Function at 0x41140e
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x449544
call fcn.00448b30
push ecx
push ecx
lea eax, [ebp + 0x18]
push ebx
push esi
push edi
test eax, eax
jne 0x4120b8
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x41146b
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x41146b
cmp byte [ebp - 0x13], 0x3a
jne 0x41146b
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4114a9
call esi
test eax, eax
je 0x411495
cmp byte [ebp - 0xf], 0x3a
jne 0x411495
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4114bd
call esi
test eax, eax
je 0x4114bd
cmp byte [ebp - 0xf], 0x3a
jne 0x4114bd
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x4114d7
cmp byte [ebp - 0xf], 0x3a
jne 0x4114d7
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411503
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411503
cmp byte [ebp - 0x13], 0x3a
jne 0x411503
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41153b
call esi
test eax, eax
je 0x411527
cmp byte [ebp - 0xf], 0x3a
jne 0x411527
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x41154f
call esi
test eax, eax
je 0x41154f
cmp byte [ebp - 0xf], 0x3a
jne 0x41154f
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411569
cmp byte [ebp - 0xf], 0x3a
jne 0x411569
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411595
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411595
cmp byte [ebp - 0x13], 0x3a
jne 0x411595
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4115cd
call esi
test eax, eax
je 0x4115b9
cmp byte [ebp - 0xf], 0x3a
jne 0x4115b9
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4115e1
call esi
test eax, eax
je 0x4115e1
cmp byte [ebp - 0xf], 0x3a
jne 0x4115e1
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x4115fb
cmp byte [ebp - 0xf], 0x3a
jne 0x4115fb
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411635
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411635
cmp byte [ebp - 0x13], 0x3a
jne 0x411635
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41166d
call esi
test eax, eax
je 0x411659
cmp byte [ebp - 0xf], 0x3a
jne 0x411659
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411681
call esi
test eax, eax
je 0x411681
cmp byte [ebp - 0xf], 0x3a
jne 0x411681
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41169b
cmp byte [ebp - 0xf], 0x3a
jne 0x41169b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x4116d2
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x4116d2
cmp byte [ebp - 0x13], 0x3a
jne 0x4116d2
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41170a
call esi
test eax, eax
je 0x4116f6
cmp byte [ebp - 0xf], 0x3a
jne 0x4116f6
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x41171e
call esi
test eax, eax
je 0x41171e
cmp byte [ebp - 0xf], 0x3a
jne 0x41171e
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411738
cmp byte [ebp - 0xf], 0x3a
jne 0x411738
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411766
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411766
cmp byte [ebp - 0x13], 0x3a
jne 0x411766
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41179e
call esi
test eax, eax
je 0x41178a
cmp byte [ebp - 0xf], 0x3a
jne 0x41178a
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4117b2
call esi
test eax, eax
je 0x4117b2
cmp byte [ebp - 0xf], 0x3a
jne 0x4117b2
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x4117cc
cmp byte [ebp - 0xf], 0x3a
jne 0x4117cc
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411800
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411800
cmp byte [ebp - 0x13], 0x3a
jne 0x411800
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411838
call esi
test eax, eax
je 0x411824
cmp byte [ebp - 0xf], 0x3a
jne 0x411824
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x41184c
call esi
test eax, eax
je 0x41184c
cmp byte [ebp - 0xf], 0x3a
jne 0x41184c
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411866
cmp byte [ebp - 0xf], 0x3a
jne 0x411866
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411894
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411894
cmp byte [ebp - 0x13], 0x3a
jne 0x411894
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4118cc
call esi
test eax, eax
je 0x4118b8
cmp byte [ebp - 0xf], 0x3a
jne 0x4118b8
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x4118e0
call esi
test eax, eax
je 0x4118e0
cmp byte [ebp - 0xf], 0x3a
jne 0x4118e0
