Function at 0x41df73
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
lea eax, [ebp - 0xc]
push ebx
test eax, eax
push esi
mov dword [ebp - 0xc], ecx
jne 0x41ec1e
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41dfcf
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41dfcf
cmp byte [ebp - 7], 0x3a
jne 0x41dfcf
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e00e
call esi
test eax, eax
je 0x41dffa
cmp byte [ebp - 3], 0x3a
jne 0x41dffa
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e022
call esi
test eax, eax
je 0x41e022
cmp byte [ebp - 3], 0x3a
jne 0x41e022
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e03c
cmp byte [ebp - 3], 0x3a
jne 0x41e03c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e068
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e068
cmp byte [ebp - 7], 0x3a
jne 0x41e068
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e0a0
call esi
test eax, eax
je 0x41e08c
cmp byte [ebp - 3], 0x3a
jne 0x41e08c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e0b4
call esi
test eax, eax
je 0x41e0b4
cmp byte [ebp - 3], 0x3a
jne 0x41e0b4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e0ce
cmp byte [ebp - 3], 0x3a
jne 0x41e0ce
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e0fa
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e0fa
cmp byte [ebp - 7], 0x3a
jne 0x41e0fa
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e132
call esi
test eax, eax
je 0x41e11e
cmp byte [ebp - 3], 0x3a
jne 0x41e11e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e146
call esi
test eax, eax
je 0x41e146
cmp byte [ebp - 3], 0x3a
jne 0x41e146
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e160
cmp byte [ebp - 3], 0x3a
jne 0x41e160
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e19a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e19a
cmp byte [ebp - 7], 0x3a
jne 0x41e19a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e1d2
call esi
test eax, eax
je 0x41e1be
cmp byte [ebp - 3], 0x3a
jne 0x41e1be
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e1e6
call esi
test eax, eax
je 0x41e1e6
cmp byte [ebp - 3], 0x3a
jne 0x41e1e6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e200
cmp byte [ebp - 3], 0x3a
jne 0x41e200
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e237
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e237
cmp byte [ebp - 7], 0x3a
jne 0x41e237
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e26f
call esi
test eax, eax
je 0x41e25b
cmp byte [ebp - 3], 0x3a
jne 0x41e25b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e283
call esi
test eax, eax
je 0x41e283
cmp byte [ebp - 3], 0x3a
jne 0x41e283
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e29d
cmp byte [ebp - 3], 0x3a
jne 0x41e29d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e2cb
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e2cb
cmp byte [ebp - 7], 0x3a
jne 0x41e2cb
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e303
call esi
test eax, eax
je 0x41e2ef
cmp byte [ebp - 3], 0x3a
jne 0x41e2ef
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e317
call esi
test eax, eax
je 0x41e317
cmp byte [ebp - 3], 0x3a
jne 0x41e317
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e331
cmp byte [ebp - 3], 0x3a
jne 0x41e331
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e365
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e365
cmp byte [ebp - 7], 0x3a
jne 0x41e365
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e39d
call esi
test eax, eax
je 0x41e389
cmp byte [ebp - 3], 0x3a
jne 0x41e389
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e3b1
call esi
test eax, eax
je 0x41e3b1
cmp byte [ebp - 3], 0x3a
jne 0x41e3b1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e3cb
cmp byte [ebp - 3], 0x3a
jne 0x41e3cb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e3f9
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e3f9
cmp byte [ebp - 7], 0x3a
jne 0x41e3f9
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e431
call esi
test eax, eax
je 0x41e41d
cmp byte [ebp - 3], 0x3a
jne 0x41e41d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e445
call esi
test eax, eax
je 0x41e445
cmp byte [ebp - 3], 0x3a
jne 0x41e445
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e45f
cmp byte [ebp - 3], 0x3a
jne 0x41e45f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e48b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e48b
cmp byte [ebp - 7], 0x3a
jne 0x41e48b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e4c3
call esi
test eax, eax
je 0x41e4af
cmp byte [ebp - 3], 0x3a
jne 0x41e4af
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e4d7
call esi
test eax, eax
je 0x41e4d7
cmp byte [ebp - 3], 0x3a
jne 0x41e4d7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e4f1
cmp byte [ebp - 3], 0x3a
jne 0x41e4f1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e51f
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e51f
cmp byte [ebp - 7], 0x3a
jne 0x41e51f
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e557
call esi
test eax, eax
je 0x41e543
cmp byte [ebp - 3], 0x3a
jne 0x41e543
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e56b
call esi
test eax, eax
je 0x41e56b
cmp byte [ebp - 3], 0x3a
jne 0x41e56b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e585
cmp byte [ebp - 3], 0x3a
jne 0x41e585
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e5af
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e5af
cmp byte [ebp - 7], 0x3a
jne 0x41e5af
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e5e7
call esi
test eax, eax
je 0x41e5d3
cmp byte [ebp - 3], 0x3a
jne 0x41e5d3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e5fb
call esi
test eax, eax
je 0x41e5fb
cmp byte [ebp - 3], 0x3a
jne 0x41e5fb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e615
cmp byte [ebp - 3], 0x3a
jne 0x41e615
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e644
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e644
cmp byte [ebp - 7], 0x3a
jne 0x41e644
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e67c
call esi
test eax, eax
je 0x41e668
cmp byte [ebp - 3], 0x3a
jne 0x41e668
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e690
call esi
test eax, eax
je 0x41e690
cmp byte [ebp - 3], 0x3a
jne 0x41e690
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e6aa
cmp byte [ebp - 3], 0x3a
jne 0x41e6aa
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e6d8
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e6d8
cmp byte [ebp - 7], 0x3a
jne 0x41e6d8
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e710
call esi
test eax, eax
je 0x41e6fc
cmp byte [ebp - 3], 0x3a
jne 0x41e6fc
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e724
call esi
test eax, eax
je 0x41e724
cmp byte [ebp - 3], 0x3a
jne 0x41e724
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e73e
cmp byte [ebp - 3], 0x3a
jne 0x41e73e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e76c
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e76c
cmp byte [ebp - 7], 0x3a
jne 0x41e76c
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e7a4
call esi
test eax, eax
je 0x41e790
cmp byte [ebp - 3], 0x3a
jne 0x41e790
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e7b8
call esi
test eax, eax
je 0x41e7b8
cmp byte [ebp - 3], 0x3a
jne 0x41e7b8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e7d2
cmp byte [ebp - 3], 0x3a
jne 0x41e7d2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e7fe
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e7fe
cmp byte [ebp - 7], 0x3a
jne 0x41e7fe
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e836
call esi
test eax, eax
je 0x41e822
cmp byte [ebp - 3], 0x3a
jne 0x41e822
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e84a
call esi
test eax, eax
je 0x41e84a
cmp byte [ebp - 3], 0x3a
jne 0x41e84a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e864
cmp byte [ebp - 3], 0x3a
jne 0x41e864
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e894
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e894
cmp byte [ebp - 7], 0x3a
jne 0x41e894
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e8cc
call esi
test eax, eax
je 0x41e8b8
cmp byte [ebp - 3], 0x3a
jne 0x41e8b8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e8e0
call esi
test eax, eax
je 0x41e8e0
cmp byte [ebp - 3], 0x3a
jne 0x41e8e0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e8fa
cmp byte [ebp - 3], 0x3a
jne 0x41e8fa
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e933
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e933
cmp byte [ebp - 7], 0x3a
jne 0x41e933
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41e96b
call esi
test eax, eax
je 0x41e957
cmp byte [ebp - 3], 0x3a
jne 0x41e957
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41e97f
call esi
test eax, eax
je 0x41e97f
cmp byte [ebp - 3], 0x3a
jne 0x41e97f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41e999
cmp byte [ebp - 3], 0x3a
jne 0x41e999
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41e9c8
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41e9c8
cmp byte [ebp - 7], 0x3a
jne 0x41e9c8
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ea00
call esi
test eax, eax
je 0x41e9ec
cmp byte [ebp - 3], 0x3a
jne 0x41e9ec
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41ea14
call esi
test eax, eax
je 0x41ea14
cmp byte [ebp - 3], 0x3a
jne 0x41ea14
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41ea2e
cmp byte [ebp - 3], 0x3a
jne 0x41ea2e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41ea5a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41ea5a
cmp byte [ebp - 7], 0x3a
jne 0x41ea5a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ea92
call esi
test eax, eax
je 0x41ea7e
cmp byte [ebp - 3], 0x3a
jne 0x41ea7e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41eaa6
call esi
test eax, eax
je 0x41eaa6
cmp byte [ebp - 3], 0x3a
jne 0x41eaa6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41eac0
cmp byte [ebp - 3], 0x3a
jne 0x41eac0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41eaf0
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41eaf0
cmp byte [ebp - 7], 0x3a
jne 0x41eaf0
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41eb28
call esi
test eax, eax
je 0x41eb14
cmp byte [ebp - 3], 0x3a
jne 0x41eb14
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41eb3c
call esi
test eax, eax
je 0x41eb3c
cmp byte [ebp - 3], 0x3a
jne 0x41eb3c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41eb56
cmp byte [ebp - 3], 0x3a
jne 0x41eb56
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x41ebb7
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41ebb7
cmp byte [ebp - 7], 0x3a
jne 0x41ebb7
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41ebef
call esi
test eax, eax
je 0x41ebdb
cmp byte [ebp - 3], 0x3a
jne 0x41ebdb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41ec03
call esi
test eax, eax
je 0x41ec03
cmp byte [ebp - 3], 0x3a
jne 0x41ec03
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
pop edi
je 0x41ec1e
cmp byte [ebp - 3], 0x3a
jne 0x41ec1e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x174]
push 0x104
push eax
mov eax, dword [0x4513d0]
xor esi, esi
push esi
call dword [eax + 0x74]
push 1
push esi
lea eax, [ebp - 0x174]
push 0x2e
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x70]
push esi
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x20
push eax
call fcn.004105df
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x174]
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x218]
mov ecx, dword [ebp - 0xc]
add esp, 0x24
lea eax, [ebp - 0x174]
push eax
call fcn.00412f00
pop esi
pop ebx
leave
ret