Function at 0x41be45
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
test eax, eax
mov dword [ecx], 0x44e160
jne 0x41cbfe
push ebx
push esi
push edi
call dword [ecx + 0x8c]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41be89
cmp byte [ebp - 3], 0x3a
jne 0x41be89
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
xor ebx, ebx
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41becb
call edi
test eax, eax
je 0x41beb8
cmp byte [ebp - 3], 0x3a
jne 0x41beb8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41bee2
call edi
test eax, eax
je 0x41bee2
cmp byte [ebp - 3], 0x3a
jne 0x41bee2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41befd
cmp byte [ebp - 3], 0x3a
jne 0x41befd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41bf37
call edi
test eax, eax
je 0x41bf24
cmp byte [ebp - 3], 0x3a
jne 0x41bf24
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41bf4e
call edi
test eax, eax
je 0x41bf4e
cmp byte [ebp - 3], 0x3a
jne 0x41bf4e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [eax + 0x34]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41bf81
cmp byte [ebp - 3], 0x3a
jne 0x41bf81
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41bfbb
call edi
test eax, eax
je 0x41bfa8
cmp byte [ebp - 3], 0x3a
jne 0x41bfa8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41bfd2
call edi
test eax, eax
je 0x41bfd2
cmp byte [ebp - 3], 0x3a
jne 0x41bfd2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41bff9
cmp byte [ebp - 3], 0x3a
jne 0x41bff9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c033
call edi
test eax, eax
je 0x41c020
cmp byte [ebp - 3], 0x3a
jne 0x41c020
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c04a
call edi
test eax, eax
je 0x41c04a
cmp byte [ebp - 3], 0x3a
jne 0x41c04a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x3c]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c06c
cmp byte [ebp - 3], 0x3a
jne 0x41c06c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c0a6
call edi
test eax, eax
je 0x41c093
cmp byte [ebp - 3], 0x3a
jne 0x41c093
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c0bd
call edi
test eax, eax
je 0x41c0bd
cmp byte [ebp - 3], 0x3a
jne 0x41c0bd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c0df
cmp byte [ebp - 3], 0x3a
jne 0x41c0df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c119
call edi
test eax, eax
je 0x41c106
cmp byte [ebp - 3], 0x3a
jne 0x41c106
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c130
call edi
test eax, eax
je 0x41c130
cmp byte [ebp - 3], 0x3a
jne 0x41c130
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c15e
cmp byte [ebp - 3], 0x3a
jne 0x41c15e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c198
call edi
test eax, eax
je 0x41c185
cmp byte [ebp - 3], 0x3a
jne 0x41c185
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c1af
call edi
test eax, eax
je 0x41c1af
cmp byte [ebp - 3], 0x3a
jne 0x41c1af
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
call dword [eax + 0x1ac]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c1ee
cmp byte [ebp - 3], 0x3a
jne 0x41c1ee
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c228
call edi
test eax, eax
je 0x41c215
cmp byte [ebp - 3], 0x3a
jne 0x41c215
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c23f
call edi
test eax, eax
je 0x41c23f
cmp byte [ebp - 3], 0x3a
jne 0x41c23f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
call dword [eax + 0x30]
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x48]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c26a
cmp byte [ebp - 3], 0x3a
jne 0x41c26a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c2a4
call edi
test eax, eax
je 0x41c291
cmp byte [ebp - 3], 0x3a
jne 0x41c291
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c2bb
call edi
test eax, eax
je 0x41c2bb
cmp byte [ebp - 3], 0x3a
jne 0x41c2bb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
call dword [eax + 0x1c0]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c2e8
cmp byte [ebp - 3], 0x3a
jne 0x41c2e8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c322
call edi
test eax, eax
je 0x41c30f
cmp byte [ebp - 3], 0x3a
jne 0x41c30f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c339
call edi
test eax, eax
je 0x41c339
cmp byte [ebp - 3], 0x3a
jne 0x41c339
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c366
cmp byte [ebp - 3], 0x3a
jne 0x41c366
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c3a0
call edi
test eax, eax
je 0x41c38d
cmp byte [ebp - 3], 0x3a
jne 0x41c38d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c3b7
call edi
test eax, eax
je 0x41c3b7
cmp byte [ebp - 3], 0x3a
jne 0x41c3b7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [eax + 0x2c]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c3ea
cmp byte [ebp - 3], 0x3a
jne 0x41c3ea
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c424
call edi
test eax, eax
je 0x41c411
cmp byte [ebp - 3], 0x3a
jne 0x41c411
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c43b
call edi
test eax, eax
je 0x41c43b
cmp byte [ebp - 3], 0x3a
jne 0x41c43b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [eax + 0x4c]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c46a
cmp byte [ebp - 3], 0x3a
jne 0x41c46a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c4a4
call edi
test eax, eax
je 0x41c491
cmp byte [ebp - 3], 0x3a
jne 0x41c491
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c4bb
call edi
test eax, eax
je 0x41c4bb
cmp byte [ebp - 3], 0x3a
jne 0x41c4bb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c4dd
cmp byte [ebp - 3], 0x3a
jne 0x41c4dd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c517
call edi
test eax, eax
je 0x41c504
cmp byte [ebp - 3], 0x3a
jne 0x41c504
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c52e
call edi
test eax, eax
je 0x41c52e
cmp byte [ebp - 3], 0x3a
jne 0x41c52e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c550
cmp byte [ebp - 3], 0x3a
jne 0x41c550
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c58a
call edi
test eax, eax
je 0x41c577
cmp byte [ebp - 3], 0x3a
jne 0x41c577
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c5a1
call edi
test eax, eax
je 0x41c5a1
cmp byte [ebp - 3], 0x3a
jne 0x41c5a1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [ebp - 0xc]
push ebx
push ebx
call dword [eax + 0xb8]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c5ce
cmp byte [ebp - 3], 0x3a
jne 0x41c5ce
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c608
call edi
test eax, eax
je 0x41c5f5
cmp byte [ebp - 3], 0x3a
jne 0x41c5f5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c61f
call edi
test eax, eax
je 0x41c61f
cmp byte [ebp - 3], 0x3a
jne 0x41c61f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x1c8]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c64d
cmp byte [ebp - 3], 0x3a
jne 0x41c64d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c687
call edi
test eax, eax
je 0x41c674
cmp byte [ebp - 3], 0x3a
jne 0x41c674
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c69e
call edi
test eax, eax
je 0x41c69e
cmp byte [ebp - 3], 0x3a
jne 0x41c69e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c6c9
cmp byte [ebp - 3], 0x3a
jne 0x41c6c9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c703
call edi
test eax, eax
je 0x41c6f0
cmp byte [ebp - 3], 0x3a
jne 0x41c6f0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c71a
call edi
test eax, eax
je 0x41c71a
cmp byte [ebp - 3], 0x3a
jne 0x41c71a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c744
cmp byte [ebp - 3], 0x3a
jne 0x41c744
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c77e
call edi
test eax, eax
je 0x41c76b
cmp byte [ebp - 3], 0x3a
jne 0x41c76b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c795
call edi
test eax, eax
je 0x41c795
cmp byte [ebp - 3], 0x3a
jne 0x41c795
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c7b9
cmp byte [ebp - 3], 0x3a
jne 0x41c7b9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c7f3
call edi
test eax, eax
je 0x41c7e0
cmp byte [ebp - 3], 0x3a
jne 0x41c7e0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c80a
call edi
test eax, eax
je 0x41c80a
cmp byte [ebp - 3], 0x3a
jne 0x41c80a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c833
cmp byte [ebp - 3], 0x3a
jne 0x41c833
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c86d
call edi
test eax, eax
je 0x41c85a
cmp byte [ebp - 3], 0x3a
jne 0x41c85a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c884
call edi
test eax, eax
je 0x41c884
cmp byte [ebp - 3], 0x3a
jne 0x41c884
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c8ad
cmp byte [ebp - 3], 0x3a
jne 0x41c8ad
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c8e7
call edi
test eax, eax
je 0x41c8d4
cmp byte [ebp - 3], 0x3a
jne 0x41c8d4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c8fe
call edi
test eax, eax
je 0x41c8fe
cmp byte [ebp - 3], 0x3a
jne 0x41c8fe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c92c
cmp byte [ebp - 3], 0x3a
jne 0x41c92c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c966
call edi
test eax, eax
je 0x41c953
cmp byte [ebp - 3], 0x3a
jne 0x41c953
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c97d
call edi
test eax, eax
je 0x41c97d
cmp byte [ebp - 3], 0x3a
jne 0x41c97d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x60]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41c9a6
cmp byte [ebp - 3], 0x3a
jne 0x41c9a6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41c9e0
call edi
test eax, eax
je 0x41c9cd
cmp byte [ebp - 3], 0x3a
jne 0x41c9cd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41c9f7
call edi
test eax, eax
je 0x41c9f7
cmp byte [ebp - 3], 0x3a
jne 0x41c9f7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ca19
cmp byte [ebp - 3], 0x3a
jne 0x41ca19
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ca53
call edi
test eax, eax
je 0x41ca40
cmp byte [ebp - 3], 0x3a
jne 0x41ca40
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ca6a
call edi
test eax, eax
je 0x41ca6a
cmp byte [ebp - 3], 0x3a
jne 0x41ca6a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41ca93
cmp byte [ebp - 3], 0x3a
jne 0x41ca93
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41cacd
call edi
test eax, eax
je 0x41caba
cmp byte [ebp - 3], 0x3a
jne 0x41caba
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41cae4
call edi
test eax, eax
je 0x41cae4
cmp byte [ebp - 3], 0x3a
jne 0x41cae4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41cb0e
cmp byte [ebp - 3], 0x3a
jne 0x41cb0e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41cb48
call edi
test eax, eax
je 0x41cb35
cmp byte [ebp - 3], 0x3a
jne 0x41cb35
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41cb5f
call edi
test eax, eax
je 0x41cb5f
cmp byte [ebp - 3], 0x3a
jne 0x41cb5f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
call dword [eax + 0x7c]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41cb8a
cmp byte [ebp - 3], 0x3a
jne 0x41cb8a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41cbc4
call edi
test eax, eax
je 0x41cbb1
cmp byte [ebp - 3], 0x3a
jne 0x41cbb1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41cbdb
call edi
test eax, eax
je 0x41cbdb
cmp byte [ebp - 3], 0x3a
jne 0x41cbdb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret