Function at 0x427793
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 0xc], ecx
mov dword [ecx], 0x44b128
jne 0x428440
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x4277f3
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4277f3
cmp byte [ebp - 7], 0x3a
jne 0x4277f3
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427831
call esi
test eax, eax
je 0x42781d
cmp byte [ebp - 3], 0x3a
jne 0x42781d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427845
call esi
test eax, eax
je 0x427845
cmp byte [ebp - 3], 0x3a
jne 0x427845
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x42785f
cmp byte [ebp - 3], 0x3a
jne 0x42785f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x42788b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x42788b
cmp byte [ebp - 7], 0x3a
jne 0x42788b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4278c3
call esi
test eax, eax
je 0x4278af
cmp byte [ebp - 3], 0x3a
jne 0x4278af
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4278d7
call esi
test eax, eax
je 0x4278d7
cmp byte [ebp - 3], 0x3a
jne 0x4278d7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4278f1
cmp byte [ebp - 3], 0x3a
jne 0x4278f1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x42791d
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x42791d
cmp byte [ebp - 7], 0x3a
jne 0x42791d
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427955
call esi
test eax, eax
je 0x427941
cmp byte [ebp - 3], 0x3a
jne 0x427941
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427969
call esi
test eax, eax
je 0x427969
cmp byte [ebp - 3], 0x3a
jne 0x427969
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427983
cmp byte [ebp - 3], 0x3a
jne 0x427983
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x4279bd
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4279bd
cmp byte [ebp - 7], 0x3a
jne 0x4279bd
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4279f5
call esi
test eax, eax
je 0x4279e1
cmp byte [ebp - 3], 0x3a
jne 0x4279e1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427a09
call esi
test eax, eax
je 0x427a09
cmp byte [ebp - 3], 0x3a
jne 0x427a09
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427a23
cmp byte [ebp - 3], 0x3a
jne 0x427a23
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427a5a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427a5a
cmp byte [ebp - 7], 0x3a
jne 0x427a5a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427a92
call esi
test eax, eax
je 0x427a7e
cmp byte [ebp - 3], 0x3a
jne 0x427a7e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427aa6
call esi
test eax, eax
je 0x427aa6
cmp byte [ebp - 3], 0x3a
jne 0x427aa6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427ac0
cmp byte [ebp - 3], 0x3a
jne 0x427ac0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427aee
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427aee
cmp byte [ebp - 7], 0x3a
jne 0x427aee
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427b26
call esi
test eax, eax
je 0x427b12
cmp byte [ebp - 3], 0x3a
jne 0x427b12
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427b3a
call esi
test eax, eax
je 0x427b3a
cmp byte [ebp - 3], 0x3a
jne 0x427b3a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427b54
cmp byte [ebp - 3], 0x3a
jne 0x427b54
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427b88
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427b88
cmp byte [ebp - 7], 0x3a
jne 0x427b88
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427bc0
call esi
test eax, eax
je 0x427bac
cmp byte [ebp - 3], 0x3a
jne 0x427bac
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427bd4
call esi
test eax, eax
je 0x427bd4
cmp byte [ebp - 3], 0x3a
jne 0x427bd4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427bee
cmp byte [ebp - 3], 0x3a
jne 0x427bee
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427c1c
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427c1c
cmp byte [ebp - 7], 0x3a
jne 0x427c1c
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427c54
call esi
test eax, eax
je 0x427c40
cmp byte [ebp - 3], 0x3a
jne 0x427c40
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427c68
call esi
test eax, eax
je 0x427c68
cmp byte [ebp - 3], 0x3a
jne 0x427c68
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427c82
cmp byte [ebp - 3], 0x3a
jne 0x427c82
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427cae
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427cae
cmp byte [ebp - 7], 0x3a
jne 0x427cae
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427ce6
call esi
test eax, eax
je 0x427cd2
cmp byte [ebp - 3], 0x3a
jne 0x427cd2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427cfa
call esi
test eax, eax
je 0x427cfa
cmp byte [ebp - 3], 0x3a
jne 0x427cfa
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427d14
cmp byte [ebp - 3], 0x3a
jne 0x427d14
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427d42
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427d42
cmp byte [ebp - 7], 0x3a
jne 0x427d42
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427d7a
call esi
test eax, eax
je 0x427d66
cmp byte [ebp - 3], 0x3a
jne 0x427d66
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427d8e
call esi
test eax, eax
je 0x427d8e
cmp byte [ebp - 3], 0x3a
jne 0x427d8e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427da8
cmp byte [ebp - 3], 0x3a
jne 0x427da8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427dd2
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427dd2
cmp byte [ebp - 7], 0x3a
jne 0x427dd2
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427e0a
call esi
test eax, eax
je 0x427df6
cmp byte [ebp - 3], 0x3a
jne 0x427df6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427e1e
call esi
test eax, eax
je 0x427e1e
cmp byte [ebp - 3], 0x3a
jne 0x427e1e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427e38
cmp byte [ebp - 3], 0x3a
jne 0x427e38
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427e67
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427e67
cmp byte [ebp - 7], 0x3a
jne 0x427e67
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427e9f
call esi
test eax, eax
je 0x427e8b
cmp byte [ebp - 3], 0x3a
jne 0x427e8b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427eb3
call esi
test eax, eax
je 0x427eb3
cmp byte [ebp - 3], 0x3a
jne 0x427eb3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427ecd
cmp byte [ebp - 3], 0x3a
jne 0x427ecd
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427efb
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427efb
cmp byte [ebp - 7], 0x3a
jne 0x427efb
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427f33
call esi
test eax, eax
je 0x427f1f
cmp byte [ebp - 3], 0x3a
jne 0x427f1f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427f47
call esi
test eax, eax
je 0x427f47
cmp byte [ebp - 3], 0x3a
jne 0x427f47
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427f61
cmp byte [ebp - 3], 0x3a
jne 0x427f61
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x427f8f
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x427f8f
cmp byte [ebp - 7], 0x3a
jne 0x427f8f
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427fc7
call esi
test eax, eax
je 0x427fb3
cmp byte [ebp - 3], 0x3a
jne 0x427fb3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x427fdb
call esi
test eax, eax
je 0x427fdb
cmp byte [ebp - 3], 0x3a
jne 0x427fdb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x427ff5
cmp byte [ebp - 3], 0x3a
jne 0x427ff5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x428021
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x428021
cmp byte [ebp - 7], 0x3a
jne 0x428021
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428059
call esi
test eax, eax
je 0x428045
cmp byte [ebp - 3], 0x3a
jne 0x428045
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42806d
call esi
test eax, eax
je 0x42806d
cmp byte [ebp - 3], 0x3a
jne 0x42806d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x428087
cmp byte [ebp - 3], 0x3a
jne 0x428087
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x4280b7
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4280b7
cmp byte [ebp - 7], 0x3a
jne 0x4280b7
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4280ef
call esi
test eax, eax
je 0x4280db
cmp byte [ebp - 3], 0x3a
jne 0x4280db
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x428103
call esi
test eax, eax
je 0x428103
cmp byte [ebp - 3], 0x3a
jne 0x428103
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x42811d
cmp byte [ebp - 3], 0x3a
jne 0x42811d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x428156
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x428156
cmp byte [ebp - 7], 0x3a
jne 0x428156
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42818e
call esi
test eax, eax
je 0x42817a
cmp byte [ebp - 3], 0x3a
jne 0x42817a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4281a2
call esi
test eax, eax
je 0x4281a2
cmp byte [ebp - 3], 0x3a
jne 0x4281a2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4281bc
cmp byte [ebp - 3], 0x3a
jne 0x4281bc
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x4281eb
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4281eb
cmp byte [ebp - 7], 0x3a
jne 0x4281eb
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428223
call esi
test eax, eax
je 0x42820f
cmp byte [ebp - 3], 0x3a
jne 0x42820f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x428237
call esi
test eax, eax
je 0x428237
cmp byte [ebp - 3], 0x3a
jne 0x428237
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x428251
cmp byte [ebp - 3], 0x3a
jne 0x428251
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x42827d
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x42827d
cmp byte [ebp - 7], 0x3a
jne 0x42827d
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4282b5
call esi
test eax, eax
je 0x4282a1
cmp byte [ebp - 3], 0x3a
jne 0x4282a1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4282c9
call esi
test eax, eax
je 0x4282c9
cmp byte [ebp - 3], 0x3a
jne 0x4282c9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4282e3
cmp byte [ebp - 3], 0x3a
jne 0x4282e3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x428313
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x428313
cmp byte [ebp - 7], 0x3a
jne 0x428313
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42834b
call esi
test eax, eax
je 0x428337
cmp byte [ebp - 3], 0x3a
jne 0x428337
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42835f
call esi
test eax, eax
je 0x42835f
cmp byte [ebp - 3], 0x3a
jne 0x42835f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x428379
cmp byte [ebp - 3], 0x3a
jne 0x428379
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0xc]
cmp eax, 0xd5
jne 0x4283da
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4283da
cmp byte [ebp - 7], 0x3a
jne 0x4283da
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428412
call esi
test eax, eax
je 0x4283fe
cmp byte [ebp - 3], 0x3a
jne 0x4283fe
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x428426
call esi
test eax, eax
je 0x428426
cmp byte [ebp - 3], 0x3a
jne 0x428426
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x428440
cmp byte [ebp - 3], 0x3a
jne 0x428440
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
mov edi, dword [ebp - 0xc]
mov esi, 0x1fbd0
xor ebx, ebx
push esi
lea eax, [edi + 4]
push ebx
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [edi + 0x1fbd8]
push ebx
push eax
mov dword [edi + 0x1fbd4], ebx
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [edi + 0x3f7a8], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret