Function at 0x431826
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x44c81a
call fcn.0044bd20
sub esp, 0x51c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov edi, ecx
xor ebx, ebx
test eax, eax
mov dword [ebp - 0x18], edi
jne 0x4326b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431872
cmp byte [ebp - 0xf], 0x3a
jne 0x431872
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4318b0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43189d
cmp byte [ebp - 0xf], 0x3a
jne 0x43189d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4318cb
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4318cb
cmp byte [ebp - 0xf], 0x3a
jne 0x4318cb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4318e6
cmp byte [ebp - 0xf], 0x3a
jne 0x4318e6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431924
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431911
cmp byte [ebp - 0xf], 0x3a
jne 0x431911
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43193f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43193f
cmp byte [ebp - 0xf], 0x3a
jne 0x43193f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431972
cmp byte [ebp - 0xf], 0x3a
jne 0x431972
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4319b0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43199d
cmp byte [ebp - 0xf], 0x3a
jne 0x43199d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4319cb
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4319cb
cmp byte [ebp - 0xf], 0x3a
jne 0x4319cb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4319f2
cmp byte [ebp - 0xf], 0x3a
jne 0x4319f2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431a30
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431a1d
cmp byte [ebp - 0xf], 0x3a
jne 0x431a1d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431a4b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431a4b
cmp byte [ebp - 0xf], 0x3a
jne 0x431a4b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431a6d
cmp byte [ebp - 0xf], 0x3a
jne 0x431a6d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431aab
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431a98
cmp byte [ebp - 0xf], 0x3a
jne 0x431a98
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431ac6
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431ac6
cmp byte [ebp - 0xf], 0x3a
jne 0x431ac6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431ae8
cmp byte [ebp - 0xf], 0x3a
jne 0x431ae8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431b26
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431b13
cmp byte [ebp - 0xf], 0x3a
jne 0x431b13
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431b41
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431b41
cmp byte [ebp - 0xf], 0x3a
jne 0x431b41
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431b6f
cmp byte [ebp - 0xf], 0x3a
jne 0x431b6f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431bad
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431b9a
cmp byte [ebp - 0xf], 0x3a
jne 0x431b9a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431bc8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431bc8
cmp byte [ebp - 0xf], 0x3a
jne 0x431bc8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431c04
cmp byte [ebp - 0xf], 0x3a
jne 0x431c04
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431c42
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431c2f
cmp byte [ebp - 0xf], 0x3a
jne 0x431c2f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431c5d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431c5d
cmp byte [ebp - 0xf], 0x3a
jne 0x431c5d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431c88
cmp byte [ebp - 0xf], 0x3a
jne 0x431c88
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431cc6
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431cb3
cmp byte [ebp - 0xf], 0x3a
jne 0x431cb3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431ce1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431ce1
cmp byte [ebp - 0xf], 0x3a
jne 0x431ce1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431d0b
cmp byte [ebp - 0xf], 0x3a
jne 0x431d0b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431d49
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431d36
cmp byte [ebp - 0xf], 0x3a
jne 0x431d36
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431d64
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431d64
cmp byte [ebp - 0xf], 0x3a
jne 0x431d64
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431d91
cmp byte [ebp - 0xf], 0x3a
jne 0x431d91
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431dcf
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431dbc
cmp byte [ebp - 0xf], 0x3a
jne 0x431dbc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431dea
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431dea
cmp byte [ebp - 0xf], 0x3a
jne 0x431dea
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431e1d
cmp byte [ebp - 0xf], 0x3a
jne 0x431e1d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431e5b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431e48
cmp byte [ebp - 0xf], 0x3a
jne 0x431e48
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431e76
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431e76
cmp byte [ebp - 0xf], 0x3a
jne 0x431e76
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431ea5
cmp byte [ebp - 0xf], 0x3a
jne 0x431ea5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431ee3
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431ed0
cmp byte [ebp - 0xf], 0x3a
jne 0x431ed0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431efe
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431efe
cmp byte [ebp - 0xf], 0x3a
jne 0x431efe
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431f20
cmp byte [ebp - 0xf], 0x3a
jne 0x431f20
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431f5e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431f4b
cmp byte [ebp - 0xf], 0x3a
jne 0x431f4b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431f79
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431f79
cmp byte [ebp - 0xf], 0x3a
jne 0x431f79
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x431f9b
cmp byte [ebp - 0xf], 0x3a
jne 0x431f9b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x431fd9
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431fc6
cmp byte [ebp - 0xf], 0x3a
jne 0x431fc6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x431ff4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431ff4
cmp byte [ebp - 0xf], 0x3a
jne 0x431ff4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43201e
cmp byte [ebp - 0xf], 0x3a
jne 0x43201e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43205c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432049
cmp byte [ebp - 0xf], 0x3a
jne 0x432049
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x432077
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432077
cmp byte [ebp - 0xf], 0x3a
jne 0x432077
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4320a2
cmp byte [ebp - 0xf], 0x3a
jne 0x4320a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4320e0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4320cd
cmp byte [ebp - 0xf], 0x3a
jne 0x4320cd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4320fb
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4320fb
cmp byte [ebp - 0xf], 0x3a
jne 0x4320fb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x432126
cmp byte [ebp - 0xf], 0x3a
jne 0x432126
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x432164
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432151
cmp byte [ebp - 0xf], 0x3a
jne 0x432151
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43217f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43217f
cmp byte [ebp - 0xf], 0x3a
jne 0x43217f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4321a9
cmp byte [ebp - 0xf], 0x3a
jne 0x4321a9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4321e7
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4321d4
cmp byte [ebp - 0xf], 0x3a
jne 0x4321d4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x432202
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432202
cmp byte [ebp - 0xf], 0x3a
jne 0x432202
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x432226
cmp byte [ebp - 0xf], 0x3a
jne 0x432226
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x432264
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432251
cmp byte [ebp - 0xf], 0x3a
jne 0x432251
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43227f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43227f
cmp byte [ebp - 0xf], 0x3a
jne 0x43227f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4322a8
cmp byte [ebp - 0xf], 0x3a
jne 0x4322a8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4322e6
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4322d3
cmp byte [ebp - 0xf], 0x3a
jne 0x4322d3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x432301
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432301
cmp byte [ebp - 0xf], 0x3a
jne 0x432301
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43232a
cmp byte [ebp - 0xf], 0x3a
jne 0x43232a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x432368
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432355
cmp byte [ebp - 0xf], 0x3a
jne 0x432355
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x432383
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432383
cmp byte [ebp - 0xf], 0x3a
jne 0x432383
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4323b1
cmp byte [ebp - 0xf], 0x3a
jne 0x4323b1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4323ef
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4323dc
cmp byte [ebp - 0xf], 0x3a
jne 0x4323dc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43240a
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43240a
cmp byte [ebp - 0xf], 0x3a
jne 0x43240a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x432433
cmp byte [ebp - 0xf], 0x3a
jne 0x432433
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x432471
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43245e
cmp byte [ebp - 0xf], 0x3a
jne 0x43245e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43248c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43248c
cmp byte [ebp - 0xf], 0x3a
jne 0x43248c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4324ae
cmp byte [ebp - 0xf], 0x3a
jne 0x4324ae
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4324ec
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4324d9
cmp byte [ebp - 0xf], 0x3a
jne 0x4324d9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x432507
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432507
cmp byte [ebp - 0xf], 0x3a
jne 0x432507
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x432530
cmp byte [ebp - 0xf], 0x3a
jne 0x432530
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43256e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43255b
cmp byte [ebp - 0xf], 0x3a
jne 0x43255b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x432589
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432589
cmp byte [ebp - 0xf], 0x3a
jne 0x432589
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4325b3
cmp byte [ebp - 0xf], 0x3a
jne 0x4325b3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4325f1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4325de
cmp byte [ebp - 0xf], 0x3a
jne 0x4325de
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43260c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43260c
cmp byte [ebp - 0xf], 0x3a
jne 0x43260c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x432637
cmp byte [ebp - 0xf], 0x3a
jne 0x432637
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x432675
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432662
cmp byte [ebp - 0xf], 0x3a
jne 0x432662
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x432690
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x432690
cmp byte [ebp - 0xf], 0x3a
jne 0x432690
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
push 0x5e
lea eax, [eax + ecx - 0x5e]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
add esp, 0xc
lea eax, [eax + ecx - 0x62]
lea ecx, [ebp - 0x320]
push 4
push eax
call fcn.00439243
lea eax, [ebp - 0x84]
push 0x5e
push eax
lea ecx, [ebp - 0x320]
mov dword [ebp - 4], ebx
call fcn.004392e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x320]
call fcn.004392de
push edi
push 0x4337f6
call fcn.004394c1
pop ecx
cmp dword [ebp - 0x84], 3
pop ecx
lea eax, [ebp - 0x6c]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push eax
push dword [ebp - 0x70]
jne 0x432748
sub esp, 0x10
lea esi, [ebp - 0x80]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push ebx
movsd dword es:[edi], dword [esi]
call fcn.0043942c
mov edi, dword [ebp - 0x18]
add esp, 0x28
jmp 0x432752
push ebx
push ebx
call fcn.004393c6
add esp, 0x18
push ebx
push 0x7d
push 0x39
push 0x39
push 0x31
push 0x37
push 0x38
push 0x33
pop eax
push eax
push 0x32
push eax
push 0x36
push 0x32
push 0x46
push 0x32
push 0x2d
pop esi
push esi
push 0x36
push 0x31
push 0x43
push 0x39
push esi
push eax
push 0x65
push 0x31
push 0x34
push esi
push eax
push 0x34
push 0x30
push 0x46
push esi
push 0x44
push 0x46
push 0x30
push 0x34
push eax
push 0x37
push eax
push 0x41
lea eax, [ebp - 0xf8]
push 0x7b
push eax
call fcn.004171ee
add esp, 0xa0
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [0x4543d0]
push ebx
push 1
push ebx
call dword [eax + 0x68]
push ebx
mov dword [edi + 0xc], eax
mov eax, dword [0x4543d0]
push ebx
push 1
push ebx
call dword [eax + 0x68]
push ebx
push 0x7d
push 0x34
mov dword [edi + 0x10], eax
pop ecx
push ecx
push 0x33
pop eax
push eax
push 0x36
push 0x31
push 0x43
push 0x38
push 0x35
push 0x44
push 0x39
push 0x36
push 0x42
push 0x37
push esi
push 0x46
push 0x46
push 0x42
push 0x41
push esi
push 0x66
push 0x36
push ecx
push ecx
push esi
push 0x32
push 0x38
push ecx
push 0x39
push esi
push 0x41
push eax
push 0x46
push eax
push eax
push 0x44
push eax
push 0x38
lea eax, [ebp - 0xf8]
push 0x7b
push eax
call fcn.004171ee
add esp, 0xa0
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [0x4543d0]
push ebx
push 1
push ebx
call dword [eax + 0x68]
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x14], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push ebx
push eax
mov eax, dword [0x4543d0]
push 3
call dword [eax + 0x80]
sub eax, ebx
je 0x4329d9
dec eax
je 0x4329c4
dec eax
jne 0x4329de
push dword [edi + 0x14]
mov eax, dword [0x4543d0]
call dword [eax + 0x7c]
push 0x5e
push ebx
push dword [edi + 8]
lea ecx, [ebp - 0x150]
push dword [edi + 4]
call fcn.004390af
lea eax, [ebp - 0x94]
lea ecx, [ebp - 0x150]
push eax
mov dword [ebp - 4], 1
call fcn.00439192
lea eax, [ebp - 0x424]
push eax
mov eax, dword [0x4543d0]
push 0x104
call dword [eax + 0x54]
push ebx
push 0x73
push 0x25
push 0x73
lea eax, [ebp - 0x218]
push 0x25
push eax
call fcn.004171ee
add esp, 0x18
push ebx
push 0x74
push 0x61
push 0x64
push 0x2e
push 0x7d
push 0x43
pop eax
push eax
push 0x32
pop ecx
push ecx
push 0x37
push ecx
push eax
push ecx
push 0x45
push eax
push 0x31
push 0x44
push 0x35
push 0x31
push esi
push 0x30
push 0x31
push eax
push 0x41
push esi
push 0x65
push 0x64
push 0x63
push 0x34
push esi
push 0x38
push 0x34
push 0x45
push 0x45
push esi
push 0x41
push 0x39
push 0x46
push eax
push 0x34
push ecx
push 0x46
push 0x46
lea eax, [ebp - 0x1b4]
push 0x7b
push eax
call fcn.004171ee
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x528]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1dc]
add esp, 0xc0
lea eax, [ebp - 0x528]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x50]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x4329b0
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x94]
push 0x10
push eax
push dword [ebp - 0x14]
mov eax, dword [0x4543d0]
call dword [eax + 0x78]
push dword [ebp - 0x14]
mov eax, dword [0x4543d0]
call dword [eax + 0x44]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.00439160
jmp 0x432850
push dword [edi + 0x10]
mov eax, dword [0x4543d0]
call dword [eax + 0x7c]
call fcn.004394a2
jmp 0x432850
call fcn.004394a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret