Function at 0x4170aa
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x4177ca
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41710e
call esi
test eax, eax
je 0x4170fb
cmp byte [ebp - 3], 0x3a
jne 0x4170fb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417125
call esi
test eax, eax
je 0x417125
cmp byte [ebp - 3], 0x3a
jne 0x417125
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417167
call esi
test eax, eax
je 0x417154
cmp byte [ebp - 3], 0x3a
jne 0x417154
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41717e
call esi
test eax, eax
je 0x41717e
cmp byte [ebp - 3], 0x3a
jne 0x41717e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4171c0
call esi
test eax, eax
je 0x4171ad
cmp byte [ebp - 3], 0x3a
jne 0x4171ad
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4171d7
call esi
test eax, eax
je 0x4171d7
cmp byte [ebp - 3], 0x3a
jne 0x4171d7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417217
call esi
test eax, eax
je 0x417204
cmp byte [ebp - 3], 0x3a
jne 0x417204
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41722e
call esi
test eax, eax
je 0x41722e
cmp byte [ebp - 3], 0x3a
jne 0x41722e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41726f
call esi
test eax, eax
je 0x41725c
cmp byte [ebp - 3], 0x3a
jne 0x41725c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417286
call esi
test eax, eax
je 0x417286
cmp byte [ebp - 3], 0x3a
jne 0x417286
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4172c8
call esi
test eax, eax
je 0x4172b5
cmp byte [ebp - 3], 0x3a
jne 0x4172b5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4172df
call esi
test eax, eax
je 0x4172df
cmp byte [ebp - 3], 0x3a
jne 0x4172df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417322
call esi
test eax, eax
je 0x41730f
cmp byte [ebp - 3], 0x3a
jne 0x41730f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417339
call esi
test eax, eax
je 0x417339
cmp byte [ebp - 3], 0x3a
jne 0x417339
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41737c
call esi
test eax, eax
je 0x417369
cmp byte [ebp - 3], 0x3a
jne 0x417369
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417393
call esi
test eax, eax
je 0x417393
cmp byte [ebp - 3], 0x3a
jne 0x417393
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4173d4
call esi
test eax, eax
je 0x4173c1
cmp byte [ebp - 3], 0x3a
jne 0x4173c1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4173eb
call esi
test eax, eax
je 0x4173eb
cmp byte [ebp - 3], 0x3a
jne 0x4173eb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41744b
call esi
test eax, eax
je 0x41741b
cmp byte [ebp - 3], 0x3a
jne 0x41741b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417438
cmp byte [ebp - 3], 0x3a
jne 0x417438
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417462
call esi
test eax, eax
je 0x417462
cmp byte [ebp - 3], 0x3a
jne 0x417462
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4174c2
call esi
test eax, eax
je 0x417492
cmp byte [ebp - 3], 0x3a
jne 0x417492
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4174af
cmp byte [ebp - 3], 0x3a
jne 0x4174af
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4174d9
call esi
test eax, eax
je 0x4174d9
cmp byte [ebp - 3], 0x3a
jne 0x4174d9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417539
call esi
test eax, eax
je 0x417509
cmp byte [ebp - 3], 0x3a
jne 0x417509
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417526
cmp byte [ebp - 3], 0x3a
jne 0x417526
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417550
call esi
test eax, eax
je 0x417550
cmp byte [ebp - 3], 0x3a
jne 0x417550
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4175b0
call esi
test eax, eax
je 0x417580
cmp byte [ebp - 3], 0x3a
jne 0x417580
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41759d
cmp byte [ebp - 3], 0x3a
jne 0x41759d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4175c7
call esi
test eax, eax
je 0x4175c7
cmp byte [ebp - 3], 0x3a
jne 0x4175c7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417625
call esi
test eax, eax
je 0x4175f5
cmp byte [ebp - 3], 0x3a
jne 0x4175f5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417612
cmp byte [ebp - 3], 0x3a
jne 0x417612
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41763c
call esi
test eax, eax
je 0x41763c
cmp byte [ebp - 3], 0x3a
jne 0x41763c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41769d
call esi
test eax, eax
je 0x41766d
cmp byte [ebp - 3], 0x3a
jne 0x41766d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41768a
cmp byte [ebp - 3], 0x3a
jne 0x41768a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4176b4
call esi
test eax, eax
je 0x4176b4
cmp byte [ebp - 3], 0x3a
jne 0x4176b4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417713
call esi
test eax, eax
je 0x4176e3
cmp byte [ebp - 3], 0x3a
jne 0x4176e3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417700
cmp byte [ebp - 3], 0x3a
jne 0x417700
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41772a
call esi
test eax, eax
je 0x41772a
cmp byte [ebp - 3], 0x3a
jne 0x41772a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4177b3
call esi
test eax, eax
je 0x417783
cmp byte [ebp - 3], 0x3a
jne 0x417783
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4177a0
cmp byte [ebp - 3], 0x3a
jne 0x4177a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4177ca
call esi
test eax, eax
je 0x4177ca
cmp byte [ebp - 3], 0x3a
jne 0x4177ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [0x43c3d0]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [eax + 0x50]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4177f0
xor eax, eax
jmp 0x417807
mov eax, dword [0x43c3d0]
push ebx
push esi
call dword [eax + 0x38]
mov edi, eax
mov eax, dword [0x43c3d0]
push esi
call dword [eax + 0x44]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4