Function at 0x415888
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x415faf
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4158f3
call esi
test eax, eax
je 0x4158e0
cmp byte [ebp - 3], 0x3a
jne 0x4158e0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41590a
call esi
test eax, eax
je 0x41590a
cmp byte [ebp - 3], 0x3a
jne 0x41590a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41594c
call esi
test eax, eax
je 0x415939
cmp byte [ebp - 3], 0x3a
jne 0x415939
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415963
call esi
test eax, eax
je 0x415963
cmp byte [ebp - 3], 0x3a
jne 0x415963
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4159a5
call esi
test eax, eax
je 0x415992
cmp byte [ebp - 3], 0x3a
jne 0x415992
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4159bc
call esi
test eax, eax
je 0x4159bc
cmp byte [ebp - 3], 0x3a
jne 0x4159bc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4159fc
call esi
test eax, eax
je 0x4159e9
cmp byte [ebp - 3], 0x3a
jne 0x4159e9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415a13
call esi
test eax, eax
je 0x415a13
cmp byte [ebp - 3], 0x3a
jne 0x415a13
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415a54
call esi
test eax, eax
je 0x415a41
cmp byte [ebp - 3], 0x3a
jne 0x415a41
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415a6b
call esi
test eax, eax
je 0x415a6b
cmp byte [ebp - 3], 0x3a
jne 0x415a6b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415aad
call esi
test eax, eax
je 0x415a9a
cmp byte [ebp - 3], 0x3a
jne 0x415a9a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415ac4
call esi
test eax, eax
je 0x415ac4
cmp byte [ebp - 3], 0x3a
jne 0x415ac4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415b07
call esi
test eax, eax
je 0x415af4
cmp byte [ebp - 3], 0x3a
jne 0x415af4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415b1e
call esi
test eax, eax
je 0x415b1e
cmp byte [ebp - 3], 0x3a
jne 0x415b1e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415b61
call esi
test eax, eax
je 0x415b4e
cmp byte [ebp - 3], 0x3a
jne 0x415b4e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415b78
call esi
test eax, eax
je 0x415b78
cmp byte [ebp - 3], 0x3a
jne 0x415b78
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415bb9
call esi
test eax, eax
je 0x415ba6
cmp byte [ebp - 3], 0x3a
jne 0x415ba6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415bd0
call esi
test eax, eax
je 0x415bd0
cmp byte [ebp - 3], 0x3a
jne 0x415bd0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415c30
call esi
test eax, eax
je 0x415c00
cmp byte [ebp - 3], 0x3a
jne 0x415c00
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415c1d
cmp byte [ebp - 3], 0x3a
jne 0x415c1d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415c47
call esi
test eax, eax
je 0x415c47
cmp byte [ebp - 3], 0x3a
jne 0x415c47
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415ca7
call esi
test eax, eax
je 0x415c77
cmp byte [ebp - 3], 0x3a
jne 0x415c77
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415c94
cmp byte [ebp - 3], 0x3a
jne 0x415c94
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415cbe
call esi
test eax, eax
je 0x415cbe
cmp byte [ebp - 3], 0x3a
jne 0x415cbe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415d1e
call esi
test eax, eax
je 0x415cee
cmp byte [ebp - 3], 0x3a
jne 0x415cee
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415d0b
cmp byte [ebp - 3], 0x3a
jne 0x415d0b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415d35
call esi
test eax, eax
je 0x415d35
cmp byte [ebp - 3], 0x3a
jne 0x415d35
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415d95
call esi
test eax, eax
je 0x415d65
cmp byte [ebp - 3], 0x3a
jne 0x415d65
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415d82
cmp byte [ebp - 3], 0x3a
jne 0x415d82
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415dac
call esi
test eax, eax
je 0x415dac
cmp byte [ebp - 3], 0x3a
jne 0x415dac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415e0a
call esi
test eax, eax
je 0x415dda
cmp byte [ebp - 3], 0x3a
jne 0x415dda
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415df7
cmp byte [ebp - 3], 0x3a
jne 0x415df7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415e21
call esi
test eax, eax
je 0x415e21
cmp byte [ebp - 3], 0x3a
jne 0x415e21
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415e82
call esi
test eax, eax
je 0x415e52
cmp byte [ebp - 3], 0x3a
jne 0x415e52
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415e6f
cmp byte [ebp - 3], 0x3a
jne 0x415e6f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415e99
call esi
test eax, eax
je 0x415e99
cmp byte [ebp - 3], 0x3a
jne 0x415e99
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415ef8
call esi
test eax, eax
je 0x415ec8
cmp byte [ebp - 3], 0x3a
jne 0x415ec8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415ee5
cmp byte [ebp - 3], 0x3a
jne 0x415ee5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415f0f
call esi
test eax, eax
je 0x415f0f
cmp byte [ebp - 3], 0x3a
jne 0x415f0f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x415f98
call esi
test eax, eax
je 0x415f68
cmp byte [ebp - 3], 0x3a
jne 0x415f68
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x415f85
cmp byte [ebp - 3], 0x3a
jne 0x415f85
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x415faf
call esi
test eax, eax
je 0x415faf
cmp byte [ebp - 3], 0x3a
jne 0x415faf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push dword [ebp + 8]
mov eax, dword [0x43c3d0]
call dword [eax + 0x1f0]
test eax, eax
pop ecx
je 0x416113
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
push dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e8]
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x210]
add esp, 0x18
lea eax, [ebp - 0x278]
push esi
push eax
mov eax, dword [0x43c3d0]
push ebx
call dword [eax + 0x74]
lea eax, [ebp - 0x278]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x210]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e0]
add esp, 0xc
test eax, eax
je 0x416113
cmp byte [ebp - 0x10f], 0x3a
jne 0x416113
cmp byte [ebp - 0x10e], 0x5c
jne 0x416113
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1f0]
mov esi, eax
pop ecx
lea eax, [ebp - 0x110]
push ebx
sub eax, 4
push 0x65
add esi, eax
push 0x78
push 0x65
lea eax, [ebp - 0x174]
push 0x2e
push eax
call fcn.0040d32b
lea eax, [ebp - 0x174]
push eax
mov eax, dword [0x43c3d0]
push esi
call dword [eax + 0x1e0]
add esp, 0x20
test eax, eax
jne 0x416113
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00416912
test eax, eax
je 0x416113
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0041780e
test eax, eax
je 0x416113
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x110]
push eax
call fcn.004170aa
cmp eax, ebx
je 0x416113
cmp eax, 0xa00000
ja 0x416113
cmp eax, 0x2800
jb 0x416113
push 1
pop eax
jmp 0x416115
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4