Function at 0x41d2c5
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
test eax, eax
mov dword [ecx], 0x44b120
jne 0x41df70
push esi
xor esi, esi
push edi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d321
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d321
cmp byte [ebp - 7], 0x3a
jne 0x41d321
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d35f
call esi
test eax, eax
je 0x41d34b
cmp byte [ebp - 3], 0x3a
jne 0x41d34b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d373
call esi
test eax, eax
je 0x41d373
cmp byte [ebp - 3], 0x3a
jne 0x41d373
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d38d
cmp byte [ebp - 3], 0x3a
jne 0x41d38d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d3b9
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d3b9
cmp byte [ebp - 7], 0x3a
jne 0x41d3b9
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d3f1
call esi
test eax, eax
je 0x41d3dd
cmp byte [ebp - 3], 0x3a
jne 0x41d3dd
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d405
call esi
test eax, eax
je 0x41d405
cmp byte [ebp - 3], 0x3a
jne 0x41d405
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d41f
cmp byte [ebp - 3], 0x3a
jne 0x41d41f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d44b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d44b
cmp byte [ebp - 7], 0x3a
jne 0x41d44b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d483
call esi
test eax, eax
je 0x41d46f
cmp byte [ebp - 3], 0x3a
jne 0x41d46f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d497
call esi
test eax, eax
je 0x41d497
cmp byte [ebp - 3], 0x3a
jne 0x41d497
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d4b1
cmp byte [ebp - 3], 0x3a
jne 0x41d4b1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d4eb
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d4eb
cmp byte [ebp - 7], 0x3a
jne 0x41d4eb
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d523
call esi
test eax, eax
je 0x41d50f
cmp byte [ebp - 3], 0x3a
jne 0x41d50f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d537
call esi
test eax, eax
je 0x41d537
cmp byte [ebp - 3], 0x3a
jne 0x41d537
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d551
cmp byte [ebp - 3], 0x3a
jne 0x41d551
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d588
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d588
cmp byte [ebp - 7], 0x3a
jne 0x41d588
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d5c0
call esi
test eax, eax
je 0x41d5ac
cmp byte [ebp - 3], 0x3a
jne 0x41d5ac
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d5d4
call esi
test eax, eax
je 0x41d5d4
cmp byte [ebp - 3], 0x3a
jne 0x41d5d4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d5ee
cmp byte [ebp - 3], 0x3a
jne 0x41d5ee
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d61c
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d61c
cmp byte [ebp - 7], 0x3a
jne 0x41d61c
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d654
call esi
test eax, eax
je 0x41d640
cmp byte [ebp - 3], 0x3a
jne 0x41d640
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d668
call esi
test eax, eax
je 0x41d668
cmp byte [ebp - 3], 0x3a
jne 0x41d668
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d682
cmp byte [ebp - 3], 0x3a
jne 0x41d682
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d6b6
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d6b6
cmp byte [ebp - 7], 0x3a
jne 0x41d6b6
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d6ee
call esi
test eax, eax
je 0x41d6da
cmp byte [ebp - 3], 0x3a
jne 0x41d6da
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d702
call esi
test eax, eax
je 0x41d702
cmp byte [ebp - 3], 0x3a
jne 0x41d702
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d71c
cmp byte [ebp - 3], 0x3a
jne 0x41d71c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d74a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d74a
cmp byte [ebp - 7], 0x3a
jne 0x41d74a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d782
call esi
test eax, eax
je 0x41d76e
cmp byte [ebp - 3], 0x3a
jne 0x41d76e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d796
call esi
test eax, eax
je 0x41d796
cmp byte [ebp - 3], 0x3a
jne 0x41d796
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d7b0
cmp byte [ebp - 3], 0x3a
jne 0x41d7b0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d7dc
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d7dc
cmp byte [ebp - 7], 0x3a
jne 0x41d7dc
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d814
call esi
test eax, eax
je 0x41d800
cmp byte [ebp - 3], 0x3a
jne 0x41d800
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d828
call esi
test eax, eax
je 0x41d828
cmp byte [ebp - 3], 0x3a
jne 0x41d828
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d842
cmp byte [ebp - 3], 0x3a
jne 0x41d842
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d870
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d870
cmp byte [ebp - 7], 0x3a
jne 0x41d870
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d8a8
call esi
test eax, eax
je 0x41d894
cmp byte [ebp - 3], 0x3a
jne 0x41d894
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d8bc
call esi
test eax, eax
je 0x41d8bc
cmp byte [ebp - 3], 0x3a
jne 0x41d8bc
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d8d6
cmp byte [ebp - 3], 0x3a
jne 0x41d8d6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d900
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d900
cmp byte [ebp - 7], 0x3a
jne 0x41d900
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d938
call esi
test eax, eax
je 0x41d924
cmp byte [ebp - 3], 0x3a
jne 0x41d924
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d94c
call esi
test eax, eax
je 0x41d94c
cmp byte [ebp - 3], 0x3a
jne 0x41d94c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d966
cmp byte [ebp - 3], 0x3a
jne 0x41d966
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41d995
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41d995
cmp byte [ebp - 7], 0x3a
jne 0x41d995
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d9cd
call esi
test eax, eax
je 0x41d9b9
cmp byte [ebp - 3], 0x3a
jne 0x41d9b9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41d9e1
call esi
test eax, eax
je 0x41d9e1
cmp byte [ebp - 3], 0x3a
jne 0x41d9e1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41d9fb
cmp byte [ebp - 3], 0x3a
jne 0x41d9fb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41da29
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41da29
cmp byte [ebp - 7], 0x3a
jne 0x41da29
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41da61
call esi
test eax, eax
je 0x41da4d
cmp byte [ebp - 3], 0x3a
jne 0x41da4d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41da75
call esi
test eax, eax
je 0x41da75
cmp byte [ebp - 3], 0x3a
jne 0x41da75
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41da8f
cmp byte [ebp - 3], 0x3a
jne 0x41da8f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41dabd
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41dabd
cmp byte [ebp - 7], 0x3a
jne 0x41dabd
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41daf5
call esi
test eax, eax
je 0x41dae1
cmp byte [ebp - 3], 0x3a
jne 0x41dae1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41db09
call esi
test eax, eax
je 0x41db09
cmp byte [ebp - 3], 0x3a
jne 0x41db09
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41db23
cmp byte [ebp - 3], 0x3a
jne 0x41db23
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41db4f
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41db4f
cmp byte [ebp - 7], 0x3a
jne 0x41db4f
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41db87
call esi
test eax, eax
je 0x41db73
cmp byte [ebp - 3], 0x3a
jne 0x41db73
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41db9b
call esi
test eax, eax
je 0x41db9b
cmp byte [ebp - 3], 0x3a
jne 0x41db9b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41dbb5
cmp byte [ebp - 3], 0x3a
jne 0x41dbb5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41dbe5
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41dbe5
cmp byte [ebp - 7], 0x3a
jne 0x41dbe5
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dc1d
call esi
test eax, eax
je 0x41dc09
cmp byte [ebp - 3], 0x3a
jne 0x41dc09
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41dc31
call esi
test eax, eax
je 0x41dc31
cmp byte [ebp - 3], 0x3a
jne 0x41dc31
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41dc4b
cmp byte [ebp - 3], 0x3a
jne 0x41dc4b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41dc84
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41dc84
cmp byte [ebp - 7], 0x3a
jne 0x41dc84
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dcbc
call esi
test eax, eax
je 0x41dca8
cmp byte [ebp - 3], 0x3a
jne 0x41dca8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41dcd0
call esi
test eax, eax
je 0x41dcd0
cmp byte [ebp - 3], 0x3a
jne 0x41dcd0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41dcea
cmp byte [ebp - 3], 0x3a
jne 0x41dcea
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41dd19
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41dd19
cmp byte [ebp - 7], 0x3a
jne 0x41dd19
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dd51
call esi
test eax, eax
je 0x41dd3d
cmp byte [ebp - 3], 0x3a
jne 0x41dd3d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41dd65
call esi
test eax, eax
je 0x41dd65
cmp byte [ebp - 3], 0x3a
jne 0x41dd65
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41dd7f
cmp byte [ebp - 3], 0x3a
jne 0x41dd7f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41ddab
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41ddab
cmp byte [ebp - 7], 0x3a
jne 0x41ddab
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dde3
call esi
test eax, eax
je 0x41ddcf
cmp byte [ebp - 3], 0x3a
jne 0x41ddcf
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41ddf7
call esi
test eax, eax
je 0x41ddf7
cmp byte [ebp - 3], 0x3a
jne 0x41ddf7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41de11
cmp byte [ebp - 3], 0x3a
jne 0x41de11
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41de41
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41de41
cmp byte [ebp - 7], 0x3a
jne 0x41de41
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41de79
call esi
test eax, eax
je 0x41de65
cmp byte [ebp - 3], 0x3a
jne 0x41de65
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41de8d
call esi
test eax, eax
je 0x41de8d
cmp byte [ebp - 3], 0x3a
jne 0x41de8d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41dea7
cmp byte [ebp - 3], 0x3a
jne 0x41dea7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41df08
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41df08
cmp byte [ebp - 7], 0x3a
jne 0x41df08
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41df40
call esi
test eax, eax
je 0x41df2c
cmp byte [ebp - 3], 0x3a
jne 0x41df2c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41df54
call esi
test eax, eax
je 0x41df54
cmp byte [ebp - 3], 0x3a
jne 0x41df54
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
pop edi
pop esi
test eax, eax
je 0x41df70
cmp byte [ebp - 3], 0x3a
jne 0x41df70
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
pop ebx
leave
ret