push 0x46
push 0x32
push 0x2d
pop ecx
push ecx
push 0x36
push 0x31
push 0x43
push 0x39
push ecx
push eax
push 0x65
push 0x31
push 0x34
push ecx
push eax
push 0x34
push 0x30
push 0x46
push ecx
push 0x44
push 0x46
push 0x30
push 0x34
push eax
push 0x37
push eax
push 0x41
lea eax, [ebp - 0x6c]
push 0x7b
push eax
call fcn.0040d32b
add esp, 0xa0
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x43c3d0]
push ebx
push 0x1f0003
call dword [eax + 0x30]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x40d327
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x44]
push 1
pop eax
leave
ret
xor eax, eax
leave
ret