Function at 0x40a692
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x40adb6
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a6fa
call esi
test eax, eax
je 0x40a6e7
cmp byte [ebp - 3], 0x3a
jne 0x40a6e7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a711
call esi
test eax, eax
je 0x40a711
cmp byte [ebp - 3], 0x3a
jne 0x40a711
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a753
call esi
test eax, eax
je 0x40a740
cmp byte [ebp - 3], 0x3a
jne 0x40a740
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a76a
call esi
test eax, eax
je 0x40a76a
cmp byte [ebp - 3], 0x3a
jne 0x40a76a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a7ac
call esi
test eax, eax
je 0x40a799
cmp byte [ebp - 3], 0x3a
jne 0x40a799
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a7c3
call esi
test eax, eax
je 0x40a7c3
cmp byte [ebp - 3], 0x3a
jne 0x40a7c3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a803
call esi
test eax, eax
je 0x40a7f0
cmp byte [ebp - 3], 0x3a
jne 0x40a7f0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a81a
call esi
test eax, eax
je 0x40a81a
cmp byte [ebp - 3], 0x3a
jne 0x40a81a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a85b
call esi
test eax, eax
je 0x40a848
cmp byte [ebp - 3], 0x3a
jne 0x40a848
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a872
call esi
test eax, eax
je 0x40a872
cmp byte [ebp - 3], 0x3a
jne 0x40a872
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a8b4
call esi
test eax, eax
je 0x40a8a1
cmp byte [ebp - 3], 0x3a
jne 0x40a8a1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a8cb
call esi
test eax, eax
je 0x40a8cb
cmp byte [ebp - 3], 0x3a
jne 0x40a8cb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a90e
call esi
test eax, eax
je 0x40a8fb
cmp byte [ebp - 3], 0x3a
jne 0x40a8fb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a925
call esi
test eax, eax
je 0x40a925
cmp byte [ebp - 3], 0x3a
jne 0x40a925
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a968
call esi
test eax, eax
je 0x40a955
cmp byte [ebp - 3], 0x3a
jne 0x40a955
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a97f
call esi
test eax, eax
je 0x40a97f
cmp byte [ebp - 3], 0x3a
jne 0x40a97f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40a9c0
call esi
test eax, eax
je 0x40a9ad
cmp byte [ebp - 3], 0x3a
jne 0x40a9ad
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40a9d7
call esi
test eax, eax
je 0x40a9d7
cmp byte [ebp - 3], 0x3a
jne 0x40a9d7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40aa37
call esi
test eax, eax
je 0x40aa07
cmp byte [ebp - 3], 0x3a
jne 0x40aa07
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40aa24
cmp byte [ebp - 3], 0x3a
jne 0x40aa24
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40aa4e
call esi
test eax, eax
je 0x40aa4e
cmp byte [ebp - 3], 0x3a
jne 0x40aa4e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40aaae
call esi
test eax, eax
je 0x40aa7e
cmp byte [ebp - 3], 0x3a
jne 0x40aa7e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40aa9b
cmp byte [ebp - 3], 0x3a
jne 0x40aa9b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40aac5
call esi
test eax, eax
je 0x40aac5
cmp byte [ebp - 3], 0x3a
jne 0x40aac5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ab25
call esi
test eax, eax
je 0x40aaf5
cmp byte [ebp - 3], 0x3a
jne 0x40aaf5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40ab12
cmp byte [ebp - 3], 0x3a
jne 0x40ab12
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40ab3c
call esi
test eax, eax
je 0x40ab3c
cmp byte [ebp - 3], 0x3a
jne 0x40ab3c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ab9c
call esi
test eax, eax
je 0x40ab6c
cmp byte [ebp - 3], 0x3a
jne 0x40ab6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40ab89
cmp byte [ebp - 3], 0x3a
jne 0x40ab89
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40abb3
call esi
test eax, eax
je 0x40abb3
cmp byte [ebp - 3], 0x3a
jne 0x40abb3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ac11
call esi
test eax, eax
je 0x40abe1
cmp byte [ebp - 3], 0x3a
jne 0x40abe1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40abfe
cmp byte [ebp - 3], 0x3a
jne 0x40abfe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40ac28
call esi
test eax, eax
je 0x40ac28
cmp byte [ebp - 3], 0x3a
jne 0x40ac28
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ac89
call esi
test eax, eax
je 0x40ac59
cmp byte [ebp - 3], 0x3a
jne 0x40ac59
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40ac76
cmp byte [ebp - 3], 0x3a
jne 0x40ac76
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40aca0
call esi
test eax, eax
je 0x40aca0
cmp byte [ebp - 3], 0x3a
jne 0x40aca0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40acff
call esi
test eax, eax
je 0x40accf
cmp byte [ebp - 3], 0x3a
jne 0x40accf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40acec
cmp byte [ebp - 3], 0x3a
jne 0x40acec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40ad16
call esi
test eax, eax
je 0x40ad16
cmp byte [ebp - 3], 0x3a
jne 0x40ad16
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40ad9f
call esi
test eax, eax
je 0x40ad6f
cmp byte [ebp - 3], 0x3a
jne 0x40ad6f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40ad8c
cmp byte [ebp - 3], 0x3a
jne 0x40ad8c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40adb6
call esi
test eax, eax
je 0x40adb6
cmp byte [ebp - 3], 0x3a
jne 0x40adb6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov esi, pe_nt_image_headers32
lea eax, [ebp - 0x128]
push esi
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
push dword [ebp + 8]
lea eax, [ebp - 0x128]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e8]
push esi
lea eax, [ebp - 0x228]
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
push dword [ebp + 0xc]
lea eax, [ebp - 0x228]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e8]
push 0x1e
lea eax, [ebp - 0x28]
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
lea eax, [ebp - 0x128]
add esp, 0x34
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x43c3d0]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 4
mov word [ebp - 0x18], 0x614
call dword [eax + 0x114]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
leave
ret 8