Function at 0x41d698
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b0
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x41e347
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41d6db
cmp byte [ebp - 3], 0x3a
jne 0x41d6db
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d71b
call edi
test eax, eax
je 0x41d708
cmp byte [ebp - 3], 0x3a
jne 0x41d708
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41d732
call edi
test eax, eax
je 0x41d732
cmp byte [ebp - 3], 0x3a
jne 0x41d732
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41d74d
cmp byte [ebp - 3], 0x3a
jne 0x41d74d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d787
call edi
test eax, eax
je 0x41d774
cmp byte [ebp - 3], 0x3a
jne 0x41d774
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41d79e
call edi
test eax, eax
je 0x41d79e
cmp byte [ebp - 3], 0x3a
jne 0x41d79e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41d7d1
cmp byte [ebp - 3], 0x3a
jne 0x41d7d1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d80b
call edi
test eax, eax
je 0x41d7f8
cmp byte [ebp - 3], 0x3a
jne 0x41d7f8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41d822
call edi
test eax, eax
je 0x41d822
cmp byte [ebp - 3], 0x3a
jne 0x41d822
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41d844
cmp byte [ebp - 3], 0x3a
jne 0x41d844
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d87e
call edi
test eax, eax
je 0x41d86b
cmp byte [ebp - 3], 0x3a
jne 0x41d86b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41d895
call edi
test eax, eax
je 0x41d895
cmp byte [ebp - 3], 0x3a
jne 0x41d895
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41d8b6
cmp byte [ebp - 3], 0x3a
jne 0x41d8b6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d8f0
call edi
test eax, eax
je 0x41d8dd
cmp byte [ebp - 3], 0x3a
jne 0x41d8dd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41d907
call edi
test eax, eax
je 0x41d907
cmp byte [ebp - 3], 0x3a
jne 0x41d907
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41d943
cmp byte [ebp - 3], 0x3a
jne 0x41d943
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d97d
call edi
test eax, eax
je 0x41d96a
cmp byte [ebp - 3], 0x3a
jne 0x41d96a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41d994
call edi
test eax, eax
je 0x41d994
cmp byte [ebp - 3], 0x3a
jne 0x41d994
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41d9bf
cmp byte [ebp - 3], 0x3a
jne 0x41d9bf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41d9f9
call edi
test eax, eax
je 0x41d9e6
cmp byte [ebp - 3], 0x3a
jne 0x41d9e6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41da10
call edi
test eax, eax
je 0x41da10
cmp byte [ebp - 3], 0x3a
jne 0x41da10
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41da3a
cmp byte [ebp - 3], 0x3a
jne 0x41da3a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41da74
call edi
test eax, eax
je 0x41da61
cmp byte [ebp - 3], 0x3a
jne 0x41da61
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41da8b
call edi
test eax, eax
je 0x41da8b
cmp byte [ebp - 3], 0x3a
jne 0x41da8b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41dab8
cmp byte [ebp - 3], 0x3a
jne 0x41dab8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41daf2
call edi
test eax, eax
je 0x41dadf
cmp byte [ebp - 3], 0x3a
jne 0x41dadf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41db09
call edi
test eax, eax
je 0x41db09
cmp byte [ebp - 3], 0x3a
jne 0x41db09
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41db3c
cmp byte [ebp - 3], 0x3a
jne 0x41db3c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41db76
call edi
test eax, eax
je 0x41db63
cmp byte [ebp - 3], 0x3a
jne 0x41db63
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41db8d
call edi
test eax, eax
je 0x41db8d
cmp byte [ebp - 3], 0x3a
jne 0x41db8d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41dbbc
cmp byte [ebp - 3], 0x3a
jne 0x41dbbc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dbf6
call edi
test eax, eax
je 0x41dbe3
cmp byte [ebp - 3], 0x3a
jne 0x41dbe3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41dc0d
call edi
test eax, eax
je 0x41dc0d
cmp byte [ebp - 3], 0x3a
jne 0x41dc0d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41dc2f
cmp byte [ebp - 3], 0x3a
jne 0x41dc2f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dc69
call edi
test eax, eax
je 0x41dc56
cmp byte [ebp - 3], 0x3a
jne 0x41dc56
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41dc80
call edi
test eax, eax
je 0x41dc80
cmp byte [ebp - 3], 0x3a
jne 0x41dc80
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41dca2
cmp byte [ebp - 3], 0x3a
jne 0x41dca2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dcdc
call edi
test eax, eax
je 0x41dcc9
cmp byte [ebp - 3], 0x3a
jne 0x41dcc9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41dcf3
call edi
test eax, eax
je 0x41dcf3
cmp byte [ebp - 3], 0x3a
jne 0x41dcf3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41dd1d
cmp byte [ebp - 3], 0x3a
jne 0x41dd1d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dd57
call edi
test eax, eax
je 0x41dd44
cmp byte [ebp - 3], 0x3a
jne 0x41dd44
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41dd6e
call edi
test eax, eax
je 0x41dd6e
cmp byte [ebp - 3], 0x3a
jne 0x41dd6e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41dd99
cmp byte [ebp - 3], 0x3a
jne 0x41dd99
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ddd3
call edi
test eax, eax
je 0x41ddc0
cmp byte [ebp - 3], 0x3a
jne 0x41ddc0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41ddea
call edi
test eax, eax
je 0x41ddea
cmp byte [ebp - 3], 0x3a
jne 0x41ddea
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41de15
cmp byte [ebp - 3], 0x3a
jne 0x41de15
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41de4f
call edi
test eax, eax
je 0x41de3c
cmp byte [ebp - 3], 0x3a
jne 0x41de3c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41de66
call edi
test eax, eax
je 0x41de66
cmp byte [ebp - 3], 0x3a
jne 0x41de66
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41de90
cmp byte [ebp - 3], 0x3a
jne 0x41de90
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41deca
call edi
test eax, eax
je 0x41deb7
cmp byte [ebp - 3], 0x3a
jne 0x41deb7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41dee1
call edi
test eax, eax
je 0x41dee1
cmp byte [ebp - 3], 0x3a
jne 0x41dee1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41df05
cmp byte [ebp - 3], 0x3a
jne 0x41df05
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41df3f
call edi
test eax, eax
je 0x41df2c
cmp byte [ebp - 3], 0x3a
jne 0x41df2c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41df56
call edi
test eax, eax
je 0x41df56
cmp byte [ebp - 3], 0x3a
jne 0x41df56
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41df7f
cmp byte [ebp - 3], 0x3a
jne 0x41df7f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41dfb9
call edi
test eax, eax
je 0x41dfa6
cmp byte [ebp - 3], 0x3a
jne 0x41dfa6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41dfd0
call edi
test eax, eax
je 0x41dfd0
cmp byte [ebp - 3], 0x3a
jne 0x41dfd0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41dff9
cmp byte [ebp - 3], 0x3a
jne 0x41dff9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e033
call edi
test eax, eax
je 0x41e020
cmp byte [ebp - 3], 0x3a
jne 0x41e020
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e04a
call edi
test eax, eax
je 0x41e04a
cmp byte [ebp - 3], 0x3a
jne 0x41e04a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e078
cmp byte [ebp - 3], 0x3a
jne 0x41e078
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e0b2
call edi
test eax, eax
je 0x41e09f
cmp byte [ebp - 3], 0x3a
jne 0x41e09f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e0c9
call edi
test eax, eax
je 0x41e0c9
cmp byte [ebp - 3], 0x3a
jne 0x41e0c9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e0f2
cmp byte [ebp - 3], 0x3a
jne 0x41e0f2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e12c
call edi
test eax, eax
je 0x41e119
cmp byte [ebp - 3], 0x3a
jne 0x41e119
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e143
call edi
test eax, eax
je 0x41e143
cmp byte [ebp - 3], 0x3a
jne 0x41e143
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e165
cmp byte [ebp - 3], 0x3a
jne 0x41e165
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e19f
call edi
test eax, eax
je 0x41e18c
cmp byte [ebp - 3], 0x3a
jne 0x41e18c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e1b6
call edi
test eax, eax
je 0x41e1b6
cmp byte [ebp - 3], 0x3a
jne 0x41e1b6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e1df
cmp byte [ebp - 3], 0x3a
jne 0x41e1df
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e219
call edi
test eax, eax
je 0x41e206
cmp byte [ebp - 3], 0x3a
jne 0x41e206
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e230
call edi
test eax, eax
je 0x41e230
cmp byte [ebp - 3], 0x3a
jne 0x41e230
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e25a
cmp byte [ebp - 3], 0x3a
jne 0x41e25a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e294
call edi
test eax, eax
je 0x41e281
cmp byte [ebp - 3], 0x3a
jne 0x41e281
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e2ab
call edi
test eax, eax
je 0x41e2ab
cmp byte [ebp - 3], 0x3a
jne 0x41e2ab
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x41e2d6
cmp byte [ebp - 3], 0x3a
jne 0x41e2d6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e310
call edi
test eax, eax
je 0x41e2fd
cmp byte [ebp - 3], 0x3a
jne 0x41e2fd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x41e327
call edi
test eax, eax
je 0x41e327
cmp byte [ebp - 3], 0x3a
jne 0x41e327
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push ebx
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x110]
push esi
push eax
mov eax, dword [0x4503d0]
push ebx
call dword [eax + 0x74]
mov eax, dword [0x4503d0]
push 1
push ebx
push 0x2e
pop edi
lea ecx, [ebp - 0x110]
push edi
push ecx
lea esi, [eax + 0x21c]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call dword [esi]
add esp, 0xc
lea eax, [ebp - 0x2dc]
push ebx
push 0x65
pop esi
push esi
push 0x78
push esi
push edi
push 0x73
push 0x25
push eax
call fcn.0041591e
add esp, 0x20
lea eax, [ebp - 0x340]
push ebx
push 0x6b
push 0x61
push 0x62
push edi
push 0x73
push 0x25
push eax
call fcn.0041591e
add esp, 0x20
lea eax, [ebp - 0x278]
push ebx
push 0x70
push 0x6d
push esi
push 0x74
push edi
push 0x73
push 0x25
push eax
call fcn.0041591e
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x214]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1dc]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x4a8]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1e8]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x5ac]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1dc]
add esp, 0x44
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x6b0]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1dc]
mov edi, dword [ebp - 0xc]
add esp, 0xc
lea eax, [ebp - 0x5ac]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0041e55e
test eax, eax
je 0x41e557
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.0041e55e
test eax, eax
je 0x41e557
push ebx
push 0x6e
push esi
push 0x70
lea eax, [ebp - 0x3a4]
push 0x6f
push eax
call fcn.0041591e
add esp, 0x18
lea eax, [ebp - 0x214]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x3a4]
push eax
mov eax, dword [0x4503d0]
push ebx
call dword [eax + 0x118]
mov eax, dword [0x4503d0]
push 0x64
call dword [eax + 0x3c]
lea eax, [ebp - 0x4a8]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0041e55e
test eax, eax
je 0x41e557
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x5ac]
push eax
call fcn.0041e55e
test eax, eax
je 0x41e557
push ebx
push 0x80
push 2
push ebx
push 1
lea eax, [ebp - 0x6b0]
push 0x40000000
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x50]
cmp eax, 0xffffffff
je 0x41e557
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x44]
lea eax, [ebp - 0x6b0]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x40]
pop edi
pop esi
pop ebx
leave
ret 8