Function at 0x41d362
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
mov eax, 0x434a70
call fcn.00433ea0
sub esp, 0x68
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0x18], ecx
jne 0x41da8d
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d3d1
call esi
test eax, eax
je 0x41d3be
cmp byte [ebp - 0xf], 0x3a
jne 0x41d3be
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d3e8
call esi
test eax, eax
je 0x41d3e8
cmp byte [ebp - 0xf], 0x3a
jne 0x41d3e8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d42a
call esi
test eax, eax
je 0x41d417
cmp byte [ebp - 0xf], 0x3a
jne 0x41d417
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d441
call esi
test eax, eax
je 0x41d441
cmp byte [ebp - 0xf], 0x3a
jne 0x41d441
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d483
call esi
test eax, eax
je 0x41d470
cmp byte [ebp - 0xf], 0x3a
jne 0x41d470
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d49a
call esi
test eax, eax
je 0x41d49a
cmp byte [ebp - 0xf], 0x3a
jne 0x41d49a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d4da
call esi
test eax, eax
je 0x41d4c7
cmp byte [ebp - 0xf], 0x3a
jne 0x41d4c7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d4f1
call esi
test eax, eax
je 0x41d4f1
cmp byte [ebp - 0xf], 0x3a
jne 0x41d4f1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d532
call esi
test eax, eax
je 0x41d51f
cmp byte [ebp - 0xf], 0x3a
jne 0x41d51f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d549
call esi
test eax, eax
je 0x41d549
cmp byte [ebp - 0xf], 0x3a
jne 0x41d549
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d58b
call esi
test eax, eax
je 0x41d578
cmp byte [ebp - 0xf], 0x3a
jne 0x41d578
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d5a2
call esi
test eax, eax
je 0x41d5a2
cmp byte [ebp - 0xf], 0x3a
jne 0x41d5a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d5e5
call esi
test eax, eax
je 0x41d5d2
cmp byte [ebp - 0xf], 0x3a
jne 0x41d5d2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d5fc
call esi
test eax, eax
je 0x41d5fc
cmp byte [ebp - 0xf], 0x3a
jne 0x41d5fc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d63f
call esi
test eax, eax
je 0x41d62c
cmp byte [ebp - 0xf], 0x3a
jne 0x41d62c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d656
call esi
test eax, eax
je 0x41d656
cmp byte [ebp - 0xf], 0x3a
jne 0x41d656
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d697
call esi
test eax, eax
je 0x41d684
cmp byte [ebp - 0xf], 0x3a
jne 0x41d684
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d6ae
call esi
test eax, eax
je 0x41d6ae
cmp byte [ebp - 0xf], 0x3a
jne 0x41d6ae
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d70e
call esi
test eax, eax
je 0x41d6de
cmp byte [ebp - 0xf], 0x3a
jne 0x41d6de
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41d6fb
cmp byte [ebp - 0xf], 0x3a
jne 0x41d6fb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d725
call esi
test eax, eax
je 0x41d725
cmp byte [ebp - 0xf], 0x3a
jne 0x41d725
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d785
call esi
test eax, eax
je 0x41d755
cmp byte [ebp - 0xf], 0x3a
jne 0x41d755
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41d772
cmp byte [ebp - 0xf], 0x3a
jne 0x41d772
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d79c
call esi
test eax, eax
je 0x41d79c
cmp byte [ebp - 0xf], 0x3a
jne 0x41d79c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d7fc
call esi
test eax, eax
je 0x41d7cc
cmp byte [ebp - 0xf], 0x3a
jne 0x41d7cc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41d7e9
cmp byte [ebp - 0xf], 0x3a
jne 0x41d7e9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d813
call esi
test eax, eax
je 0x41d813
cmp byte [ebp - 0xf], 0x3a
jne 0x41d813
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d873
call esi
test eax, eax
je 0x41d843
cmp byte [ebp - 0xf], 0x3a
jne 0x41d843
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41d860
cmp byte [ebp - 0xf], 0x3a
jne 0x41d860
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d88a
call esi
test eax, eax
je 0x41d88a
cmp byte [ebp - 0xf], 0x3a
jne 0x41d88a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d8e8
call esi
test eax, eax
je 0x41d8b8
cmp byte [ebp - 0xf], 0x3a
jne 0x41d8b8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41d8d5
cmp byte [ebp - 0xf], 0x3a
jne 0x41d8d5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d8ff
call esi
test eax, eax
je 0x41d8ff
cmp byte [ebp - 0xf], 0x3a
jne 0x41d8ff
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d960
call esi
test eax, eax
je 0x41d930
cmp byte [ebp - 0xf], 0x3a
jne 0x41d930
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41d94d
cmp byte [ebp - 0xf], 0x3a
jne 0x41d94d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d977
call esi
test eax, eax
je 0x41d977
cmp byte [ebp - 0xf], 0x3a
jne 0x41d977
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41d9d6
call esi
test eax, eax
je 0x41d9a6
cmp byte [ebp - 0xf], 0x3a
jne 0x41d9a6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41d9c3
cmp byte [ebp - 0xf], 0x3a
jne 0x41d9c3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41d9ed
call esi
test eax, eax
je 0x41d9ed
cmp byte [ebp - 0xf], 0x3a
jne 0x41d9ed
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41da76
call esi
test eax, eax
je 0x41da46
cmp byte [ebp - 0xf], 0x3a
jne 0x41da46
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41da63
cmp byte [ebp - 0xf], 0x3a
jne 0x41da63
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call edi
jmp 0x41da8d
call esi
test eax, eax
je 0x41da8d
cmp byte [ebp - 0xf], 0x3a
jne 0x41da8d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0040daea
cmp eax, ebx
jne 0x41daa1
xor eax, eax
jmp 0x41dadc
mov eax, dword [ebp - 0x18]
push 0x5e
push 0x400
lea ecx, [ebp - 0x74]
push dword [eax + 8]
push dword [eax + 4]
call fcn.00421327
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], ebx
call fcn.004213e6
test eax, eax
jne 0x41dace
push 1
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.004213d8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4