Function at 0x411ab1
Capabilities:
Enumerate files on windows
Get file attributes
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov dword [ebp - 0x18], 0xc6
mov dword [ebp - 0x94], 0x4a
mov dword [ebp - 0x30], 0xf0
mov dword [ebp - 0x14], 0x9b
mov dword [ebp - 0x3c], 0x83
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0xc
mov eax, dword [ebp - 0x28]
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov ecx, dword [0x419128]
sub ecx, dword [ebp - 0x20]
mov edx, dword [0x4190d8]
imul edx, dword [ebp - 0x30]
cmp ecx, edx
jae 0x411b2f
mov dword [ebp - 0x4c], 1
jmp 0x411b36
mov dword [ebp - 0x4c], 0
cmp dword [ebp - 0x4c], 0
jne 0x411b69
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x8c]
cmp eax, ecx
jbe 0x411b58
mov dword [ebp - 0x50], 1
jmp 0x411b5f
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0
je 0x411ea7
mov dword [ebp - 0xa0], 0x26
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x40]
push eax
call fcn.0040a771
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x34]
jne 0x411bbe
mov edx, dword [ebp - 0x40]
or edx, dword [ebp - 4]
jne 0x411bbe
mov dword [ebp - 0x54], 0
jmp 0x411bc5
mov dword [ebp - 0x54], 1
cmp dword [ebp - 0x54], 0
je 0x411c00
mov eax, dword [ebp - 0x2c]
xor eax, dword [0x419130]
jne 0x411bea
mov ecx, dword [0x4190dc]
xor ecx, dword [ebp - 4]
jne 0x411bea
mov dword [ebp - 0x58], 0
jmp 0x411bf1
mov dword [ebp - 0x58], 1
cmp dword [ebp - 0x58], 0
je 0x411c00
mov dword [ebp - 0x5c], 1
jmp 0x411c07
mov dword [ebp - 0x5c], 0
cmp dword [ebp - 0x5c], 0
je 0x411c3c
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x2c]
je 0x411c26
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x10]
je 0x411c26
mov dword [ebp - 0x60], 1
jmp 0x411c2d
mov dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
je 0x411c3c
mov dword [ebp - 0x64], 1
jmp 0x411c43
mov dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 0
je 0x411cb7
mov ecx, dword [ebp - 0x2c]
xor ecx, dword [ebp - 0x84]
je 0x411c6b
mov edx, dword [ebp - 4]
imul edx, dword [ebp - 0x90]
test edx, edx
je 0x411c6b
mov dword [ebp - 0x68], 1
jmp 0x411c72
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0
je 0x411cb7
mov dword [ebp - 0xa4], 0xb0
mov eax, dword [ebp - 0x30]
xor eax, dword [0x419114]
mov dword [ebp - 0xa8], eax
mov ecx, dword [0x41911c]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [0x4190dc]
push eax
call fcn.0040a771
add esp, 8
jmp 0x411d58
mov dword [ebp - 0xac], 0xd4
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp + 8]
push ecx
push str.afwDGZnnYD
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x411d05
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x411ce8
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x70], edx
push 0
push 0xffffffffffffffff
push str.qhwn
push 0xffffffffffffffff
push str.sbzx
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x6c], eax
push str.lISUnO.XrG
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x6c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
movzx ecx, word [eax]
mov dword [ebp - 0x70], ecx
jmp 0x411ea7
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040a771
add esp, 8
test eax, eax
je 0x411d7d
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
je 0x411d7d
mov dword [ebp - 0x74], 1
jmp 0x411d84
mov dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x38]
xor edx, edx
div dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x411dac
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x411dac
mov dword [ebp - 0x78], 1
jmp 0x411db3
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x78]
je 0x411dd8
mov dword [ebp - 0xb0], 0x90
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
jmp 0x411e16
mov dword [ebp - 0xb4], 0x32
mov dword [ebp - 0xb8], 0x2b
mov eax, dword [ebp - 0x38]
and eax, dword [0x419130]
mov dword [0x4190bc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x4190d8], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
div dword [0x419130]
mov dword [ebp - 0xc], eax
mov eax, dword [0x419120]
push eax
call fcn.0040ec41
add esp, 4
cmp eax, dword [ebp - 0xc]
jbe 0x411e40
mov dword [ebp - 0x7c], 1
jmp 0x411e47
mov dword [ebp - 0x7c], 0
mov ecx, dword [0x4190d0]
push ecx
mov edx, dword [0x4190dc]
push edx
call fcn.0040a771
add esp, 8
mov ecx, dword [0x4190c4]
xor ecx, dword [0x419120]
cmp eax, ecx
jae 0x411e76
mov dword [ebp - 0x80], 1
jmp 0x411e7d
mov dword [ebp - 0x80], 0
mov edx, dword [ebp - 0x7c]
cmp edx, dword [ebp - 0x80]
jbe 0x411ea2
mov eax, dword [ebp - 4]
push eax
call fcn.0040ba01
add esp, 4
mov ecx, dword [ebp - 0x3c]
or ecx, dword [ebp - 0x84]
mov dword [ebp - 0x24], ecx
jmp 0x411e16
jmp 0x411b0f
lea edx, [ebp - 0x20]
push edx
push str.AAbrC
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x411edd
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x411ec0
lea eax, [ebp - 0x3c]
push eax
push str.UcoCgQJBzzNd
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x411f13
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x411ef6
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x44], 0x1f
jmp 0x411f31
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x4e
jae 0x411fd0
mov dword [ebp - 0x9c], 0x8a
mov dword [ebp - 0xbc], 0x91
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x88], ecx
cmp dword [ebp - 0x88], 0x88
je 0x411f75
cmp dword [ebp - 0x88], 0xe3
je 0x411f88
jmp 0x411f9d
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptor]
mov dword [ebp - 0x1c], eax
jmp 0x411fcb
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x419130], eax
jmp 0x411fcb
mov dword [ebp - 0xc0], 0xf7
mov dword [ebp - 0x48], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc8], 0x67
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
jmp 0x411f28
mov ecx, dword [0x4190c0]
push ecx
mov edx, dword [0x419120]
push edx
call fcn.0040a771
add esp, 8
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret