Function at 0x41ec97
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ac
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x41fa49
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41ecf2
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41ecf2
cmp byte [ebp - 7], 0x3a
jne 0x41ecf2
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ed33
call esi
test eax, eax
je 0x41ed20
cmp byte [ebp - 3], 0x3a
jne 0x41ed20
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ed4b
call esi
test eax, eax
je 0x41ed4b
cmp byte [ebp - 3], 0x3a
jne 0x41ed4b
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ed69
cmp byte [ebp - 3], 0x3a
jne 0x41ed69
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41ed98
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41ed98
cmp byte [ebp - 7], 0x3a
jne 0x41ed98
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41edd3
call esi
test eax, eax
je 0x41edc0
cmp byte [ebp - 3], 0x3a
jne 0x41edc0
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41edeb
call esi
test eax, eax
je 0x41edeb
cmp byte [ebp - 3], 0x3a
jne 0x41edeb
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ee09
cmp byte [ebp - 3], 0x3a
jne 0x41ee09
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41ee38
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41ee38
cmp byte [ebp - 7], 0x3a
jne 0x41ee38
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ee73
call esi
test eax, eax
je 0x41ee60
cmp byte [ebp - 3], 0x3a
jne 0x41ee60
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ee8b
call esi
test eax, eax
je 0x41ee8b
cmp byte [ebp - 3], 0x3a
jne 0x41ee8b
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41eea9
cmp byte [ebp - 3], 0x3a
jne 0x41eea9
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41eee3
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41eee3
cmp byte [ebp - 7], 0x3a
jne 0x41eee3
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ef1e
call esi
test eax, eax
je 0x41ef0b
cmp byte [ebp - 3], 0x3a
jne 0x41ef0b
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41ef36
call esi
test eax, eax
je 0x41ef36
cmp byte [ebp - 3], 0x3a
jne 0x41ef36
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ef54
cmp byte [ebp - 3], 0x3a
jne 0x41ef54
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41ef8c
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41ef8c
cmp byte [ebp - 7], 0x3a
jne 0x41ef8c
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41efc7
call esi
test eax, eax
je 0x41efb4
cmp byte [ebp - 3], 0x3a
jne 0x41efb4
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41efdf
call esi
test eax, eax
je 0x41efdf
cmp byte [ebp - 3], 0x3a
jne 0x41efdf
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41effd
cmp byte [ebp - 3], 0x3a
jne 0x41effd
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f02d
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f02d
cmp byte [ebp - 7], 0x3a
jne 0x41f02d
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f068
call esi
test eax, eax
je 0x41f055
cmp byte [ebp - 3], 0x3a
jne 0x41f055
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f080
call esi
test eax, eax
je 0x41f080
cmp byte [ebp - 3], 0x3a
jne 0x41f080
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f09e
cmp byte [ebp - 3], 0x3a
jne 0x41f09e
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f0d4
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f0d4
cmp byte [ebp - 7], 0x3a
jne 0x41f0d4
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f10f
call esi
test eax, eax
je 0x41f0fc
cmp byte [ebp - 3], 0x3a
jne 0x41f0fc
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f127
call esi
test eax, eax
je 0x41f127
cmp byte [ebp - 3], 0x3a
jne 0x41f127
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f145
cmp byte [ebp - 3], 0x3a
jne 0x41f145
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f175
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f175
cmp byte [ebp - 7], 0x3a
jne 0x41f175
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f1b0
call esi
test eax, eax
je 0x41f19d
cmp byte [ebp - 3], 0x3a
jne 0x41f19d
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f1c8
call esi
test eax, eax
je 0x41f1c8
cmp byte [ebp - 3], 0x3a
jne 0x41f1c8
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f1e6
cmp byte [ebp - 3], 0x3a
jne 0x41f1e6
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f215
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f215
cmp byte [ebp - 7], 0x3a
jne 0x41f215
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f250
call esi
test eax, eax
je 0x41f23d
cmp byte [ebp - 3], 0x3a
jne 0x41f23d
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f268
call esi
test eax, eax
je 0x41f268
cmp byte [ebp - 3], 0x3a
jne 0x41f268
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f286
cmp byte [ebp - 3], 0x3a
jne 0x41f286
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f2b6
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f2b6
cmp byte [ebp - 7], 0x3a
jne 0x41f2b6
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f2f1
call esi
test eax, eax
je 0x41f2de
cmp byte [ebp - 3], 0x3a
jne 0x41f2de
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f309
call esi
test eax, eax
je 0x41f309
cmp byte [ebp - 3], 0x3a
jne 0x41f309
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f327
cmp byte [ebp - 3], 0x3a
jne 0x41f327
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f355
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f355
cmp byte [ebp - 7], 0x3a
jne 0x41f355
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f390
call esi
test eax, eax
je 0x41f37d
cmp byte [ebp - 3], 0x3a
jne 0x41f37d
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f3a8
call esi
test eax, eax
je 0x41f3a8
cmp byte [ebp - 3], 0x3a
jne 0x41f3a8
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f3c6
cmp byte [ebp - 3], 0x3a
jne 0x41f3c6
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f3f7
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f3f7
cmp byte [ebp - 7], 0x3a
jne 0x41f3f7
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f432
call esi
test eax, eax
je 0x41f41f
cmp byte [ebp - 3], 0x3a
jne 0x41f41f
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f44a
call esi
test eax, eax
je 0x41f44a
cmp byte [ebp - 3], 0x3a
jne 0x41f44a
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f468
cmp byte [ebp - 3], 0x3a
jne 0x41f468
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f498
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f498
cmp byte [ebp - 7], 0x3a
jne 0x41f498
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f4d3
call esi
test eax, eax
je 0x41f4c0
cmp byte [ebp - 3], 0x3a
jne 0x41f4c0
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f4eb
call esi
test eax, eax
je 0x41f4eb
cmp byte [ebp - 3], 0x3a
jne 0x41f4eb
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f509
cmp byte [ebp - 3], 0x3a
jne 0x41f509
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f539
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f539
cmp byte [ebp - 7], 0x3a
jne 0x41f539
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f574
call esi
test eax, eax
je 0x41f561
cmp byte [ebp - 3], 0x3a
jne 0x41f561
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f58c
call esi
test eax, eax
je 0x41f58c
cmp byte [ebp - 3], 0x3a
jne 0x41f58c
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f5aa
cmp byte [ebp - 3], 0x3a
jne 0x41f5aa
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f5d9
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f5d9
cmp byte [ebp - 7], 0x3a
jne 0x41f5d9
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f614
call esi
test eax, eax
je 0x41f601
cmp byte [ebp - 3], 0x3a
jne 0x41f601
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f62c
call esi
test eax, eax
je 0x41f62c
cmp byte [ebp - 3], 0x3a
jne 0x41f62c
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f64a
cmp byte [ebp - 3], 0x3a
jne 0x41f64a
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f67c
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f67c
cmp byte [ebp - 7], 0x3a
jne 0x41f67c
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f6b7
call esi
test eax, eax
je 0x41f6a4
cmp byte [ebp - 3], 0x3a
jne 0x41f6a4
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f6cf
call esi
test eax, eax
je 0x41f6cf
cmp byte [ebp - 3], 0x3a
jne 0x41f6cf
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f6ed
cmp byte [ebp - 3], 0x3a
jne 0x41f6ed
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f726
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f726
cmp byte [ebp - 7], 0x3a
jne 0x41f726
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f761
call esi
test eax, eax
je 0x41f74e
cmp byte [ebp - 3], 0x3a
jne 0x41f74e
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f779
call esi
test eax, eax
je 0x41f779
cmp byte [ebp - 3], 0x3a
jne 0x41f779
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f797
cmp byte [ebp - 3], 0x3a
jne 0x41f797
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f7c8
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f7c8
cmp byte [ebp - 7], 0x3a
jne 0x41f7c8
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f803
call esi
test eax, eax
je 0x41f7f0
cmp byte [ebp - 3], 0x3a
jne 0x41f7f0
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f81b
call esi
test eax, eax
je 0x41f81b
cmp byte [ebp - 3], 0x3a
jne 0x41f81b
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f839
cmp byte [ebp - 3], 0x3a
jne 0x41f839
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f868
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f868
cmp byte [ebp - 7], 0x3a
jne 0x41f868
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f8a3
call esi
test eax, eax
je 0x41f890
cmp byte [ebp - 3], 0x3a
jne 0x41f890
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f8bb
call esi
test eax, eax
je 0x41f8bb
cmp byte [ebp - 3], 0x3a
jne 0x41f8bb
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f8d9
cmp byte [ebp - 3], 0x3a
jne 0x41f8d9
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f90b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f90b
cmp byte [ebp - 7], 0x3a
jne 0x41f90b
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f946
call esi
test eax, eax
je 0x41f933
cmp byte [ebp - 3], 0x3a
jne 0x41f933
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f95e
call esi
test eax, eax
je 0x41f95e
cmp byte [ebp - 3], 0x3a
jne 0x41f95e
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41f97c
cmp byte [ebp - 3], 0x3a
jne 0x41f97c
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x41f9d8
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41f9d8
cmp byte [ebp - 7], 0x3a
jne 0x41f9d8
movzx eax, byte [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fa13
call esi
test eax, eax
je 0x41fa00
cmp byte [ebp - 3], 0x3a
jne 0x41fa00
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fa2b
call esi
test eax, eax
je 0x41fa2b
cmp byte [ebp - 3], 0x3a
jne 0x41fa2b
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41fa49
cmp byte [ebp - 3], 0x3a
jne 0x41fa49
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
mov esi, 0x104
lea eax, [ebp - 0x214]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push esi
push eax
mov eax, dword [0x4513d0]
push ebx
call dword [eax + 0x74]
push 1
push ebx
push 0x2e
lea eax, [ebp - 0x214]
pop edi
push edi
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2dc]
push ebx
push 0x65
pop esi
push esi
push 0x78
push esi
push edi
push 0x73
push 0x25
push eax
call fcn.004105df
add esp, 0x20
lea eax, [ebp - 0x3a4]
push ebx
push esi
push 0x78
push esi
push edi
push 0x20
push 0x73
push 0x25
push eax
call fcn.004105df
add esp, 0x24
lea eax, [ebp - 0x278]
push ebx
push esi
push 0x78
push esi
push edi
push 0x20
push 0x20
push 0x73
push 0x25
push eax
call fcn.004105df
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x1dc]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x4a8]
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x1dc]
add esp, 0x40
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x5ac]
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x1dc]
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004121c0
test eax, eax
je 0x41fbf5
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.004121c0
test eax, eax
je 0x41fbf5
push ebx
push 0x6e
push esi
push 0x70
lea eax, [ebp - 0x340]
push 0x6f
push eax
call fcn.004105df
add esp, 0x18
lea eax, [ebp - 0x110]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x340]
push eax
mov eax, dword [0x4513d0]
push ebx
call dword [eax + 0x118]
mov eax, dword [0x4513d0]
push 0x64
call dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004121c0
test eax, eax
je 0x41fbf5
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x5ac]
push eax
call fcn.004121c0
pop edi
pop esi
pop ebx
leave
ret 8