Function at 0x413bd5
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp + 8]
push ebx
test eax, eax
jne 0x41487a
push esi
xor esi, esi
push edi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413c2b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413c2b
cmp byte [ebp - 7], 0x3a
jne 0x413c2b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413c69
call esi
test eax, eax
je 0x413c55
cmp byte [ebp - 3], 0x3a
jne 0x413c55
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413c7d
call esi
test eax, eax
je 0x413c7d
cmp byte [ebp - 3], 0x3a
jne 0x413c7d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413c97
cmp byte [ebp - 3], 0x3a
jne 0x413c97
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413cc3
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413cc3
cmp byte [ebp - 7], 0x3a
jne 0x413cc3
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413cfb
call esi
test eax, eax
je 0x413ce7
cmp byte [ebp - 3], 0x3a
jne 0x413ce7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413d0f
call esi
test eax, eax
je 0x413d0f
cmp byte [ebp - 3], 0x3a
jne 0x413d0f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413d29
cmp byte [ebp - 3], 0x3a
jne 0x413d29
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413d55
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413d55
cmp byte [ebp - 7], 0x3a
jne 0x413d55
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413d8d
call esi
test eax, eax
je 0x413d79
cmp byte [ebp - 3], 0x3a
jne 0x413d79
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413da1
call esi
test eax, eax
je 0x413da1
cmp byte [ebp - 3], 0x3a
jne 0x413da1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413dbb
cmp byte [ebp - 3], 0x3a
jne 0x413dbb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413df5
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413df5
cmp byte [ebp - 7], 0x3a
jne 0x413df5
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413e2d
call esi
test eax, eax
je 0x413e19
cmp byte [ebp - 3], 0x3a
jne 0x413e19
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413e41
call esi
test eax, eax
je 0x413e41
cmp byte [ebp - 3], 0x3a
jne 0x413e41
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413e5b
cmp byte [ebp - 3], 0x3a
jne 0x413e5b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413e92
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413e92
cmp byte [ebp - 7], 0x3a
jne 0x413e92
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413eca
call esi
test eax, eax
je 0x413eb6
cmp byte [ebp - 3], 0x3a
jne 0x413eb6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413ede
call esi
test eax, eax
je 0x413ede
cmp byte [ebp - 3], 0x3a
jne 0x413ede
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413ef8
cmp byte [ebp - 3], 0x3a
jne 0x413ef8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413f26
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413f26
cmp byte [ebp - 7], 0x3a
jne 0x413f26
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413f5e
call esi
test eax, eax
je 0x413f4a
cmp byte [ebp - 3], 0x3a
jne 0x413f4a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413f72
call esi
test eax, eax
je 0x413f72
cmp byte [ebp - 3], 0x3a
jne 0x413f72
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413f8c
cmp byte [ebp - 3], 0x3a
jne 0x413f8c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413fc0
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413fc0
cmp byte [ebp - 7], 0x3a
jne 0x413fc0
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413ff8
call esi
test eax, eax
je 0x413fe4
cmp byte [ebp - 3], 0x3a
jne 0x413fe4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41400c
call esi
test eax, eax
je 0x41400c
cmp byte [ebp - 3], 0x3a
jne 0x41400c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414026
cmp byte [ebp - 3], 0x3a
jne 0x414026
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x414054
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x414054
cmp byte [ebp - 7], 0x3a
jne 0x414054
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41408c
call esi
test eax, eax
je 0x414078
cmp byte [ebp - 3], 0x3a
jne 0x414078
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4140a0
call esi
test eax, eax
je 0x4140a0
cmp byte [ebp - 3], 0x3a
jne 0x4140a0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4140ba
cmp byte [ebp - 3], 0x3a
jne 0x4140ba
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4140e6
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4140e6
cmp byte [ebp - 7], 0x3a
jne 0x4140e6
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41411e
call esi
test eax, eax
je 0x41410a
cmp byte [ebp - 3], 0x3a
jne 0x41410a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x414132
call esi
test eax, eax
je 0x414132
cmp byte [ebp - 3], 0x3a
jne 0x414132
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41414c
cmp byte [ebp - 3], 0x3a
jne 0x41414c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x41417a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41417a
cmp byte [ebp - 7], 0x3a
jne 0x41417a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4141b2
call esi
test eax, eax
je 0x41419e
cmp byte [ebp - 3], 0x3a
jne 0x41419e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4141c6
call esi
test eax, eax
je 0x4141c6
cmp byte [ebp - 3], 0x3a
jne 0x4141c6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4141e0
cmp byte [ebp - 3], 0x3a
jne 0x4141e0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x41420a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41420a
cmp byte [ebp - 7], 0x3a
jne 0x41420a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414242
call esi
test eax, eax
je 0x41422e
cmp byte [ebp - 3], 0x3a
jne 0x41422e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x414256
call esi
test eax, eax
je 0x414256
cmp byte [ebp - 3], 0x3a
jne 0x414256
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414270
cmp byte [ebp - 3], 0x3a
jne 0x414270
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x41429f
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41429f
cmp byte [ebp - 7], 0x3a
jne 0x41429f
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4142d7
call esi
test eax, eax
je 0x4142c3
cmp byte [ebp - 3], 0x3a
jne 0x4142c3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4142eb
call esi
test eax, eax
je 0x4142eb
cmp byte [ebp - 3], 0x3a
jne 0x4142eb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414305
cmp byte [ebp - 3], 0x3a
jne 0x414305
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x414333
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x414333
cmp byte [ebp - 7], 0x3a
jne 0x414333
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41436b
call esi
test eax, eax
je 0x414357
cmp byte [ebp - 3], 0x3a
jne 0x414357
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41437f
call esi
test eax, eax
je 0x41437f
cmp byte [ebp - 3], 0x3a
jne 0x41437f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414399
cmp byte [ebp - 3], 0x3a
jne 0x414399
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4143c7
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4143c7
cmp byte [ebp - 7], 0x3a
jne 0x4143c7
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4143ff
call esi
test eax, eax
je 0x4143eb
cmp byte [ebp - 3], 0x3a
jne 0x4143eb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x414413
call esi
test eax, eax
je 0x414413
cmp byte [ebp - 3], 0x3a
jne 0x414413
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41442d
cmp byte [ebp - 3], 0x3a
jne 0x41442d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x414459
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x414459
cmp byte [ebp - 7], 0x3a
jne 0x414459
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414491
call esi
test eax, eax
je 0x41447d
cmp byte [ebp - 3], 0x3a
jne 0x41447d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4144a5
call esi
test eax, eax
je 0x4144a5
cmp byte [ebp - 3], 0x3a
jne 0x4144a5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4144bf
cmp byte [ebp - 3], 0x3a
jne 0x4144bf
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4144ef
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4144ef
cmp byte [ebp - 7], 0x3a
jne 0x4144ef
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414527
call esi
test eax, eax
je 0x414513
cmp byte [ebp - 3], 0x3a
jne 0x414513
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41453b
call esi
test eax, eax
je 0x41453b
cmp byte [ebp - 3], 0x3a
jne 0x41453b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414555
cmp byte [ebp - 3], 0x3a
jne 0x414555
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x41458e
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41458e
cmp byte [ebp - 7], 0x3a
jne 0x41458e
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4145c6
call esi
test eax, eax
je 0x4145b2
cmp byte [ebp - 3], 0x3a
jne 0x4145b2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4145da
call esi
test eax, eax
je 0x4145da
cmp byte [ebp - 3], 0x3a
jne 0x4145da
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4145f4
cmp byte [ebp - 3], 0x3a
jne 0x4145f4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x414623
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x414623
cmp byte [ebp - 7], 0x3a
jne 0x414623
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41465b
call esi
test eax, eax
je 0x414647
cmp byte [ebp - 3], 0x3a
jne 0x414647
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41466f
call esi
test eax, eax
je 0x41466f
cmp byte [ebp - 3], 0x3a
jne 0x41466f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x414689
cmp byte [ebp - 3], 0x3a
jne 0x414689
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4146b5
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4146b5
cmp byte [ebp - 7], 0x3a
jne 0x4146b5
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4146ed
call esi
test eax, eax
je 0x4146d9
cmp byte [ebp - 3], 0x3a
jne 0x4146d9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x414701
call esi
test eax, eax
je 0x414701
cmp byte [ebp - 3], 0x3a
jne 0x414701
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41471b
cmp byte [ebp - 3], 0x3a
jne 0x41471b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x41474b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41474b
cmp byte [ebp - 7], 0x3a
jne 0x41474b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x414783
call esi
test eax, eax
je 0x41476f
cmp byte [ebp - 3], 0x3a
jne 0x41476f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x414797
call esi
test eax, eax
je 0x414797
cmp byte [ebp - 3], 0x3a
jne 0x414797
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4147b1
cmp byte [ebp - 3], 0x3a
jne 0x4147b1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x414812
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x414812
cmp byte [ebp - 7], 0x3a
jne 0x414812
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41484a
call esi
test eax, eax
je 0x414836
cmp byte [ebp - 3], 0x3a
jne 0x414836
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41485e
call esi
test eax, eax
je 0x41485e
cmp byte [ebp - 3], 0x3a
jne 0x41485e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
pop edi
pop esi
test eax, eax
je 0x41487a
cmp byte [ebp - 3], 0x3a
jne 0x41487a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push dword [ebp + 8]
mov eax, dword [0x4513d0]
call dword [eax + 0x94]
cmp eax, 0xffffffff
pop ebx
jne 0x414892
xor eax, eax
jmp 0x4148a3
or al, 2
push eax
mov eax, dword [0x4513d0]
push dword [ebp + 8]
call dword [eax + 0x90]
leave
ret 4