Function at 0x40d179
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x44950b
call fcn.00448b30
sub esp, 0xbc
lea eax, [ebp - 0x18]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 0x18], ecx
jne 0x40de2a
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d1dd
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d1dd
cmp byte [ebp - 0x13], 0x3a
jne 0x40d1dd
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d21b
call esi
test eax, eax
je 0x40d207
cmp byte [ebp - 0xf], 0x3a
jne 0x40d207
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d22f
call esi
test eax, eax
je 0x40d22f
cmp byte [ebp - 0xf], 0x3a
jne 0x40d22f
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d249
cmp byte [ebp - 0xf], 0x3a
jne 0x40d249
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d275
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d275
cmp byte [ebp - 0x13], 0x3a
jne 0x40d275
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d2ad
call esi
test eax, eax
je 0x40d299
cmp byte [ebp - 0xf], 0x3a
jne 0x40d299
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d2c1
call esi
test eax, eax
je 0x40d2c1
cmp byte [ebp - 0xf], 0x3a
jne 0x40d2c1
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d2db
cmp byte [ebp - 0xf], 0x3a
jne 0x40d2db
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d307
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d307
cmp byte [ebp - 0x13], 0x3a
jne 0x40d307
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d33f
call esi
test eax, eax
je 0x40d32b
cmp byte [ebp - 0xf], 0x3a
jne 0x40d32b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d353
call esi
test eax, eax
je 0x40d353
cmp byte [ebp - 0xf], 0x3a
jne 0x40d353
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d36d
cmp byte [ebp - 0xf], 0x3a
jne 0x40d36d
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d3a7
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d3a7
cmp byte [ebp - 0x13], 0x3a
jne 0x40d3a7
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d3df
call esi
test eax, eax
je 0x40d3cb
cmp byte [ebp - 0xf], 0x3a
jne 0x40d3cb
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d3f3
call esi
test eax, eax
je 0x40d3f3
cmp byte [ebp - 0xf], 0x3a
jne 0x40d3f3
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d40d
cmp byte [ebp - 0xf], 0x3a
jne 0x40d40d
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d444
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d444
cmp byte [ebp - 0x13], 0x3a
jne 0x40d444
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d47c
call esi
test eax, eax
je 0x40d468
cmp byte [ebp - 0xf], 0x3a
jne 0x40d468
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d490
call esi
test eax, eax
je 0x40d490
cmp byte [ebp - 0xf], 0x3a
jne 0x40d490
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d4aa
cmp byte [ebp - 0xf], 0x3a
jne 0x40d4aa
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d4d8
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d4d8
cmp byte [ebp - 0x13], 0x3a
jne 0x40d4d8
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d510
call esi
test eax, eax
je 0x40d4fc
cmp byte [ebp - 0xf], 0x3a
jne 0x40d4fc
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d524
call esi
test eax, eax
je 0x40d524
cmp byte [ebp - 0xf], 0x3a
jne 0x40d524
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d53e
cmp byte [ebp - 0xf], 0x3a
jne 0x40d53e
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d572
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d572
cmp byte [ebp - 0x13], 0x3a
jne 0x40d572
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d5aa
call esi
test eax, eax
je 0x40d596
cmp byte [ebp - 0xf], 0x3a
jne 0x40d596
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d5be
call esi
test eax, eax
je 0x40d5be
cmp byte [ebp - 0xf], 0x3a
jne 0x40d5be
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d5d8
cmp byte [ebp - 0xf], 0x3a
jne 0x40d5d8
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d606
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d606
cmp byte [ebp - 0x13], 0x3a
jne 0x40d606
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d63e
call esi
test eax, eax
je 0x40d62a
cmp byte [ebp - 0xf], 0x3a
jne 0x40d62a
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d652
call esi
test eax, eax
je 0x40d652
cmp byte [ebp - 0xf], 0x3a
jne 0x40d652
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d66c
cmp byte [ebp - 0xf], 0x3a
jne 0x40d66c
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d698
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d698
cmp byte [ebp - 0x13], 0x3a
jne 0x40d698
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d6d0
call esi
test eax, eax
je 0x40d6bc
cmp byte [ebp - 0xf], 0x3a
jne 0x40d6bc
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d6e4
call esi
test eax, eax
je 0x40d6e4
cmp byte [ebp - 0xf], 0x3a
jne 0x40d6e4
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d6fe
cmp byte [ebp - 0xf], 0x3a
jne 0x40d6fe
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d72c
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d72c
cmp byte [ebp - 0x13], 0x3a
jne 0x40d72c
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d764
call esi
test eax, eax
je 0x40d750
cmp byte [ebp - 0xf], 0x3a
jne 0x40d750
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d778
call esi
test eax, eax
je 0x40d778
cmp byte [ebp - 0xf], 0x3a
jne 0x40d778
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d792
cmp byte [ebp - 0xf], 0x3a
jne 0x40d792
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d7bc
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d7bc
cmp byte [ebp - 0x13], 0x3a
jne 0x40d7bc
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d7f4
call esi
test eax, eax
je 0x40d7e0
cmp byte [ebp - 0xf], 0x3a
jne 0x40d7e0
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d808
call esi
test eax, eax
je 0x40d808
cmp byte [ebp - 0xf], 0x3a
jne 0x40d808
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d822
cmp byte [ebp - 0xf], 0x3a
jne 0x40d822
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d851
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d851
cmp byte [ebp - 0x13], 0x3a
jne 0x40d851
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d889
call esi
test eax, eax
je 0x40d875
cmp byte [ebp - 0xf], 0x3a
jne 0x40d875
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d89d
call esi
test eax, eax
je 0x40d89d
cmp byte [ebp - 0xf], 0x3a
jne 0x40d89d
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d8b7
cmp byte [ebp - 0xf], 0x3a
jne 0x40d8b7
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d8e5
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d8e5
cmp byte [ebp - 0x13], 0x3a
jne 0x40d8e5
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d91d
call esi
test eax, eax
je 0x40d909
cmp byte [ebp - 0xf], 0x3a
jne 0x40d909
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d931
call esi
test eax, eax
je 0x40d931
cmp byte [ebp - 0xf], 0x3a
jne 0x40d931
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d94b
cmp byte [ebp - 0xf], 0x3a
jne 0x40d94b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40d979
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40d979
cmp byte [ebp - 0x13], 0x3a
jne 0x40d979
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40d9b1
call esi
test eax, eax
je 0x40d99d
cmp byte [ebp - 0xf], 0x3a
jne 0x40d99d
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40d9c5
call esi
test eax, eax
je 0x40d9c5
cmp byte [ebp - 0xf], 0x3a
jne 0x40d9c5
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40d9df
cmp byte [ebp - 0xf], 0x3a
jne 0x40d9df
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40da0b
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40da0b
cmp byte [ebp - 0x13], 0x3a
jne 0x40da0b
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40da43
call esi
test eax, eax
je 0x40da2f
cmp byte [ebp - 0xf], 0x3a
jne 0x40da2f
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40da57
call esi
test eax, eax
je 0x40da57
cmp byte [ebp - 0xf], 0x3a
jne 0x40da57
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40da71
cmp byte [ebp - 0xf], 0x3a
jne 0x40da71
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40daa1
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40daa1
cmp byte [ebp - 0x13], 0x3a
jne 0x40daa1
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dad9
call esi
test eax, eax
je 0x40dac5
cmp byte [ebp - 0xf], 0x3a
jne 0x40dac5
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40daed
call esi
test eax, eax
je 0x40daed
cmp byte [ebp - 0xf], 0x3a
jne 0x40daed
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40db07
cmp byte [ebp - 0xf], 0x3a
jne 0x40db07
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40db40
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40db40
cmp byte [ebp - 0x13], 0x3a
jne 0x40db40
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40db78
call esi
test eax, eax
je 0x40db64
cmp byte [ebp - 0xf], 0x3a
jne 0x40db64
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40db8c
call esi
test eax, eax
je 0x40db8c
cmp byte [ebp - 0xf], 0x3a
jne 0x40db8c
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40dba6
cmp byte [ebp - 0xf], 0x3a
jne 0x40dba6
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40dbd5
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40dbd5
cmp byte [ebp - 0x13], 0x3a
jne 0x40dbd5
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dc0d
call esi
test eax, eax
je 0x40dbf9
cmp byte [ebp - 0xf], 0x3a
jne 0x40dbf9
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40dc21
call esi
test eax, eax
je 0x40dc21
cmp byte [ebp - 0xf], 0x3a
jne 0x40dc21
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40dc3b
cmp byte [ebp - 0xf], 0x3a
jne 0x40dc3b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40dc67
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40dc67
cmp byte [ebp - 0x13], 0x3a
jne 0x40dc67
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dc9f
call esi
test eax, eax
je 0x40dc8b
cmp byte [ebp - 0xf], 0x3a
jne 0x40dc8b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40dcb3
call esi
test eax, eax
je 0x40dcb3
cmp byte [ebp - 0xf], 0x3a
jne 0x40dcb3
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40dccd
cmp byte [ebp - 0xf], 0x3a
jne 0x40dccd
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40dcfd
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40dcfd
cmp byte [ebp - 0x13], 0x3a
jne 0x40dcfd
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40dd35
call esi
test eax, eax
je 0x40dd21
cmp byte [ebp - 0xf], 0x3a
jne 0x40dd21
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40dd49
call esi
test eax, eax
je 0x40dd49
cmp byte [ebp - 0xf], 0x3a
jne 0x40dd49
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40dd63
cmp byte [ebp - 0xf], 0x3a
jne 0x40dd63
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x18]
cmp eax, 0xd5
jne 0x40ddc4
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x40ddc4
cmp byte [ebp - 0x13], 0x3a
jne 0x40ddc4
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x40ddfc
call esi
test eax, eax
je 0x40dde8
cmp byte [ebp - 0xf], 0x3a
jne 0x40dde8
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x40de10
call esi
test eax, eax
je 0x40de10
cmp byte [ebp - 0xf], 0x3a
jne 0x40de10
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x40de2a
cmp byte [ebp - 0xf], 0x3a
jne 0x40de2a
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
mov edi, dword [ebp - 0x18]
mov esi, 0x400
push 0x5e
push esi
push dword [edi + 0x10c]
lea ecx, [ebp - 0xc8]
push dword [edi + 0x108]
call fcn.00435f47
and dword [ebp - 4], 0
push 0x5e
push esi
lea ecx, [ebp - 0x70]
push dword [edi + 0x114]
push dword [edi + 0x110]
call fcn.00435f47
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 1
call fcn.00436000
test eax, eax
je 0x40de83
push 1
pop esi
jmp 0x40de85
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00435ff2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.00435ff2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret