Function at 0x4117f3
Capabilities:
Allocate thread local storage
Enumerate files on windows
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push esi
mov dword [ebp - 0x38], 0x74
mov dword [ebp - 0x20], 0xf3
mov dword [ebp - 0x13c], 0x85
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x74
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov eax, dword [0x41c128]
xor eax, dword [0x41c0d8]
mov ecx, dword [0x41c0d0]
add ecx, dword [0x41c0c8]
cmp eax, ecx
jne 0x411855
mov dword [ebp - 0x58], 1
jmp 0x41185c
mov dword [ebp - 0x58], 0
cmp dword [ebp - 0x58], 0
jne 0x41188f
mov edx, dword [ebp - 8]
imul edx, dword [ebp - 0x10]
test edx, edx
jne 0x41187e
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0xc]
jne 0x41187e
mov dword [ebp - 0x5c], 0
jmp 0x411885
mov dword [ebp - 0x5c], 1
cmp dword [ebp - 0x5c], 0
je 0x411abd
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0x63
mov ecx, dword [0x41c118]
imul ecx, dword [0x41c11c]
test ecx, ecx
jne 0x4118c9
mov edx, dword [ebp - 8]
imul edx, dword [ebp - 0x10]
test edx, edx
jne 0x4118c9
mov dword [ebp - 0x60], 0
jmp 0x4118d0
mov dword [ebp - 0x60], 1
cmp dword [ebp - 0x60], 0
jne 0x41190d
mov eax, dword [str.p4vH_]
imul eax, dword [ebp - 0x34]
test eax, eax
jne 0x4118f7
mov ecx, dword [ebp - 0x1c]
or ecx, dword [ebp - 0x140]
jne 0x4118f7
mov dword [ebp - 0x64], 0
jmp 0x4118fe
mov dword [ebp - 0x64], 1
cmp dword [ebp - 0x64], 0
jne 0x41190d
mov dword [ebp - 0x68], 0
jmp 0x411914
mov dword [ebp - 0x68], 1
cmp dword [ebp - 0x68], 0
jne 0x411952
mov edx, dword [ebp - 0x18]
imul edx, dword [0x41c0d4]
test edx, edx
je 0x41193c
mov eax, dword [ebp - 0x38]
sub eax, dword [0x41c110]
je 0x41193c
mov dword [ebp - 0x6c], 1
jmp 0x411943
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0x6c], 0
jne 0x411952
mov dword [ebp - 0x70], 0
jmp 0x411959
mov dword [ebp - 0x70], 1
cmp dword [ebp - 0x70], 0
jne 0x411989
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
cmp ecx, edx
jbe 0x411978
mov dword [ebp - 0x74], 1
jmp 0x41197f
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 0
je 0x411a49
mov dword [ebp - 0x78], 0xaf
mov dword [ebp - 0x40], 0x73
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x40]
xor eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x41c0d0]
push ecx
mov edx, dword [0x41c130]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 0x34]
push eax
push str.CiBekmnVa
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x78], eax
mov dword [ebp + 0xc], 0
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4119f1
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
jmp 0x4119d4
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
push 0
push 0xffffffffffffffff
push str.timxezmrbdc
push 0xffffffffffffffff
push str.avojyqzg
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
push edx
call fcn.00410ef3
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x2c], eax
push str.xlAVZQyGc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
jmp 0x411a72
mov dword [ebp - 0x144], 0x40
mov dword [ebp - 0x148], 0xbd
mov eax, dword [ebp - 0x4c]
and eax, dword [ebp - 0x7c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x30]
mov dword [0x41c134], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
movzx eax, word [edx]
mov dword [ebp - 0x18], eax
push 0
push 0xffffffffffffffff
push str.ljcovmogp
push 0xffffffffffffffff
push str.gitvatab
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x2c]
movzx edx, word [ecx]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov dword [ebp - 0x18], ecx
jmp 0x411c5d
mov dword [ebp - 0x104], 0xc7
mov dword [ebp - 0x44], 0xd2
mov edx, dword [ebp - 0x104]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp esi, eax
jbe 0x411b01
mov dword [ebp - 0x84], 1
jmp 0x411b0b
mov dword [ebp - 0x84], 0
mov edx, dword [0x41c12c]
push edx
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [0x41c11c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
mov eax, dword [0x41c110]
push eax
mov ecx, dword [0x41c118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
cmp esi, eax
jae 0x411b4c
mov dword [ebp - 0x88], 1
jmp 0x411b56
mov dword [ebp - 0x88], 0
mov edx, dword [ebp - 0x84]
cmp edx, dword [ebp - 0x88]
je 0x411b70
mov dword [ebp - 0x8c], 1
jmp 0x411b7a
mov dword [ebp - 0x8c], 0
mov eax, dword [0x41c0d4]
xor eax, dword [ebp - 0x34]
mov dword [0x41c134], eax
mov ecx, dword [ebp - 0x44]
imul ecx, dword [0x41c11c]
mov dword [0x41c0bc], ecx
mov edx, dword [0x41c134]
cmp edx, dword [0x41c0bc]
je 0x411bb1
mov dword [ebp - 0x90], 1
jmp 0x411bbb
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x90]
jbe 0x411bd5
mov dword [ebp - 0x94], 1
jmp 0x411bdf
mov dword [ebp - 0x94], 0
mov ecx, dword [ebp - 0x14]
or ecx, dword [0x41c0d0]
jne 0x411c04
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x411c04
mov dword [ebp - 0x98], 0
jmp 0x411c0e
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x98]
jae 0x411c37
mov dword [ebp - 0x14c], 0x4d
mov ecx, dword [0x41c0d0]
add ecx, dword [ebp - 0x150]
mov dword [ebp - 0x44], ecx
jmp 0x411c5d
mov dword [ebp - 0x154], 0xc3
mov edx, dword [ebp - 0x158]
push edx
mov eax, dword [0x41c134]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.GDI32.dll_PolylineTo]
mov dword [0x41c12c], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x1a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xc6
ja case.0x411c83.1
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0x412453]
jmp dword [edx*4 + 0x41243f]
mov eax, dword [0x41c0d4]
add eax, dword [ebp + 0xc]
mov dword [0x41c0c4], eax
mov ecx, dword [0x41c0d4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x41c0bc], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 0x2c], eax
jmp 0x411dc3
mov dword [ebp - 0x15c], 0xdd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x41c0d0], eax
jmp 0x411dc3
mov ecx, dword [str.p4vH_]
sub ecx, dword [0x41c134]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x41c0c4]
and edx, dword [0x41c118]
mov dword [ebp - 0x160], edx
jmp 0x411dc3
mov dword [ebp - 0x108], 0x53
mov dword [ebp - 0x164], 0xf
mov eax, dword [0x41c0cc]
imul eax, dword [0x41c128]
mov dword [0x41c11c], eax
mov ecx, dword [0x41c0c0]
and ecx, dword [0x41c0c0]
mov dword [ebp - 0x108], ecx
mov edx, dword [0x41c0bc]
and edx, dword [ebp - 0x1c]
mov dword [0x41c11c], edx
jmp 0x411dc3
mov dword [ebp - 0x168], 0xee
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0x7e
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x9c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x10c]
or ecx, dword [ebp - 0x48]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x110]
imul edx, dword [ebp - 0x114]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push str.nbXAclqI
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push str.pNXybfAhT.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x4c], eax
push str.jrCdwpXxb
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
mov eax, dword [0x41c110]
xor eax, dword [0x41c134]
je 0x411e26
mov ecx, dword [ebp - 0x20]
imul ecx, dword [0x41c0d0]
test ecx, ecx
je 0x411e26
mov dword [ebp - 0xa0], 1
jmp 0x411e30
mov dword [ebp - 0xa0], 0
cmp dword [ebp - 0xa0], 0
je 0x411e77
mov edx, dword [ebp - 0x14]
sub edx, dword [0x41c134]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
cmp edx, eax
je 0x411e58
mov dword [ebp - 0xa4], 1
jmp 0x411e62
mov dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 0
je 0x411e77
mov dword [ebp - 0xa8], 1
jmp 0x411e81
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 0
je 0x411ec0
mov ecx, dword [ebp - 0xc]
and ecx, dword [ebp - 0x24]
jne 0x411ea9
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 8]
test edx, edx
jne 0x411ea9
mov dword [ebp - 0xac], 0
jmp 0x411eb3
mov dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 0
jne 0x412092
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [0x41c0cc]
imul edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
sub eax, dword [0x41c12c]
cmp edx, eax
jne 0x411efc
mov dword [ebp - 0xb0], 1
jmp 0x411f06
mov dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0
je 0x411f7d
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 4]
jne 0x411f2b
mov edx, dword [ebp - 4]
and edx, dword [ebp - 4]
jne 0x411f2b
mov dword [ebp - 0xb4], 0
jmp 0x411f35
mov dword [ebp - 0xb4], 1
cmp dword [ebp - 0xb4], 0
je 0x411f7d
mov eax, dword [0x41c11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x41c0d0], eax
mov ecx, dword [ebp - 0x170]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.GDI32.dll_PolylineTo]
mov dword [0x41c134], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x11c], eax
jmp 0x41208d
mov dword [ebp - 0xbc], 0xa5
