Function at 0x416912
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x417036
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41697a
call esi
test eax, eax
je 0x416967
cmp byte [ebp - 3], 0x3a
jne 0x416967
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416991
call esi
test eax, eax
je 0x416991
cmp byte [ebp - 3], 0x3a
jne 0x416991
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4169d3
call esi
test eax, eax
je 0x4169c0
cmp byte [ebp - 3], 0x3a
jne 0x4169c0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4169ea
call esi
test eax, eax
je 0x4169ea
cmp byte [ebp - 3], 0x3a
jne 0x4169ea
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416a2c
call esi
test eax, eax
je 0x416a19
cmp byte [ebp - 3], 0x3a
jne 0x416a19
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416a43
call esi
test eax, eax
je 0x416a43
cmp byte [ebp - 3], 0x3a
jne 0x416a43
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416a83
call esi
test eax, eax
je 0x416a70
cmp byte [ebp - 3], 0x3a
jne 0x416a70
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416a9a
call esi
test eax, eax
je 0x416a9a
cmp byte [ebp - 3], 0x3a
jne 0x416a9a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416adb
call esi
test eax, eax
je 0x416ac8
cmp byte [ebp - 3], 0x3a
jne 0x416ac8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416af2
call esi
test eax, eax
je 0x416af2
cmp byte [ebp - 3], 0x3a
jne 0x416af2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416b34
call esi
test eax, eax
je 0x416b21
cmp byte [ebp - 3], 0x3a
jne 0x416b21
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416b4b
call esi
test eax, eax
je 0x416b4b
cmp byte [ebp - 3], 0x3a
jne 0x416b4b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416b8e
call esi
test eax, eax
je 0x416b7b
cmp byte [ebp - 3], 0x3a
jne 0x416b7b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416ba5
call esi
test eax, eax
je 0x416ba5
cmp byte [ebp - 3], 0x3a
jne 0x416ba5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416be8
call esi
test eax, eax
je 0x416bd5
cmp byte [ebp - 3], 0x3a
jne 0x416bd5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416bff
call esi
test eax, eax
je 0x416bff
cmp byte [ebp - 3], 0x3a
jne 0x416bff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416c40
call esi
test eax, eax
je 0x416c2d
cmp byte [ebp - 3], 0x3a
jne 0x416c2d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416c57
call esi
test eax, eax
je 0x416c57
cmp byte [ebp - 3], 0x3a
jne 0x416c57
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416cb7
call esi
test eax, eax
je 0x416c87
cmp byte [ebp - 3], 0x3a
jne 0x416c87
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416ca4
cmp byte [ebp - 3], 0x3a
jne 0x416ca4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416cce
call esi
test eax, eax
je 0x416cce
cmp byte [ebp - 3], 0x3a
jne 0x416cce
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416d2e
call esi
test eax, eax
je 0x416cfe
cmp byte [ebp - 3], 0x3a
jne 0x416cfe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416d1b
cmp byte [ebp - 3], 0x3a
jne 0x416d1b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416d45
call esi
test eax, eax
je 0x416d45
cmp byte [ebp - 3], 0x3a
jne 0x416d45
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416da5
call esi
test eax, eax
je 0x416d75
cmp byte [ebp - 3], 0x3a
jne 0x416d75
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416d92
cmp byte [ebp - 3], 0x3a
jne 0x416d92
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416dbc
call esi
test eax, eax
je 0x416dbc
cmp byte [ebp - 3], 0x3a
jne 0x416dbc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416e1c
call esi
test eax, eax
je 0x416dec
cmp byte [ebp - 3], 0x3a
jne 0x416dec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416e09
cmp byte [ebp - 3], 0x3a
jne 0x416e09
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416e33
call esi
test eax, eax
je 0x416e33
cmp byte [ebp - 3], 0x3a
jne 0x416e33
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416e91
call esi
test eax, eax
je 0x416e61
cmp byte [ebp - 3], 0x3a
jne 0x416e61
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416e7e
cmp byte [ebp - 3], 0x3a
jne 0x416e7e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416ea8
call esi
test eax, eax
je 0x416ea8
cmp byte [ebp - 3], 0x3a
jne 0x416ea8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416f09
call esi
test eax, eax
je 0x416ed9
cmp byte [ebp - 3], 0x3a
jne 0x416ed9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416ef6
cmp byte [ebp - 3], 0x3a
jne 0x416ef6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416f20
call esi
test eax, eax
je 0x416f20
cmp byte [ebp - 3], 0x3a
jne 0x416f20
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416f7f
call esi
test eax, eax
je 0x416f4f
cmp byte [ebp - 3], 0x3a
jne 0x416f4f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416f6c
cmp byte [ebp - 3], 0x3a
jne 0x416f6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x416f96
call esi
test eax, eax
je 0x416f96
cmp byte [ebp - 3], 0x3a
jne 0x416f96
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41701f
call esi
test eax, eax
je 0x416fef
cmp byte [ebp - 3], 0x3a
jne 0x416fef
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41700c
cmp byte [ebp - 3], 0x3a
jne 0x41700c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417036
call esi
test eax, eax
je 0x417036
cmp byte [ebp - 3], 0x3a
jne 0x417036
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e8]
mov eax, dword [0x43c3d0]
pop ecx
pop ecx
push 1
push ebx
lea ecx, [ebp - 0x10c]
push 0x5c
push ecx
lea esi, [eax + 0x21c]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call dword [esi]
lea eax, [ebp - 0x10c]
push 0x5c
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1ec]
add esp, 0x14
cmp eax, ebx
pop edi
pop esi
pop ebx
jne 0x417091
xor eax, eax
jmp 0x4170a6
inc eax
push eax
mov eax, dword [0x43c3d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e8]
pop ecx
pop ecx
push 1
pop eax
leave
ret 8