Function at 0x41136d
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 0xc], ecx
mov dword [ecx], 0x4360f8
jne 0x411a97
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4113db
call esi
test eax, eax
je 0x4113c8
cmp byte [ebp - 3], 0x3a
jne 0x4113c8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4113f2
call esi
test eax, eax
je 0x4113f2
cmp byte [ebp - 3], 0x3a
jne 0x4113f2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x411434
call esi
test eax, eax
je 0x411421
cmp byte [ebp - 3], 0x3a
jne 0x411421
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41144b
call esi
test eax, eax
je 0x41144b
cmp byte [ebp - 3], 0x3a
jne 0x41144b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41148d
call esi
test eax, eax
je 0x41147a
cmp byte [ebp - 3], 0x3a
jne 0x41147a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4114a4
call esi
test eax, eax
je 0x4114a4
cmp byte [ebp - 3], 0x3a
jne 0x4114a4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4114e4
call esi
test eax, eax
je 0x4114d1
cmp byte [ebp - 3], 0x3a
jne 0x4114d1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4114fb
call esi
test eax, eax
je 0x4114fb
cmp byte [ebp - 3], 0x3a
jne 0x4114fb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41153c
call esi
test eax, eax
je 0x411529
cmp byte [ebp - 3], 0x3a
jne 0x411529
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x411553
call esi
test eax, eax
je 0x411553
cmp byte [ebp - 3], 0x3a
jne 0x411553
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x411595
call esi
test eax, eax
je 0x411582
cmp byte [ebp - 3], 0x3a
jne 0x411582
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4115ac
call esi
test eax, eax
je 0x4115ac
cmp byte [ebp - 3], 0x3a
jne 0x4115ac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4115ef
call esi
test eax, eax
je 0x4115dc
cmp byte [ebp - 3], 0x3a
jne 0x4115dc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x411606
call esi
test eax, eax
je 0x411606
cmp byte [ebp - 3], 0x3a
jne 0x411606
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x411649
call esi
test eax, eax
je 0x411636
cmp byte [ebp - 3], 0x3a
jne 0x411636
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x411660
call esi
test eax, eax
je 0x411660
cmp byte [ebp - 3], 0x3a
jne 0x411660
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4116a1
call esi
test eax, eax
je 0x41168e
cmp byte [ebp - 3], 0x3a
jne 0x41168e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4116b8
call esi
test eax, eax
je 0x4116b8
cmp byte [ebp - 3], 0x3a
jne 0x4116b8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x411718
call esi
test eax, eax
je 0x4116e8
cmp byte [ebp - 3], 0x3a
jne 0x4116e8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x411705
cmp byte [ebp - 3], 0x3a
jne 0x411705
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41172f
call esi
test eax, eax
je 0x41172f
cmp byte [ebp - 3], 0x3a
jne 0x41172f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41178f
call esi
test eax, eax
je 0x41175f
cmp byte [ebp - 3], 0x3a
jne 0x41175f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41177c
cmp byte [ebp - 3], 0x3a
jne 0x41177c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4117a6
call esi
test eax, eax
je 0x4117a6
cmp byte [ebp - 3], 0x3a
jne 0x4117a6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x411806
call esi
test eax, eax
je 0x4117d6
cmp byte [ebp - 3], 0x3a
jne 0x4117d6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4117f3
cmp byte [ebp - 3], 0x3a
jne 0x4117f3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41181d
call esi
test eax, eax
je 0x41181d
cmp byte [ebp - 3], 0x3a
jne 0x41181d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41187d
call esi
test eax, eax
je 0x41184d
cmp byte [ebp - 3], 0x3a
jne 0x41184d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41186a
cmp byte [ebp - 3], 0x3a
jne 0x41186a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x411894
call esi
test eax, eax
je 0x411894
cmp byte [ebp - 3], 0x3a
jne 0x411894
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4118f2
call esi
test eax, eax
je 0x4118c2
cmp byte [ebp - 3], 0x3a
jne 0x4118c2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4118df
cmp byte [ebp - 3], 0x3a
jne 0x4118df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x411909
call esi
test eax, eax
je 0x411909
cmp byte [ebp - 3], 0x3a
jne 0x411909
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41196a
call esi
test eax, eax
je 0x41193a
cmp byte [ebp - 3], 0x3a
jne 0x41193a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x411957
cmp byte [ebp - 3], 0x3a
jne 0x411957
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x411981
call esi
test eax, eax
je 0x411981
cmp byte [ebp - 3], 0x3a
jne 0x411981
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4119e0
call esi
test eax, eax
je 0x4119b0
cmp byte [ebp - 3], 0x3a
jne 0x4119b0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4119cd
cmp byte [ebp - 3], 0x3a
jne 0x4119cd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4119f7
call esi
test eax, eax
je 0x4119f7
cmp byte [ebp - 3], 0x3a
jne 0x4119f7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x411a80
call esi
test eax, eax
je 0x411a50
cmp byte [ebp - 3], 0x3a
jne 0x411a50
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x411a6d
cmp byte [ebp - 3], 0x3a
jne 0x411a6d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x411a97
call esi
test eax, eax
je 0x411a97
cmp byte [ebp - 3], 0x3a
jne 0x411a97
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret