Function at 0x41e55e
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
jne 0x41f20b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e59d
cmp byte [ebp - 3], 0x3a
jne 0x41e59d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e5de
call edi
test eax, eax
je 0x41e5cb
cmp byte [ebp - 3], 0x3a
jne 0x41e5cb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e5f5
call edi
test eax, eax
je 0x41e5f5
cmp byte [ebp - 3], 0x3a
jne 0x41e5f5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e610
cmp byte [ebp - 3], 0x3a
jne 0x41e610
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e64a
call edi
test eax, eax
je 0x41e637
cmp byte [ebp - 3], 0x3a
jne 0x41e637
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e661
call edi
test eax, eax
je 0x41e661
cmp byte [ebp - 3], 0x3a
jne 0x41e661
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e694
cmp byte [ebp - 3], 0x3a
jne 0x41e694
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e6ce
call edi
test eax, eax
je 0x41e6bb
cmp byte [ebp - 3], 0x3a
jne 0x41e6bb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e6e5
call edi
test eax, eax
je 0x41e6e5
cmp byte [ebp - 3], 0x3a
jne 0x41e6e5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e707
cmp byte [ebp - 3], 0x3a
jne 0x41e707
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e741
call edi
test eax, eax
je 0x41e72e
cmp byte [ebp - 3], 0x3a
jne 0x41e72e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e758
call edi
test eax, eax
je 0x41e758
cmp byte [ebp - 3], 0x3a
jne 0x41e758
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e779
cmp byte [ebp - 3], 0x3a
jne 0x41e779
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e7b3
call edi
test eax, eax
je 0x41e7a0
cmp byte [ebp - 3], 0x3a
jne 0x41e7a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e7ca
call edi
test eax, eax
je 0x41e7ca
cmp byte [ebp - 3], 0x3a
jne 0x41e7ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e806
cmp byte [ebp - 3], 0x3a
jne 0x41e806
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e840
call edi
test eax, eax
je 0x41e82d
cmp byte [ebp - 3], 0x3a
jne 0x41e82d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e857
call edi
test eax, eax
je 0x41e857
cmp byte [ebp - 3], 0x3a
jne 0x41e857
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e882
cmp byte [ebp - 3], 0x3a
jne 0x41e882
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e8bc
call edi
test eax, eax
je 0x41e8a9
cmp byte [ebp - 3], 0x3a
jne 0x41e8a9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e8d3
call edi
test eax, eax
je 0x41e8d3
cmp byte [ebp - 3], 0x3a
jne 0x41e8d3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e8fd
cmp byte [ebp - 3], 0x3a
jne 0x41e8fd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e937
call edi
test eax, eax
je 0x41e924
cmp byte [ebp - 3], 0x3a
jne 0x41e924
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e94e
call edi
test eax, eax
je 0x41e94e
cmp byte [ebp - 3], 0x3a
jne 0x41e94e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e97b
cmp byte [ebp - 3], 0x3a
jne 0x41e97b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e9b5
call edi
test eax, eax
je 0x41e9a2
cmp byte [ebp - 3], 0x3a
jne 0x41e9a2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e9cc
call edi
test eax, eax
je 0x41e9cc
cmp byte [ebp - 3], 0x3a
jne 0x41e9cc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e9ff
cmp byte [ebp - 3], 0x3a
jne 0x41e9ff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ea39
call edi
test eax, eax
je 0x41ea26
cmp byte [ebp - 3], 0x3a
jne 0x41ea26
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ea50
call edi
test eax, eax
je 0x41ea50
cmp byte [ebp - 3], 0x3a
jne 0x41ea50
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ea7f
cmp byte [ebp - 3], 0x3a
jne 0x41ea7f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41eab9
call edi
test eax, eax
je 0x41eaa6
cmp byte [ebp - 3], 0x3a
jne 0x41eaa6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ead0
call edi
test eax, eax
je 0x41ead0
cmp byte [ebp - 3], 0x3a
jne 0x41ead0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41eaf2
cmp byte [ebp - 3], 0x3a
jne 0x41eaf2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41eb2c
call edi
test eax, eax
je 0x41eb19
cmp byte [ebp - 3], 0x3a
jne 0x41eb19
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41eb43
call edi
test eax, eax
je 0x41eb43
cmp byte [ebp - 3], 0x3a
jne 0x41eb43
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41eb65
cmp byte [ebp - 3], 0x3a
jne 0x41eb65
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41eb9f
call edi
test eax, eax
je 0x41eb8c
cmp byte [ebp - 3], 0x3a
jne 0x41eb8c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ebb6
call edi
test eax, eax
je 0x41ebb6
cmp byte [ebp - 3], 0x3a
jne 0x41ebb6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ebe0
cmp byte [ebp - 3], 0x3a
jne 0x41ebe0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ec1a
call edi
test eax, eax
je 0x41ec07
cmp byte [ebp - 3], 0x3a
jne 0x41ec07
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ec31
call edi
test eax, eax
je 0x41ec31
cmp byte [ebp - 3], 0x3a
jne 0x41ec31
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ec5c
cmp byte [ebp - 3], 0x3a
jne 0x41ec5c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ec96
call edi
test eax, eax
je 0x41ec83
cmp byte [ebp - 3], 0x3a
jne 0x41ec83
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ecad
call edi
test eax, eax
je 0x41ecad
cmp byte [ebp - 3], 0x3a
jne 0x41ecad
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ecd8
cmp byte [ebp - 3], 0x3a
jne 0x41ecd8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ed12
call edi
test eax, eax
je 0x41ecff
cmp byte [ebp - 3], 0x3a
jne 0x41ecff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ed29
call edi
test eax, eax
je 0x41ed29
cmp byte [ebp - 3], 0x3a
jne 0x41ed29
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ed53
cmp byte [ebp - 3], 0x3a
jne 0x41ed53
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ed8d
call edi
test eax, eax
je 0x41ed7a
cmp byte [ebp - 3], 0x3a
jne 0x41ed7a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41eda4
call edi
test eax, eax
je 0x41eda4
cmp byte [ebp - 3], 0x3a
jne 0x41eda4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41edc8
cmp byte [ebp - 3], 0x3a
jne 0x41edc8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ee02
call edi
test eax, eax
je 0x41edef
cmp byte [ebp - 3], 0x3a
jne 0x41edef
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ee19
call edi
test eax, eax
je 0x41ee19
cmp byte [ebp - 3], 0x3a
jne 0x41ee19
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ee42
cmp byte [ebp - 3], 0x3a
jne 0x41ee42
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ee7c
call edi
test eax, eax
je 0x41ee69
cmp byte [ebp - 3], 0x3a
jne 0x41ee69
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ee93
call edi
test eax, eax
je 0x41ee93
cmp byte [ebp - 3], 0x3a
jne 0x41ee93
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41eebc
cmp byte [ebp - 3], 0x3a
jne 0x41eebc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41eef6
call edi
test eax, eax
je 0x41eee3
cmp byte [ebp - 3], 0x3a
jne 0x41eee3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ef0d
call edi
test eax, eax
je 0x41ef0d
cmp byte [ebp - 3], 0x3a
jne 0x41ef0d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ef3b
cmp byte [ebp - 3], 0x3a
jne 0x41ef3b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ef75
call edi
test eax, eax
je 0x41ef62
cmp byte [ebp - 3], 0x3a
jne 0x41ef62
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ef8c
call edi
test eax, eax
je 0x41ef8c
cmp byte [ebp - 3], 0x3a
jne 0x41ef8c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41efb5
cmp byte [ebp - 3], 0x3a
jne 0x41efb5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41efef
call edi
test eax, eax
je 0x41efdc
cmp byte [ebp - 3], 0x3a
jne 0x41efdc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f006
call edi
test eax, eax
je 0x41f006
cmp byte [ebp - 3], 0x3a
jne 0x41f006
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f028
cmp byte [ebp - 3], 0x3a
jne 0x41f028
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f062
call edi
test eax, eax
je 0x41f04f
cmp byte [ebp - 3], 0x3a
jne 0x41f04f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f079
call edi
test eax, eax
je 0x41f079
cmp byte [ebp - 3], 0x3a
jne 0x41f079
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f0a2
cmp byte [ebp - 3], 0x3a
jne 0x41f0a2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f0dc
call edi
test eax, eax
je 0x41f0c9
cmp byte [ebp - 3], 0x3a
jne 0x41f0c9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f0f3
call edi
test eax, eax
je 0x41f0f3
cmp byte [ebp - 3], 0x3a
jne 0x41f0f3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f11d
cmp byte [ebp - 3], 0x3a
jne 0x41f11d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f157
call edi
test eax, eax
je 0x41f144
cmp byte [ebp - 3], 0x3a
jne 0x41f144
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f16e
call edi
test eax, eax
je 0x41f16e
cmp byte [ebp - 3], 0x3a
jne 0x41f16e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41f199
cmp byte [ebp - 3], 0x3a
jne 0x41f199
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f1d3
call edi
test eax, eax
je 0x41f1c0
cmp byte [ebp - 3], 0x3a
jne 0x41f1c0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41f1ea
call edi
test eax, eax
je 0x41f1ea
cmp byte [ebp - 3], 0x3a
jne 0x41f1ea
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
mov esi, 0x100
lea eax, [ebp - 0x128]
push esi
push ebx
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x21c]
push dword [ebp + 8]
lea eax, [ebp - 0x128]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1e8]
push esi
lea eax, [ebp - 0x228]
push ebx
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x21c]
push dword [ebp + 0xc]
lea eax, [ebp - 0x228]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1e8]
push 0x1e
lea eax, [ebp - 0x28]
push ebx
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x21c]
lea eax, [ebp - 0x128]
add esp, 0x34
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x4503d0]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 4
mov word [ebp - 0x18], 0x614
call dword [eax + 0x114]
neg eax
sbb eax, eax
pop esi
inc eax
pop ebx
leave
ret 8