Function at 0x425c10
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x4269b4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425c50
cmp byte [ebp - 3], 0x3a
jne 0x425c50
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425c90
call edi
test eax, eax
je 0x425c7d
cmp byte [ebp - 3], 0x3a
jne 0x425c7d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425ca7
call edi
test eax, eax
je 0x425ca7
cmp byte [ebp - 3], 0x3a
jne 0x425ca7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425cc2
cmp byte [ebp - 3], 0x3a
jne 0x425cc2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425cfc
call edi
test eax, eax
je 0x425ce9
cmp byte [ebp - 3], 0x3a
jne 0x425ce9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425d13
call edi
test eax, eax
je 0x425d13
cmp byte [ebp - 3], 0x3a
jne 0x425d13
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425d46
cmp byte [ebp - 3], 0x3a
jne 0x425d46
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425d80
call edi
test eax, eax
je 0x425d6d
cmp byte [ebp - 3], 0x3a
jne 0x425d6d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425d97
call edi
test eax, eax
je 0x425d97
cmp byte [ebp - 3], 0x3a
jne 0x425d97
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425dbe
cmp byte [ebp - 3], 0x3a
jne 0x425dbe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425df8
call edi
test eax, eax
je 0x425de5
cmp byte [ebp - 3], 0x3a
jne 0x425de5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425e0f
call edi
test eax, eax
je 0x425e0f
cmp byte [ebp - 3], 0x3a
jne 0x425e0f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425e31
cmp byte [ebp - 3], 0x3a
jne 0x425e31
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425e6b
call edi
test eax, eax
je 0x425e58
cmp byte [ebp - 3], 0x3a
jne 0x425e58
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425e82
call edi
test eax, eax
je 0x425e82
cmp byte [ebp - 3], 0x3a
jne 0x425e82
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425ea4
cmp byte [ebp - 3], 0x3a
jne 0x425ea4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425ede
call edi
test eax, eax
je 0x425ecb
cmp byte [ebp - 3], 0x3a
jne 0x425ecb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425ef5
call edi
test eax, eax
je 0x425ef5
cmp byte [ebp - 3], 0x3a
jne 0x425ef5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425f23
cmp byte [ebp - 3], 0x3a
jne 0x425f23
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425f5d
call edi
test eax, eax
je 0x425f4a
cmp byte [ebp - 3], 0x3a
jne 0x425f4a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425f74
call edi
test eax, eax
je 0x425f74
cmp byte [ebp - 3], 0x3a
jne 0x425f74
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425fb0
cmp byte [ebp - 3], 0x3a
jne 0x425fb0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425fea
call edi
test eax, eax
je 0x425fd7
cmp byte [ebp - 3], 0x3a
jne 0x425fd7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426001
call edi
test eax, eax
je 0x426001
cmp byte [ebp - 3], 0x3a
jne 0x426001
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42602c
cmp byte [ebp - 3], 0x3a
jne 0x42602c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426066
call edi
test eax, eax
je 0x426053
cmp byte [ebp - 3], 0x3a
jne 0x426053
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42607d
call edi
test eax, eax
je 0x42607d
cmp byte [ebp - 3], 0x3a
jne 0x42607d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4260a7
cmp byte [ebp - 3], 0x3a
jne 0x4260a7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4260e1
call edi
test eax, eax
je 0x4260ce
cmp byte [ebp - 3], 0x3a
jne 0x4260ce
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4260f8
call edi
test eax, eax
je 0x4260f8
cmp byte [ebp - 3], 0x3a
jne 0x4260f8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426125
cmp byte [ebp - 3], 0x3a
jne 0x426125
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42615f
call edi
test eax, eax
je 0x42614c
cmp byte [ebp - 3], 0x3a
jne 0x42614c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426176
call edi
test eax, eax
je 0x426176
cmp byte [ebp - 3], 0x3a
jne 0x426176
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4261a9
cmp byte [ebp - 3], 0x3a
jne 0x4261a9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4261e3
call edi
test eax, eax
je 0x4261d0
cmp byte [ebp - 3], 0x3a
jne 0x4261d0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4261fa
call edi
test eax, eax
je 0x4261fa
cmp byte [ebp - 3], 0x3a
jne 0x4261fa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426229
cmp byte [ebp - 3], 0x3a
jne 0x426229
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426263
call edi
test eax, eax
je 0x426250
cmp byte [ebp - 3], 0x3a
jne 0x426250
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42627a
call edi
test eax, eax
je 0x42627a
cmp byte [ebp - 3], 0x3a
jne 0x42627a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42629c
cmp byte [ebp - 3], 0x3a
jne 0x42629c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4262d6
call edi
test eax, eax
je 0x4262c3
cmp byte [ebp - 3], 0x3a
jne 0x4262c3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4262ed
call edi
test eax, eax
je 0x4262ed
cmp byte [ebp - 3], 0x3a
jne 0x4262ed
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42630f
cmp byte [ebp - 3], 0x3a
jne 0x42630f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426349
call edi
test eax, eax
je 0x426336
cmp byte [ebp - 3], 0x3a
jne 0x426336
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426360
call edi
test eax, eax
je 0x426360
cmp byte [ebp - 3], 0x3a
jne 0x426360
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42638a
cmp byte [ebp - 3], 0x3a
jne 0x42638a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4263c4
call edi
test eax, eax
je 0x4263b1
cmp byte [ebp - 3], 0x3a
jne 0x4263b1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4263db
call edi
test eax, eax
je 0x4263db
cmp byte [ebp - 3], 0x3a
jne 0x4263db
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426406
cmp byte [ebp - 3], 0x3a
jne 0x426406
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426440
call edi
test eax, eax
je 0x42642d
cmp byte [ebp - 3], 0x3a
jne 0x42642d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426457
call edi
test eax, eax
je 0x426457
cmp byte [ebp - 3], 0x3a
jne 0x426457
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426482
cmp byte [ebp - 3], 0x3a
jne 0x426482
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4264bc
call edi
test eax, eax
je 0x4264a9
cmp byte [ebp - 3], 0x3a
jne 0x4264a9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4264d3
call edi
test eax, eax
je 0x4264d3
cmp byte [ebp - 3], 0x3a
jne 0x4264d3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4264fd
cmp byte [ebp - 3], 0x3a
jne 0x4264fd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426537
call edi
test eax, eax
je 0x426524
cmp byte [ebp - 3], 0x3a
jne 0x426524
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42654e
call edi
test eax, eax
je 0x42654e
cmp byte [ebp - 3], 0x3a
jne 0x42654e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426572
cmp byte [ebp - 3], 0x3a
jne 0x426572
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4265ac
call edi
test eax, eax
je 0x426599
cmp byte [ebp - 3], 0x3a
jne 0x426599
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4265c3
call edi
test eax, eax
je 0x4265c3
cmp byte [ebp - 3], 0x3a
jne 0x4265c3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4265ec
cmp byte [ebp - 3], 0x3a
jne 0x4265ec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426626
call edi
test eax, eax
je 0x426613
cmp byte [ebp - 3], 0x3a
jne 0x426613
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42663d
call edi
test eax, eax
je 0x42663d
cmp byte [ebp - 3], 0x3a
jne 0x42663d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426666
cmp byte [ebp - 3], 0x3a
jne 0x426666
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4266a0
call edi
test eax, eax
je 0x42668d
cmp byte [ebp - 3], 0x3a
jne 0x42668d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4266b7
call edi
test eax, eax
je 0x4266b7
cmp byte [ebp - 3], 0x3a
jne 0x4266b7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4266e5
cmp byte [ebp - 3], 0x3a
jne 0x4266e5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42671f
call edi
test eax, eax
je 0x42670c
cmp byte [ebp - 3], 0x3a
jne 0x42670c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426736
call edi
test eax, eax
je 0x426736
cmp byte [ebp - 3], 0x3a
jne 0x426736
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42675f
cmp byte [ebp - 3], 0x3a
jne 0x42675f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426799
call edi
test eax, eax
je 0x426786
cmp byte [ebp - 3], 0x3a
jne 0x426786
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4267b0
call edi
test eax, eax
je 0x4267b0
cmp byte [ebp - 3], 0x3a
jne 0x4267b0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4267d2
cmp byte [ebp - 3], 0x3a
jne 0x4267d2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42680c
call edi
test eax, eax
je 0x4267f9
cmp byte [ebp - 3], 0x3a
jne 0x4267f9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426823
call edi
test eax, eax
je 0x426823
cmp byte [ebp - 3], 0x3a
jne 0x426823
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42684c
cmp byte [ebp - 3], 0x3a
jne 0x42684c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426886
call edi
test eax, eax
je 0x426873
cmp byte [ebp - 3], 0x3a
jne 0x426873
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42689d
call edi
test eax, eax
je 0x42689d
cmp byte [ebp - 3], 0x3a
jne 0x42689d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4268c7
cmp byte [ebp - 3], 0x3a
jne 0x4268c7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426901
call edi
test eax, eax
je 0x4268ee
cmp byte [ebp - 3], 0x3a
jne 0x4268ee
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426918
call edi
test eax, eax
je 0x426918
cmp byte [ebp - 3], 0x3a
jne 0x426918
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426943
cmp byte [ebp - 3], 0x3a
jne 0x426943
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42697d
call edi
test eax, eax
je 0x42696a
cmp byte [ebp - 3], 0x3a
jne 0x42696a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426994
call edi
test eax, eax
je 0x426994
cmp byte [ebp - 3], 0x3a
jne 0x426994
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp + 8]
mov eax, dword [0x4543d0]
push ebx
push 0x410
call dword [eax + 0x18]
mov edi, eax
cmp edi, ebx
je 0x426a7f
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push 4
push eax
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0xd8]
test eax, eax
je 0x426a76
mov esi, 0x104
lea eax, [ebp - 0x10c]
push esi
push ebx
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x10c]
push esi
push eax
push dword [ebp + 8]
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0xd4]
test eax, eax
je 0x426a76
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x21c]
add esp, 0xc
lea eax, [ebp - 0x210]
push esi
push eax
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0xb4]
test eax, eax
lea eax, [ebp - 0x210]
jne 0x426a65
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x4543d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e8]
pop ecx
pop ecx
mov eax, dword [0x4543d0]
push edi
call dword [eax + 0x44]
pop edi
pop esi
pop ebx
leave
ret 8