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0xc0], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.CIF.yRk
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x30], eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.QRiVVmti.mBe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb8], eax
push 0
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.VHxKQ.Wuy
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
push str.eMkETMXou.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xbc], eax
push str.ziCiSGB
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x124], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412092
jmp 0x411dff
mov edx, dword [0x41c134]
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
and eax, dword [ebp + 8]
cmp edx, eax
jne 0x4120b2
mov dword [ebp - 0xc4], 1
jmp 0x4120bc
mov dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 0
jne 0x412107
mov ecx, dword [ebp - 0x20]
imul ecx, dword [0x41c128]
mov edx, dword [ebp + 8]
and edx, dword [0x41c11c]
cmp ecx, edx
je 0x4120e8
mov dword [ebp - 0xc8], 1
jmp 0x4120f2
mov dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0
jne 0x412107
mov dword [ebp - 0xcc], 0
jmp 0x412111
mov dword [ebp - 0xcc], 1
cmp dword [ebp - 0xcc], 0
jne 0x41215d
mov eax, dword [0x41c124]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [0x41c110]
sub ecx, dword [0x41c134]
cmp eax, ecx
je 0x41213e
mov dword [ebp - 0xd0], 1
jmp 0x412148
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jne 0x41215d
mov dword [ebp - 0xd4], 0
jmp 0x412167
mov dword [ebp - 0xd4], 1
cmp dword [ebp - 0xd4], 0
jne 0x4121b3
mov edx, dword [0x41c12c]
add edx, dword [0x41c110]
mov eax, dword [0x41c118]
and eax, dword [ebp - 8]
cmp edx, eax
jae 0x412194
mov dword [ebp - 0xd8], 1
jmp 0x41219e
mov dword [ebp - 0xd8], 0
cmp dword [ebp - 0xd8], 0
jne 0x4121b3
mov dword [ebp - 0xdc], 0
jmp 0x4121bd
mov dword [ebp - 0xdc], 1
cmp dword [ebp - 0xdc], 0
jne 0x4121fc
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x4121e5
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 8]
jne 0x4121e5
mov dword [ebp - 0xe0], 0
jmp 0x4121ef
mov dword [ebp - 0xe0], 1
cmp dword [ebp - 0xe0], 0
je 0x412404
mov dword [ebp - 0x12c], 0x33
mov dword [ebp - 0x100], 0xc1
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0x67
mov dword [ebp - 0x178], 0x60
mov dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x128]
xor edx, edx
div dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [0x41c0c0]
imul eax, dword [0x41c0c8]
mov ecx, dword [0x41c0d0]
or ecx, dword [ebp - 0x4c]
cmp eax, ecx
jne 0x412279
mov dword [ebp - 0xe4], 1
jmp 0x412283
mov dword [ebp - 0xe4], 0
cmp dword [ebp - 0xe4], 0
je 0x4122ca
mov edx, dword [0x41c0c4]
add edx, dword [ebp - 8]
jne 0x4122ab
mov eax, dword [ebp - 0x38]
xor eax, dword [ebp - 0x24]
jne 0x4122ab
mov dword [ebp - 0xe8], 0
jmp 0x4122b5
mov dword [ebp - 0xe8], 1
cmp dword [ebp - 0xe8], 0
je 0x4122ca
mov dword [ebp - 0xec], 1
jmp 0x4122d4
mov dword [ebp - 0xec], 0
cmp dword [ebp - 0xec], 0
je 0x41231b
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x12c]
sub edx, dword [ebp - 0x50]
cmp ecx, edx
jne 0x4122fc
mov dword [ebp - 0xf0], 1
jmp 0x412306
mov dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0
je 0x41231b
mov dword [ebp - 0xf4], 1
jmp 0x412325
mov dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 0
je 0x41238e
mov eax, dword [ebp - 0x54]
or eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xf8]
or ecx, dword [ebp - 0xf8]
cmp eax, ecx
jae 0x412350
mov dword [ebp - 0xfc], 1
jmp 0x41235a
mov dword [ebp - 0xfc], 0
cmp dword [ebp - 0xfc], 0
je 0x41238e
mov dword [ebp - 0x130], 0x63
mov edx, dword [0x41c0bc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov dword [ebp - 0x10], eax
jmp 0x412402
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x180], 0
push str.tEghlK.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x100], eax
push str.vyyFGzNzG
mov eax, dword [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x134], eax
push 0
push 0xffffffffffffffff
push str.mtkn
push 0xffffffffffffffff
push str.ivzyaajocff
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x138], eax
jmp 0x412433
mov dword [ebp - 0x184], 0x6a
mov dword [ebp - 0x188], 0x6d
mov ecx, dword [0x41c0c0]
or ecx, dword [0x41c110]
mov dword [0x41c0c4], ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret