Function at 0x41777e
Capabilities:
Allocate thread local storage
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Get hostname
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp + 8]
push ebx
push esi
push edi
test eax, eax
jne 0x4180df
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4177e6
call esi
test eax, eax
je 0x4177d3
cmp byte [ebp - 3], 0x3a
jne 0x4177d3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4177fd
call esi
test eax, eax
je 0x4177fd
cmp byte [ebp - 3], 0x3a
jne 0x4177fd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41783e
call esi
test eax, eax
je 0x41782b
cmp byte [ebp - 3], 0x3a
jne 0x41782b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417855
call esi
test eax, eax
je 0x417855
cmp byte [ebp - 3], 0x3a
jne 0x417855
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417898
call esi
test eax, eax
je 0x417885
cmp byte [ebp - 3], 0x3a
jne 0x417885
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4178af
call esi
test eax, eax
je 0x4178af
cmp byte [ebp - 3], 0x3a
jne 0x4178af
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4178f2
call esi
test eax, eax
je 0x4178df
cmp byte [ebp - 3], 0x3a
jne 0x4178df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417909
call esi
test eax, eax
je 0x417909
cmp byte [ebp - 3], 0x3a
jne 0x417909
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41794b
call esi
test eax, eax
je 0x417938
cmp byte [ebp - 3], 0x3a
jne 0x417938
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417962
call esi
test eax, eax
je 0x417962
cmp byte [ebp - 3], 0x3a
jne 0x417962
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4179a3
call esi
test eax, eax
je 0x417990
cmp byte [ebp - 3], 0x3a
jne 0x417990
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4179ba
call esi
test eax, eax
je 0x4179ba
cmp byte [ebp - 3], 0x3a
jne 0x4179ba
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4179ff
call esi
test eax, eax
je 0x4179ec
cmp byte [ebp - 3], 0x3a
jne 0x4179ec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417a16
call esi
test eax, eax
je 0x417a16
cmp byte [ebp - 3], 0x3a
jne 0x417a16
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417a57
call esi
test eax, eax
je 0x417a44
cmp byte [ebp - 3], 0x3a
jne 0x417a44
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417a6e
call esi
test eax, eax
je 0x417a6e
cmp byte [ebp - 3], 0x3a
jne 0x417a6e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417aaf
call esi
test eax, eax
je 0x417a9c
cmp byte [ebp - 3], 0x3a
jne 0x417a9c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417ac6
call esi
test eax, eax
je 0x417ac6
cmp byte [ebp - 3], 0x3a
jne 0x417ac6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417b08
call esi
test eax, eax
je 0x417af5
cmp byte [ebp - 3], 0x3a
jne 0x417af5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417b1f
call esi
test eax, eax
je 0x417b1f
cmp byte [ebp - 3], 0x3a
jne 0x417b1f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417b60
call esi
test eax, eax
je 0x417b4d
cmp byte [ebp - 3], 0x3a
jne 0x417b4d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417b77
call esi
test eax, eax
je 0x417b77
cmp byte [ebp - 3], 0x3a
jne 0x417b77
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417bb8
call esi
test eax, eax
je 0x417ba5
cmp byte [ebp - 3], 0x3a
jne 0x417ba5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417bcf
call esi
test eax, eax
je 0x417bcf
cmp byte [ebp - 3], 0x3a
jne 0x417bcf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417c14
call esi
test eax, eax
je 0x417c01
cmp byte [ebp - 3], 0x3a
jne 0x417c01
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417c2b
call esi
test eax, eax
je 0x417c2b
cmp byte [ebp - 3], 0x3a
jne 0x417c2b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417c6d
call esi
test eax, eax
je 0x417c5a
cmp byte [ebp - 3], 0x3a
jne 0x417c5a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417c84
call esi
test eax, eax
je 0x417c84
cmp byte [ebp - 3], 0x3a
jne 0x417c84
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417cc8
call esi
test eax, eax
je 0x417cb5
cmp byte [ebp - 3], 0x3a
jne 0x417cb5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417cdf
call esi
test eax, eax
je 0x417cdf
cmp byte [ebp - 3], 0x3a
jne 0x417cdf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417d21
call esi
test eax, eax
je 0x417d0e
cmp byte [ebp - 3], 0x3a
jne 0x417d0e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417d38
call esi
test eax, eax
je 0x417d38
cmp byte [ebp - 3], 0x3a
jne 0x417d38
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417d7b
call esi
test eax, eax
je 0x417d68
cmp byte [ebp - 3], 0x3a
jne 0x417d68
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417d92
call esi
test eax, eax
je 0x417d92
cmp byte [ebp - 3], 0x3a
jne 0x417d92
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417dd3
call esi
test eax, eax
je 0x417dc0
cmp byte [ebp - 3], 0x3a
jne 0x417dc0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417dea
call esi
test eax, eax
je 0x417dea
cmp byte [ebp - 3], 0x3a
jne 0x417dea
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417e2b
call esi
test eax, eax
je 0x417e18
cmp byte [ebp - 3], 0x3a
jne 0x417e18
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417e42
call esi
test eax, eax
je 0x417e42
cmp byte [ebp - 3], 0x3a
jne 0x417e42
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417e83
call esi
test eax, eax
je 0x417e70
cmp byte [ebp - 3], 0x3a
jne 0x417e70
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417e9a
call esi
test eax, eax
je 0x417e9a
cmp byte [ebp - 3], 0x3a
jne 0x417e9a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417edc
call esi
test eax, eax
je 0x417ec9
cmp byte [ebp - 3], 0x3a
jne 0x417ec9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417ef3
call esi
test eax, eax
je 0x417ef3
cmp byte [ebp - 3], 0x3a
jne 0x417ef3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417f34
call esi
test eax, eax
je 0x417f21
cmp byte [ebp - 3], 0x3a
jne 0x417f21
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417f4b
call esi
test eax, eax
je 0x417f4b
cmp byte [ebp - 3], 0x3a
jne 0x417f4b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417f8c
call esi
test eax, eax
je 0x417f79
cmp byte [ebp - 3], 0x3a
jne 0x417f79
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417fa3
call esi
test eax, eax
je 0x417fa3
cmp byte [ebp - 3], 0x3a
jne 0x417fa3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417fe5
call esi
test eax, eax
je 0x417fd2
cmp byte [ebp - 3], 0x3a
jne 0x417fd2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x417ffc
call esi
test eax, eax
je 0x417ffc
cmp byte [ebp - 3], 0x3a
jne 0x417ffc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41803f
call esi
test eax, eax
je 0x41802c
cmp byte [ebp - 3], 0x3a
jne 0x41802c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x418056
call esi
test eax, eax
je 0x418056
cmp byte [ebp - 3], 0x3a
jne 0x418056
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4180c8
call esi
test eax, eax
je 0x4180b5
cmp byte [ebp - 3], 0x3a
jne 0x4180b5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x4180df
call esi
test eax, eax
je 0x4180df
cmp byte [ebp - 3], 0x3a
jne 0x4180df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x148]
push eax
mov eax, dword [0x4453d0]
push dword [ebp + 8]
call dword [eax + 0x64]
pop edi
pop esi
cmp eax, 0xffffffff
pop ebx
jne 0x4180fd
xor eax, eax
jmp 0x418109
push eax
mov eax, dword [0x4453d0]
call dword [eax + 0x60]
push 1
pop eax
leave
ret 4