Function at 0x41a274
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
test eax, eax
mov dword [ecx], 0x44a158
jne 0x41af35
push ebx
push esi
push edi
call dword [ecx + 0x8c]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a2b8
cmp byte [ebp - 3], 0x3a
jne 0x41a2b8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
xor ebx, ebx
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a2fa
call edi
test eax, eax
je 0x41a2e7
cmp byte [ebp - 3], 0x3a
jne 0x41a2e7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a311
call edi
test eax, eax
je 0x41a311
cmp byte [ebp - 3], 0x3a
jne 0x41a311
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a32c
cmp byte [ebp - 3], 0x3a
jne 0x41a32c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a366
call edi
test eax, eax
je 0x41a353
cmp byte [ebp - 3], 0x3a
jne 0x41a353
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a37d
call edi
test eax, eax
je 0x41a37d
cmp byte [ebp - 3], 0x3a
jne 0x41a37d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a3b0
cmp byte [ebp - 3], 0x3a
jne 0x41a3b0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a3ea
call edi
test eax, eax
je 0x41a3d7
cmp byte [ebp - 3], 0x3a
jne 0x41a3d7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a401
call edi
test eax, eax
je 0x41a401
cmp byte [ebp - 3], 0x3a
jne 0x41a401
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x3c]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a423
cmp byte [ebp - 3], 0x3a
jne 0x41a423
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a45d
call edi
test eax, eax
je 0x41a44a
cmp byte [ebp - 3], 0x3a
jne 0x41a44a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a474
call edi
test eax, eax
je 0x41a474
cmp byte [ebp - 3], 0x3a
jne 0x41a474
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a495
cmp byte [ebp - 3], 0x3a
jne 0x41a495
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a4cf
call edi
test eax, eax
je 0x41a4bc
cmp byte [ebp - 3], 0x3a
jne 0x41a4bc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a4e6
call edi
test eax, eax
je 0x41a4e6
cmp byte [ebp - 3], 0x3a
jne 0x41a4e6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
call dword [eax + 0x1ac]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a525
cmp byte [ebp - 3], 0x3a
jne 0x41a525
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a55f
call edi
test eax, eax
je 0x41a54c
cmp byte [ebp - 3], 0x3a
jne 0x41a54c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a576
call edi
test eax, eax
je 0x41a576
cmp byte [ebp - 3], 0x3a
jne 0x41a576
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
call dword [eax + 0x30]
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x48]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a5a1
cmp byte [ebp - 3], 0x3a
jne 0x41a5a1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a5db
call edi
test eax, eax
je 0x41a5c8
cmp byte [ebp - 3], 0x3a
jne 0x41a5c8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a5f2
call edi
test eax, eax
je 0x41a5f2
cmp byte [ebp - 3], 0x3a
jne 0x41a5f2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
call dword [eax + 0x1c0]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a61f
cmp byte [ebp - 3], 0x3a
jne 0x41a61f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a659
call edi
test eax, eax
je 0x41a646
cmp byte [ebp - 3], 0x3a
jne 0x41a646
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a670
call edi
test eax, eax
je 0x41a670
cmp byte [ebp - 3], 0x3a
jne 0x41a670
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a69d
cmp byte [ebp - 3], 0x3a
jne 0x41a69d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a6d7
call edi
test eax, eax
je 0x41a6c4
cmp byte [ebp - 3], 0x3a
jne 0x41a6c4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a6ee
call edi
test eax, eax
je 0x41a6ee
cmp byte [ebp - 3], 0x3a
jne 0x41a6ee
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [eax + 0x2c]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a721
cmp byte [ebp - 3], 0x3a
jne 0x41a721
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a75b
call edi
test eax, eax
je 0x41a748
cmp byte [ebp - 3], 0x3a
jne 0x41a748
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a772
call edi
test eax, eax
je 0x41a772
cmp byte [ebp - 3], 0x3a
jne 0x41a772
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [eax + 0x4c]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a7a1
cmp byte [ebp - 3], 0x3a
jne 0x41a7a1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a7db
call edi
test eax, eax
je 0x41a7c8
cmp byte [ebp - 3], 0x3a
jne 0x41a7c8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a7f2
call edi
test eax, eax
je 0x41a7f2
cmp byte [ebp - 3], 0x3a
jne 0x41a7f2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a814
cmp byte [ebp - 3], 0x3a
jne 0x41a814
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a84e
call edi
test eax, eax
je 0x41a83b
cmp byte [ebp - 3], 0x3a
jne 0x41a83b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a865
call edi
test eax, eax
je 0x41a865
cmp byte [ebp - 3], 0x3a
jne 0x41a865
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a887
cmp byte [ebp - 3], 0x3a
jne 0x41a887
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a8c1
call edi
test eax, eax
je 0x41a8ae
cmp byte [ebp - 3], 0x3a
jne 0x41a8ae
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a8d8
call edi
test eax, eax
je 0x41a8d8
cmp byte [ebp - 3], 0x3a
jne 0x41a8d8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [ebp - 0xc]
push ebx
push ebx
call dword [eax + 0xb8]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a905
cmp byte [ebp - 3], 0x3a
jne 0x41a905
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a93f
call edi
test eax, eax
je 0x41a92c
cmp byte [ebp - 3], 0x3a
jne 0x41a92c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a956
call edi
test eax, eax
je 0x41a956
cmp byte [ebp - 3], 0x3a
jne 0x41a956
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x1c8]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41a984
cmp byte [ebp - 3], 0x3a
jne 0x41a984
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41a9be
call edi
test eax, eax
je 0x41a9ab
cmp byte [ebp - 3], 0x3a
jne 0x41a9ab
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41a9d5
call edi
test eax, eax
je 0x41a9d5
cmp byte [ebp - 3], 0x3a
jne 0x41a9d5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41aa00
cmp byte [ebp - 3], 0x3a
jne 0x41aa00
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aa3a
call edi
test eax, eax
je 0x41aa27
cmp byte [ebp - 3], 0x3a
jne 0x41aa27
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41aa51
call edi
test eax, eax
je 0x41aa51
cmp byte [ebp - 3], 0x3a
jne 0x41aa51
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41aa7b
cmp byte [ebp - 3], 0x3a
jne 0x41aa7b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aab5
call edi
test eax, eax
je 0x41aaa2
cmp byte [ebp - 3], 0x3a
jne 0x41aaa2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41aacc
call edi
test eax, eax
je 0x41aacc
cmp byte [ebp - 3], 0x3a
jne 0x41aacc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41aaf0
cmp byte [ebp - 3], 0x3a
jne 0x41aaf0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ab2a
call edi
test eax, eax
je 0x41ab17
cmp byte [ebp - 3], 0x3a
jne 0x41ab17
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ab41
call edi
test eax, eax
je 0x41ab41
cmp byte [ebp - 3], 0x3a
jne 0x41ab41
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ab6a
cmp byte [ebp - 3], 0x3a
jne 0x41ab6a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aba4
call edi
test eax, eax
je 0x41ab91
cmp byte [ebp - 3], 0x3a
jne 0x41ab91
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41abbb
call edi
test eax, eax
je 0x41abbb
cmp byte [ebp - 3], 0x3a
jne 0x41abbb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41abe4
cmp byte [ebp - 3], 0x3a
jne 0x41abe4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ac1e
call edi
test eax, eax
je 0x41ac0b
cmp byte [ebp - 3], 0x3a
jne 0x41ac0b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ac35
call edi
test eax, eax
je 0x41ac35
cmp byte [ebp - 3], 0x3a
jne 0x41ac35
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ac63
cmp byte [ebp - 3], 0x3a
jne 0x41ac63
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ac9d
call edi
test eax, eax
je 0x41ac8a
cmp byte [ebp - 3], 0x3a
jne 0x41ac8a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41acb4
call edi
test eax, eax
je 0x41acb4
cmp byte [ebp - 3], 0x3a
jne 0x41acb4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x60]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41acdd
cmp byte [ebp - 3], 0x3a
jne 0x41acdd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ad17
call edi
test eax, eax
je 0x41ad04
cmp byte [ebp - 3], 0x3a
jne 0x41ad04
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ad2e
call edi
test eax, eax
je 0x41ad2e
cmp byte [ebp - 3], 0x3a
jne 0x41ad2e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ad50
cmp byte [ebp - 3], 0x3a
jne 0x41ad50
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ad8a
call edi
test eax, eax
je 0x41ad77
cmp byte [ebp - 3], 0x3a
jne 0x41ad77
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ada1
call edi
test eax, eax
je 0x41ada1
cmp byte [ebp - 3], 0x3a
jne 0x41ada1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41adca
cmp byte [ebp - 3], 0x3a
jne 0x41adca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ae04
call edi
test eax, eax
je 0x41adf1
cmp byte [ebp - 3], 0x3a
jne 0x41adf1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ae1b
call edi
test eax, eax
je 0x41ae1b
cmp byte [ebp - 3], 0x3a
jne 0x41ae1b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ae45
cmp byte [ebp - 3], 0x3a
jne 0x41ae45
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ae7f
call edi
test eax, eax
je 0x41ae6c
cmp byte [ebp - 3], 0x3a
jne 0x41ae6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ae96
call edi
test eax, eax
je 0x41ae96
cmp byte [ebp - 3], 0x3a
jne 0x41ae96
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x7c]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41aec1
cmp byte [ebp - 3], 0x3a
jne 0x41aec1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41aefb
call edi
test eax, eax
je 0x41aee8
cmp byte [ebp - 3], 0x3a
jne 0x41aee8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41af12
call edi
test eax, eax
je 0x41af12
cmp byte [ebp - 3], 0x3a
jne 0x41af12
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret