Function at 0x40f261
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x44c7ac
call fcn.0044bd20
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x1c]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], esi
test eax, eax
jne 0x410012
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f2a9
cmp byte [ebp - 0xf], 0x3a
jne 0x40f2a9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f2ea
call edi
test eax, eax
je 0x40f2d7
cmp byte [ebp - 0xf], 0x3a
jne 0x40f2d7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f301
call edi
test eax, eax
je 0x40f301
cmp byte [ebp - 0xf], 0x3a
jne 0x40f301
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f31c
cmp byte [ebp - 0xf], 0x3a
jne 0x40f31c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f356
call edi
test eax, eax
je 0x40f343
cmp byte [ebp - 0xf], 0x3a
jne 0x40f343
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f36d
call edi
test eax, eax
je 0x40f36d
cmp byte [ebp - 0xf], 0x3a
jne 0x40f36d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f3a0
cmp byte [ebp - 0xf], 0x3a
jne 0x40f3a0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f3da
call edi
test eax, eax
je 0x40f3c7
cmp byte [ebp - 0xf], 0x3a
jne 0x40f3c7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f3f1
call edi
test eax, eax
je 0x40f3f1
cmp byte [ebp - 0xf], 0x3a
jne 0x40f3f1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f418
cmp byte [ebp - 0xf], 0x3a
jne 0x40f418
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f452
call edi
test eax, eax
je 0x40f43f
cmp byte [ebp - 0xf], 0x3a
jne 0x40f43f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f469
call edi
test eax, eax
je 0x40f469
cmp byte [ebp - 0xf], 0x3a
jne 0x40f469
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f48b
cmp byte [ebp - 0xf], 0x3a
jne 0x40f48b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f4c5
call edi
test eax, eax
je 0x40f4b2
cmp byte [ebp - 0xf], 0x3a
jne 0x40f4b2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f4dc
call edi
test eax, eax
je 0x40f4dc
cmp byte [ebp - 0xf], 0x3a
jne 0x40f4dc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f4fe
cmp byte [ebp - 0xf], 0x3a
jne 0x40f4fe
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f538
call edi
test eax, eax
je 0x40f525
cmp byte [ebp - 0xf], 0x3a
jne 0x40f525
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f54f
call edi
test eax, eax
je 0x40f54f
cmp byte [ebp - 0xf], 0x3a
jne 0x40f54f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f57d
cmp byte [ebp - 0xf], 0x3a
jne 0x40f57d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f5b7
call edi
test eax, eax
je 0x40f5a4
cmp byte [ebp - 0xf], 0x3a
jne 0x40f5a4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f5ce
call edi
test eax, eax
je 0x40f5ce
cmp byte [ebp - 0xf], 0x3a
jne 0x40f5ce
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f60a
cmp byte [ebp - 0xf], 0x3a
jne 0x40f60a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f644
call edi
test eax, eax
je 0x40f631
cmp byte [ebp - 0xf], 0x3a
jne 0x40f631
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f65b
call edi
test eax, eax
je 0x40f65b
cmp byte [ebp - 0xf], 0x3a
jne 0x40f65b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f686
cmp byte [ebp - 0xf], 0x3a
jne 0x40f686
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f6c0
call edi
test eax, eax
je 0x40f6ad
cmp byte [ebp - 0xf], 0x3a
jne 0x40f6ad
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f6d7
call edi
test eax, eax
je 0x40f6d7
cmp byte [ebp - 0xf], 0x3a
jne 0x40f6d7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f701
cmp byte [ebp - 0xf], 0x3a
jne 0x40f701
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f73b
call edi
test eax, eax
je 0x40f728
cmp byte [ebp - 0xf], 0x3a
jne 0x40f728
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f752
call edi
test eax, eax
je 0x40f752
cmp byte [ebp - 0xf], 0x3a
jne 0x40f752
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f77f
cmp byte [ebp - 0xf], 0x3a
jne 0x40f77f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f7b9
call edi
test eax, eax
je 0x40f7a6
cmp byte [ebp - 0xf], 0x3a
jne 0x40f7a6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f7d0
call edi
test eax, eax
je 0x40f7d0
cmp byte [ebp - 0xf], 0x3a
jne 0x40f7d0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f803
cmp byte [ebp - 0xf], 0x3a
jne 0x40f803
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f83d
call edi
test eax, eax
je 0x40f82a
cmp byte [ebp - 0xf], 0x3a
jne 0x40f82a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f854
call edi
test eax, eax
je 0x40f854
cmp byte [ebp - 0xf], 0x3a
jne 0x40f854
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f883
cmp byte [ebp - 0xf], 0x3a
jne 0x40f883
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f8bd
call edi
test eax, eax
je 0x40f8aa
cmp byte [ebp - 0xf], 0x3a
jne 0x40f8aa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f8d4
call edi
test eax, eax
je 0x40f8d4
cmp byte [ebp - 0xf], 0x3a
jne 0x40f8d4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f8f6
cmp byte [ebp - 0xf], 0x3a
jne 0x40f8f6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f930
call edi
test eax, eax
je 0x40f91d
cmp byte [ebp - 0xf], 0x3a
jne 0x40f91d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f947
call edi
test eax, eax
je 0x40f947
cmp byte [ebp - 0xf], 0x3a
jne 0x40f947
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f969
cmp byte [ebp - 0xf], 0x3a
jne 0x40f969
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40f9a3
call edi
test eax, eax
je 0x40f990
cmp byte [ebp - 0xf], 0x3a
jne 0x40f990
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40f9ba
call edi
test eax, eax
je 0x40f9ba
cmp byte [ebp - 0xf], 0x3a
jne 0x40f9ba
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40f9e4
cmp byte [ebp - 0xf], 0x3a
jne 0x40f9e4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fa1e
call edi
test eax, eax
je 0x40fa0b
cmp byte [ebp - 0xf], 0x3a
jne 0x40fa0b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fa35
call edi
test eax, eax
je 0x40fa35
cmp byte [ebp - 0xf], 0x3a
jne 0x40fa35
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fa60
cmp byte [ebp - 0xf], 0x3a
jne 0x40fa60
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fa9a
call edi
test eax, eax
je 0x40fa87
cmp byte [ebp - 0xf], 0x3a
jne 0x40fa87
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fab1
call edi
test eax, eax
je 0x40fab1
cmp byte [ebp - 0xf], 0x3a
jne 0x40fab1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fadc
cmp byte [ebp - 0xf], 0x3a
jne 0x40fadc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fb16
call edi
test eax, eax
je 0x40fb03
cmp byte [ebp - 0xf], 0x3a
jne 0x40fb03
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fb2d
call edi
test eax, eax
je 0x40fb2d
cmp byte [ebp - 0xf], 0x3a
jne 0x40fb2d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fb57
cmp byte [ebp - 0xf], 0x3a
jne 0x40fb57
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fb91
call edi
test eax, eax
je 0x40fb7e
cmp byte [ebp - 0xf], 0x3a
jne 0x40fb7e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fba8
call edi
test eax, eax
je 0x40fba8
cmp byte [ebp - 0xf], 0x3a
jne 0x40fba8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fbcc
cmp byte [ebp - 0xf], 0x3a
jne 0x40fbcc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fc06
call edi
test eax, eax
je 0x40fbf3
cmp byte [ebp - 0xf], 0x3a
jne 0x40fbf3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fc1d
call edi
test eax, eax
je 0x40fc1d
cmp byte [ebp - 0xf], 0x3a
jne 0x40fc1d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fc46
cmp byte [ebp - 0xf], 0x3a
jne 0x40fc46
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fc80
call edi
test eax, eax
je 0x40fc6d
cmp byte [ebp - 0xf], 0x3a
jne 0x40fc6d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fc97
call edi
test eax, eax
je 0x40fc97
cmp byte [ebp - 0xf], 0x3a
jne 0x40fc97
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fcc0
cmp byte [ebp - 0xf], 0x3a
jne 0x40fcc0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fcfa
call edi
test eax, eax
je 0x40fce7
cmp byte [ebp - 0xf], 0x3a
jne 0x40fce7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fd11
call edi
test eax, eax
je 0x40fd11
cmp byte [ebp - 0xf], 0x3a
jne 0x40fd11
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fd3f
cmp byte [ebp - 0xf], 0x3a
jne 0x40fd3f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fd79
call edi
test eax, eax
je 0x40fd66
cmp byte [ebp - 0xf], 0x3a
jne 0x40fd66
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fd90
call edi
test eax, eax
je 0x40fd90
cmp byte [ebp - 0xf], 0x3a
jne 0x40fd90
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fdb9
cmp byte [ebp - 0xf], 0x3a
jne 0x40fdb9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fdf3
call edi
test eax, eax
je 0x40fde0
cmp byte [ebp - 0xf], 0x3a
jne 0x40fde0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fe0a
call edi
test eax, eax
je 0x40fe0a
cmp byte [ebp - 0xf], 0x3a
jne 0x40fe0a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fe2c
cmp byte [ebp - 0xf], 0x3a
jne 0x40fe2c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fe66
call edi
test eax, eax
je 0x40fe53
cmp byte [ebp - 0xf], 0x3a
jne 0x40fe53
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fe7d
call edi
test eax, eax
je 0x40fe7d
cmp byte [ebp - 0xf], 0x3a
jne 0x40fe7d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40fea6
cmp byte [ebp - 0xf], 0x3a
jne 0x40fea6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40fee0
call edi
test eax, eax
je 0x40fecd
cmp byte [ebp - 0xf], 0x3a
jne 0x40fecd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40fef7
call edi
test eax, eax
je 0x40fef7
cmp byte [ebp - 0xf], 0x3a
jne 0x40fef7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ff21
cmp byte [ebp - 0xf], 0x3a
jne 0x40ff21
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ff5b
call edi
test eax, eax
je 0x40ff48
cmp byte [ebp - 0xf], 0x3a
jne 0x40ff48
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ff72
call edi
test eax, eax
je 0x40ff72
cmp byte [ebp - 0xf], 0x3a
jne 0x40ff72
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ff9d
cmp byte [ebp - 0xf], 0x3a
jne 0x40ff9d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ffd7
call edi
test eax, eax
je 0x40ffc4
cmp byte [ebp - 0xf], 0x3a
jne 0x40ffc4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ffee
call edi
test eax, eax
je 0x40ffee
cmp byte [ebp - 0xf], 0x3a
jne 0x40ffee
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, dword [ebp - 0x1c]
pop edi
lea ecx, [ebp - 0x18]
call fcn.004391aa
push 0x100000
push 0x400
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.004391ee
push eax
lea eax, [esi + 0x118]
push dword [esi + 0x19118]
mov ecx, esi
push eax
lea eax, [esi + 4]
push dword [esi + 0x10c]
push dword [esi + 0x108]
push eax
call fcn.00411dae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004391cf
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret