Function at 0x40ae5f
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp + 8]
push ebx
push esi
push edi
test eax, eax
jne 0x40b583
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40aec7
call esi
test eax, eax
je 0x40aeb4
cmp byte [ebp - 3], 0x3a
jne 0x40aeb4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40aede
call esi
test eax, eax
je 0x40aede
cmp byte [ebp - 3], 0x3a
jne 0x40aede
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40af20
call esi
test eax, eax
je 0x40af0d
cmp byte [ebp - 3], 0x3a
jne 0x40af0d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40af37
call esi
test eax, eax
je 0x40af37
cmp byte [ebp - 3], 0x3a
jne 0x40af37
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40af79
call esi
test eax, eax
je 0x40af66
cmp byte [ebp - 3], 0x3a
jne 0x40af66
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40af90
call esi
test eax, eax
je 0x40af90
cmp byte [ebp - 3], 0x3a
jne 0x40af90
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40afd0
call esi
test eax, eax
je 0x40afbd
cmp byte [ebp - 3], 0x3a
jne 0x40afbd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40afe7
call esi
test eax, eax
je 0x40afe7
cmp byte [ebp - 3], 0x3a
jne 0x40afe7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b028
call esi
test eax, eax
je 0x40b015
cmp byte [ebp - 3], 0x3a
jne 0x40b015
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b03f
call esi
test eax, eax
je 0x40b03f
cmp byte [ebp - 3], 0x3a
jne 0x40b03f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b081
call esi
test eax, eax
je 0x40b06e
cmp byte [ebp - 3], 0x3a
jne 0x40b06e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b098
call esi
test eax, eax
je 0x40b098
cmp byte [ebp - 3], 0x3a
jne 0x40b098
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b0db
call esi
test eax, eax
je 0x40b0c8
cmp byte [ebp - 3], 0x3a
jne 0x40b0c8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b0f2
call esi
test eax, eax
je 0x40b0f2
cmp byte [ebp - 3], 0x3a
jne 0x40b0f2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b135
call esi
test eax, eax
je 0x40b122
cmp byte [ebp - 3], 0x3a
jne 0x40b122
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b14c
call esi
test eax, eax
je 0x40b14c
cmp byte [ebp - 3], 0x3a
jne 0x40b14c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b18d
call esi
test eax, eax
je 0x40b17a
cmp byte [ebp - 3], 0x3a
jne 0x40b17a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b1a4
call esi
test eax, eax
je 0x40b1a4
cmp byte [ebp - 3], 0x3a
jne 0x40b1a4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b204
call esi
test eax, eax
je 0x40b1d4
cmp byte [ebp - 3], 0x3a
jne 0x40b1d4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b1f1
cmp byte [ebp - 3], 0x3a
jne 0x40b1f1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b21b
call esi
test eax, eax
je 0x40b21b
cmp byte [ebp - 3], 0x3a
jne 0x40b21b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b27b
call esi
test eax, eax
je 0x40b24b
cmp byte [ebp - 3], 0x3a
jne 0x40b24b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b268
cmp byte [ebp - 3], 0x3a
jne 0x40b268
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b292
call esi
test eax, eax
je 0x40b292
cmp byte [ebp - 3], 0x3a
jne 0x40b292
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b2f2
call esi
test eax, eax
je 0x40b2c2
cmp byte [ebp - 3], 0x3a
jne 0x40b2c2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b2df
cmp byte [ebp - 3], 0x3a
jne 0x40b2df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b309
call esi
test eax, eax
je 0x40b309
cmp byte [ebp - 3], 0x3a
jne 0x40b309
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b369
call esi
test eax, eax
je 0x40b339
cmp byte [ebp - 3], 0x3a
jne 0x40b339
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b356
cmp byte [ebp - 3], 0x3a
jne 0x40b356
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b380
call esi
test eax, eax
je 0x40b380
cmp byte [ebp - 3], 0x3a
jne 0x40b380
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b3de
call esi
test eax, eax
je 0x40b3ae
cmp byte [ebp - 3], 0x3a
jne 0x40b3ae
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b3cb
cmp byte [ebp - 3], 0x3a
jne 0x40b3cb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b3f5
call esi
test eax, eax
je 0x40b3f5
cmp byte [ebp - 3], 0x3a
jne 0x40b3f5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b456
call esi
test eax, eax
je 0x40b426
cmp byte [ebp - 3], 0x3a
jne 0x40b426
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b443
cmp byte [ebp - 3], 0x3a
jne 0x40b443
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b46d
call esi
test eax, eax
je 0x40b46d
cmp byte [ebp - 3], 0x3a
jne 0x40b46d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b4cc
call esi
test eax, eax
je 0x40b49c
cmp byte [ebp - 3], 0x3a
jne 0x40b49c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b4b9
cmp byte [ebp - 3], 0x3a
jne 0x40b4b9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b4e3
call esi
test eax, eax
je 0x40b4e3
cmp byte [ebp - 3], 0x3a
jne 0x40b4e3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40b56c
call esi
test eax, eax
je 0x40b53c
cmp byte [ebp - 3], 0x3a
jne 0x40b53c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x40b559
cmp byte [ebp - 3], 0x3a
jne 0x40b559
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x40b583
call esi
test eax, eax
je 0x40b583
cmp byte [ebp - 3], 0x3a
jne 0x40b583
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x148]
push eax
mov eax, dword [0x43c3d0]
push dword [ebp + 8]
call dword [eax + 0x64]
pop edi
pop esi
cmp eax, 0xffffffff
pop ebx
jne 0x40b5a1
xor eax, eax
jmp 0x40b5bb
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x60]
mov eax, dword [ebp - 0x148]
not al
movzx eax, al
shr eax, 4
and eax, 1
leave
ret 4