Function at 0x41f39c
Capabilities:
Allocate thread local storage
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Get hostname
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push esi
push edi
test eax, eax
mov dword [ecx], 0x43f128
jne 0x41fcff
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f406
call esi
test eax, eax
je 0x41f3f3
cmp byte [ebp - 3], 0x3a
jne 0x41f3f3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f41d
call esi
test eax, eax
je 0x41f41d
cmp byte [ebp - 3], 0x3a
jne 0x41f41d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f45e
call esi
test eax, eax
je 0x41f44b
cmp byte [ebp - 3], 0x3a
jne 0x41f44b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f475
call esi
test eax, eax
je 0x41f475
cmp byte [ebp - 3], 0x3a
jne 0x41f475
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f4b8
call esi
test eax, eax
je 0x41f4a5
cmp byte [ebp - 3], 0x3a
jne 0x41f4a5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f4cf
call esi
test eax, eax
je 0x41f4cf
cmp byte [ebp - 3], 0x3a
jne 0x41f4cf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f512
call esi
test eax, eax
je 0x41f4ff
cmp byte [ebp - 3], 0x3a
jne 0x41f4ff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f529
call esi
test eax, eax
je 0x41f529
cmp byte [ebp - 3], 0x3a
jne 0x41f529
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f56b
call esi
test eax, eax
je 0x41f558
cmp byte [ebp - 3], 0x3a
jne 0x41f558
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f582
call esi
test eax, eax
je 0x41f582
cmp byte [ebp - 3], 0x3a
jne 0x41f582
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f5c3
call esi
test eax, eax
je 0x41f5b0
cmp byte [ebp - 3], 0x3a
jne 0x41f5b0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f5da
call esi
test eax, eax
je 0x41f5da
cmp byte [ebp - 3], 0x3a
jne 0x41f5da
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f61f
call esi
test eax, eax
je 0x41f60c
cmp byte [ebp - 3], 0x3a
jne 0x41f60c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f636
call esi
test eax, eax
je 0x41f636
cmp byte [ebp - 3], 0x3a
jne 0x41f636
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f677
call esi
test eax, eax
je 0x41f664
cmp byte [ebp - 3], 0x3a
jne 0x41f664
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f68e
call esi
test eax, eax
je 0x41f68e
cmp byte [ebp - 3], 0x3a
jne 0x41f68e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f6cf
call esi
test eax, eax
je 0x41f6bc
cmp byte [ebp - 3], 0x3a
jne 0x41f6bc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f6e6
call esi
test eax, eax
je 0x41f6e6
cmp byte [ebp - 3], 0x3a
jne 0x41f6e6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f728
call esi
test eax, eax
je 0x41f715
cmp byte [ebp - 3], 0x3a
jne 0x41f715
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f73f
call esi
test eax, eax
je 0x41f73f
cmp byte [ebp - 3], 0x3a
jne 0x41f73f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f780
call esi
test eax, eax
je 0x41f76d
cmp byte [ebp - 3], 0x3a
jne 0x41f76d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f797
call esi
test eax, eax
je 0x41f797
cmp byte [ebp - 3], 0x3a
jne 0x41f797
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f7d8
call esi
test eax, eax
je 0x41f7c5
cmp byte [ebp - 3], 0x3a
jne 0x41f7c5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f7ef
call esi
test eax, eax
je 0x41f7ef
cmp byte [ebp - 3], 0x3a
jne 0x41f7ef
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f834
call esi
test eax, eax
je 0x41f821
cmp byte [ebp - 3], 0x3a
jne 0x41f821
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f84b
call esi
test eax, eax
je 0x41f84b
cmp byte [ebp - 3], 0x3a
jne 0x41f84b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f88d
call esi
test eax, eax
je 0x41f87a
cmp byte [ebp - 3], 0x3a
jne 0x41f87a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f8a4
call esi
test eax, eax
je 0x41f8a4
cmp byte [ebp - 3], 0x3a
jne 0x41f8a4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f8e8
call esi
test eax, eax
je 0x41f8d5
cmp byte [ebp - 3], 0x3a
jne 0x41f8d5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f8ff
call esi
test eax, eax
je 0x41f8ff
cmp byte [ebp - 3], 0x3a
jne 0x41f8ff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f941
call esi
test eax, eax
je 0x41f92e
cmp byte [ebp - 3], 0x3a
jne 0x41f92e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f958
call esi
test eax, eax
je 0x41f958
cmp byte [ebp - 3], 0x3a
jne 0x41f958
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f99b
call esi
test eax, eax
je 0x41f988
cmp byte [ebp - 3], 0x3a
jne 0x41f988
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41f9b2
call esi
test eax, eax
je 0x41f9b2
cmp byte [ebp - 3], 0x3a
jne 0x41f9b2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41f9f3
call esi
test eax, eax
je 0x41f9e0
cmp byte [ebp - 3], 0x3a
jne 0x41f9e0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fa0a
call esi
test eax, eax
je 0x41fa0a
cmp byte [ebp - 3], 0x3a
jne 0x41fa0a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fa4b
call esi
test eax, eax
je 0x41fa38
cmp byte [ebp - 3], 0x3a
jne 0x41fa38
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fa62
call esi
test eax, eax
je 0x41fa62
cmp byte [ebp - 3], 0x3a
jne 0x41fa62
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41faa3
call esi
test eax, eax
je 0x41fa90
cmp byte [ebp - 3], 0x3a
jne 0x41fa90
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41faba
call esi
test eax, eax
je 0x41faba
cmp byte [ebp - 3], 0x3a
jne 0x41faba
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fafc
call esi
test eax, eax
je 0x41fae9
cmp byte [ebp - 3], 0x3a
jne 0x41fae9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fb13
call esi
test eax, eax
je 0x41fb13
cmp byte [ebp - 3], 0x3a
jne 0x41fb13
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fb54
call esi
test eax, eax
je 0x41fb41
cmp byte [ebp - 3], 0x3a
jne 0x41fb41
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fb6b
call esi
test eax, eax
je 0x41fb6b
cmp byte [ebp - 3], 0x3a
jne 0x41fb6b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fbac
call esi
test eax, eax
je 0x41fb99
cmp byte [ebp - 3], 0x3a
jne 0x41fb99
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fbc3
call esi
test eax, eax
je 0x41fbc3
cmp byte [ebp - 3], 0x3a
jne 0x41fbc3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fc05
call esi
test eax, eax
je 0x41fbf2
cmp byte [ebp - 3], 0x3a
jne 0x41fbf2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fc1c
call esi
test eax, eax
je 0x41fc1c
cmp byte [ebp - 3], 0x3a
jne 0x41fc1c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fc5f
call esi
test eax, eax
je 0x41fc4c
cmp byte [ebp - 3], 0x3a
jne 0x41fc4c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fc76
call esi
test eax, eax
je 0x41fc76
cmp byte [ebp - 3], 0x3a
jne 0x41fc76
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41fce8
call esi
test eax, eax
je 0x41fcd5
cmp byte [ebp - 3], 0x3a
jne 0x41fcd5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call edi
jmp 0x41fcff
call esi
test eax, eax
je 0x41fcff
cmp byte [ebp - 3], 0x3a
jne 0x41fcff
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
pop edi
pop esi
pop ebx
leave
ret