Function at 0x428682
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x429423
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4286bf
cmp byte [ebp - 3], 0x3a
jne 0x4286bf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4286ff
call edi
test eax, eax
je 0x4286ec
cmp byte [ebp - 3], 0x3a
jne 0x4286ec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428716
call edi
test eax, eax
je 0x428716
cmp byte [ebp - 3], 0x3a
jne 0x428716
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428731
cmp byte [ebp - 3], 0x3a
jne 0x428731
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42876b
call edi
test eax, eax
je 0x428758
cmp byte [ebp - 3], 0x3a
jne 0x428758
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428782
call edi
test eax, eax
je 0x428782
cmp byte [ebp - 3], 0x3a
jne 0x428782
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4287b5
cmp byte [ebp - 3], 0x3a
jne 0x4287b5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4287ef
call edi
test eax, eax
je 0x4287dc
cmp byte [ebp - 3], 0x3a
jne 0x4287dc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428806
call edi
test eax, eax
je 0x428806
cmp byte [ebp - 3], 0x3a
jne 0x428806
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42882d
cmp byte [ebp - 3], 0x3a
jne 0x42882d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428867
call edi
test eax, eax
je 0x428854
cmp byte [ebp - 3], 0x3a
jne 0x428854
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42887e
call edi
test eax, eax
je 0x42887e
cmp byte [ebp - 3], 0x3a
jne 0x42887e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4288a0
cmp byte [ebp - 3], 0x3a
jne 0x4288a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4288da
call edi
test eax, eax
je 0x4288c7
cmp byte [ebp - 3], 0x3a
jne 0x4288c7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4288f1
call edi
test eax, eax
je 0x4288f1
cmp byte [ebp - 3], 0x3a
jne 0x4288f1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428913
cmp byte [ebp - 3], 0x3a
jne 0x428913
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42894d
call edi
test eax, eax
je 0x42893a
cmp byte [ebp - 3], 0x3a
jne 0x42893a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428964
call edi
test eax, eax
je 0x428964
cmp byte [ebp - 3], 0x3a
jne 0x428964
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428992
cmp byte [ebp - 3], 0x3a
jne 0x428992
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4289cc
call edi
test eax, eax
je 0x4289b9
cmp byte [ebp - 3], 0x3a
jne 0x4289b9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4289e3
call edi
test eax, eax
je 0x4289e3
cmp byte [ebp - 3], 0x3a
jne 0x4289e3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428a1f
cmp byte [ebp - 3], 0x3a
jne 0x428a1f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428a59
call edi
test eax, eax
je 0x428a46
cmp byte [ebp - 3], 0x3a
jne 0x428a46
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428a70
call edi
test eax, eax
je 0x428a70
cmp byte [ebp - 3], 0x3a
jne 0x428a70
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428a9b
cmp byte [ebp - 3], 0x3a
jne 0x428a9b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428ad5
call edi
test eax, eax
je 0x428ac2
cmp byte [ebp - 3], 0x3a
jne 0x428ac2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428aec
call edi
test eax, eax
je 0x428aec
cmp byte [ebp - 3], 0x3a
jne 0x428aec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428b16
cmp byte [ebp - 3], 0x3a
jne 0x428b16
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428b50
call edi
test eax, eax
je 0x428b3d
cmp byte [ebp - 3], 0x3a
jne 0x428b3d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428b67
call edi
test eax, eax
je 0x428b67
cmp byte [ebp - 3], 0x3a
jne 0x428b67
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428b94
cmp byte [ebp - 3], 0x3a
jne 0x428b94
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428bce
call edi
test eax, eax
je 0x428bbb
cmp byte [ebp - 3], 0x3a
jne 0x428bbb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428be5
call edi
test eax, eax
je 0x428be5
cmp byte [ebp - 3], 0x3a
jne 0x428be5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428c18
cmp byte [ebp - 3], 0x3a
jne 0x428c18
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428c52
call edi
test eax, eax
je 0x428c3f
cmp byte [ebp - 3], 0x3a
jne 0x428c3f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428c69
call edi
test eax, eax
je 0x428c69
cmp byte [ebp - 3], 0x3a
jne 0x428c69
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428c98
cmp byte [ebp - 3], 0x3a
jne 0x428c98
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428cd2
call edi
test eax, eax
je 0x428cbf
cmp byte [ebp - 3], 0x3a
jne 0x428cbf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428ce9
call edi
test eax, eax
je 0x428ce9
cmp byte [ebp - 3], 0x3a
jne 0x428ce9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428d0b
cmp byte [ebp - 3], 0x3a
jne 0x428d0b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428d45
call edi
test eax, eax
je 0x428d32
cmp byte [ebp - 3], 0x3a
jne 0x428d32
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428d5c
call edi
test eax, eax
je 0x428d5c
cmp byte [ebp - 3], 0x3a
jne 0x428d5c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428d7e
cmp byte [ebp - 3], 0x3a
jne 0x428d7e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428db8
call edi
test eax, eax
je 0x428da5
cmp byte [ebp - 3], 0x3a
jne 0x428da5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428dcf
call edi
test eax, eax
je 0x428dcf
cmp byte [ebp - 3], 0x3a
jne 0x428dcf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428df9
cmp byte [ebp - 3], 0x3a
jne 0x428df9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428e33
call edi
test eax, eax
je 0x428e20
cmp byte [ebp - 3], 0x3a
jne 0x428e20
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428e4a
call edi
test eax, eax
je 0x428e4a
cmp byte [ebp - 3], 0x3a
jne 0x428e4a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428e75
cmp byte [ebp - 3], 0x3a
jne 0x428e75
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428eaf
call edi
test eax, eax
je 0x428e9c
cmp byte [ebp - 3], 0x3a
jne 0x428e9c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428ec6
call edi
test eax, eax
je 0x428ec6
cmp byte [ebp - 3], 0x3a
jne 0x428ec6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428ef1
cmp byte [ebp - 3], 0x3a
jne 0x428ef1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428f2b
call edi
test eax, eax
je 0x428f18
cmp byte [ebp - 3], 0x3a
jne 0x428f18
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428f42
call edi
test eax, eax
je 0x428f42
cmp byte [ebp - 3], 0x3a
jne 0x428f42
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428f6c
cmp byte [ebp - 3], 0x3a
jne 0x428f6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428fa6
call edi
test eax, eax
je 0x428f93
cmp byte [ebp - 3], 0x3a
jne 0x428f93
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428fbd
call edi
test eax, eax
je 0x428fbd
cmp byte [ebp - 3], 0x3a
jne 0x428fbd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428fe1
cmp byte [ebp - 3], 0x3a
jne 0x428fe1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42901b
call edi
test eax, eax
je 0x429008
cmp byte [ebp - 3], 0x3a
jne 0x429008
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x429032
call edi
test eax, eax
je 0x429032
cmp byte [ebp - 3], 0x3a
jne 0x429032
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42905b
cmp byte [ebp - 3], 0x3a
jne 0x42905b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x429095
call edi
test eax, eax
je 0x429082
cmp byte [ebp - 3], 0x3a
jne 0x429082
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4290ac
call edi
test eax, eax
je 0x4290ac
cmp byte [ebp - 3], 0x3a
jne 0x4290ac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4290d5
cmp byte [ebp - 3], 0x3a
jne 0x4290d5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42910f
call edi
test eax, eax
je 0x4290fc
cmp byte [ebp - 3], 0x3a
jne 0x4290fc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x429126
call edi
test eax, eax
je 0x429126
cmp byte [ebp - 3], 0x3a
jne 0x429126
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x429154
cmp byte [ebp - 3], 0x3a
jne 0x429154
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42918e
call edi
test eax, eax
je 0x42917b
cmp byte [ebp - 3], 0x3a
jne 0x42917b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4291a5
call edi
test eax, eax
je 0x4291a5
cmp byte [ebp - 3], 0x3a
jne 0x4291a5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4291ce
cmp byte [ebp - 3], 0x3a
jne 0x4291ce
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x429208
call edi
test eax, eax
je 0x4291f5
cmp byte [ebp - 3], 0x3a
jne 0x4291f5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42921f
call edi
test eax, eax
je 0x42921f
cmp byte [ebp - 3], 0x3a
jne 0x42921f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x429241
cmp byte [ebp - 3], 0x3a
jne 0x429241
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42927b
call edi
test eax, eax
je 0x429268
cmp byte [ebp - 3], 0x3a
jne 0x429268
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x429292
call edi
test eax, eax
je 0x429292
cmp byte [ebp - 3], 0x3a
jne 0x429292
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4292bb
cmp byte [ebp - 3], 0x3a
jne 0x4292bb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4292f5
call edi
test eax, eax
je 0x4292e2
cmp byte [ebp - 3], 0x3a
jne 0x4292e2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42930c
call edi
test eax, eax
je 0x42930c
cmp byte [ebp - 3], 0x3a
jne 0x42930c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x429336
cmp byte [ebp - 3], 0x3a
jne 0x429336
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x429370
call edi
test eax, eax
je 0x42935d
cmp byte [ebp - 3], 0x3a
jne 0x42935d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x429387
call edi
test eax, eax
je 0x429387
cmp byte [ebp - 3], 0x3a
jne 0x429387
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4293b2
cmp byte [ebp - 3], 0x3a
jne 0x4293b2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4293ec
call edi
test eax, eax
je 0x4293d9
cmp byte [ebp - 3], 0x3a
jne 0x4293d9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x429403
call edi
test eax, eax
je 0x429403
cmp byte [ebp - 3], 0x3a
jne 0x429403
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
