Function at 0x413299
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp + 8]
push ebx
push esi
push edi
test eax, eax
jne 0x4139bd
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413301
call esi
test eax, eax
je 0x4132ee
cmp byte [ebp - 3], 0x3a
jne 0x4132ee
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413318
call esi
test eax, eax
je 0x413318
cmp byte [ebp - 3], 0x3a
jne 0x413318
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41335a
call esi
test eax, eax
je 0x413347
cmp byte [ebp - 3], 0x3a
jne 0x413347
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413371
call esi
test eax, eax
je 0x413371
cmp byte [ebp - 3], 0x3a
jne 0x413371
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4133b3
call esi
test eax, eax
je 0x4133a0
cmp byte [ebp - 3], 0x3a
jne 0x4133a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4133ca
call esi
test eax, eax
je 0x4133ca
cmp byte [ebp - 3], 0x3a
jne 0x4133ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41340a
call esi
test eax, eax
je 0x4133f7
cmp byte [ebp - 3], 0x3a
jne 0x4133f7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413421
call esi
test eax, eax
je 0x413421
cmp byte [ebp - 3], 0x3a
jne 0x413421
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413462
call esi
test eax, eax
je 0x41344f
cmp byte [ebp - 3], 0x3a
jne 0x41344f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413479
call esi
test eax, eax
je 0x413479
cmp byte [ebp - 3], 0x3a
jne 0x413479
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4134bb
call esi
test eax, eax
je 0x4134a8
cmp byte [ebp - 3], 0x3a
jne 0x4134a8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4134d2
call esi
test eax, eax
je 0x4134d2
cmp byte [ebp - 3], 0x3a
jne 0x4134d2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413515
call esi
test eax, eax
je 0x413502
cmp byte [ebp - 3], 0x3a
jne 0x413502
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41352c
call esi
test eax, eax
je 0x41352c
cmp byte [ebp - 3], 0x3a
jne 0x41352c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41356f
call esi
test eax, eax
je 0x41355c
cmp byte [ebp - 3], 0x3a
jne 0x41355c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413586
call esi
test eax, eax
je 0x413586
cmp byte [ebp - 3], 0x3a
jne 0x413586
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4135c7
call esi
test eax, eax
je 0x4135b4
cmp byte [ebp - 3], 0x3a
jne 0x4135b4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4135de
call esi
test eax, eax
je 0x4135de
cmp byte [ebp - 3], 0x3a
jne 0x4135de
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41363e
call esi
test eax, eax
je 0x41360e
cmp byte [ebp - 3], 0x3a
jne 0x41360e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41362b
cmp byte [ebp - 3], 0x3a
jne 0x41362b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413655
call esi
test eax, eax
je 0x413655
cmp byte [ebp - 3], 0x3a
jne 0x413655
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4136b5
call esi
test eax, eax
je 0x413685
cmp byte [ebp - 3], 0x3a
jne 0x413685
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4136a2
cmp byte [ebp - 3], 0x3a
jne 0x4136a2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4136cc
call esi
test eax, eax
je 0x4136cc
cmp byte [ebp - 3], 0x3a
jne 0x4136cc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41372c
call esi
test eax, eax
je 0x4136fc
cmp byte [ebp - 3], 0x3a
jne 0x4136fc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413719
cmp byte [ebp - 3], 0x3a
jne 0x413719
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413743
call esi
test eax, eax
je 0x413743
cmp byte [ebp - 3], 0x3a
jne 0x413743
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4137a3
call esi
test eax, eax
je 0x413773
cmp byte [ebp - 3], 0x3a
jne 0x413773
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413790
cmp byte [ebp - 3], 0x3a
jne 0x413790
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4137ba
call esi
test eax, eax
je 0x4137ba
cmp byte [ebp - 3], 0x3a
jne 0x4137ba
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413818
call esi
test eax, eax
je 0x4137e8
cmp byte [ebp - 3], 0x3a
jne 0x4137e8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413805
cmp byte [ebp - 3], 0x3a
jne 0x413805
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41382f
call esi
test eax, eax
je 0x41382f
cmp byte [ebp - 3], 0x3a
jne 0x41382f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413890
call esi
test eax, eax
je 0x413860
cmp byte [ebp - 3], 0x3a
jne 0x413860
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41387d
cmp byte [ebp - 3], 0x3a
jne 0x41387d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4138a7
call esi
test eax, eax
je 0x4138a7
cmp byte [ebp - 3], 0x3a
jne 0x4138a7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413906
call esi
test eax, eax
je 0x4138d6
cmp byte [ebp - 3], 0x3a
jne 0x4138d6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4138f3
cmp byte [ebp - 3], 0x3a
jne 0x4138f3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41391d
call esi
test eax, eax
je 0x41391d
cmp byte [ebp - 3], 0x3a
jne 0x41391d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4139a6
call esi
test eax, eax
je 0x413976
cmp byte [ebp - 3], 0x3a
jne 0x413976
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413993
cmp byte [ebp - 3], 0x3a
jne 0x413993
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4139bd
call esi
test eax, eax
je 0x4139bd
cmp byte [ebp - 3], 0x3a
jne 0x4139bd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x148]
push eax
mov eax, dword [0x43c3d0]
push dword [ebp + 8]
call dword [eax + 0x64]
pop edi
pop esi
cmp eax, 0xffffffff
pop ebx
jne 0x4139db
xor eax, eax
jmp 0x4139e7
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x60]
push 1
pop eax
leave
ret 4