Function at 0x41295b
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b0
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x413082
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4129c6
call esi
test eax, eax
je 0x4129b3
cmp byte [ebp - 3], 0x3a
jne 0x4129b3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4129dd
call esi
test eax, eax
je 0x4129dd
cmp byte [ebp - 3], 0x3a
jne 0x4129dd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412a1f
call esi
test eax, eax
je 0x412a0c
cmp byte [ebp - 3], 0x3a
jne 0x412a0c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412a36
call esi
test eax, eax
je 0x412a36
cmp byte [ebp - 3], 0x3a
jne 0x412a36
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412a78
call esi
test eax, eax
je 0x412a65
cmp byte [ebp - 3], 0x3a
jne 0x412a65
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412a8f
call esi
test eax, eax
je 0x412a8f
cmp byte [ebp - 3], 0x3a
jne 0x412a8f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412acf
call esi
test eax, eax
je 0x412abc
cmp byte [ebp - 3], 0x3a
jne 0x412abc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412ae6
call esi
test eax, eax
je 0x412ae6
cmp byte [ebp - 3], 0x3a
jne 0x412ae6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412b27
call esi
test eax, eax
je 0x412b14
cmp byte [ebp - 3], 0x3a
jne 0x412b14
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412b3e
call esi
test eax, eax
je 0x412b3e
cmp byte [ebp - 3], 0x3a
jne 0x412b3e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412b80
call esi
test eax, eax
je 0x412b6d
cmp byte [ebp - 3], 0x3a
jne 0x412b6d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412b97
call esi
test eax, eax
je 0x412b97
cmp byte [ebp - 3], 0x3a
jne 0x412b97
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412bda
call esi
test eax, eax
je 0x412bc7
cmp byte [ebp - 3], 0x3a
jne 0x412bc7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412bf1
call esi
test eax, eax
je 0x412bf1
cmp byte [ebp - 3], 0x3a
jne 0x412bf1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412c34
call esi
test eax, eax
je 0x412c21
cmp byte [ebp - 3], 0x3a
jne 0x412c21
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412c4b
call esi
test eax, eax
je 0x412c4b
cmp byte [ebp - 3], 0x3a
jne 0x412c4b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412c8c
call esi
test eax, eax
je 0x412c79
cmp byte [ebp - 3], 0x3a
jne 0x412c79
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412ca3
call esi
test eax, eax
je 0x412ca3
cmp byte [ebp - 3], 0x3a
jne 0x412ca3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412d03
call esi
test eax, eax
je 0x412cd3
cmp byte [ebp - 3], 0x3a
jne 0x412cd3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412cf0
cmp byte [ebp - 3], 0x3a
jne 0x412cf0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412d1a
call esi
test eax, eax
je 0x412d1a
cmp byte [ebp - 3], 0x3a
jne 0x412d1a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412d7a
call esi
test eax, eax
je 0x412d4a
cmp byte [ebp - 3], 0x3a
jne 0x412d4a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412d67
cmp byte [ebp - 3], 0x3a
jne 0x412d67
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412d91
call esi
test eax, eax
je 0x412d91
cmp byte [ebp - 3], 0x3a
jne 0x412d91
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412df1
call esi
test eax, eax
je 0x412dc1
cmp byte [ebp - 3], 0x3a
jne 0x412dc1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412dde
cmp byte [ebp - 3], 0x3a
jne 0x412dde
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412e08
call esi
test eax, eax
je 0x412e08
cmp byte [ebp - 3], 0x3a
jne 0x412e08
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412e68
call esi
test eax, eax
je 0x412e38
cmp byte [ebp - 3], 0x3a
jne 0x412e38
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412e55
cmp byte [ebp - 3], 0x3a
jne 0x412e55
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412e7f
call esi
test eax, eax
je 0x412e7f
cmp byte [ebp - 3], 0x3a
jne 0x412e7f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412edd
call esi
test eax, eax
je 0x412ead
cmp byte [ebp - 3], 0x3a
jne 0x412ead
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412eca
cmp byte [ebp - 3], 0x3a
jne 0x412eca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412ef4
call esi
test eax, eax
je 0x412ef4
cmp byte [ebp - 3], 0x3a
jne 0x412ef4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412f55
call esi
test eax, eax
je 0x412f25
cmp byte [ebp - 3], 0x3a
jne 0x412f25
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412f42
cmp byte [ebp - 3], 0x3a
jne 0x412f42
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412f6c
call esi
test eax, eax
je 0x412f6c
cmp byte [ebp - 3], 0x3a
jne 0x412f6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412fcb
call esi
test eax, eax
je 0x412f9b
cmp byte [ebp - 3], 0x3a
jne 0x412f9b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412fb8
cmp byte [ebp - 3], 0x3a
jne 0x412fb8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x412fe2
call esi
test eax, eax
je 0x412fe2
cmp byte [ebp - 3], 0x3a
jne 0x412fe2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41306b
call esi
test eax, eax
je 0x41303b
cmp byte [ebp - 3], 0x3a
jne 0x41303b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413058
cmp byte [ebp - 3], 0x3a
jne 0x413058
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x413082
call esi
test eax, eax
je 0x413082
cmp byte [ebp - 3], 0x3a
jne 0x413082
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push ebx
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x110]
push esi
push eax
mov eax, dword [0x43c3d0]
push ebx
call dword [eax + 0x74]
mov eax, dword [0x43c3d0]
push 1
push ebx
push 0x2e
pop edi
lea ecx, [ebp - 0x110]
push edi
push ecx
lea esi, [eax + 0x21c]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call dword [esi]
add esp, 0xc
lea eax, [ebp - 0x2dc]
push ebx
push 0x65
pop esi
push esi
push 0x78
push esi
push edi
push 0x73
push 0x25
push eax
call fcn.0040d32b
add esp, 0x20
lea eax, [ebp - 0x340]
push ebx
push 0x6b
push 0x61
push 0x62
push edi
push 0x73
push 0x25
push eax
call fcn.0040d32b
add esp, 0x20
lea eax, [ebp - 0x278]
push ebx
push 0x70
push 0x6d
push esi
push 0x74
push edi
push 0x73
push 0x25
push eax
call fcn.0040d32b
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x214]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1dc]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x4a8]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e8]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x5ac]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1dc]
add esp, 0x44
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x6b0]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1dc]
mov edi, dword [ebp - 0xc]
add esp, 0xc
lea eax, [ebp - 0x5ac]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040a692
test eax, eax
je 0x413292
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.0040a692
test eax, eax
je 0x413292
push ebx
push 0x6e
push esi
push 0x70
lea eax, [ebp - 0x3a4]
push 0x6f
push eax
call fcn.0040d32b
add esp, 0x18
lea eax, [ebp - 0x214]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x3a4]
push eax
mov eax, dword [0x43c3d0]
push ebx
call dword [eax + 0x118]
mov eax, dword [0x43c3d0]
push 0x64
call dword [eax + 0x3c]
lea eax, [ebp - 0x4a8]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040a692
test eax, eax
je 0x413292
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x5ac]
push eax
call fcn.0040a692
test eax, eax
je 0x413292
push ebx
push 0x80
push 2
push ebx
push 1
lea eax, [ebp - 0x6b0]
push 0x40000000
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x50]
cmp eax, 0xffffffff
je 0x413292
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x44]
lea eax, [ebp - 0x6b0]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x40]
pop edi
pop esi
pop ebx
leave
ret 8