Function at 0x40d864
Capabilities:
Allocate thread local storage
Enumerate files on windows
Get file size
Get thread local storage value

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, byte [esp + eax]
add al, 4
add al, 4
add al, 4
add al, 4
add esp, dword [esi - 112]
xor ebp, ecx
inc eax
add ch, bl
int 0x40
add byte [ebx - 0xbffbf32], bh
into
inc eax
add byte [edi - 0x32], ch
inc eax
add byte [esi + ecx*8], ch
inc eax
add byte [0x8f0040ce], dl
into
inc eax
add bh, bh
into
inc eax
add byte [eax], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ecx], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [edx], al
add ecx, dword [eax]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add al, 8
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add eax, 134744072
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
push es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
pop es
cmp ah, dl
inc eax
add byte [eax - 0x71ffbf2c], bh
aam 0x40
add ch, bh
aam 0x40
add byte [edx*8 - 0x2b88ffc0], bl
inc eax
add byte [ebp + edx*8 + 0x40], dh
add byte [eax], al
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add dword [esi], eax
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, byte [esi]
push es
push es
push es
push es
add eax, dword [esi]
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, 6
push es
push es
push es
push es
push es
push es
add eax, 1439485132
push ebp
mov ebp, esp
sub esp, 0x150
push esi
mov dword [ebp - 0x2c], 0x1f
mov dword [ebp - 0x3c], 0x1c
mov dword [ebp - 0x20], 0x94
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x8c], 0
mov eax, dword [0x4217e0]
or eax, dword [0x421808]
mov ecx, dword [0x421808]
add ecx, dword [0x4217f4]
cmp eax, ecx
je 0x40d8c6
mov dword [ebp - 0x74], 1
jmp 0x40d8cd
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 0
je 0x40da75
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0x20]
cmp ecx, eax
jae 0x40d8f3
mov dword [ebp - 0x78], 1
jmp 0x40d8fa
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0
je 0x40da75
mov dword [ebp - 0xec], 4
mov eax, dword [0x421824]
xor edx, edx
div dword [0x42180c]
mov dword [0x42181c], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov esi, eax
mov eax, dword [0x4217f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp esi, eax
jne 0x40d945
mov dword [ebp - 0x7c], 1
jmp 0x40d94c
mov dword [ebp - 0x7c], 0
mov ecx, dword [0x421800]
xor ecx, dword [0x4217fc]
mov dword [0x421808], ecx
mov edx, dword [0x42180c]
push edx
mov eax, dword [0x421804]
push eax
mov ecx, dword [0x4217ec]
push ecx
call dword [sym.imp.GDI32.dll_PolylineTo]
cmp eax, dword [0x421808]
jae 0x40d989
mov dword [ebp - 0x80], 1
jmp 0x40d990
mov dword [ebp - 0x80], 0
mov edx, dword [ebp - 0x7c]
cmp edx, dword [ebp - 0x80]
jbe 0x40d9a4
mov dword [ebp - 0x84], 1
jmp 0x40d9ae
mov dword [ebp - 0x84], 0
mov eax, dword [0x4217e8]
xor eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [0x42180c]
cmp dword [ebp - 0x1c], ecx
jae 0x40d9d3
mov dword [ebp - 0x88], 1
jmp 0x40d9dd
mov dword [ebp - 0x88], 0
mov edx, dword [ebp - 0x84]
cmp edx, dword [ebp - 0x88]
jbe 0x40da35
mov dword [ebp - 0x104], 0xbc
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [0x4217e4]
push edx
call dword [sym.imp.GDI32.dll_PolylineTo]
mov dword [0x4217e0], eax
mov eax, dword [0x4217f8]
xor eax, dword [0x4217ec]
mov dword [ebp - 0x48], eax
mov ecx, dword [0x421818]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [ebp - 0x8c], eax
jmp 0x40da63
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0xec]
mov dword [0x4217f8], edx
mov eax, dword [0x4217e8]
add eax, dword [0x421820]
mov dword [0x421820], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
mov dword [0x421814], edx
mov eax, dword [0x421818]
add eax, dword [ebp - 4]
mov dword [str.AJ], eax
jmp 0x40dd0e
mov dword [ebp - 0xa4], 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0x3a
push 0x3f8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0xffffffffffffffff
push str.lyplgmea
push 0xffffffffffffffff
push str.pkmbjcg
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 8], eax
push 0
push 0xffffffffffffffff
push str.lkqbjwazzt
push 0xffffffffffffffff
push str.conhtltrh
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x4217e4]
add ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x8c]
cmp ecx, edx
jae 0x40dafa
mov dword [ebp - 0x90], 1
jmp 0x40db04
mov dword [ebp - 0x90], 0
cmp dword [ebp - 0x90], 0
je 0x40db51
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 8]
cmp eax, ecx
jne 0x40db2a
mov dword [ebp - 0x94], 1
jmp 0x40db34
mov dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0
je 0x40db51
mov edx, dword [0x4217e4]
sub edx, dword [0x421824]
mov dword [0x421804], edx
jmp 0x40dba2
mov dword [ebp - 0x10c], 0xdb
mov dword [ebp - 0x110], 0x24
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
push 0
push 0xffffffffffffffff
push str.ilvtavzd
push 0xffffffffffffffff
push str.ybwuurripw
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040ed44
add esp, 4
mov edx, dword [0x421824]
and edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
and eax, dword [0x4217e4]
cmp edx, eax
je 0x40dbc4
mov dword [ebp - 0x98], 1
jmp 0x40dbce
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 0
je 0x40dc33
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 8]
cmp ecx, edx
je 0x40dbf3
mov dword [ebp - 0x9c], 1
jmp 0x40dbfd
mov dword [ebp - 0x9c], 0
cmp dword [ebp - 0x9c], 0
je 0x40dc33
mov eax, dword [0x4217f4]
push eax
mov ecx, dword [ebp - 0xf0]
push ecx
call dword [sym.imp.GDI32.dll_SetArcDirection]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xf0]
sub edx, dword [0x421804]
mov dword [0x4217f0], edx
jmp 0x40dd0e
mov dword [ebp - 0xa0], 0x96
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x64]
push ecx
push str.qVTmSLcbqiTY
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xa0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40dcac
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x40dc8c
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0xa4]
movzx ecx, word [eax]
mov dword [ebp - 0x4c], ecx
lea edx, [ebp - 0x2c]
push edx
push str.nkApzVLYaJjJ
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x3c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40dcff
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x40dce2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx]
mov dword [ebp - 0x50], edx
mov eax, dword [0x421824]
add eax, dword [ebp + 0xc]
jne 0x40dd2c
mov ecx, dword [ebp - 0x18]
and ecx, dword [ebp + 8]
jne 0x40dd2c
mov dword [ebp - 0xa8], 0
jmp 0x40dd36
mov dword [ebp - 0xa8], 1
cmp dword [ebp - 0xa8], 0
jne 0x40dd72
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
jne 0x40dd5b
mov eax, dword [ebp - 0x70]
or eax, dword [ebp - 0x20]
jne 0x40dd5b
mov dword [ebp - 0xac], 0
jmp 0x40dd65
mov dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 0
je 0x40e179
mov dword [ebp - 0xd0], 0x19
mov dword [ebp - 0xd4], 0x74
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x14], 0x4f
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x40], 0
mov ecx, dword [0x421818]
sub ecx, dword [0x421804]
mov edx, dword [ebp - 0x14]
sub edx, dword [0x421804]
cmp ecx, edx
jne 0x40ddc7
mov dword [ebp - 0xb0], 1
jmp 0x40ddd1
mov dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0
je 0x40de1d
mov eax, dword [0x4217f0]
add eax, dword [0x4217f4]
jne 0x40ddfe
mov ecx, dword [ebp + 8]
xor ecx, dword [0x4217f0]
jne 0x40ddfe
mov dword [ebp - 0xb4], 0
jmp 0x40de08
mov dword [ebp - 0xb4], 1
cmp dword [ebp - 0xb4], 0
je 0x40de1d
mov dword [ebp - 0xb8], 1
jmp 0x40de27
mov dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 0
je 0x40de71
mov edx, dword [ebp - 0x18]
xor edx, dword [0x4217f4]
mov eax, dword [ebp - 4]
xor eax, dword [0x4217ec]
cmp edx, eax
jne 0x40de52
invalid
mov dword [ebp - 0xbc], 1
jmp 0x40de5c
mov dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0
je 0x40de71
mov dword [ebp - 0xc0], 1
jmp 0x40de7b
mov dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0
je 0x40dec9
mov ecx, dword [ebp - 4]
and ecx, dword [0x421804]
mov edx, dword [0x4217f8]
imul edx, dword [0x4217f8]
cmp ecx, edx
jne 0x40deaa
mov dword [ebp - 0xc4], 1
jmp 0x40deb4
mov dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 0
je 0x40dec9
mov dword [ebp - 0xc8], 1
jmp 0x40ded3
mov dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0
je 0x40df4c
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
jne 0x40defb
mov ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x40defb
mov dword [ebp - 0xcc], 0
jmp 0x40df05
mov dword [ebp - 0xcc], 1
cmp dword [ebp - 0xcc], 0
je 0x40df4c
mov dword [ebp - 0xf8], 0x41
mov eax, dword [ebp - 0x5c]
xor edx, edx
div dword [0x42180c]
mov dword [0x4217f0], eax
mov edx, dword [ebp - 0xf8]
push edx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x421824]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
jmp 0x40dfd4
mov dword [ebp - 0x28], 0x62
mov dword [ebp - 0x58], 0
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
and edx, dword [ebp - 0x58]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0xd0]
push eax
push str.eapZDKDOM
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x54], 0
invalid
lea esi, [eax]
invalid