Function at 0x401000
Capabilities:
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x154
push 0
push 0x4124c8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4124cc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4124c8], eax
call section..text
mov eax, 0x41130a
mov dword [0x412500], eax
call fcn.0040e4a0
call fcn.0040e28c
call fcn.0040c793
call fcn.0040c2c3
call fcn.0040bc70
call fcn.0040b8fb
call fcn.0040b640
call fcn.0040b621
call fcn.0040b598
call fcn.0040ad00
call fcn.00409d2f
call fcn.00408f61
call fcn.00408c26
call fcn.004088ae
call fcn.00407421
call fcn.00407099
push dword [0x412608]
call fcn.00408c45
push 7
push 0x411060
lea eax, [0x412608]
push eax
push 8
call fcn.00408b94
push 0x412600
push 0x411070
push 7
push 0x401
push 8
call fcn.0040e18d
mov eax, 0x200
push eax
lea eax, [0x412618]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040c7b2
push dword [0x412610]
call fcn.00408c45
push 7
push 0x411068
lea eax, [0x412610]
push eax
push 8
call fcn.00408b94
mov edx, 0x411021
lea ecx, [0x4125a0]
call fcn.00404068
mov ebp, 0x41130a
mov ebx, ebp
mov ebp, 0x411125
sub ebx, ebp
mov dword [0x412590], ebx
mov ebp, 0x411125
mov dword [0x412594], ebp
push dword [0x412590]
call fcn.0040b6b0
mov dword [0x412564], eax
mov dword [0x412510], 0
mov eax, dword [0x412590]
cmp eax, dword [0x412510]
jl 0x4011b1
mov ebx, dword [0x412594]
add ebx, dword [0x412510]
mov eax, ebx
call fcn.0040b6d0
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x412564]
add ebx, dword [0x412510]
mov eax, ebx
call fcn.0040b6e0
inc dword [0x412510]
jno 0x401170
mov edx, dword [0x412af8]
push edx
push edx
mov ebx, dword [0x412590]
add ebx, 0xfffffff8
push ebx
mov ebx, dword [0x412564]
add ebx, 4
push ebx
call fcn.0040b6f0
push 0x4124f0
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push dword [0x4124f0]
call fcn.004040d0
push 0x4124f0
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 1
push dword [0x4124f0]
call fcn.004041b0
push 0x412530
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 2
push dword [0x4124f0]
call fcn.004041b0
push 0x412598
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 3
push dword [0x4124f0]
call fcn.004041b0
push 0x412528
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 4
push dword [0x4124f0]
call fcn.004041b0
push 0x4125fc
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 5
push dword [0x4124f0]
call fcn.004041b0
push 0x412534
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 6
push dword [0x4124f0]
call fcn.004041b0
push 0x4125bc
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 7
push dword [0x4124f0]
call fcn.004041b0
push 0x4124f4
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 8
push dword [0x4124f0]
call fcn.004041b0
push 0x412548
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 9
push dword [0x4124f0]
call fcn.004041b0
push 0x4125e0
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0xa
push dword [0x4124f0]
call fcn.004041b0
push 0x412504
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0xb
push dword [0x4124f0]
call fcn.004041b0
push 0x4125f0
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0xc
push dword [0x4124f0]
call fcn.004041b0
push 0x4125a8
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0xd
push dword [0x4124f0]
call fcn.004041b0
push 0x412550
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0xe
push dword [0x4124f0]
call fcn.004041b0
push 0x412588
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0xf
push dword [0x4124f0]
call fcn.004041b0
push 0x4124e0
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x10
push dword [0x4124f0]
call fcn.004041b0
push 0x4125dc
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x11
push dword [0x4124f0]
call fcn.004041b0
push 0x41250c
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x12
push dword [0x4124f0]
call fcn.004041b0
push 0x412580
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x13
push dword [0x4124f0]
call fcn.004041b0
push 0x4125b0
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x14
push dword [0x4124f0]
call fcn.004041b0
push 0x41257c
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x15
push dword [0x4124f0]
call fcn.004041b0
push 0x4125c4
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x16
push dword [0x4124f0]
call fcn.004041b0
push 0x4125a4
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x17
push dword [0x4124f0]
call fcn.004041b0
push 0x4125cc
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x18
push dword [0x4124f0]
call fcn.004041b0
push 0x412538
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x19
push dword [0x4124f0]
call fcn.004041b0
push 0x412540
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x1a
push dword [0x4124f0]
call fcn.004041b0
push 0x4125c8
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x4125a0]
push 0x1b
push dword [0x4124f0]
call fcn.004041b0
push 0x412578
call fcn.0040e520
call fcn.00409b0f
mov ebx, eax
cmp ebx, 0x3c
jge 0x40165e
push 0x10
push dword [0x4125c4]
push dword [0x4125dc]
call fcn.004070d0
jmp 0x401dd9
mov eax, 0x41130a
mov dword [0x412500], eax
mov eax, dword [0x412500]
mov eax, dword [eax]
mov dword [0x412510], eax
add dword [0x412500], 4
mov eax, dword [0x412500]
mov eax, dword [eax]
mov dword [0x412514], eax
add dword [0x412500], 4
mov eax, dword [0x412500]
mov eax, dword [eax]
mov dword [0x412518], eax
add dword [0x412500], 4
mov eax, dword [0x412500]
mov eax, dword [eax]
mov dword [0x41251c], eax
add dword [0x412500], 4
mov eax, dword [0x412500]
mov eax, dword [eax]
mov dword [0x412520], eax
add dword [0x412500], 4
push 0x14
call fcn.0040b6b0
mov dword [0x412524], eax
push dword [0x412510]
mov eax, dword [0x412524]
call fcn.0040b750
push dword [0x412514]
mov ebx, dword [0x412524]
add ebx, 4
mov eax, ebx
call fcn.0040b750
push dword [0x412518]
mov ebx, dword [0x412524]
add ebx, 8
mov eax, ebx
call fcn.0040b750
push dword [0x41251c]
mov ebx, dword [0x412524]
add ebx, 0xc
mov eax, ebx
call fcn.0040b750
push dword [0x412520]
mov ebx, dword [0x412524]
add ebx, 0x10
mov eax, ebx
call fcn.0040b750
mov edx, dword [0x412af8]
push edx
push edx
push 0x14
push dword [0x412524]
call fcn.0040cd70
push 0x4125f4
call fcn.0040e520
call fcn.00407fcd
mov edx, 0x411025
lea ecx, [0x4125b4]
call fcn.00404068
mov edx, str..bat
lea ecx, [0x4125ac]
call fcn.00404068
mov edx, str..exe
lea ecx, [0x41256c]
call fcn.00404068
push 1
lea eax, [0x4027c0]
push eax
call sub.KERNEL32.dll_SetConsoleCtrlHandler
lea eax, [0x402650]
push eax
call fcn.004089b0
call fcn.0040755f
mov dword [0x4125b8], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x412554], eax
push dword [0x412af8]
push dword [0x4125b8]
call fcn.004024e7
push 0x412544
call fcn.0040e520
call fcn.00403e49
call fcn.00403bf9
mov edx, dword [0x412af8]
push edx
push edx
push 0
call fcn.00407511
inc dword [0x412af8]
mov edx, dword [0x412578]
pop ecx
mov dword [0x412af8], ecx
add ecx, dword [0x411320]
call fcn.0040e5a0
je 0x401834
mov ebx, dword [0x4125b8]
cmp ebx, 1
jne 0x401834
mov eax, 1
jmp 0x401836
xor eax, eax
and eax, eax
je 0x40183f
call fcn.0040269a
push 0x411035
push dword [0x412554]
call fcn.00403203
and eax, eax
je 0x401994
push 0x400
call fcn.0040b6b0
mov dword [0x41254c], eax
mov edx, dword [0x412af8]
push edx
push edx
call fcn.0040b907
push 0x4125ec
call fcn.0040e520
push dword [0x41254c]
push 0
push 0x41101e
push dword [0x4125ec]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x41254c]
call fcn.0040b760
push 0x4125d4
call fcn.0040e520
push dword [0x41254c]
call fcn.0040b7b0
push dword [0x4125d4]
call fcn.0040b996
push dword [0x4125d4]
call fcn.0040b9a4
push dword [0x4125d4]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x4125d4]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, dword [0x412598]
call fcn.0040e5d0
mov edx, dword [0x41256c]
call fcn.0040e5d0
push 0x412560
call fcn.0040e520
push dword [0x412560]
push 0
call fcn.0040be10
push dword [0x4124e8]
push dword [0x4124d4]
push 0
call fcn.0040bf90
push 0
call fcn.0040bbf0
mov edx, dword [0x412560]
push dword [0x412af8]
call fcn.0040e5d0
push 0x41255c
call fcn.0040e520
push dword [0x41255c]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x41255c]
push dword [0x412530]
call fcn.00407572
push dword [0x412528]
push dword [0x412598]
call fcn.00407572
mov dword [0x4124e4], 1
mov edx, dword [0x4125d8]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, dword [0x4125b4]
call fcn.0040e5d0
mov edx, dword [0x412574]
call fcn.0040e5d0
push 0x412574
call fcn.0040e520
mov edx, dword [0x412af8]
push edx
push edx
push 0x800
call fcn.004042c0
push 0x4124fc
call fcn.0040e520
push dword [0x412af8]
push dword [0x4124fc]
push 0
push 0x41101e
mov edx, dword [0x4125d8]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, dword [0x4125b4]
call fcn.0040e5d0
inc dword [0x412af8]
mov edx, dword [0x411320]
add dword [esp], edx
call sub.KERNEL32.dll_GetTempFileNameA
pop dword [0x412af8]
push dword [0x4124fc]
call fcn.0040b996
push dword [0x4125ac]
push dword [0x4124fc]
call sub.SHLWAPI.DLL_PathRenameExtensionA
mov edx, dword [0x4124fc]
push dword [0x412af8]
call fcn.0040e5d0
push 0x412574
call fcn.0040e520
call fcn.00403a09
mov edx, dword [0x4124f8]
xor ecx, ecx
call fcn.0040e5a0
jne 0x401a83
push dword [0x4124f8]
call fcn.00402ac4
call fcn.0040340e
call fcn.004031cf
and eax, eax
je 0x401aa4
call fcn.00409b0f
mov ebx, eax
cmp ebx, 0x41
je 0x401aa4
mov eax, 1
jmp 0x401aa6
xor eax, eax
and eax, eax
je 0x401c1d
mov edx, dword [0x412af8]
push edx
push edx
push 0x800
call fcn.004042c0
push 0x4125f8
call fcn.0040e520
push 0x800
push dword [0x4125f8]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push dword [0x4125f8]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x4125f8]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, 0x411037
call fcn.0040e5d0
push 0x4125f8
call fcn.0040e520
push dword [0x4125f8]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x4125f8]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, dword [0x412540]
call fcn.0040e5d0
push 0x41253c
call fcn.0040e520
mov edx, dword [0x4125f8]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, dword [0x412540]
call fcn.0040e5d0
mov edx, dword [0x41256c]
call fcn.0040e5d0
push 0x412558
call fcn.0040e520
push dword [0x41253c]
push 0
call fcn.0040bee0
and eax, eax
je 0x401b96
mov dword [0x412510], 1
push 0
call fcn.0040bbf0
jmp 0x401ba0
mov dword [0x412510], 0
push dword [0x412558]
push 0
call fcn.0040bee0
and eax, eax
je 0x401bca
mov dword [0x412514], 1
push 0
call fcn.0040bbf0
jmp 0x401bd4
mov dword [0x412514], 0
mov ebx, dword [0x412510]
add ebx, dword [0x412514]
and ebx, ebx
jne 0x401c1b
mov edx, dword [0x412af8]
push edx
push edx
push 0x800
call fcn.004042c0
push 0x4125f8
call fcn.0040e520
push 0x800
push dword [0x4125f8]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [0x4125f8]
call sub.SHLWAPI.DLL_PathAddBackslashA
jmp 0x401c54
mov edx, dword [0x412af8]
push edx
push edx
push 0x800
call fcn.004042c0
push 0x4125f8
call fcn.0040e520
push 0x800
push dword [0x4125f8]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [0x4125f8]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x412574]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x412574]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, str.__BFINOPSX
call fcn.0040e5d0
mov edx, dword [0x412544]
call fcn.0040e5d0
push 0x412544
call fcn.0040e520
push dword [0x412544]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x412af8]
push 0x45
push dword [0x412568]
mov edx, dword [0x4125c8]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, str.__BFINOPSX
call fcn.0040e5d0
mov edx, dword [0x412544]
call fcn.0040e5d0
inc dword [0x412af8]
mov edx, dword [0x4125f8]
push dword [0x412af8]
call fcn.0040e5d0
mov edx, dword [0x412540]
call fcn.0040e5d0
mov edx, dword [0x411320]
add dword [esp], edx
mov edx, dword [0x411320]
add dword [esp + 4], edx
call fcn.004079ee
pop dword [0x412af8]
mov dword [0x412584], eax
push dword [0x412584]
call fcn.00407a08
push dword [0x412584]
call fcn.00407a19
mov dword [0x412508], eax
push dword [0x412584]
call fcn.00407a37
push 0
lea eax, [0x4027c0]
push eax
call sub.KERNEL32.dll_SetConsoleCtrlHandler
call fcn.0040393d
push dword [0x412574]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x412574]
call fcn.0040b996
push dword [0x4125e8]
call fcn.0040b996
push dword [0x412560]
call fcn.0040b996
mov edx, dword [0x412af8]
push edx
push edx
mov edx, dword [0x412af8]
push edx
push edx
push dword [0x412af8]
call fcn.00407a8a
mov edx, dword [0x411320]
add dword [esp], edx
call fcn.0040ba1a
mov edx, dword [0x411320]
add dword [esp], edx
call fcn.0040ba90
pop dword [0x412af8]
push dword [0x4125d4]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x4125d8]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x412508]
jmp 0x401dde
push 0
call 0x401df8
call fcn.0040e4f0
push dword [0x4124c8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004088c2
call fcn.00408b00
call fcn.00408fd1
call fcn.00409d18
call fcn.0040ad8e
call fcn.0040b58c
call fcn.0040baa2
call fcn.0040bc60
call fcn.0040c670
call fcn.0040b660
ret