Function at 0x410e99
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x44c7c0
call fcn.0044bd20
sub esp, 0x10
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x411c41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410edd
cmp byte [ebp - 0xf], 0x3a
jne 0x410edd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410f1d
call edi
test eax, eax
je 0x410f0a
cmp byte [ebp - 0xf], 0x3a
jne 0x410f0a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410f34
call edi
test eax, eax
je 0x410f34
cmp byte [ebp - 0xf], 0x3a
jne 0x410f34
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410f4f
cmp byte [ebp - 0xf], 0x3a
jne 0x410f4f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410f89
call edi
test eax, eax
je 0x410f76
cmp byte [ebp - 0xf], 0x3a
jne 0x410f76
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410fa0
call edi
test eax, eax
je 0x410fa0
cmp byte [ebp - 0xf], 0x3a
jne 0x410fa0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410fd3
cmp byte [ebp - 0xf], 0x3a
jne 0x410fd3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41100d
call edi
test eax, eax
je 0x410ffa
cmp byte [ebp - 0xf], 0x3a
jne 0x410ffa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411024
call edi
test eax, eax
je 0x411024
cmp byte [ebp - 0xf], 0x3a
jne 0x411024
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41104b
cmp byte [ebp - 0xf], 0x3a
jne 0x41104b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411085
call edi
test eax, eax
je 0x411072
cmp byte [ebp - 0xf], 0x3a
jne 0x411072
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41109c
call edi
test eax, eax
je 0x41109c
cmp byte [ebp - 0xf], 0x3a
jne 0x41109c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4110be
cmp byte [ebp - 0xf], 0x3a
jne 0x4110be
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4110f8
call edi
test eax, eax
je 0x4110e5
cmp byte [ebp - 0xf], 0x3a
jne 0x4110e5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41110f
call edi
test eax, eax
je 0x41110f
cmp byte [ebp - 0xf], 0x3a
jne 0x41110f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411131
cmp byte [ebp - 0xf], 0x3a
jne 0x411131
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41116b
call edi
test eax, eax
je 0x411158
cmp byte [ebp - 0xf], 0x3a
jne 0x411158
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411182
call edi
test eax, eax
je 0x411182
cmp byte [ebp - 0xf], 0x3a
jne 0x411182
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4111b0
cmp byte [ebp - 0xf], 0x3a
jne 0x4111b0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4111ea
call edi
test eax, eax
je 0x4111d7
cmp byte [ebp - 0xf], 0x3a
jne 0x4111d7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411201
call edi
test eax, eax
je 0x411201
cmp byte [ebp - 0xf], 0x3a
jne 0x411201
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41123d
cmp byte [ebp - 0xf], 0x3a
jne 0x41123d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411277
call edi
test eax, eax
je 0x411264
cmp byte [ebp - 0xf], 0x3a
jne 0x411264
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41128e
call edi
test eax, eax
je 0x41128e
cmp byte [ebp - 0xf], 0x3a
jne 0x41128e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4112b9
cmp byte [ebp - 0xf], 0x3a
jne 0x4112b9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4112f3
call edi
test eax, eax
je 0x4112e0
cmp byte [ebp - 0xf], 0x3a
jne 0x4112e0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41130a
call edi
test eax, eax
je 0x41130a
cmp byte [ebp - 0xf], 0x3a
jne 0x41130a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411334
cmp byte [ebp - 0xf], 0x3a
jne 0x411334
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41136e
call edi
test eax, eax
je 0x41135b
cmp byte [ebp - 0xf], 0x3a
jne 0x41135b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411385
call edi
test eax, eax
je 0x411385
cmp byte [ebp - 0xf], 0x3a
jne 0x411385
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4113b2
cmp byte [ebp - 0xf], 0x3a
jne 0x4113b2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4113ec
call edi
test eax, eax
je 0x4113d9
cmp byte [ebp - 0xf], 0x3a
jne 0x4113d9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411403
call edi
test eax, eax
je 0x411403
cmp byte [ebp - 0xf], 0x3a
jne 0x411403
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411436
cmp byte [ebp - 0xf], 0x3a
jne 0x411436
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411470
call edi
test eax, eax
je 0x41145d
cmp byte [ebp - 0xf], 0x3a
jne 0x41145d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411487
call edi
test eax, eax
je 0x411487
cmp byte [ebp - 0xf], 0x3a
jne 0x411487
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4114b6
cmp byte [ebp - 0xf], 0x3a
jne 0x4114b6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4114f0
call edi
test eax, eax
je 0x4114dd
cmp byte [ebp - 0xf], 0x3a
jne 0x4114dd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411507
call edi
test eax, eax
je 0x411507
cmp byte [ebp - 0xf], 0x3a
jne 0x411507
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411529
cmp byte [ebp - 0xf], 0x3a
jne 0x411529
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411563
call edi
test eax, eax
je 0x411550
cmp byte [ebp - 0xf], 0x3a
jne 0x411550
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41157a
call edi
test eax, eax
je 0x41157a
cmp byte [ebp - 0xf], 0x3a
jne 0x41157a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41159c
cmp byte [ebp - 0xf], 0x3a
jne 0x41159c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4115d6
call edi
test eax, eax
je 0x4115c3
cmp byte [ebp - 0xf], 0x3a
jne 0x4115c3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4115ed
call edi
test eax, eax
je 0x4115ed
cmp byte [ebp - 0xf], 0x3a
jne 0x4115ed
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411617
cmp byte [ebp - 0xf], 0x3a
jne 0x411617
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411651
call edi
test eax, eax
je 0x41163e
cmp byte [ebp - 0xf], 0x3a
jne 0x41163e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411668
call edi
test eax, eax
je 0x411668
cmp byte [ebp - 0xf], 0x3a
jne 0x411668
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411693
cmp byte [ebp - 0xf], 0x3a
jne 0x411693
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4116cd
call edi
test eax, eax
je 0x4116ba
cmp byte [ebp - 0xf], 0x3a
jne 0x4116ba
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4116e4
call edi
test eax, eax
je 0x4116e4
cmp byte [ebp - 0xf], 0x3a
jne 0x4116e4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41170f
cmp byte [ebp - 0xf], 0x3a
jne 0x41170f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411749
call edi
test eax, eax
je 0x411736
cmp byte [ebp - 0xf], 0x3a
jne 0x411736
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411760
call edi
test eax, eax
je 0x411760
cmp byte [ebp - 0xf], 0x3a
jne 0x411760
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41178a
cmp byte [ebp - 0xf], 0x3a
jne 0x41178a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4117c4
call edi
test eax, eax
je 0x4117b1
cmp byte [ebp - 0xf], 0x3a
jne 0x4117b1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4117db
call edi
test eax, eax
je 0x4117db
cmp byte [ebp - 0xf], 0x3a
jne 0x4117db
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4117ff
cmp byte [ebp - 0xf], 0x3a
jne 0x4117ff
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411839
call edi
test eax, eax
je 0x411826
cmp byte [ebp - 0xf], 0x3a
jne 0x411826
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411850
call edi
test eax, eax
je 0x411850
cmp byte [ebp - 0xf], 0x3a
jne 0x411850
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411879
cmp byte [ebp - 0xf], 0x3a
jne 0x411879
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4118b3
call edi
test eax, eax
je 0x4118a0
cmp byte [ebp - 0xf], 0x3a
jne 0x4118a0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4118ca
call edi
test eax, eax
je 0x4118ca
cmp byte [ebp - 0xf], 0x3a
jne 0x4118ca
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4118f3
cmp byte [ebp - 0xf], 0x3a
jne 0x4118f3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41192d
call edi
test eax, eax
je 0x41191a
cmp byte [ebp - 0xf], 0x3a
jne 0x41191a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411944
call edi
test eax, eax
je 0x411944
cmp byte [ebp - 0xf], 0x3a
jne 0x411944
