Function at 0x436120
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x44c843
call fcn.0044bd20
mov eax, 0x3f7c4
call fcn.0044bd50
push ebx
push esi
lea eax, [ebp - 0x18]
mov esi, ecx
xor ebx, ebx
push edi
test eax, eax
mov dword [ebp - 0x18], esi
jne 0x436ed7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436170
cmp byte [ebp - 0xf], 0x3a
jne 0x436170
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4361b0
call edi
test eax, eax
je 0x43619d
cmp byte [ebp - 0xf], 0x3a
jne 0x43619d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4361c7
call edi
test eax, eax
je 0x4361c7
cmp byte [ebp - 0xf], 0x3a
jne 0x4361c7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4361e2
cmp byte [ebp - 0xf], 0x3a
jne 0x4361e2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43621c
call edi
test eax, eax
je 0x436209
cmp byte [ebp - 0xf], 0x3a
jne 0x436209
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436233
call edi
test eax, eax
je 0x436233
cmp byte [ebp - 0xf], 0x3a
jne 0x436233
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436266
cmp byte [ebp - 0xf], 0x3a
jne 0x436266
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4362a0
call edi
test eax, eax
je 0x43628d
cmp byte [ebp - 0xf], 0x3a
jne 0x43628d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4362b7
call edi
test eax, eax
je 0x4362b7
cmp byte [ebp - 0xf], 0x3a
jne 0x4362b7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4362de
cmp byte [ebp - 0xf], 0x3a
jne 0x4362de
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436318
call edi
test eax, eax
je 0x436305
cmp byte [ebp - 0xf], 0x3a
jne 0x436305
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43632f
call edi
test eax, eax
je 0x43632f
cmp byte [ebp - 0xf], 0x3a
jne 0x43632f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436351
cmp byte [ebp - 0xf], 0x3a
jne 0x436351
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43638b
call edi
test eax, eax
je 0x436378
cmp byte [ebp - 0xf], 0x3a
jne 0x436378
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4363a2
call edi
test eax, eax
je 0x4363a2
cmp byte [ebp - 0xf], 0x3a
jne 0x4363a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4363c4
cmp byte [ebp - 0xf], 0x3a
jne 0x4363c4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4363fe
call edi
test eax, eax
je 0x4363eb
cmp byte [ebp - 0xf], 0x3a
jne 0x4363eb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436415
call edi
test eax, eax
je 0x436415
cmp byte [ebp - 0xf], 0x3a
jne 0x436415
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436443
cmp byte [ebp - 0xf], 0x3a
jne 0x436443
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43647d
call edi
test eax, eax
je 0x43646a
cmp byte [ebp - 0xf], 0x3a
jne 0x43646a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436494
call edi
test eax, eax
je 0x436494
cmp byte [ebp - 0xf], 0x3a
jne 0x436494
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4364d0
cmp byte [ebp - 0xf], 0x3a
jne 0x4364d0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43650a
call edi
test eax, eax
je 0x4364f7
cmp byte [ebp - 0xf], 0x3a
jne 0x4364f7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436521
call edi
test eax, eax
je 0x436521
cmp byte [ebp - 0xf], 0x3a
jne 0x436521
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43654c
cmp byte [ebp - 0xf], 0x3a
jne 0x43654c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436586
call edi
test eax, eax
je 0x436573
cmp byte [ebp - 0xf], 0x3a
jne 0x436573
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43659d
call edi
test eax, eax
je 0x43659d
cmp byte [ebp - 0xf], 0x3a
jne 0x43659d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4365c7
cmp byte [ebp - 0xf], 0x3a
jne 0x4365c7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436601
call edi
test eax, eax
je 0x4365ee
cmp byte [ebp - 0xf], 0x3a
jne 0x4365ee
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436618
call edi
test eax, eax
je 0x436618
cmp byte [ebp - 0xf], 0x3a
jne 0x436618
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436645
cmp byte [ebp - 0xf], 0x3a
jne 0x436645
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43667f
call edi
test eax, eax
je 0x43666c
cmp byte [ebp - 0xf], 0x3a
jne 0x43666c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436696
call edi
test eax, eax
je 0x436696
cmp byte [ebp - 0xf], 0x3a
jne 0x436696
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4366c9
cmp byte [ebp - 0xf], 0x3a
jne 0x4366c9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436703
call edi
test eax, eax
je 0x4366f0
cmp byte [ebp - 0xf], 0x3a
jne 0x4366f0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43671a
call edi
test eax, eax
je 0x43671a
cmp byte [ebp - 0xf], 0x3a
jne 0x43671a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436749
cmp byte [ebp - 0xf], 0x3a
jne 0x436749
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436783
call edi
test eax, eax
je 0x436770
cmp byte [ebp - 0xf], 0x3a
jne 0x436770
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43679a
call edi
test eax, eax
je 0x43679a
cmp byte [ebp - 0xf], 0x3a
jne 0x43679a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4367bc
cmp byte [ebp - 0xf], 0x3a
jne 0x4367bc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4367f6
call edi
test eax, eax
je 0x4367e3
cmp byte [ebp - 0xf], 0x3a
jne 0x4367e3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43680d
call edi
test eax, eax
je 0x43680d
cmp byte [ebp - 0xf], 0x3a
jne 0x43680d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43682f
cmp byte [ebp - 0xf], 0x3a
jne 0x43682f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436869
call edi
test eax, eax
je 0x436856
cmp byte [ebp - 0xf], 0x3a
jne 0x436856
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436880
call edi
test eax, eax
je 0x436880
cmp byte [ebp - 0xf], 0x3a
jne 0x436880
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4368aa
cmp byte [ebp - 0xf], 0x3a
jne 0x4368aa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4368e4
call edi
test eax, eax
je 0x4368d1
cmp byte [ebp - 0xf], 0x3a
jne 0x4368d1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4368fb
call edi
test eax, eax
je 0x4368fb
cmp byte [ebp - 0xf], 0x3a
jne 0x4368fb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436926
cmp byte [ebp - 0xf], 0x3a
jne 0x436926
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436960
call edi
test eax, eax
je 0x43694d
cmp byte [ebp - 0xf], 0x3a
jne 0x43694d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436977
call edi
test eax, eax
je 0x436977
cmp byte [ebp - 0xf], 0x3a
jne 0x436977
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4369a2
cmp byte [ebp - 0xf], 0x3a
jne 0x4369a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4369dc
call edi
test eax, eax
je 0x4369c9
cmp byte [ebp - 0xf], 0x3a
jne 0x4369c9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4369f3
call edi
test eax, eax
je 0x4369f3
cmp byte [ebp - 0xf], 0x3a
jne 0x4369f3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436a1d
cmp byte [ebp - 0xf], 0x3a
jne 0x436a1d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436a57
call edi
test eax, eax
je 0x436a44
cmp byte [ebp - 0xf], 0x3a
jne 0x436a44
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436a6e
call edi
test eax, eax
je 0x436a6e
cmp byte [ebp - 0xf], 0x3a
jne 0x436a6e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436a92
cmp byte [ebp - 0xf], 0x3a
jne 0x436a92
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436acc
call edi
test eax, eax
je 0x436ab9
cmp byte [ebp - 0xf], 0x3a
jne 0x436ab9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436ae3
call edi
test eax, eax
je 0x436ae3
cmp byte [ebp - 0xf], 0x3a
jne 0x436ae3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436b0c
cmp byte [ebp - 0xf], 0x3a
jne 0x436b0c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436b46
call edi
test eax, eax
je 0x436b33
cmp byte [ebp - 0xf], 0x3a
jne 0x436b33
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436b5d
call edi
test eax, eax
je 0x436b5d
cmp byte [ebp - 0xf], 0x3a
jne 0x436b5d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436b86
cmp byte [ebp - 0xf], 0x3a
jne 0x436b86
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436bc0
call edi
test eax, eax
je 0x436bad
cmp byte [ebp - 0xf], 0x3a
jne 0x436bad
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436bd7
call edi
test eax, eax
je 0x436bd7
cmp byte [ebp - 0xf], 0x3a
jne 0x436bd7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436c05
cmp byte [ebp - 0xf], 0x3a
jne 0x436c05
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436c3f
call edi
test eax, eax
je 0x436c2c
cmp byte [ebp - 0xf], 0x3a
jne 0x436c2c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436c56
call edi
test eax, eax
je 0x436c56
cmp byte [ebp - 0xf], 0x3a
jne 0x436c56
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436c7f
cmp byte [ebp - 0xf], 0x3a
jne 0x436c7f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436cb9
call edi
test eax, eax
je 0x436ca6
cmp byte [ebp - 0xf], 0x3a
jne 0x436ca6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436cd0
call edi
test eax, eax
je 0x436cd0
cmp byte [ebp - 0xf], 0x3a
jne 0x436cd0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436cf2
cmp byte [ebp - 0xf], 0x3a
jne 0x436cf2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436d2c
call edi
test eax, eax
je 0x436d19
cmp byte [ebp - 0xf], 0x3a
jne 0x436d19
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436d43
call edi
test eax, eax
je 0x436d43
cmp byte [ebp - 0xf], 0x3a
jne 0x436d43
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436d6c
cmp byte [ebp - 0xf], 0x3a
jne 0x436d6c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436da6
call edi
test eax, eax
je 0x436d93
cmp byte [ebp - 0xf], 0x3a
jne 0x436d93
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436dbd
call edi
test eax, eax
je 0x436dbd
cmp byte [ebp - 0xf], 0x3a
jne 0x436dbd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436de7
cmp byte [ebp - 0xf], 0x3a
jne 0x436de7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436e21
call edi
test eax, eax
je 0x436e0e
cmp byte [ebp - 0xf], 0x3a
jne 0x436e0e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436e38
call edi
test eax, eax
je 0x436e38
cmp byte [ebp - 0xf], 0x3a
jne 0x436e38
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x436e63
cmp byte [ebp - 0xf], 0x3a
jne 0x436e63
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x436e9d
call edi
test eax, eax
je 0x436e8a
cmp byte [ebp - 0xf], 0x3a
jne 0x436e8a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x436eb4
call edi
test eax, eax
je 0x436eb4
cmp byte [ebp - 0xf], 0x3a
jne 0x436eb4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, dword [ebp - 0x18]
mov eax, dword [0x4543d0]
push 0x7530
push dword [esi + 0x18]
call dword [eax + 0x70]
cmp eax, ebx
je 0x436ff1
cmp eax, 0xffffffff
je 0x436ff1
push 0x1fbd0
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x3f7d0]
mov dword [ebp - 0x1c], ebx
call fcn.00421454
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x3f7d0]
push eax
mov dword [ebp - 4], ebx
push dword [ebp - 0x20]
call fcn.00422fe8
cmp dword [ebp - 0x1c], ebx
je 0x436f73
mov eax, dword [0x4543d0]
push 0xbb8
push dword [esi + 0x18]
call dword [eax + 0x70]
cmp eax, ebx
je 0x436fe2
cmp eax, 0xffffffff
je 0x436fe2
xor edi, edi
cmp dword [ebp - 0x1c], ebx
jle 0x436f73
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00437000
add dword [ebp - 0x18], 0x104
inc edi
cmp edi, dword [ebp - 0x1c]
jl 0x436f5c
mov eax, dword [0x4543d0]
push 0x1388
push dword [esi + 0x18]
call dword [eax + 0x70]
cmp eax, ebx
je 0x436fe2
cmp eax, 0xffffffff
je 0x436fe2
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x3f7d0]
push eax
push dword [ebp - 0x20]
call fcn.00423e6e
cmp dword [ebp - 0x1c], ebx
je 0x436f73
mov eax, dword [0x4543d0]
push 0xbb8
push dword [esi + 0x18]
call dword [eax + 0x70]
cmp eax, ebx
je 0x436fe2
cmp eax, 0xffffffff
je 0x436fe2
xor edi, edi
cmp dword [ebp - 0x1c], ebx
jle 0x436f73
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00437000
add dword [ebp - 0x18], 0x104
inc edi
cmp edi, dword [ebp - 0x1c]
jl 0x436fc9
jmp 0x436f73
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f7d0]
call fcn.0042222e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret