Function at 0x416226
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
lea eax, [ebp - 8]
push ebx
test eax, eax
jne 0x416ecc
push esi
xor esi, esi
push edi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41627d
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41627d
cmp byte [ebp - 7], 0x3a
jne 0x41627d
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4162bb
call esi
test eax, eax
je 0x4162a7
cmp byte [ebp - 3], 0x3a
jne 0x4162a7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4162cf
call esi
test eax, eax
je 0x4162cf
cmp byte [ebp - 3], 0x3a
jne 0x4162cf
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4162e9
cmp byte [ebp - 3], 0x3a
jne 0x4162e9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416315
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416315
cmp byte [ebp - 7], 0x3a
jne 0x416315
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41634d
call esi
test eax, eax
je 0x416339
cmp byte [ebp - 3], 0x3a
jne 0x416339
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416361
call esi
test eax, eax
je 0x416361
cmp byte [ebp - 3], 0x3a
jne 0x416361
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41637b
cmp byte [ebp - 3], 0x3a
jne 0x41637b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4163a7
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4163a7
cmp byte [ebp - 7], 0x3a
jne 0x4163a7
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4163df
call esi
test eax, eax
je 0x4163cb
cmp byte [ebp - 3], 0x3a
jne 0x4163cb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4163f3
call esi
test eax, eax
je 0x4163f3
cmp byte [ebp - 3], 0x3a
jne 0x4163f3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41640d
cmp byte [ebp - 3], 0x3a
jne 0x41640d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416447
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416447
cmp byte [ebp - 7], 0x3a
jne 0x416447
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41647f
call esi
test eax, eax
je 0x41646b
cmp byte [ebp - 3], 0x3a
jne 0x41646b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416493
call esi
test eax, eax
je 0x416493
cmp byte [ebp - 3], 0x3a
jne 0x416493
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4164ad
cmp byte [ebp - 3], 0x3a
jne 0x4164ad
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4164e4
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4164e4
cmp byte [ebp - 7], 0x3a
jne 0x4164e4
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41651c
call esi
test eax, eax
je 0x416508
cmp byte [ebp - 3], 0x3a
jne 0x416508
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416530
call esi
test eax, eax
je 0x416530
cmp byte [ebp - 3], 0x3a
jne 0x416530
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41654a
cmp byte [ebp - 3], 0x3a
jne 0x41654a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416578
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416578
cmp byte [ebp - 7], 0x3a
jne 0x416578
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4165b0
call esi
test eax, eax
je 0x41659c
cmp byte [ebp - 3], 0x3a
jne 0x41659c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4165c4
call esi
test eax, eax
je 0x4165c4
cmp byte [ebp - 3], 0x3a
jne 0x4165c4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4165de
cmp byte [ebp - 3], 0x3a
jne 0x4165de
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416612
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416612
cmp byte [ebp - 7], 0x3a
jne 0x416612
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41664a
call esi
test eax, eax
je 0x416636
cmp byte [ebp - 3], 0x3a
jne 0x416636
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41665e
call esi
test eax, eax
je 0x41665e
cmp byte [ebp - 3], 0x3a
jne 0x41665e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416678
cmp byte [ebp - 3], 0x3a
jne 0x416678
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4166a6
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4166a6
cmp byte [ebp - 7], 0x3a
jne 0x4166a6
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4166de
call esi
test eax, eax
je 0x4166ca
cmp byte [ebp - 3], 0x3a
jne 0x4166ca
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4166f2
call esi
test eax, eax
je 0x4166f2
cmp byte [ebp - 3], 0x3a
jne 0x4166f2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41670c
cmp byte [ebp - 3], 0x3a
jne 0x41670c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416738
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416738
cmp byte [ebp - 7], 0x3a
jne 0x416738
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416770
call esi
test eax, eax
je 0x41675c
cmp byte [ebp - 3], 0x3a
jne 0x41675c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416784
call esi
test eax, eax
je 0x416784
cmp byte [ebp - 3], 0x3a
jne 0x416784
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41679e
cmp byte [ebp - 3], 0x3a
jne 0x41679e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4167cc
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4167cc
cmp byte [ebp - 7], 0x3a
jne 0x4167cc
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416804
call esi
test eax, eax
je 0x4167f0
cmp byte [ebp - 3], 0x3a
jne 0x4167f0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416818
call esi
test eax, eax
je 0x416818
cmp byte [ebp - 3], 0x3a
jne 0x416818
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416832
cmp byte [ebp - 3], 0x3a
jne 0x416832
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41685c
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41685c
cmp byte [ebp - 7], 0x3a
jne 0x41685c
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416894
call esi
test eax, eax
je 0x416880
cmp byte [ebp - 3], 0x3a
jne 0x416880
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4168a8
call esi
test eax, eax
je 0x4168a8
cmp byte [ebp - 3], 0x3a
jne 0x4168a8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4168c2
cmp byte [ebp - 3], 0x3a
jne 0x4168c2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4168f1
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4168f1
cmp byte [ebp - 7], 0x3a
jne 0x4168f1
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416929
call esi
test eax, eax
je 0x416915
cmp byte [ebp - 3], 0x3a
jne 0x416915
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41693d
call esi
test eax, eax
je 0x41693d
cmp byte [ebp - 3], 0x3a
jne 0x41693d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416957
cmp byte [ebp - 3], 0x3a
jne 0x416957
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416985
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416985
cmp byte [ebp - 7], 0x3a
jne 0x416985
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4169bd
call esi
test eax, eax
je 0x4169a9
cmp byte [ebp - 3], 0x3a
jne 0x4169a9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4169d1
call esi
test eax, eax
je 0x4169d1
cmp byte [ebp - 3], 0x3a
jne 0x4169d1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4169eb
cmp byte [ebp - 3], 0x3a
jne 0x4169eb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416a19
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416a19
cmp byte [ebp - 7], 0x3a
jne 0x416a19
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416a51
call esi
test eax, eax
je 0x416a3d
cmp byte [ebp - 3], 0x3a
jne 0x416a3d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416a65
call esi
test eax, eax
je 0x416a65
cmp byte [ebp - 3], 0x3a
jne 0x416a65
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416a7f
cmp byte [ebp - 3], 0x3a
jne 0x416a7f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416aab
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416aab
cmp byte [ebp - 7], 0x3a
jne 0x416aab
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416ae3
call esi
test eax, eax
je 0x416acf
cmp byte [ebp - 3], 0x3a
jne 0x416acf
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416af7
call esi
test eax, eax
je 0x416af7
cmp byte [ebp - 3], 0x3a
jne 0x416af7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416b11
cmp byte [ebp - 3], 0x3a
jne 0x416b11
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416b41
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416b41
cmp byte [ebp - 7], 0x3a
jne 0x416b41
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416b79
call esi
test eax, eax
je 0x416b65
cmp byte [ebp - 3], 0x3a
jne 0x416b65
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416b8d
call esi
test eax, eax
je 0x416b8d
cmp byte [ebp - 3], 0x3a
jne 0x416b8d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416ba7
cmp byte [ebp - 3], 0x3a
jne 0x416ba7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416be0
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416be0
cmp byte [ebp - 7], 0x3a
jne 0x416be0
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416c18
call esi
test eax, eax
je 0x416c04
cmp byte [ebp - 3], 0x3a
jne 0x416c04
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416c2c
call esi
test eax, eax
je 0x416c2c
cmp byte [ebp - 3], 0x3a
jne 0x416c2c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416c46
cmp byte [ebp - 3], 0x3a
jne 0x416c46
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416c75
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416c75
cmp byte [ebp - 7], 0x3a
jne 0x416c75
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416cad
call esi
test eax, eax
je 0x416c99
cmp byte [ebp - 3], 0x3a
jne 0x416c99
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416cc1
call esi
test eax, eax
je 0x416cc1
cmp byte [ebp - 3], 0x3a
jne 0x416cc1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416cdb
cmp byte [ebp - 3], 0x3a
jne 0x416cdb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416d07
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416d07
cmp byte [ebp - 7], 0x3a
jne 0x416d07
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416d3f
call esi
test eax, eax
je 0x416d2b
cmp byte [ebp - 3], 0x3a
jne 0x416d2b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416d53
call esi
test eax, eax
je 0x416d53
cmp byte [ebp - 3], 0x3a
jne 0x416d53
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416d6d
cmp byte [ebp - 3], 0x3a
jne 0x416d6d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416d9d
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416d9d
cmp byte [ebp - 7], 0x3a
jne 0x416d9d
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416dd5
call esi
test eax, eax
je 0x416dc1
cmp byte [ebp - 3], 0x3a
jne 0x416dc1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416de9
call esi
test eax, eax
je 0x416de9
cmp byte [ebp - 3], 0x3a
jne 0x416de9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x416e03
cmp byte [ebp - 3], 0x3a
jne 0x416e03
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416e64
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416e64
cmp byte [ebp - 7], 0x3a
jne 0x416e64
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416e9c
call esi
test eax, eax
je 0x416e88
cmp byte [ebp - 3], 0x3a
jne 0x416e88
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416eb0
call esi
test eax, eax
je 0x416eb0
cmp byte [ebp - 3], 0x3a
jne 0x416eb0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
pop edi
pop esi
test eax, eax
je 0x416ecc
cmp byte [ebp - 3], 0x3a
jne 0x416ecc
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0x7d
push 0x39
push 0x39
push 0x31
push 0x37
push 0x38
push 0x33
pop eax
push eax
push 0x32
push eax
push 0x36
push 0x32
push 0x46
push 0x32
push 0x2d
pop ecx
push ecx
push 0x36
push 0x31
push 0x43
push 0x39
push ecx
push eax
push 0x65
push 0x31
push 0x34
push ecx
push eax
push 0x34
push 0x30
push 0x46
push ecx
push 0x44
push 0x46
push 0x30
push 0x34
push eax
push 0x37
push eax
push 0x41
lea eax, [ebp - 0x6c]
push 0x7b
push eax
call fcn.004105df
add esp, 0xa0
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4513d0]
push 0
push 0x1f0003
call dword [eax + 0x30]
test eax, eax
pop ebx
je 0x416f4b
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x44]
push 1
pop eax
leave
ret
xor eax, eax
leave
ret