Function at 0x41611c
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x416840
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416184
call esi
test eax, eax
je 0x416171
cmp byte [ebp - 3], 0x3a
jne 0x416171
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41619b
call esi
test eax, eax
je 0x41619b
cmp byte [ebp - 3], 0x3a
jne 0x41619b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4161dd
call esi
test eax, eax
je 0x4161ca
cmp byte [ebp - 3], 0x3a
jne 0x4161ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4161f4
call esi
test eax, eax
je 0x4161f4
cmp byte [ebp - 3], 0x3a
jne 0x4161f4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416236
call esi
test eax, eax
je 0x416223
cmp byte [ebp - 3], 0x3a
jne 0x416223
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41624d
call esi
test eax, eax
je 0x41624d
cmp byte [ebp - 3], 0x3a
jne 0x41624d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41628d
call esi
test eax, eax
je 0x41627a
cmp byte [ebp - 3], 0x3a
jne 0x41627a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4162a4
call esi
test eax, eax
je 0x4162a4
cmp byte [ebp - 3], 0x3a
jne 0x4162a4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4162e5
call esi
test eax, eax
je 0x4162d2
cmp byte [ebp - 3], 0x3a
jne 0x4162d2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4162fc
call esi
test eax, eax
je 0x4162fc
cmp byte [ebp - 3], 0x3a
jne 0x4162fc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41633e
call esi
test eax, eax
je 0x41632b
cmp byte [ebp - 3], 0x3a
jne 0x41632b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416355
call esi
test eax, eax
je 0x416355
cmp byte [ebp - 3], 0x3a
jne 0x416355
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416398
call esi
test eax, eax
je 0x416385
cmp byte [ebp - 3], 0x3a
jne 0x416385
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4163af
call esi
test eax, eax
je 0x4163af
cmp byte [ebp - 3], 0x3a
jne 0x4163af
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4163f2
call esi
test eax, eax
je 0x4163df
cmp byte [ebp - 3], 0x3a
jne 0x4163df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416409
call esi
test eax, eax
je 0x416409
cmp byte [ebp - 3], 0x3a
jne 0x416409
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41644a
call esi
test eax, eax
je 0x416437
cmp byte [ebp - 3], 0x3a
jne 0x416437
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416461
call esi
test eax, eax
je 0x416461
cmp byte [ebp - 3], 0x3a
jne 0x416461
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4164c1
call esi
test eax, eax
je 0x416491
cmp byte [ebp - 3], 0x3a
jne 0x416491
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4164ae
cmp byte [ebp - 3], 0x3a
jne 0x4164ae
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4164d8
call esi
test eax, eax
je 0x4164d8
cmp byte [ebp - 3], 0x3a
jne 0x4164d8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416538
call esi
test eax, eax
je 0x416508
cmp byte [ebp - 3], 0x3a
jne 0x416508
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416525
cmp byte [ebp - 3], 0x3a
jne 0x416525
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41654f
call esi
test eax, eax
je 0x41654f
cmp byte [ebp - 3], 0x3a
jne 0x41654f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4165af
call esi
test eax, eax
je 0x41657f
cmp byte [ebp - 3], 0x3a
jne 0x41657f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41659c
cmp byte [ebp - 3], 0x3a
jne 0x41659c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4165c6
call esi
test eax, eax
je 0x4165c6
cmp byte [ebp - 3], 0x3a
jne 0x4165c6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416626
call esi
test eax, eax
je 0x4165f6
cmp byte [ebp - 3], 0x3a
jne 0x4165f6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416613
cmp byte [ebp - 3], 0x3a
jne 0x416613
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41663d
call esi
test eax, eax
je 0x41663d
cmp byte [ebp - 3], 0x3a
jne 0x41663d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41669b
call esi
test eax, eax
je 0x41666b
cmp byte [ebp - 3], 0x3a
jne 0x41666b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416688
cmp byte [ebp - 3], 0x3a
jne 0x416688
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4166b2
call esi
test eax, eax
je 0x4166b2
cmp byte [ebp - 3], 0x3a
jne 0x4166b2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416713
call esi
test eax, eax
je 0x4166e3
cmp byte [ebp - 3], 0x3a
jne 0x4166e3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416700
cmp byte [ebp - 3], 0x3a
jne 0x416700
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41672a
call esi
test eax, eax
je 0x41672a
cmp byte [ebp - 3], 0x3a
jne 0x41672a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416789
call esi
test eax, eax
je 0x416759
cmp byte [ebp - 3], 0x3a
jne 0x416759
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416776
cmp byte [ebp - 3], 0x3a
jne 0x416776
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4167a0
call esi
test eax, eax
je 0x4167a0
cmp byte [ebp - 3], 0x3a
jne 0x4167a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416829
call esi
test eax, eax
je 0x4167f9
cmp byte [ebp - 3], 0x3a
jne 0x4167f9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416816
cmp byte [ebp - 3], 0x3a
jne 0x416816
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416840
call esi
test eax, eax
je 0x416840
cmp byte [ebp - 3], 0x3a
jne 0x416840
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push dword [ebp + 8]
mov eax, dword [0x43c3d0]
push ebx
push 0x410
call dword [eax + 0x18]
mov edi, eax
cmp edi, ebx
je 0x41690b
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push 4
push eax
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 0xd8]
test eax, eax
je 0x416902
mov esi, 0x104
lea eax, [ebp - 0x10c]
push esi
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x10c]
push esi
push eax
push dword [ebp + 8]
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 0xd4]
test eax, eax
je 0x416902
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x210]
push esi
push eax
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0xb4]
test eax, eax
lea eax, [ebp - 0x210]
jne 0x4168f1
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x43c3d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e8]
pop ecx
pop ecx
mov eax, dword [0x43c3d0]
push edi
call dword [eax + 0x44]
pop edi
pop esi
pop ebx
leave
ret 8