Function at 0x42596e
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp + 8]
push ebx
push esi
push edi
test eax, eax
jne 0x426611
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4259c4
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4259c4
cmp byte [ebp - 7], 0x3a
jne 0x4259c4
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425a02
call esi
test eax, eax
je 0x4259ee
cmp byte [ebp - 3], 0x3a
jne 0x4259ee
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425a16
call esi
test eax, eax
je 0x425a16
cmp byte [ebp - 3], 0x3a
jne 0x425a16
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425a30
cmp byte [ebp - 3], 0x3a
jne 0x425a30
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425a5c
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425a5c
cmp byte [ebp - 7], 0x3a
jne 0x425a5c
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425a94
call esi
test eax, eax
je 0x425a80
cmp byte [ebp - 3], 0x3a
jne 0x425a80
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425aa8
call esi
test eax, eax
je 0x425aa8
cmp byte [ebp - 3], 0x3a
jne 0x425aa8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425ac2
cmp byte [ebp - 3], 0x3a
jne 0x425ac2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425aee
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425aee
cmp byte [ebp - 7], 0x3a
jne 0x425aee
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425b26
call esi
test eax, eax
je 0x425b12
cmp byte [ebp - 3], 0x3a
jne 0x425b12
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425b3a
call esi
test eax, eax
je 0x425b3a
cmp byte [ebp - 3], 0x3a
jne 0x425b3a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425b54
cmp byte [ebp - 3], 0x3a
jne 0x425b54
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425b8e
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425b8e
cmp byte [ebp - 7], 0x3a
jne 0x425b8e
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425bc6
call esi
test eax, eax
je 0x425bb2
cmp byte [ebp - 3], 0x3a
jne 0x425bb2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425bda
call esi
test eax, eax
je 0x425bda
cmp byte [ebp - 3], 0x3a
jne 0x425bda
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425bf4
cmp byte [ebp - 3], 0x3a
jne 0x425bf4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425c2b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425c2b
cmp byte [ebp - 7], 0x3a
jne 0x425c2b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425c63
call esi
test eax, eax
je 0x425c4f
cmp byte [ebp - 3], 0x3a
jne 0x425c4f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425c77
call esi
test eax, eax
je 0x425c77
cmp byte [ebp - 3], 0x3a
jne 0x425c77
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425c91
cmp byte [ebp - 3], 0x3a
jne 0x425c91
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425cbf
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425cbf
cmp byte [ebp - 7], 0x3a
jne 0x425cbf
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425cf7
call esi
test eax, eax
je 0x425ce3
cmp byte [ebp - 3], 0x3a
jne 0x425ce3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425d0b
call esi
test eax, eax
je 0x425d0b
cmp byte [ebp - 3], 0x3a
jne 0x425d0b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425d25
cmp byte [ebp - 3], 0x3a
jne 0x425d25
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425d59
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425d59
cmp byte [ebp - 7], 0x3a
jne 0x425d59
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425d91
call esi
test eax, eax
je 0x425d7d
cmp byte [ebp - 3], 0x3a
jne 0x425d7d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425da5
call esi
test eax, eax
je 0x425da5
cmp byte [ebp - 3], 0x3a
jne 0x425da5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425dbf
cmp byte [ebp - 3], 0x3a
jne 0x425dbf
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425ded
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425ded
cmp byte [ebp - 7], 0x3a
jne 0x425ded
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425e25
call esi
test eax, eax
je 0x425e11
cmp byte [ebp - 3], 0x3a
jne 0x425e11
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425e39
call esi
test eax, eax
je 0x425e39
cmp byte [ebp - 3], 0x3a
jne 0x425e39
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425e53
cmp byte [ebp - 3], 0x3a
jne 0x425e53
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425e7f
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425e7f
cmp byte [ebp - 7], 0x3a
jne 0x425e7f
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425eb7
call esi
test eax, eax
je 0x425ea3
cmp byte [ebp - 3], 0x3a
jne 0x425ea3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425ecb
call esi
test eax, eax
je 0x425ecb
cmp byte [ebp - 3], 0x3a
jne 0x425ecb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425ee5
cmp byte [ebp - 3], 0x3a
jne 0x425ee5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425f13
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425f13
cmp byte [ebp - 7], 0x3a
jne 0x425f13
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425f4b
call esi
test eax, eax
je 0x425f37
cmp byte [ebp - 3], 0x3a
jne 0x425f37
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425f5f
call esi
test eax, eax
je 0x425f5f
cmp byte [ebp - 3], 0x3a
jne 0x425f5f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x425f79
cmp byte [ebp - 3], 0x3a
jne 0x425f79
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x425fa3
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x425fa3
cmp byte [ebp - 7], 0x3a
jne 0x425fa3
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425fdb
call esi
test eax, eax
je 0x425fc7
cmp byte [ebp - 3], 0x3a
jne 0x425fc7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x425fef
call esi
test eax, eax
je 0x425fef
cmp byte [ebp - 3], 0x3a
jne 0x425fef
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x426009
cmp byte [ebp - 3], 0x3a
jne 0x426009
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x426038
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x426038
cmp byte [ebp - 7], 0x3a
jne 0x426038
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426070
call esi
test eax, eax
je 0x42605c
cmp byte [ebp - 3], 0x3a
jne 0x42605c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x426084
call esi
test eax, eax
je 0x426084
cmp byte [ebp - 3], 0x3a
jne 0x426084
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x42609e
cmp byte [ebp - 3], 0x3a
jne 0x42609e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4260cc
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4260cc
cmp byte [ebp - 7], 0x3a
jne 0x4260cc
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426104
call esi
test eax, eax
je 0x4260f0
cmp byte [ebp - 3], 0x3a
jne 0x4260f0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x426118
call esi
test eax, eax
je 0x426118
cmp byte [ebp - 3], 0x3a
jne 0x426118
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x426132
cmp byte [ebp - 3], 0x3a
jne 0x426132
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x426160
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x426160
cmp byte [ebp - 7], 0x3a
jne 0x426160
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426198
call esi
test eax, eax
je 0x426184
cmp byte [ebp - 3], 0x3a
jne 0x426184
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4261ac
call esi
test eax, eax
je 0x4261ac
cmp byte [ebp - 3], 0x3a
jne 0x4261ac
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4261c6
cmp byte [ebp - 3], 0x3a
jne 0x4261c6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4261f2
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4261f2
cmp byte [ebp - 7], 0x3a
jne 0x4261f2
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42622a
call esi
test eax, eax
je 0x426216
cmp byte [ebp - 3], 0x3a
jne 0x426216
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42623e
call esi
test eax, eax
je 0x42623e
cmp byte [ebp - 3], 0x3a
jne 0x42623e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x426258
cmp byte [ebp - 3], 0x3a
jne 0x426258
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x426288
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x426288
cmp byte [ebp - 7], 0x3a
jne 0x426288
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4262c0
call esi
test eax, eax
je 0x4262ac
cmp byte [ebp - 3], 0x3a
jne 0x4262ac
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4262d4
call esi
test eax, eax
je 0x4262d4
cmp byte [ebp - 3], 0x3a
jne 0x4262d4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4262ee
cmp byte [ebp - 3], 0x3a
jne 0x4262ee
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x426327
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x426327
cmp byte [ebp - 7], 0x3a
jne 0x426327
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42635f
call esi
test eax, eax
je 0x42634b
cmp byte [ebp - 3], 0x3a
jne 0x42634b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x426373
call esi
test eax, eax
je 0x426373
cmp byte [ebp - 3], 0x3a
jne 0x426373
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x42638d
cmp byte [ebp - 3], 0x3a
jne 0x42638d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4263bc
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4263bc
cmp byte [ebp - 7], 0x3a
jne 0x4263bc
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4263f4
call esi
test eax, eax
je 0x4263e0
cmp byte [ebp - 3], 0x3a
jne 0x4263e0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x426408
call esi
test eax, eax
je 0x426408
cmp byte [ebp - 3], 0x3a
jne 0x426408
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x426422
cmp byte [ebp - 3], 0x3a
jne 0x426422
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x42644e
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x42644e
cmp byte [ebp - 7], 0x3a
jne 0x42644e
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426486
call esi
test eax, eax
je 0x426472
cmp byte [ebp - 3], 0x3a
jne 0x426472
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42649a
call esi
test eax, eax
je 0x42649a
cmp byte [ebp - 3], 0x3a
jne 0x42649a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4264b4
cmp byte [ebp - 3], 0x3a
jne 0x4264b4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4264e4
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4264e4
cmp byte [ebp - 7], 0x3a
jne 0x4264e4
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42651c
call esi
test eax, eax
je 0x426508
cmp byte [ebp - 3], 0x3a
jne 0x426508
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x426530
call esi
test eax, eax
je 0x426530
cmp byte [ebp - 3], 0x3a
jne 0x426530
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x42654a
cmp byte [ebp - 3], 0x3a
jne 0x42654a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4265ab
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4265ab
cmp byte [ebp - 7], 0x3a
jne 0x4265ab
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4265e3
call esi
test eax, eax
je 0x4265cf
cmp byte [ebp - 3], 0x3a
jne 0x4265cf
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4265f7
call esi
test eax, eax
je 0x4265f7
cmp byte [ebp - 3], 0x3a
jne 0x4265f7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x426611
cmp byte [ebp - 3], 0x3a
jne 0x426611
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
mov eax, dword [0x4513d0]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [eax + 0x50]
mov esi, eax
cmp esi, 0xffffffff
jne 0x426639
xor eax, eax
jmp 0x426651
mov eax, dword [0x4513d0]
push 0
push esi
call dword [eax + 0x38]
mov edi, eax
mov eax, dword [0x4513d0]
push esi
call dword [eax + 0x44]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4