Function at 0x40d644
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x44c797
call fcn.0044bd20
sub esp, 0xbc
push ebx
push esi
lea eax, [ebp - 0x18]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test eax, eax
jne 0x40e3f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d68f
cmp byte [ebp - 0xf], 0x3a
jne 0x40d68f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d6d0
call edi
test eax, eax
je 0x40d6bd
cmp byte [ebp - 0xf], 0x3a
jne 0x40d6bd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40d6e7
call edi
test eax, eax
je 0x40d6e7
cmp byte [ebp - 0xf], 0x3a
jne 0x40d6e7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d702
cmp byte [ebp - 0xf], 0x3a
jne 0x40d702
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d73c
call edi
test eax, eax
je 0x40d729
cmp byte [ebp - 0xf], 0x3a
jne 0x40d729
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40d753
call edi
test eax, eax
je 0x40d753
cmp byte [ebp - 0xf], 0x3a
jne 0x40d753
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d786
cmp byte [ebp - 0xf], 0x3a
jne 0x40d786
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d7c0
call edi
test eax, eax
je 0x40d7ad
cmp byte [ebp - 0xf], 0x3a
jne 0x40d7ad
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40d7d7
call edi
test eax, eax
je 0x40d7d7
cmp byte [ebp - 0xf], 0x3a
jne 0x40d7d7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d7fe
cmp byte [ebp - 0xf], 0x3a
jne 0x40d7fe
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d838
call edi
test eax, eax
je 0x40d825
cmp byte [ebp - 0xf], 0x3a
jne 0x40d825
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40d84f
call edi
test eax, eax
je 0x40d84f
cmp byte [ebp - 0xf], 0x3a
jne 0x40d84f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d871
cmp byte [ebp - 0xf], 0x3a
jne 0x40d871
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d8ab
call edi
test eax, eax
je 0x40d898
cmp byte [ebp - 0xf], 0x3a
jne 0x40d898
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40d8c2
call edi
test eax, eax
je 0x40d8c2
cmp byte [ebp - 0xf], 0x3a
jne 0x40d8c2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d8e4
cmp byte [ebp - 0xf], 0x3a
jne 0x40d8e4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d91e
call edi
test eax, eax
je 0x40d90b
cmp byte [ebp - 0xf], 0x3a
jne 0x40d90b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40d935
call edi
test eax, eax
je 0x40d935
cmp byte [ebp - 0xf], 0x3a
jne 0x40d935
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d963
cmp byte [ebp - 0xf], 0x3a
jne 0x40d963
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d99d
call edi
test eax, eax
je 0x40d98a
cmp byte [ebp - 0xf], 0x3a
jne 0x40d98a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40d9b4
call edi
test eax, eax
je 0x40d9b4
cmp byte [ebp - 0xf], 0x3a
jne 0x40d9b4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40d9f0
cmp byte [ebp - 0xf], 0x3a
jne 0x40d9f0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40da2a
call edi
test eax, eax
je 0x40da17
cmp byte [ebp - 0xf], 0x3a
jne 0x40da17
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40da41
call edi
test eax, eax
je 0x40da41
cmp byte [ebp - 0xf], 0x3a
jne 0x40da41
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40da6c
cmp byte [ebp - 0xf], 0x3a
jne 0x40da6c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40daa6
call edi
test eax, eax
je 0x40da93
cmp byte [ebp - 0xf], 0x3a
jne 0x40da93
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40dabd
call edi
test eax, eax
je 0x40dabd
cmp byte [ebp - 0xf], 0x3a
jne 0x40dabd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40dae7
cmp byte [ebp - 0xf], 0x3a
jne 0x40dae7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40db21
call edi
test eax, eax
je 0x40db0e
cmp byte [ebp - 0xf], 0x3a
jne 0x40db0e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40db38
call edi
test eax, eax
je 0x40db38
cmp byte [ebp - 0xf], 0x3a
jne 0x40db38
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40db65
cmp byte [ebp - 0xf], 0x3a
jne 0x40db65
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40db9f
call edi
test eax, eax
je 0x40db8c
cmp byte [ebp - 0xf], 0x3a
jne 0x40db8c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40dbb6
call edi
test eax, eax
je 0x40dbb6
cmp byte [ebp - 0xf], 0x3a
jne 0x40dbb6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40dbe9
cmp byte [ebp - 0xf], 0x3a
jne 0x40dbe9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dc23
call edi
test eax, eax
je 0x40dc10
cmp byte [ebp - 0xf], 0x3a
jne 0x40dc10
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40dc3a
call edi
test eax, eax
je 0x40dc3a
cmp byte [ebp - 0xf], 0x3a
jne 0x40dc3a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40dc69
cmp byte [ebp - 0xf], 0x3a
jne 0x40dc69
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dca3
call edi
test eax, eax
je 0x40dc90
cmp byte [ebp - 0xf], 0x3a
jne 0x40dc90
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40dcba
call edi
test eax, eax
je 0x40dcba
cmp byte [ebp - 0xf], 0x3a
jne 0x40dcba
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40dcdc
cmp byte [ebp - 0xf], 0x3a
jne 0x40dcdc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dd16
call edi
test eax, eax
je 0x40dd03
cmp byte [ebp - 0xf], 0x3a
jne 0x40dd03
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40dd2d
call edi
test eax, eax
je 0x40dd2d
cmp byte [ebp - 0xf], 0x3a
jne 0x40dd2d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40dd4f
cmp byte [ebp - 0xf], 0x3a
jne 0x40dd4f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dd89
call edi
test eax, eax
je 0x40dd76
cmp byte [ebp - 0xf], 0x3a
jne 0x40dd76
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40dda0
call edi
test eax, eax
je 0x40dda0
cmp byte [ebp - 0xf], 0x3a
jne 0x40dda0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ddca
cmp byte [ebp - 0xf], 0x3a
jne 0x40ddca
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40de04
call edi
test eax, eax
je 0x40ddf1
cmp byte [ebp - 0xf], 0x3a
jne 0x40ddf1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40de1b
call edi
test eax, eax
je 0x40de1b
cmp byte [ebp - 0xf], 0x3a
jne 0x40de1b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40de46
cmp byte [ebp - 0xf], 0x3a
jne 0x40de46
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40de80
call edi
test eax, eax
je 0x40de6d
cmp byte [ebp - 0xf], 0x3a
jne 0x40de6d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40de97
call edi
test eax, eax
je 0x40de97
cmp byte [ebp - 0xf], 0x3a
jne 0x40de97
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40dec2
cmp byte [ebp - 0xf], 0x3a
jne 0x40dec2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40defc
call edi
test eax, eax
je 0x40dee9
cmp byte [ebp - 0xf], 0x3a
jne 0x40dee9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40df13
call edi
test eax, eax
je 0x40df13
cmp byte [ebp - 0xf], 0x3a
jne 0x40df13
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40df3d
cmp byte [ebp - 0xf], 0x3a
jne 0x40df3d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40df77
call edi
test eax, eax
je 0x40df64
cmp byte [ebp - 0xf], 0x3a
jne 0x40df64
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40df8e
call edi
test eax, eax
je 0x40df8e
cmp byte [ebp - 0xf], 0x3a
jne 0x40df8e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40dfb2
cmp byte [ebp - 0xf], 0x3a
jne 0x40dfb2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dfec
call edi
test eax, eax
je 0x40dfd9
cmp byte [ebp - 0xf], 0x3a
jne 0x40dfd9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e003
call edi
test eax, eax
je 0x40e003
cmp byte [ebp - 0xf], 0x3a
jne 0x40e003
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e02c
cmp byte [ebp - 0xf], 0x3a
jne 0x40e02c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e066
call edi
test eax, eax
je 0x40e053
cmp byte [ebp - 0xf], 0x3a
jne 0x40e053
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e07d
call edi
test eax, eax
je 0x40e07d
cmp byte [ebp - 0xf], 0x3a
jne 0x40e07d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e0a6
cmp byte [ebp - 0xf], 0x3a
jne 0x40e0a6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e0e0
call edi
test eax, eax
je 0x40e0cd
cmp byte [ebp - 0xf], 0x3a
jne 0x40e0cd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e0f7
call edi
test eax, eax
je 0x40e0f7
cmp byte [ebp - 0xf], 0x3a
jne 0x40e0f7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e125
cmp byte [ebp - 0xf], 0x3a
jne 0x40e125
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e15f
call edi
test eax, eax
je 0x40e14c
cmp byte [ebp - 0xf], 0x3a
jne 0x40e14c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e176
call edi
test eax, eax
je 0x40e176
cmp byte [ebp - 0xf], 0x3a
jne 0x40e176
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e19f
cmp byte [ebp - 0xf], 0x3a
jne 0x40e19f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e1d9
call edi
test eax, eax
je 0x40e1c6
cmp byte [ebp - 0xf], 0x3a
jne 0x40e1c6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e1f0
call edi
test eax, eax
je 0x40e1f0
cmp byte [ebp - 0xf], 0x3a
jne 0x40e1f0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e212
cmp byte [ebp - 0xf], 0x3a
jne 0x40e212
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e24c
call edi
test eax, eax
je 0x40e239
cmp byte [ebp - 0xf], 0x3a
jne 0x40e239
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e263
call edi
test eax, eax
je 0x40e263
cmp byte [ebp - 0xf], 0x3a
jne 0x40e263
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e28c
cmp byte [ebp - 0xf], 0x3a
jne 0x40e28c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e2c6
call edi
test eax, eax
je 0x40e2b3
cmp byte [ebp - 0xf], 0x3a
jne 0x40e2b3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e2dd
call edi
test eax, eax
je 0x40e2dd
cmp byte [ebp - 0xf], 0x3a
jne 0x40e2dd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e307
cmp byte [ebp - 0xf], 0x3a
jne 0x40e307
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e341
call edi
test eax, eax
je 0x40e32e
cmp byte [ebp - 0xf], 0x3a
jne 0x40e32e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e358
call edi
test eax, eax
je 0x40e358
cmp byte [ebp - 0xf], 0x3a
jne 0x40e358
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e383
cmp byte [ebp - 0xf], 0x3a
jne 0x40e383
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e3bd
call edi
test eax, eax
je 0x40e3aa
cmp byte [ebp - 0xf], 0x3a
jne 0x40e3aa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e3d4
call edi
test eax, eax
je 0x40e3d4
cmp byte [ebp - 0xf], 0x3a
jne 0x40e3d4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, dword [ebp - 0x18]
pop edi
push 0x5e
push ebx
push dword [esi + 0x10c]
lea ecx, [ebp - 0xc8]
push dword [esi + 0x108]
call fcn.004390af
push 0x5e
push ebx
push dword [esi + 0x114]
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], ebx
push dword [esi + 0x110]
call fcn.004390af
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 1
call fcn.0043916e
test eax, eax
je 0x40e448
push 1
pop esi
jmp 0x40e44a
xor esi, esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00439160
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.00439160
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret