Function at 0x41f649
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b0
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x4203f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f68c
cmp byte [ebp - 3], 0x3a
jne 0x41f68c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f6cc
call edi
test eax, eax
je 0x41f6b9
cmp byte [ebp - 3], 0x3a
jne 0x41f6b9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f6e3
call edi
test eax, eax
je 0x41f6e3
cmp byte [ebp - 3], 0x3a
jne 0x41f6e3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f6fe
cmp byte [ebp - 3], 0x3a
jne 0x41f6fe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f738
call edi
test eax, eax
je 0x41f725
cmp byte [ebp - 3], 0x3a
jne 0x41f725
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f74f
call edi
test eax, eax
je 0x41f74f
cmp byte [ebp - 3], 0x3a
jne 0x41f74f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f782
cmp byte [ebp - 3], 0x3a
jne 0x41f782
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f7bc
call edi
test eax, eax
je 0x41f7a9
cmp byte [ebp - 3], 0x3a
jne 0x41f7a9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f7d3
call edi
test eax, eax
je 0x41f7d3
cmp byte [ebp - 3], 0x3a
jne 0x41f7d3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f7fa
cmp byte [ebp - 3], 0x3a
jne 0x41f7fa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f834
call edi
test eax, eax
je 0x41f821
cmp byte [ebp - 3], 0x3a
jne 0x41f821
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f84b
call edi
test eax, eax
je 0x41f84b
cmp byte [ebp - 3], 0x3a
jne 0x41f84b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f86d
cmp byte [ebp - 3], 0x3a
jne 0x41f86d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f8a7
call edi
test eax, eax
je 0x41f894
cmp byte [ebp - 3], 0x3a
jne 0x41f894
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f8be
call edi
test eax, eax
je 0x41f8be
cmp byte [ebp - 3], 0x3a
jne 0x41f8be
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f8e0
cmp byte [ebp - 3], 0x3a
jne 0x41f8e0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f91a
call edi
test eax, eax
je 0x41f907
cmp byte [ebp - 3], 0x3a
jne 0x41f907
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f931
call edi
test eax, eax
je 0x41f931
cmp byte [ebp - 3], 0x3a
jne 0x41f931
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f95f
cmp byte [ebp - 3], 0x3a
jne 0x41f95f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f999
call edi
test eax, eax
je 0x41f986
cmp byte [ebp - 3], 0x3a
jne 0x41f986
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f9b0
call edi
test eax, eax
je 0x41f9b0
cmp byte [ebp - 3], 0x3a
jne 0x41f9b0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f9ec
cmp byte [ebp - 3], 0x3a
jne 0x41f9ec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fa26
call edi
test eax, eax
je 0x41fa13
cmp byte [ebp - 3], 0x3a
jne 0x41fa13
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fa3d
call edi
test eax, eax
je 0x41fa3d
cmp byte [ebp - 3], 0x3a
jne 0x41fa3d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fa68
cmp byte [ebp - 3], 0x3a
jne 0x41fa68
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41faa2
call edi
test eax, eax
je 0x41fa8f
cmp byte [ebp - 3], 0x3a
jne 0x41fa8f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fab9
call edi
test eax, eax
je 0x41fab9
cmp byte [ebp - 3], 0x3a
jne 0x41fab9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fae3
cmp byte [ebp - 3], 0x3a
jne 0x41fae3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fb1d
call edi
test eax, eax
je 0x41fb0a
cmp byte [ebp - 3], 0x3a
jne 0x41fb0a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fb34
call edi
test eax, eax
je 0x41fb34
cmp byte [ebp - 3], 0x3a
jne 0x41fb34
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fb61
cmp byte [ebp - 3], 0x3a
jne 0x41fb61
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fb9b
call edi
test eax, eax
je 0x41fb88
cmp byte [ebp - 3], 0x3a
jne 0x41fb88
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fbb2
call edi
test eax, eax
je 0x41fbb2
cmp byte [ebp - 3], 0x3a
jne 0x41fbb2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fbe5
cmp byte [ebp - 3], 0x3a
jne 0x41fbe5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fc1f
call edi
test eax, eax
je 0x41fc0c
cmp byte [ebp - 3], 0x3a
jne 0x41fc0c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fc36
call edi
test eax, eax
je 0x41fc36
cmp byte [ebp - 3], 0x3a
jne 0x41fc36
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fc65
cmp byte [ebp - 3], 0x3a
jne 0x41fc65
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fc9f
call edi
test eax, eax
je 0x41fc8c
cmp byte [ebp - 3], 0x3a
jne 0x41fc8c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fcb6
call edi
test eax, eax
je 0x41fcb6
cmp byte [ebp - 3], 0x3a
jne 0x41fcb6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fcd8
cmp byte [ebp - 3], 0x3a
jne 0x41fcd8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fd12
call edi
test eax, eax
je 0x41fcff
cmp byte [ebp - 3], 0x3a
jne 0x41fcff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fd29
call edi
test eax, eax
je 0x41fd29
cmp byte [ebp - 3], 0x3a
jne 0x41fd29
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fd4b
cmp byte [ebp - 3], 0x3a
jne 0x41fd4b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fd85
call edi
test eax, eax
je 0x41fd72
cmp byte [ebp - 3], 0x3a
jne 0x41fd72
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fd9c
call edi
test eax, eax
je 0x41fd9c
cmp byte [ebp - 3], 0x3a
jne 0x41fd9c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fdc6
cmp byte [ebp - 3], 0x3a
jne 0x41fdc6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fe00
call edi
test eax, eax
je 0x41fded
cmp byte [ebp - 3], 0x3a
jne 0x41fded
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fe17
call edi
test eax, eax
je 0x41fe17
cmp byte [ebp - 3], 0x3a
jne 0x41fe17
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41fe42
cmp byte [ebp - 3], 0x3a
jne 0x41fe42
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fe7c
call edi
test eax, eax
je 0x41fe69
cmp byte [ebp - 3], 0x3a
jne 0x41fe69
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41fe93
call edi
test eax, eax
je 0x41fe93
cmp byte [ebp - 3], 0x3a
jne 0x41fe93
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41febe
cmp byte [ebp - 3], 0x3a
jne 0x41febe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fef8
call edi
test eax, eax
je 0x41fee5
cmp byte [ebp - 3], 0x3a
jne 0x41fee5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ff0f
call edi
test eax, eax
je 0x41ff0f
cmp byte [ebp - 3], 0x3a
jne 0x41ff0f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ff39
cmp byte [ebp - 3], 0x3a
jne 0x41ff39
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ff73
call edi
test eax, eax
je 0x41ff60
cmp byte [ebp - 3], 0x3a
jne 0x41ff60
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ff8a
call edi
test eax, eax
je 0x41ff8a
cmp byte [ebp - 3], 0x3a
jne 0x41ff8a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ffae
cmp byte [ebp - 3], 0x3a
jne 0x41ffae
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ffe8
call edi
test eax, eax
je 0x41ffd5
cmp byte [ebp - 3], 0x3a
jne 0x41ffd5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ffff
call edi
test eax, eax
je 0x41ffff
cmp byte [ebp - 3], 0x3a
jne 0x41ffff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x420028
cmp byte [ebp - 3], 0x3a
jne 0x420028
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x420062
call edi
test eax, eax
je 0x42004f
cmp byte [ebp - 3], 0x3a
jne 0x42004f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x420079
call edi
test eax, eax
je 0x420079
cmp byte [ebp - 3], 0x3a
jne 0x420079
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4200a2
cmp byte [ebp - 3], 0x3a
jne 0x4200a2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4200dc
call edi
test eax, eax
je 0x4200c9
cmp byte [ebp - 3], 0x3a
jne 0x4200c9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4200f3
call edi
test eax, eax
je 0x4200f3
cmp byte [ebp - 3], 0x3a
jne 0x4200f3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x420121
cmp byte [ebp - 3], 0x3a
jne 0x420121
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42015b
call edi
test eax, eax
je 0x420148
cmp byte [ebp - 3], 0x3a
jne 0x420148
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x420172
call edi
test eax, eax
je 0x420172
cmp byte [ebp - 3], 0x3a
jne 0x420172
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42019b
cmp byte [ebp - 3], 0x3a
jne 0x42019b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4201d5
call edi
test eax, eax
je 0x4201c2
cmp byte [ebp - 3], 0x3a
jne 0x4201c2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4201ec
call edi
test eax, eax
je 0x4201ec
cmp byte [ebp - 3], 0x3a
jne 0x4201ec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42020e
cmp byte [ebp - 3], 0x3a
jne 0x42020e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x420248
call edi
test eax, eax
je 0x420235
cmp byte [ebp - 3], 0x3a
jne 0x420235
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42025f
call edi
test eax, eax
je 0x42025f
cmp byte [ebp - 3], 0x3a
jne 0x42025f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x420288
cmp byte [ebp - 3], 0x3a
jne 0x420288
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4202c2
call edi
test eax, eax
je 0x4202af
cmp byte [ebp - 3], 0x3a
jne 0x4202af
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4202d9
call edi
test eax, eax
je 0x4202d9
cmp byte [ebp - 3], 0x3a
jne 0x4202d9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x420303
cmp byte [ebp - 3], 0x3a
jne 0x420303
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42033d
call edi
test eax, eax
je 0x42032a
cmp byte [ebp - 3], 0x3a
jne 0x42032a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x420354
call edi
test eax, eax
je 0x420354
cmp byte [ebp - 3], 0x3a
jne 0x420354
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42037f
cmp byte [ebp - 3], 0x3a
jne 0x42037f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4203b9
call edi
test eax, eax
je 0x4203a6
cmp byte [ebp - 3], 0x3a
jne 0x4203a6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4203d0
call edi
test eax, eax
je 0x4203d0
cmp byte [ebp - 3], 0x3a
jne 0x4203d0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push ebx
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x110]
push esi
push eax
mov eax, dword [0x4543d0]
push ebx
call dword [eax + 0x74]
mov eax, dword [0x4543d0]
push 1
push ebx
push 0x2e
pop edi
lea ecx, [ebp - 0x110]
push edi
push ecx
lea esi, [eax + 0x21c]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call dword [esi]
add esp, 0xc
lea eax, [ebp - 0x2dc]
push ebx
push 0x65
pop esi
push esi
push 0x78
push esi
push edi
push 0x73
push 0x25
push eax
call fcn.004171ee
add esp, 0x20
lea eax, [ebp - 0x340]
push ebx
push 0x6b
push 0x61
push 0x62
push edi
push 0x73
push 0x25
push eax
call fcn.004171ee
add esp, 0x20
lea eax, [ebp - 0x278]
push ebx
push 0x70
push 0x6d
push esi
push 0x74
push edi
push 0x73
push 0x25
push eax
call fcn.004171ee
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x214]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1dc]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x4a8]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1e8]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x5ac]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1dc]
add esp, 0x44
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x6b0]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1dc]
mov edi, dword [ebp - 0xc]
add esp, 0xc
lea eax, [ebp - 0x5ac]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00420607
test eax, eax
je 0x420600
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.00420607
test eax, eax
je 0x420600
push ebx
push 0x6e
push esi
push 0x70
lea eax, [ebp - 0x3a4]
push 0x6f
push eax
call fcn.004171ee
add esp, 0x18
lea eax, [ebp - 0x214]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x3a4]
push eax
mov eax, dword [0x4543d0]
push ebx
call dword [eax + 0x118]
mov eax, dword [0x4543d0]
push 0x64
call dword [eax + 0x3c]
lea eax, [ebp - 0x4a8]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00420607
test eax, eax
je 0x420600
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x5ac]
push eax
call fcn.00420607
test eax, eax
je 0x420600
push ebx
push 0x80
push 2
push ebx
push 1
lea eax, [ebp - 0x6b0]
push 0x40000000
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x50]
cmp eax, 0xffffffff
je 0x420600
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x44]
lea eax, [ebp - 0x6b0]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x40]
pop edi
pop esi
pop ebx
leave
ret 8