Function at 0x411dae
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x44c7e4
call fcn.0044bd20
push ecx
push ecx
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x412b55
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411df1
cmp byte [ebp - 0xf], 0x3a
jne 0x411df1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411e31
call edi
test eax, eax
je 0x411e1e
cmp byte [ebp - 0xf], 0x3a
jne 0x411e1e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411e48
call edi
test eax, eax
je 0x411e48
cmp byte [ebp - 0xf], 0x3a
jne 0x411e48
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411e63
cmp byte [ebp - 0xf], 0x3a
jne 0x411e63
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411e9d
call edi
test eax, eax
je 0x411e8a
cmp byte [ebp - 0xf], 0x3a
jne 0x411e8a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411eb4
call edi
test eax, eax
je 0x411eb4
cmp byte [ebp - 0xf], 0x3a
jne 0x411eb4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411ee7
cmp byte [ebp - 0xf], 0x3a
jne 0x411ee7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411f21
call edi
test eax, eax
je 0x411f0e
cmp byte [ebp - 0xf], 0x3a
jne 0x411f0e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411f38
call edi
test eax, eax
je 0x411f38
cmp byte [ebp - 0xf], 0x3a
jne 0x411f38
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411f5f
cmp byte [ebp - 0xf], 0x3a
jne 0x411f5f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411f99
call edi
test eax, eax
je 0x411f86
cmp byte [ebp - 0xf], 0x3a
jne 0x411f86
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411fb0
call edi
test eax, eax
je 0x411fb0
cmp byte [ebp - 0xf], 0x3a
jne 0x411fb0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411fd2
cmp byte [ebp - 0xf], 0x3a
jne 0x411fd2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41200c
call edi
test eax, eax
je 0x411ff9
cmp byte [ebp - 0xf], 0x3a
jne 0x411ff9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412023
call edi
test eax, eax
je 0x412023
cmp byte [ebp - 0xf], 0x3a
jne 0x412023
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412045
cmp byte [ebp - 0xf], 0x3a
jne 0x412045
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41207f
call edi
test eax, eax
je 0x41206c
cmp byte [ebp - 0xf], 0x3a
jne 0x41206c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412096
call edi
test eax, eax
je 0x412096
cmp byte [ebp - 0xf], 0x3a
jne 0x412096
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4120c4
cmp byte [ebp - 0xf], 0x3a
jne 0x4120c4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4120fe
call edi
test eax, eax
je 0x4120eb
cmp byte [ebp - 0xf], 0x3a
jne 0x4120eb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412115
call edi
test eax, eax
je 0x412115
cmp byte [ebp - 0xf], 0x3a
jne 0x412115
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412151
cmp byte [ebp - 0xf], 0x3a
jne 0x412151
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41218b
call edi
test eax, eax
je 0x412178
cmp byte [ebp - 0xf], 0x3a
jne 0x412178
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4121a2
call edi
test eax, eax
je 0x4121a2
cmp byte [ebp - 0xf], 0x3a
jne 0x4121a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4121cd
cmp byte [ebp - 0xf], 0x3a
jne 0x4121cd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412207
call edi
test eax, eax
je 0x4121f4
cmp byte [ebp - 0xf], 0x3a
jne 0x4121f4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41221e
call edi
test eax, eax
je 0x41221e
cmp byte [ebp - 0xf], 0x3a
jne 0x41221e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412248
cmp byte [ebp - 0xf], 0x3a
jne 0x412248
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412282
call edi
test eax, eax
je 0x41226f
cmp byte [ebp - 0xf], 0x3a
jne 0x41226f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412299
call edi
test eax, eax
je 0x412299
cmp byte [ebp - 0xf], 0x3a
jne 0x412299
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4122c6
cmp byte [ebp - 0xf], 0x3a
jne 0x4122c6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412300
call edi
test eax, eax
je 0x4122ed
cmp byte [ebp - 0xf], 0x3a
jne 0x4122ed
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412317
call edi
test eax, eax
je 0x412317
cmp byte [ebp - 0xf], 0x3a
jne 0x412317
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41234a
cmp byte [ebp - 0xf], 0x3a
jne 0x41234a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412384
call edi
test eax, eax
je 0x412371
cmp byte [ebp - 0xf], 0x3a
jne 0x412371
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41239b
call edi
test eax, eax
je 0x41239b
cmp byte [ebp - 0xf], 0x3a
jne 0x41239b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4123ca
cmp byte [ebp - 0xf], 0x3a
jne 0x4123ca
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412404
call edi
test eax, eax
je 0x4123f1
cmp byte [ebp - 0xf], 0x3a
jne 0x4123f1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41241b
call edi
test eax, eax
je 0x41241b
cmp byte [ebp - 0xf], 0x3a
jne 0x41241b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41243d
cmp byte [ebp - 0xf], 0x3a
jne 0x41243d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412477
call edi
test eax, eax
je 0x412464
cmp byte [ebp - 0xf], 0x3a
jne 0x412464
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41248e
call edi
test eax, eax
je 0x41248e
cmp byte [ebp - 0xf], 0x3a
jne 0x41248e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4124b0
cmp byte [ebp - 0xf], 0x3a
jne 0x4124b0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4124ea
call edi
test eax, eax
je 0x4124d7
cmp byte [ebp - 0xf], 0x3a
jne 0x4124d7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412501
call edi
test eax, eax
je 0x412501
cmp byte [ebp - 0xf], 0x3a
jne 0x412501
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41252b
cmp byte [ebp - 0xf], 0x3a
jne 0x41252b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412565
call edi
test eax, eax
je 0x412552
cmp byte [ebp - 0xf], 0x3a
jne 0x412552
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41257c
call edi
test eax, eax
je 0x41257c
cmp byte [ebp - 0xf], 0x3a
jne 0x41257c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4125a7
cmp byte [ebp - 0xf], 0x3a
jne 0x4125a7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4125e1
call edi
test eax, eax
je 0x4125ce
cmp byte [ebp - 0xf], 0x3a
jne 0x4125ce
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4125f8
call edi
test eax, eax
je 0x4125f8
cmp byte [ebp - 0xf], 0x3a
jne 0x4125f8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412623
cmp byte [ebp - 0xf], 0x3a
jne 0x412623
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41265d
call edi
test eax, eax
je 0x41264a
cmp byte [ebp - 0xf], 0x3a
jne 0x41264a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412674
call edi
test eax, eax
je 0x412674
cmp byte [ebp - 0xf], 0x3a
jne 0x412674
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41269e
cmp byte [ebp - 0xf], 0x3a
jne 0x41269e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4126d8
call edi
test eax, eax
je 0x4126c5
cmp byte [ebp - 0xf], 0x3a
jne 0x4126c5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4126ef
call edi
test eax, eax
je 0x4126ef
cmp byte [ebp - 0xf], 0x3a
jne 0x4126ef
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412713
cmp byte [ebp - 0xf], 0x3a
jne 0x412713
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41274d
call edi
test eax, eax
je 0x41273a
cmp byte [ebp - 0xf], 0x3a
jne 0x41273a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412764
call edi
test eax, eax
je 0x412764
cmp byte [ebp - 0xf], 0x3a
jne 0x412764
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41278d
cmp byte [ebp - 0xf], 0x3a
jne 0x41278d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4127c7
call edi
test eax, eax
je 0x4127b4
cmp byte [ebp - 0xf], 0x3a
jne 0x4127b4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4127de
call edi
test eax, eax
je 0x4127de
cmp byte [ebp - 0xf], 0x3a
jne 0x4127de
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412807
cmp byte [ebp - 0xf], 0x3a
jne 0x412807
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412841
call edi
test eax, eax
je 0x41282e
cmp byte [ebp - 0xf], 0x3a
jne 0x41282e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412858
call edi
test eax, eax
je 0x412858
cmp byte [ebp - 0xf], 0x3a
jne 0x412858
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412886
cmp byte [ebp - 0xf], 0x3a
jne 0x412886
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4128c0
call edi
test eax, eax
je 0x4128ad
cmp byte [ebp - 0xf], 0x3a
jne 0x4128ad
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4128d7
call edi
test eax, eax
je 0x4128d7
cmp byte [ebp - 0xf], 0x3a
jne 0x4128d7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412900
cmp byte [ebp - 0xf], 0x3a
jne 0x412900
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41293a
call edi
test eax, eax
je 0x412927
cmp byte [ebp - 0xf], 0x3a
jne 0x412927
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412951
call edi
test eax, eax
je 0x412951
cmp byte [ebp - 0xf], 0x3a
jne 0x412951
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412973
cmp byte [ebp - 0xf], 0x3a
jne 0x412973
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4129ad
call edi
test eax, eax
je 0x41299a
cmp byte [ebp - 0xf], 0x3a
jne 0x41299a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4129c4
call edi
test eax, eax
je 0x4129c4
cmp byte [ebp - 0xf], 0x3a
jne 0x4129c4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4129ed
cmp byte [ebp - 0xf], 0x3a
jne 0x4129ed
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412a27
call edi
test eax, eax
je 0x412a14
cmp byte [ebp - 0xf], 0x3a
jne 0x412a14
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412a3e
call edi
test eax, eax
je 0x412a3e
cmp byte [ebp - 0xf], 0x3a
jne 0x412a3e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412a68
cmp byte [ebp - 0xf], 0x3a
jne 0x412a68
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412aa2
call edi
test eax, eax
je 0x412a8f
cmp byte [ebp - 0xf], 0x3a
jne 0x412a8f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412ab9
call edi
test eax, eax
je 0x412ab9
cmp byte [ebp - 0xf], 0x3a
jne 0x412ab9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x412ae4
cmp byte [ebp - 0xf], 0x3a
jne 0x412ae4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x412b1e
call edi
test eax, eax
je 0x412b0b
cmp byte [ebp - 0xf], 0x3a
jne 0x412b0b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x412b35
call edi
test eax, eax
je 0x412b35
cmp byte [ebp - 0xf], 0x3a
jne 0x412b35
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea eax, [eax + esi - 0x6e]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
sub esi, eax
mov eax, dword [ebp + 0x1c]
add eax, esi
push eax
mov dword [ebp + 0x10], eax
call sub.MFC42.DLL_operatornew
push dword [ebp + 0x10]
mov edi, eax
mov eax, dword [0x4543d0]
push ebx
push edi
call dword [eax + 0x21c]
add esi, 0xffffff92
push esi
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp + 0x10]
push 0x6e
push dword [ebp - 0x14]
lea esi, [edi + eax]
lea eax, [esi - 0x6e]
push eax
mov dword [ebp - 0x10], eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [0x4543d0]
add esp, 0x28
call dword [eax + 0x8c]
mov dword [esi - 0x66], eax
add eax, 0xfffff843
mov dword [edi + 0xffc], eax
cmp dword [esi - 0x6a], ebx
jne 0x412bee
lea ecx, [ebp + 0xc]
call fcn.00437e40
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ebx
push edi
call fcn.00437e8f
or dword [ebp - 4], 0xffffffff
mov dword [esi - 0x6a], eax
lea ecx, [ebp + 0xc]
jmp 0x412c13
lea ecx, [ebp + 0xc]
call fcn.00437e40
push dword [esi - 0x6a]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
push edi
call fcn.00437f4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00437e6e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
cmp dword [ebp + 0x18], ebx
push 2
mov dword [ecx], eax
pop esi
je 0x412c4e
lea ecx, [ebp + 0xc]
call fcn.00438027
push dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 0x14]
push edi
call fcn.004380d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043804c
mov eax, dword [0x4543d0]
push ebx
push 0x80
push esi
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [eax + 0x50]
mov esi, eax
cmp esi, 0xffffffff
je 0x412c8a
lea eax, [ebp + 0x1c]
push ebx
push eax
mov eax, dword [0x4543d0]
push dword [ebp + 0x10]
push edi
push esi
call dword [eax + 0x78]
mov eax, dword [0x4543d0]
push esi
call dword [eax + 0x44]
push edi
call fcn.0044bcf1
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18