Function at 0x41a99c
Capabilities:
Allocate thread local storage
Create directory
Get common file path
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0x10], ecx
jne 0x41b0c0
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aa04
call esi
test eax, eax
je 0x41a9f1
cmp byte [ebp - 3], 0x3a
jne 0x41a9f1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41aa1b
call esi
test eax, eax
je 0x41aa1b
cmp byte [ebp - 3], 0x3a
jne 0x41aa1b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aa5d
call esi
test eax, eax
je 0x41aa4a
cmp byte [ebp - 3], 0x3a
jne 0x41aa4a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41aa74
call esi
test eax, eax
je 0x41aa74
cmp byte [ebp - 3], 0x3a
jne 0x41aa74
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aab6
call esi
test eax, eax
je 0x41aaa3
cmp byte [ebp - 3], 0x3a
jne 0x41aaa3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41aacd
call esi
test eax, eax
je 0x41aacd
cmp byte [ebp - 3], 0x3a
jne 0x41aacd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ab0d
call esi
test eax, eax
je 0x41aafa
cmp byte [ebp - 3], 0x3a
jne 0x41aafa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ab24
call esi
test eax, eax
je 0x41ab24
cmp byte [ebp - 3], 0x3a
jne 0x41ab24
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ab65
call esi
test eax, eax
je 0x41ab52
cmp byte [ebp - 3], 0x3a
jne 0x41ab52
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ab7c
call esi
test eax, eax
je 0x41ab7c
cmp byte [ebp - 3], 0x3a
jne 0x41ab7c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41abbe
call esi
test eax, eax
je 0x41abab
cmp byte [ebp - 3], 0x3a
jne 0x41abab
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41abd5
call esi
test eax, eax
je 0x41abd5
cmp byte [ebp - 3], 0x3a
jne 0x41abd5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ac18
call esi
test eax, eax
je 0x41ac05
cmp byte [ebp - 3], 0x3a
jne 0x41ac05
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ac2f
call esi
test eax, eax
je 0x41ac2f
cmp byte [ebp - 3], 0x3a
jne 0x41ac2f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ac72
call esi
test eax, eax
je 0x41ac5f
cmp byte [ebp - 3], 0x3a
jne 0x41ac5f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ac89
call esi
test eax, eax
je 0x41ac89
cmp byte [ebp - 3], 0x3a
jne 0x41ac89
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41acca
call esi
test eax, eax
je 0x41acb7
cmp byte [ebp - 3], 0x3a
jne 0x41acb7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ace1
call esi
test eax, eax
je 0x41ace1
cmp byte [ebp - 3], 0x3a
jne 0x41ace1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ad41
call esi
test eax, eax
je 0x41ad11
cmp byte [ebp - 3], 0x3a
jne 0x41ad11
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ad2e
cmp byte [ebp - 3], 0x3a
jne 0x41ad2e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ad58
call esi
test eax, eax
je 0x41ad58
cmp byte [ebp - 3], 0x3a
jne 0x41ad58
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41adb8
call esi
test eax, eax
je 0x41ad88
cmp byte [ebp - 3], 0x3a
jne 0x41ad88
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ada5
cmp byte [ebp - 3], 0x3a
jne 0x41ada5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41adcf
call esi
test eax, eax
je 0x41adcf
cmp byte [ebp - 3], 0x3a
jne 0x41adcf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ae2f
call esi
test eax, eax
je 0x41adff
cmp byte [ebp - 3], 0x3a
jne 0x41adff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ae1c
cmp byte [ebp - 3], 0x3a
jne 0x41ae1c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ae46
call esi
test eax, eax
je 0x41ae46
cmp byte [ebp - 3], 0x3a
jne 0x41ae46
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aea6
call esi
test eax, eax
je 0x41ae76
cmp byte [ebp - 3], 0x3a
jne 0x41ae76
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ae93
cmp byte [ebp - 3], 0x3a
jne 0x41ae93
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41aebd
call esi
test eax, eax
je 0x41aebd
cmp byte [ebp - 3], 0x3a
jne 0x41aebd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41af1b
call esi
test eax, eax
je 0x41aeeb
cmp byte [ebp - 3], 0x3a
jne 0x41aeeb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41af08
cmp byte [ebp - 3], 0x3a
jne 0x41af08
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41af32
call esi
test eax, eax
je 0x41af32
cmp byte [ebp - 3], 0x3a
jne 0x41af32
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41af93
call esi
test eax, eax
je 0x41af63
cmp byte [ebp - 3], 0x3a
jne 0x41af63
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41af80
cmp byte [ebp - 3], 0x3a
jne 0x41af80
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41afaa
call esi
test eax, eax
je 0x41afaa
cmp byte [ebp - 3], 0x3a
jne 0x41afaa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b009
call esi
test eax, eax
je 0x41afd9
cmp byte [ebp - 3], 0x3a
jne 0x41afd9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41aff6
cmp byte [ebp - 3], 0x3a
jne 0x41aff6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b020
call esi
test eax, eax
je 0x41b020
cmp byte [ebp - 3], 0x3a
jne 0x41b020
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41b0a9
call esi
test eax, eax
je 0x41b079
cmp byte [ebp - 3], 0x3a
jne 0x41b079
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41b096
cmp byte [ebp - 3], 0x3a
jne 0x41b096
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41b0c0
call esi
test eax, eax
je 0x41b0c0
cmp byte [ebp - 3], 0x3a
jne 0x41b0c0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [edi], ebx
cmp dword [esi + 0x3f7a8], ebx
jle 0x41b157
lea eax, [esi + 0x1fbd8]
mov dword [ebp + 0xc], eax
cmp dword [esi + 0x1fbd4], ebx
mov dword [ebp - 4], ebx
jle 0x41b11d
lea eax, [esi + 4]
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov eax, dword [0x43c3d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e0]
pop ecx
test eax, eax
pop ecx
je 0x41b142
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 8], 0x104
cmp eax, dword [esi + 0x1fbd4]
jl 0x41b0f1
inc dword [edi]
mov eax, dword [edi]
imul eax, eax, 0x104
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [eax + ecx - 0x104]
push eax
mov eax, dword [0x43c3d0]
call dword [eax + 0x1e8]
pop ecx
pop ecx
inc dword [ebp - 0xc]
add dword [ebp + 0xc], 0x104
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0x3f7a8]
jl 0x41b0e0
pop edi
pop esi
pop ebx
leave
ret 8