push 0x70
push 0x6f
push 0x74
push 0x6b
push 0x73
push 0x65
lea eax, [ebp - 0x6c]
push 0x64
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e0]
add esp, 0x2c
test eax, eax
jne 0x42945b
xor eax, eax
jmp 0x4299d9
push ebx
push 0xe6
push 0xc3
push 0xc0
lea eax, [ebp - 0x6c]
push 0xd7
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e0]
add esp, 0x20
test eax, eax
je 0x429454
push ebx
push 0x5c
pop esi
lea eax, [ebp - 0x6c]
push esi
push 0x70
push 0x6d
push 0x65
push 0x74
push esi
push eax
call fcn.004171ee
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x28
test eax, eax
jne 0x429454
push ebx
push esi
push 0x73
push 0x77
push 0x6f
push 0x64
push 0x6e
push 0x69
push 0x77
push esi
lea eax, [ebp - 0x6c]
push 0x3a
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x38
test eax, eax
jne 0x429454
push ebx
push 0x66
push 0x65
push 0x69
push 0x68
push 0x74
push 0x74
push 0x65
lea eax, [ebp - 0x6c]
push 0x6e
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x429454
push ebx
push 0x72
push 0x65
push 0x64
push 0x6e
push 0x69
push 0x62
push 0x65
push 0x78
lea eax, [ebp - 0x6c]
push 0x65
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x34
test eax, eax
jne 0x429454
push ebx
push 0x71
push 0x71
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x1c
test eax, eax
jne 0x429454
push ebx
push 0x6f
push 0x69
push 0x64
push 0x75
push 0x74
push 0x73
push 0x20
push 0x6c
push 0x61
push 0x75
push 0x73
push 0x69
lea eax, [ebp - 0x6c]
push 0x76
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x44
test eax, eax
jne 0x429454
push ebx
push esi
push 0x65
push 0x63
push 0x69
push 0x66
push 0x66
push 0x6f
push 0x20
push 0x74
push 0x66
push 0x6f
push 0x73
push 0x6f
push 0x72
push 0x63
push 0x69
push 0x6d
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x58
test eax, eax
jne 0x429454
push ebx
push esi
push 0x72
push 0x65
push 0x64
push 0x6e
push 0x75
push 0x68
push 0x74
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x34
test eax, eax
jne 0x429454
push ebx
push esi
push 0x30
push 0x36
push 0x33
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x24
test eax, eax
jne 0x429454
push ebx
push esi
push 0x67
push 0x6e
push 0x61
push 0x77
push 0x67
push 0x6e
push 0x61
push 0x77
push 0x69
push 0x6c
push 0x61
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x44
test eax, eax
jne 0x429454
push ebx
push esi
push 0x72
push 0x65
pop eax
push eax
push 0x72
push 0x6f
push 0x6c
push 0x70
push 0x78
push eax
push 0x20
push 0x74
push eax
push 0x6e
push 0x72
push eax
push 0x74
push 0x6e
push 0x69
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x5c
test eax, eax
jne 0x429454
push ebx
push esi
push 0x73
push 0x73
push 0x65
push 0x72
push 0x70
push 0x78
push 0x65
push 0x20
push 0x6b
push 0x6f
push 0x6f
push 0x6c
push 0x74
push 0x75
push 0x6f
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x54
test eax, eax
jne 0x429454
push ebx
push esi
push 0x72
push 0x65
push 0x76
push 0x72
push 0x65
push 0x73
push 0x20
push 0x6c
push 0x71
push 0x73
push 0x20
push 0x74
push 0x66
push 0x6f
push 0x73
push 0x6f
push 0x72
push 0x63
push 0x69
push 0x6d
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x68
test eax, eax
jne 0x429454
push ebx
push esi
push 0x72
push 0x65
pop eax
push eax
push 0x67
push 0x6e
push eax
push 0x73
push 0x73
push eax
push 0x6d
push esi
push eax
push 0x76
push 0x69
push 0x6c
push 0x20
push 0x73
push 0x77
push 0x6f
push 0x64
push 0x6e
push 0x69
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x70
test eax, eax
jne 0x429454
push ebx
push esi
push 0x70
push 0x69
push 0x7a
push 0x6e
push 0x69
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x429454
push ebx
push esi
push 0x72
push 0x61
push 0x72
push 0x6e
push 0x69
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x429454
push ebx
push esi
push 0x65
push 0x6d
push 0x61
push 0x67
push esi
push 0x6b
push 0x6e
push 0x69
push 0x6c
push 0x6c
push 0x61
push 0x62
push 0x6f
push 0x6c
push 0x67
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x54
test eax, eax
jne 0x429454
push ebx
push esi
push 0x72
push 0x6f
push 0x74
push 0x63
push 0x6f
push 0x64
push 0x71
push 0x71
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x38
test eax, eax
jne 0x429454
push ebx
push esi
push 0x67
push 0x6e
push 0x69
push 0x73
push 0x69
push 0x72
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x429454
push ebx
push 0x78
push 0x6f
push 0x66
push 0x65
push 0x72
push 0x69
push 0x66
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x429454
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x6d
push 0x69
push 0x69
push 0x6c
push 0x61
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x38
test eax, eax
jne 0x429454
push ebx
push esi
push 0x61
push 0x72
push 0x69
push 0x76
push 0x61
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x2c
test eax, eax
jne 0x429454
push ebx
push esi
push 0x74
push 0x66
push 0x61
push 0x72
push 0x63
push 0x72
push 0x61
push 0x77
push 0x20
push 0x66
push 0x6f
push 0x20
push 0x64
push 0x6c
push 0x72
push 0x6f
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004171ee
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x5c
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8