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x4118fa
cmp byte [ebp - 0xf], 0x3a
jne 0x4118fa
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411926
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411926
cmp byte [ebp - 0x13], 0x3a
jne 0x411926
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41195e
call esi
test eax, eax
je 0x41194a
cmp byte [ebp - 0xf], 0x3a
jne 0x41194a
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411972
call esi
test eax, eax
je 0x411972
cmp byte [ebp - 0xf], 0x3a
jne 0x411972
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x41198c
cmp byte [ebp - 0xf], 0x3a
jne 0x41198c
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x4119ba
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x4119ba
cmp byte [ebp - 0x13], 0x3a
jne 0x4119ba
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4119f2
call esi
test eax, eax
je 0x4119de
cmp byte [ebp - 0xf], 0x3a
jne 0x4119de
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411a06
call esi
test eax, eax
je 0x411a06
cmp byte [ebp - 0xf], 0x3a
jne 0x411a06
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411a20
cmp byte [ebp - 0xf], 0x3a
jne 0x411a20
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411a4a
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411a4a
cmp byte [ebp - 0x13], 0x3a
jne 0x411a4a
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411a82
call esi
test eax, eax
je 0x411a6e
cmp byte [ebp - 0xf], 0x3a
jne 0x411a6e
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411a96
call esi
test eax, eax
je 0x411a96
cmp byte [ebp - 0xf], 0x3a
jne 0x411a96
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411ab0
cmp byte [ebp - 0xf], 0x3a
jne 0x411ab0
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411adf
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411adf
cmp byte [ebp - 0x13], 0x3a
jne 0x411adf
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411b17
call esi
test eax, eax
je 0x411b03
cmp byte [ebp - 0xf], 0x3a
jne 0x411b03
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411b2b
call esi
test eax, eax
je 0x411b2b
cmp byte [ebp - 0xf], 0x3a
jne 0x411b2b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411b45
cmp byte [ebp - 0xf], 0x3a
jne 0x411b45
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411b73
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411b73
cmp byte [ebp - 0x13], 0x3a
jne 0x411b73
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411bab
call esi
test eax, eax
je 0x411b97
cmp byte [ebp - 0xf], 0x3a
jne 0x411b97
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411bbf
call esi
test eax, eax
je 0x411bbf
cmp byte [ebp - 0xf], 0x3a
jne 0x411bbf
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411bd9
cmp byte [ebp - 0xf], 0x3a
jne 0x411bd9
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411c07
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411c07
cmp byte [ebp - 0x13], 0x3a
jne 0x411c07
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411c3f
call esi
test eax, eax
je 0x411c2b
cmp byte [ebp - 0xf], 0x3a
jne 0x411c2b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411c53
call esi
test eax, eax
je 0x411c53
cmp byte [ebp - 0xf], 0x3a
jne 0x411c53
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411c6d
cmp byte [ebp - 0xf], 0x3a
jne 0x411c6d
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411c99
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411c99
cmp byte [ebp - 0x13], 0x3a
jne 0x411c99
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411cd1
call esi
test eax, eax
je 0x411cbd
cmp byte [ebp - 0xf], 0x3a
jne 0x411cbd
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411ce5
call esi
test eax, eax
je 0x411ce5
cmp byte [ebp - 0xf], 0x3a
jne 0x411ce5
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411cff
cmp byte [ebp - 0xf], 0x3a
jne 0x411cff
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411d2f
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411d2f
cmp byte [ebp - 0x13], 0x3a
jne 0x411d2f
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411d67
call esi
test eax, eax
je 0x411d53
cmp byte [ebp - 0xf], 0x3a
jne 0x411d53
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411d7b
call esi
test eax, eax
je 0x411d7b
cmp byte [ebp - 0xf], 0x3a
jne 0x411d7b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411d95
cmp byte [ebp - 0xf], 0x3a
jne 0x411d95
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411dce
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411dce
cmp byte [ebp - 0x13], 0x3a
jne 0x411dce
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411e06
call esi
test eax, eax
je 0x411df2
cmp byte [ebp - 0xf], 0x3a
jne 0x411df2
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411e1a
call esi
test eax, eax
je 0x411e1a
cmp byte [ebp - 0xf], 0x3a
jne 0x411e1a
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411e34
cmp byte [ebp - 0xf], 0x3a
jne 0x411e34
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411e63
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411e63
cmp byte [ebp - 0x13], 0x3a
jne 0x411e63
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411e9b
call esi
test eax, eax
je 0x411e87
cmp byte [ebp - 0xf], 0x3a
jne 0x411e87
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411eaf
call esi
test eax, eax
je 0x411eaf
cmp byte [ebp - 0xf], 0x3a
jne 0x411eaf
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411ec9
cmp byte [ebp - 0xf], 0x3a
jne 0x411ec9
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411ef5
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411ef5
cmp byte [ebp - 0x13], 0x3a
jne 0x411ef5
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411f2d
call esi
test eax, eax
je 0x411f19
cmp byte [ebp - 0xf], 0x3a
jne 0x411f19
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411f41
call esi
test eax, eax
je 0x411f41
cmp byte [ebp - 0xf], 0x3a
jne 0x411f41
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411f5b
cmp byte [ebp - 0xf], 0x3a
jne 0x411f5b
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x411f8b
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x411f8b
cmp byte [ebp - 0x13], 0x3a
jne 0x411f8b
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411fc3
call esi
test eax, eax
je 0x411faf
cmp byte [ebp - 0xf], 0x3a
jne 0x411faf
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x411fd7
call esi
test eax, eax
je 0x411fd7
cmp byte [ebp - 0xf], 0x3a
jne 0x411fd7
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x411ff1
cmp byte [ebp - 0xf], 0x3a
jne 0x411ff1
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp + 0x18]
cmp eax, 0xd5
jne 0x412052
lea eax, [ebp - 0x14]
push eax
push 3
call esi
test eax, eax
je 0x412052
cmp byte [ebp - 0x13], 0x3a
jne 0x412052
movzx eax, byte [ebp - 0x14]
push eax
call ebx
pop ecx
lea eax, [ebp + 0x18]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41208a
call esi
test eax, eax
je 0x412076
cmp byte [ebp - 0xf], 0x3a
jne 0x412076
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
and byte [ebp - 0x12], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x3a
call edi
jmp 0x41209e
call esi
test eax, eax
je 0x41209e
cmp byte [ebp - 0xf], 0x3a
jne 0x41209e
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 3
call esi
test eax, eax
je 0x4120b8
cmp byte [ebp - 0xf], 0x3a
jne 0x4120b8
movzx eax, byte [ebp - 0x10]
push eax
call ebx
pop ecx
mov ebx, dword [ebp + 0x10]
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
mov edi, eax
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_memcpy
mov eax, dword [0x4513d0]
add esp, 0x10
call dword [eax + 0x8c]
lea esi, [edi + ebx]
mov dword [esi - 0x66], eax
add eax, 0xfffff843
mov dword [edi + 0xffc], eax
cmp dword [esi - 0x6a], 0
jne 0x412114
lea ecx, [ebp + 0x10]
call fcn.00434ce4
and dword [ebp - 4], 0
push ebx
push edi
lea ecx, [ebp + 0x10]
call fcn.00434d33
or dword [ebp - 4], 0xffffffff
mov dword [esi - 0x6a], eax
lea ecx, [ebp + 0x10]
jmp 0x412137
lea ecx, [ebp + 0x10]
call fcn.00434ce4
push dword [esi - 0x6a]
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], 1
push ebx
push edi
call fcn.00434def
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00434d12
cmp dword [ebp + 0x18], 0
push 2
pop esi
je 0x41216b
lea ecx, [ebp + 0x10]
call fcn.00434ecb
push dword [ebp + 0x18]
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 0x14]
push edi
call fcn.00434f79
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00434ef0
mov eax, dword [0x4513d0]
push 0
push 0x80
push esi
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [eax + 0x50]
mov esi, eax
cmp esi, 0xffffffff
je 0x4121a8
lea eax, [ebp + 0x18]
push 0
push eax
mov eax, dword [0x4513d0]
push ebx
push edi
push esi
call dword [eax + 0x78]
mov eax, dword [0x4513d0]
push esi
call dword [eax + 0x44]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14