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411972
cmp byte [ebp - 0xf], 0x3a
jne 0x411972
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4119ac
call edi
test eax, eax
je 0x411999
cmp byte [ebp - 0xf], 0x3a
jne 0x411999
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4119c3
call edi
test eax, eax
je 0x4119c3
cmp byte [ebp - 0xf], 0x3a
jne 0x4119c3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4119ec
cmp byte [ebp - 0xf], 0x3a
jne 0x4119ec
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411a26
call edi
test eax, eax
je 0x411a13
cmp byte [ebp - 0xf], 0x3a
jne 0x411a13
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411a3d
call edi
test eax, eax
je 0x411a3d
cmp byte [ebp - 0xf], 0x3a
jne 0x411a3d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411a5f
cmp byte [ebp - 0xf], 0x3a
jne 0x411a5f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411a99
call edi
test eax, eax
je 0x411a86
cmp byte [ebp - 0xf], 0x3a
jne 0x411a86
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411ab0
call edi
test eax, eax
je 0x411ab0
cmp byte [ebp - 0xf], 0x3a
jne 0x411ab0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411ad9
cmp byte [ebp - 0xf], 0x3a
jne 0x411ad9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411b13
call edi
test eax, eax
je 0x411b00
cmp byte [ebp - 0xf], 0x3a
jne 0x411b00
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411b2a
call edi
test eax, eax
je 0x411b2a
cmp byte [ebp - 0xf], 0x3a
jne 0x411b2a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411b54
cmp byte [ebp - 0xf], 0x3a
jne 0x411b54
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411b8e
call edi
test eax, eax
je 0x411b7b
cmp byte [ebp - 0xf], 0x3a
jne 0x411b7b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411ba5
call edi
test eax, eax
je 0x411ba5
cmp byte [ebp - 0xf], 0x3a
jne 0x411ba5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411bd0
cmp byte [ebp - 0xf], 0x3a
jne 0x411bd0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411c0a
call edi
test eax, eax
je 0x411bf7
cmp byte [ebp - 0xf], 0x3a
jne 0x411bf7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411c21
call edi
test eax, eax
je 0x411c21
cmp byte [ebp - 0xf], 0x3a
jne 0x411c21
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x20
lea ecx, [ebp - 0x14]
pop esi
mov dword [ebp - 0x10], 0x30
call fcn.00438027
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push edi
push esi
push 0x30
mov dword [ebp - 4], ebx
call fcn.00438053
test eax, eax
jne 0x411d57
push 0x18
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x30
call fcn.00438053
test eax, eax
jne 0x411d57
push 8
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x30
call fcn.00438053
test eax, eax
jne 0x411d57
push 4
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x30
call fcn.00438053
test eax, eax
jne 0x411d57
push 0x20
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push esi
mov dword [ebp - 0x10], esi
call fcn.00438053
test eax, eax
jne 0x411d57
push 0x18
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x20
call fcn.00438053
test eax, eax
jne 0x411d57
push 8
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x20
call fcn.00438053
test eax, eax
jne 0x411d57
push 4
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x20
call fcn.00438053
test eax, eax
jne 0x411d57
push 0x10
lea ecx, [ebp - 0x14]
pop eax
push 0x20
mov dword [ebp - 0x10], eax
pop esi
push edi
push esi
push eax
call fcn.00438053
test eax, eax
jne 0x411d57
push 0x18
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x10
call fcn.00438053
test eax, eax
jne 0x411d57
push 8
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x10
call fcn.00438053
test eax, eax
jne 0x411d57
push 4
lea ecx, [ebp - 0x14]
pop esi
push edi
push esi
push 0x10
call fcn.00438053
test eax, eax
jne 0x411d57
xor esi, esi
cmp esi, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0x411d91
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ebp - 0x10]
call fcn.00438091
test eax, eax
je 0x411d91
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ecx], eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0043804c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc