Function at 0x437000
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x44c85b
call fcn.0044bd20
mov eax, 0x19128
call fcn.0044bd50
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x437db7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43704e
cmp byte [ebp - 0xf], 0x3a
jne 0x43704e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43708e
call edi
test eax, eax
je 0x43707b
cmp byte [ebp - 0xf], 0x3a
jne 0x43707b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4370a5
call edi
test eax, eax
je 0x4370a5
cmp byte [ebp - 0xf], 0x3a
jne 0x4370a5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4370c0
cmp byte [ebp - 0xf], 0x3a
jne 0x4370c0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4370fa
call edi
test eax, eax
je 0x4370e7
cmp byte [ebp - 0xf], 0x3a
jne 0x4370e7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437111
call edi
test eax, eax
je 0x437111
cmp byte [ebp - 0xf], 0x3a
jne 0x437111
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437144
cmp byte [ebp - 0xf], 0x3a
jne 0x437144
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43717e
call edi
test eax, eax
je 0x43716b
cmp byte [ebp - 0xf], 0x3a
jne 0x43716b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437195
call edi
test eax, eax
je 0x437195
cmp byte [ebp - 0xf], 0x3a
jne 0x437195
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4371bc
cmp byte [ebp - 0xf], 0x3a
jne 0x4371bc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4371f6
call edi
test eax, eax
je 0x4371e3
cmp byte [ebp - 0xf], 0x3a
jne 0x4371e3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43720d
call edi
test eax, eax
je 0x43720d
cmp byte [ebp - 0xf], 0x3a
jne 0x43720d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43722f
cmp byte [ebp - 0xf], 0x3a
jne 0x43722f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437269
call edi
test eax, eax
je 0x437256
cmp byte [ebp - 0xf], 0x3a
jne 0x437256
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437280
call edi
test eax, eax
je 0x437280
cmp byte [ebp - 0xf], 0x3a
jne 0x437280
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4372a2
cmp byte [ebp - 0xf], 0x3a
jne 0x4372a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4372dc
call edi
test eax, eax
je 0x4372c9
cmp byte [ebp - 0xf], 0x3a
jne 0x4372c9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4372f3
call edi
test eax, eax
je 0x4372f3
cmp byte [ebp - 0xf], 0x3a
jne 0x4372f3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437321
cmp byte [ebp - 0xf], 0x3a
jne 0x437321
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43735b
call edi
test eax, eax
je 0x437348
cmp byte [ebp - 0xf], 0x3a
jne 0x437348
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437372
call edi
test eax, eax
je 0x437372
cmp byte [ebp - 0xf], 0x3a
jne 0x437372
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4373ae
cmp byte [ebp - 0xf], 0x3a
jne 0x4373ae
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4373e8
call edi
test eax, eax
je 0x4373d5
cmp byte [ebp - 0xf], 0x3a
jne 0x4373d5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4373ff
call edi
test eax, eax
je 0x4373ff
cmp byte [ebp - 0xf], 0x3a
jne 0x4373ff
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43742a
cmp byte [ebp - 0xf], 0x3a
jne 0x43742a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437464
call edi
test eax, eax
je 0x437451
cmp byte [ebp - 0xf], 0x3a
jne 0x437451
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43747b
call edi
test eax, eax
je 0x43747b
cmp byte [ebp - 0xf], 0x3a
jne 0x43747b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4374a5
cmp byte [ebp - 0xf], 0x3a
jne 0x4374a5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4374df
call edi
test eax, eax
je 0x4374cc
cmp byte [ebp - 0xf], 0x3a
jne 0x4374cc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4374f6
call edi
test eax, eax
je 0x4374f6
cmp byte [ebp - 0xf], 0x3a
jne 0x4374f6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437523
cmp byte [ebp - 0xf], 0x3a
jne 0x437523
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43755d
call edi
test eax, eax
je 0x43754a
cmp byte [ebp - 0xf], 0x3a
jne 0x43754a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437574
call edi
test eax, eax
je 0x437574
cmp byte [ebp - 0xf], 0x3a
jne 0x437574
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4375a7
cmp byte [ebp - 0xf], 0x3a
jne 0x4375a7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4375e1
call edi
test eax, eax
je 0x4375ce
cmp byte [ebp - 0xf], 0x3a
jne 0x4375ce
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4375f8
call edi
test eax, eax
je 0x4375f8
cmp byte [ebp - 0xf], 0x3a
jne 0x4375f8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437627
cmp byte [ebp - 0xf], 0x3a
jne 0x437627
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437661
call edi
test eax, eax
je 0x43764e
cmp byte [ebp - 0xf], 0x3a
jne 0x43764e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437678
call edi
test eax, eax
je 0x437678
cmp byte [ebp - 0xf], 0x3a
jne 0x437678
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43769a
cmp byte [ebp - 0xf], 0x3a
jne 0x43769a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4376d4
call edi
test eax, eax
je 0x4376c1
cmp byte [ebp - 0xf], 0x3a
jne 0x4376c1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4376eb
call edi
test eax, eax
je 0x4376eb
cmp byte [ebp - 0xf], 0x3a
jne 0x4376eb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43770d
cmp byte [ebp - 0xf], 0x3a
jne 0x43770d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437747
call edi
test eax, eax
je 0x437734
cmp byte [ebp - 0xf], 0x3a
jne 0x437734
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43775e
call edi
test eax, eax
je 0x43775e
cmp byte [ebp - 0xf], 0x3a
jne 0x43775e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437788
cmp byte [ebp - 0xf], 0x3a
jne 0x437788
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4377c2
call edi
test eax, eax
je 0x4377af
cmp byte [ebp - 0xf], 0x3a
jne 0x4377af
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4377d9
call edi
test eax, eax
je 0x4377d9
cmp byte [ebp - 0xf], 0x3a
jne 0x4377d9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437804
cmp byte [ebp - 0xf], 0x3a
jne 0x437804
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43783e
call edi
test eax, eax
je 0x43782b
cmp byte [ebp - 0xf], 0x3a
jne 0x43782b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437855
call edi
test eax, eax
je 0x437855
cmp byte [ebp - 0xf], 0x3a
jne 0x437855
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437880
cmp byte [ebp - 0xf], 0x3a
jne 0x437880
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4378ba
call edi
test eax, eax
je 0x4378a7
cmp byte [ebp - 0xf], 0x3a
jne 0x4378a7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4378d1
call edi
test eax, eax
je 0x4378d1
cmp byte [ebp - 0xf], 0x3a
jne 0x4378d1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4378fb
cmp byte [ebp - 0xf], 0x3a
jne 0x4378fb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437935
call edi
test eax, eax
je 0x437922
cmp byte [ebp - 0xf], 0x3a
jne 0x437922
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43794c
call edi
test eax, eax
je 0x43794c
cmp byte [ebp - 0xf], 0x3a
jne 0x43794c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437970
cmp byte [ebp - 0xf], 0x3a
jne 0x437970
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4379aa
call edi
test eax, eax
je 0x437997
cmp byte [ebp - 0xf], 0x3a
jne 0x437997
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4379c1
call edi
test eax, eax
je 0x4379c1
cmp byte [ebp - 0xf], 0x3a
jne 0x4379c1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4379ea
cmp byte [ebp - 0xf], 0x3a
jne 0x4379ea
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437a24
call edi
test eax, eax
je 0x437a11
cmp byte [ebp - 0xf], 0x3a
jne 0x437a11
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437a3b
call edi
test eax, eax
je 0x437a3b
cmp byte [ebp - 0xf], 0x3a
jne 0x437a3b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437a64
cmp byte [ebp - 0xf], 0x3a
jne 0x437a64
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437a9e
call edi
test eax, eax
je 0x437a8b
cmp byte [ebp - 0xf], 0x3a
jne 0x437a8b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437ab5
call edi
test eax, eax
je 0x437ab5
cmp byte [ebp - 0xf], 0x3a
jne 0x437ab5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437ae3
cmp byte [ebp - 0xf], 0x3a
jne 0x437ae3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437b1d
call edi
test eax, eax
je 0x437b0a
cmp byte [ebp - 0xf], 0x3a
jne 0x437b0a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437b34
call edi
test eax, eax
je 0x437b34
cmp byte [ebp - 0xf], 0x3a
jne 0x437b34
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437b5d
cmp byte [ebp - 0xf], 0x3a
jne 0x437b5d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437b97
call edi
test eax, eax
je 0x437b84
cmp byte [ebp - 0xf], 0x3a
jne 0x437b84
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437bae
call edi
test eax, eax
je 0x437bae
cmp byte [ebp - 0xf], 0x3a
jne 0x437bae
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437bd0
cmp byte [ebp - 0xf], 0x3a
jne 0x437bd0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437c0a
call edi
test eax, eax
je 0x437bf7
cmp byte [ebp - 0xf], 0x3a
jne 0x437bf7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437c21
call edi
test eax, eax
je 0x437c21
cmp byte [ebp - 0xf], 0x3a
jne 0x437c21
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437c4a
cmp byte [ebp - 0xf], 0x3a
jne 0x437c4a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437c84
call edi
test eax, eax
je 0x437c71
cmp byte [ebp - 0xf], 0x3a
jne 0x437c71
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437c9b
call edi
test eax, eax
je 0x437c9b
cmp byte [ebp - 0xf], 0x3a
jne 0x437c9b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437cc5
cmp byte [ebp - 0xf], 0x3a
jne 0x437cc5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437cff
call edi
test eax, eax
je 0x437cec
cmp byte [ebp - 0xf], 0x3a
jne 0x437cec
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437d16
call edi
test eax, eax
je 0x437d16
cmp byte [ebp - 0xf], 0x3a
jne 0x437d16
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x437d41
cmp byte [ebp - 0xf], 0x3a
jne 0x437d41
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x437d7b
call edi
test eax, eax
je 0x437d68
cmp byte [ebp - 0xf], 0x3a
jne 0x437d68
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x437d92
call edi
test eax, eax
je 0x437d92
cmp byte [ebp - 0xf], 0x3a
jne 0x437d92
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
push dword [ecx + 8]
push dword [ecx + 4]
lea ecx, [ebp - 0x19134]
push dword [ebp + 8]
call fcn.0040ac3b
lea ecx, [ebp - 0x19134]
mov dword [ebp - 4], ebx
call fcn.0040c804
cmp eax, 3
pop ebx
je 0x437e23
cmp eax, 1
lea ecx, [ebp - 0x19134]
jne 0x437e0f
call fcn.0040d644
test eax, eax
jne 0x437e23
lea ecx, [ebp - 0x19134]
call fcn.0040e474
test eax, eax
je 0x437e23
lea ecx, [ebp - 0x19134]
call fcn.0040f261
jmp 0x437e23
call fcn.0040e474
test eax, eax
je 0x437e23
lea ecx, [ebp - 0x19134]
call fcn.0041006e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19134]
call fcn.0040ba41
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4