Function at 0x40e249
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x448dbc
call fcn.00448330
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x1c]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], esi
test eax, eax
jne 0x40ef02
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e291
cmp byte [ebp - 0xf], 0x3a
jne 0x40e291
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e2d2
call edi
test eax, eax
je 0x40e2bf
cmp byte [ebp - 0xf], 0x3a
jne 0x40e2bf
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e2e9
call edi
test eax, eax
je 0x40e2e9
cmp byte [ebp - 0xf], 0x3a
jne 0x40e2e9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e304
cmp byte [ebp - 0xf], 0x3a
jne 0x40e304
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e33e
call edi
test eax, eax
je 0x40e32b
cmp byte [ebp - 0xf], 0x3a
jne 0x40e32b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e355
call edi
test eax, eax
je 0x40e355
cmp byte [ebp - 0xf], 0x3a
jne 0x40e355
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e388
cmp byte [ebp - 0xf], 0x3a
jne 0x40e388
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e3c2
call edi
test eax, eax
je 0x40e3af
cmp byte [ebp - 0xf], 0x3a
jne 0x40e3af
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e3d9
call edi
test eax, eax
je 0x40e3d9
cmp byte [ebp - 0xf], 0x3a
jne 0x40e3d9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e3fb
cmp byte [ebp - 0xf], 0x3a
jne 0x40e3fb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e435
call edi
test eax, eax
je 0x40e422
cmp byte [ebp - 0xf], 0x3a
jne 0x40e422
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e44c
call edi
test eax, eax
je 0x40e44c
cmp byte [ebp - 0xf], 0x3a
jne 0x40e44c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e46d
cmp byte [ebp - 0xf], 0x3a
jne 0x40e46d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e4a7
call edi
test eax, eax
je 0x40e494
cmp byte [ebp - 0xf], 0x3a
jne 0x40e494
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e4be
call edi
test eax, eax
je 0x40e4be
cmp byte [ebp - 0xf], 0x3a
jne 0x40e4be
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e4fa
cmp byte [ebp - 0xf], 0x3a
jne 0x40e4fa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e534
call edi
test eax, eax
je 0x40e521
cmp byte [ebp - 0xf], 0x3a
jne 0x40e521
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e54b
call edi
test eax, eax
je 0x40e54b
cmp byte [ebp - 0xf], 0x3a
jne 0x40e54b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e576
cmp byte [ebp - 0xf], 0x3a
jne 0x40e576
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e5b0
call edi
test eax, eax
je 0x40e59d
cmp byte [ebp - 0xf], 0x3a
jne 0x40e59d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e5c7
call edi
test eax, eax
je 0x40e5c7
cmp byte [ebp - 0xf], 0x3a
jne 0x40e5c7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e5f1
cmp byte [ebp - 0xf], 0x3a
jne 0x40e5f1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e62b
call edi
test eax, eax
je 0x40e618
cmp byte [ebp - 0xf], 0x3a
jne 0x40e618
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e642
call edi
test eax, eax
je 0x40e642
cmp byte [ebp - 0xf], 0x3a
jne 0x40e642
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e66f
cmp byte [ebp - 0xf], 0x3a
jne 0x40e66f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e6a9
call edi
test eax, eax
je 0x40e696
cmp byte [ebp - 0xf], 0x3a
jne 0x40e696
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e6c0
call edi
test eax, eax
je 0x40e6c0
cmp byte [ebp - 0xf], 0x3a
jne 0x40e6c0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e6f3
cmp byte [ebp - 0xf], 0x3a
jne 0x40e6f3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e72d
call edi
test eax, eax
je 0x40e71a
cmp byte [ebp - 0xf], 0x3a
jne 0x40e71a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e744
call edi
test eax, eax
je 0x40e744
cmp byte [ebp - 0xf], 0x3a
jne 0x40e744
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e773
cmp byte [ebp - 0xf], 0x3a
jne 0x40e773
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e7ad
call edi
test eax, eax
je 0x40e79a
cmp byte [ebp - 0xf], 0x3a
jne 0x40e79a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e7c4
call edi
test eax, eax
je 0x40e7c4
cmp byte [ebp - 0xf], 0x3a
jne 0x40e7c4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e7e6
cmp byte [ebp - 0xf], 0x3a
jne 0x40e7e6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e820
call edi
test eax, eax
je 0x40e80d
cmp byte [ebp - 0xf], 0x3a
jne 0x40e80d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e837
call edi
test eax, eax
je 0x40e837
cmp byte [ebp - 0xf], 0x3a
jne 0x40e837
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e859
cmp byte [ebp - 0xf], 0x3a
jne 0x40e859
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e893
call edi
test eax, eax
je 0x40e880
cmp byte [ebp - 0xf], 0x3a
jne 0x40e880
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e8aa
call edi
test eax, eax
je 0x40e8aa
cmp byte [ebp - 0xf], 0x3a
jne 0x40e8aa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e8d4
cmp byte [ebp - 0xf], 0x3a
jne 0x40e8d4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e90e
call edi
test eax, eax
je 0x40e8fb
cmp byte [ebp - 0xf], 0x3a
jne 0x40e8fb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e925
call edi
test eax, eax
je 0x40e925
cmp byte [ebp - 0xf], 0x3a
jne 0x40e925
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e950
cmp byte [ebp - 0xf], 0x3a
jne 0x40e950
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40e98a
call edi
test eax, eax
je 0x40e977
cmp byte [ebp - 0xf], 0x3a
jne 0x40e977
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40e9a1
call edi
test eax, eax
je 0x40e9a1
cmp byte [ebp - 0xf], 0x3a
jne 0x40e9a1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40e9cc
cmp byte [ebp - 0xf], 0x3a
jne 0x40e9cc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ea06
call edi
test eax, eax
je 0x40e9f3
cmp byte [ebp - 0xf], 0x3a
jne 0x40e9f3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ea1d
call edi
test eax, eax
je 0x40ea1d
cmp byte [ebp - 0xf], 0x3a
jne 0x40ea1d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ea47
cmp byte [ebp - 0xf], 0x3a
jne 0x40ea47
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ea81
call edi
test eax, eax
je 0x40ea6e
cmp byte [ebp - 0xf], 0x3a
jne 0x40ea6e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ea98
call edi
test eax, eax
je 0x40ea98
cmp byte [ebp - 0xf], 0x3a
jne 0x40ea98
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40eabc
cmp byte [ebp - 0xf], 0x3a
jne 0x40eabc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40eaf6
call edi
test eax, eax
je 0x40eae3
cmp byte [ebp - 0xf], 0x3a
jne 0x40eae3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40eb0d
call edi
test eax, eax
je 0x40eb0d
cmp byte [ebp - 0xf], 0x3a
jne 0x40eb0d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40eb36
cmp byte [ebp - 0xf], 0x3a
jne 0x40eb36
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40eb70
call edi
test eax, eax
je 0x40eb5d
cmp byte [ebp - 0xf], 0x3a
jne 0x40eb5d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40eb87
call edi
test eax, eax
je 0x40eb87
cmp byte [ebp - 0xf], 0x3a
jne 0x40eb87
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ebb0
cmp byte [ebp - 0xf], 0x3a
jne 0x40ebb0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ebea
call edi
test eax, eax
je 0x40ebd7
cmp byte [ebp - 0xf], 0x3a
jne 0x40ebd7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ec01
call edi
test eax, eax
je 0x40ec01
cmp byte [ebp - 0xf], 0x3a
jne 0x40ec01
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ec2f
cmp byte [ebp - 0xf], 0x3a
jne 0x40ec2f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ec69
call edi
test eax, eax
je 0x40ec56
cmp byte [ebp - 0xf], 0x3a
jne 0x40ec56
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ec80
call edi
test eax, eax
je 0x40ec80
cmp byte [ebp - 0xf], 0x3a
jne 0x40ec80
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40eca9
cmp byte [ebp - 0xf], 0x3a
jne 0x40eca9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ece3
call edi
test eax, eax
je 0x40ecd0
cmp byte [ebp - 0xf], 0x3a
jne 0x40ecd0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ecfa
call edi
test eax, eax
je 0x40ecfa
cmp byte [ebp - 0xf], 0x3a
jne 0x40ecfa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ed1c
cmp byte [ebp - 0xf], 0x3a
jne 0x40ed1c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ed56
call edi
test eax, eax
je 0x40ed43
cmp byte [ebp - 0xf], 0x3a
jne 0x40ed43
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ed6d
call edi
test eax, eax
je 0x40ed6d
cmp byte [ebp - 0xf], 0x3a
jne 0x40ed6d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ed96
cmp byte [ebp - 0xf], 0x3a
jne 0x40ed96
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40edd0
call edi
test eax, eax
je 0x40edbd
cmp byte [ebp - 0xf], 0x3a
jne 0x40edbd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ede7
call edi
test eax, eax
je 0x40ede7
cmp byte [ebp - 0xf], 0x3a
jne 0x40ede7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ee11
cmp byte [ebp - 0xf], 0x3a
jne 0x40ee11
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ee4b
call edi
test eax, eax
je 0x40ee38
cmp byte [ebp - 0xf], 0x3a
jne 0x40ee38
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40ee62
call edi
test eax, eax
je 0x40ee62
cmp byte [ebp - 0xf], 0x3a
jne 0x40ee62
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40ee8d
cmp byte [ebp - 0xf], 0x3a
jne 0x40ee8d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x1c]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40eec7
call edi
test eax, eax
je 0x40eeb4
cmp byte [ebp - 0xf], 0x3a
jne 0x40eeb4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x40eede
call edi
test eax, eax
je 0x40eede
cmp byte [ebp - 0xf], 0x3a
jne 0x40eede
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, dword [ebp - 0x1c]
pop edi
lea ecx, [ebp - 0x18]
call fcn.004357c1
push 0x100000
push 0x400
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00435805
push eax
lea eax, [esi + 0x118]
push dword [esi + 0x19118]
mov ecx, esi
push eax
lea eax, [esi + 4]
push dword [esi + 0x10c]
push dword [esi + 0x108]
push eax
call fcn.00410aae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004357e6
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret