Function at 0x427c9a
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
mov dword [ecx], 0x44a168
test eax, eax
jne 0x42894b
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x427cda
cmp byte [ebp - 3], 0x3a
jne 0x427cda
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 8]
xor ebx, ebx
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427d1c
call edi
test eax, eax
je 0x427d09
cmp byte [ebp - 3], 0x3a
jne 0x427d09
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x427d33
call edi
test eax, eax
je 0x427d33
cmp byte [ebp - 3], 0x3a
jne 0x427d33
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x427d4e
cmp byte [ebp - 3], 0x3a
jne 0x427d4e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427d88
call edi
test eax, eax
je 0x427d75
cmp byte [ebp - 3], 0x3a
jne 0x427d75
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x427d9f
call edi
test eax, eax
je 0x427d9f
cmp byte [ebp - 3], 0x3a
jne 0x427d9f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x427dd2
cmp byte [ebp - 3], 0x3a
jne 0x427dd2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427e0c
call edi
test eax, eax
je 0x427df9
cmp byte [ebp - 3], 0x3a
jne 0x427df9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x427e23
call edi
test eax, eax
je 0x427e23
cmp byte [ebp - 3], 0x3a
jne 0x427e23
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x427e45
cmp byte [ebp - 3], 0x3a
jne 0x427e45
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427e7f
call edi
test eax, eax
je 0x427e6c
cmp byte [ebp - 3], 0x3a
jne 0x427e6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x427e96
call edi
test eax, eax
je 0x427e96
cmp byte [ebp - 3], 0x3a
jne 0x427e96
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x427eb7
cmp byte [ebp - 3], 0x3a
jne 0x427eb7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427ef1
call edi
test eax, eax
je 0x427ede
cmp byte [ebp - 3], 0x3a
jne 0x427ede
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x427f08
call edi
test eax, eax
je 0x427f08
cmp byte [ebp - 3], 0x3a
jne 0x427f08
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x427f44
cmp byte [ebp - 3], 0x3a
jne 0x427f44
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427f7e
call edi
test eax, eax
je 0x427f6b
cmp byte [ebp - 3], 0x3a
jne 0x427f6b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x427f95
call edi
test eax, eax
je 0x427f95
cmp byte [ebp - 3], 0x3a
jne 0x427f95
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x427fc0
cmp byte [ebp - 3], 0x3a
jne 0x427fc0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x427ffa
call edi
test eax, eax
je 0x427fe7
cmp byte [ebp - 3], 0x3a
jne 0x427fe7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428011
call edi
test eax, eax
je 0x428011
cmp byte [ebp - 3], 0x3a
jne 0x428011
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42803b
cmp byte [ebp - 3], 0x3a
jne 0x42803b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428075
call edi
test eax, eax
je 0x428062
cmp byte [ebp - 3], 0x3a
jne 0x428062
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42808c
call edi
test eax, eax
je 0x42808c
cmp byte [ebp - 3], 0x3a
jne 0x42808c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4280b9
cmp byte [ebp - 3], 0x3a
jne 0x4280b9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4280f3
call edi
test eax, eax
je 0x4280e0
cmp byte [ebp - 3], 0x3a
jne 0x4280e0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42810a
call edi
test eax, eax
je 0x42810a
cmp byte [ebp - 3], 0x3a
jne 0x42810a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42813d
cmp byte [ebp - 3], 0x3a
jne 0x42813d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428177
call edi
test eax, eax
je 0x428164
cmp byte [ebp - 3], 0x3a
jne 0x428164
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42818e
call edi
test eax, eax
je 0x42818e
cmp byte [ebp - 3], 0x3a
jne 0x42818e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4281bd
cmp byte [ebp - 3], 0x3a
jne 0x4281bd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4281f7
call edi
test eax, eax
je 0x4281e4
cmp byte [ebp - 3], 0x3a
jne 0x4281e4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42820e
call edi
test eax, eax
je 0x42820e
cmp byte [ebp - 3], 0x3a
jne 0x42820e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428230
cmp byte [ebp - 3], 0x3a
jne 0x428230
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42826a
call edi
test eax, eax
je 0x428257
cmp byte [ebp - 3], 0x3a
jne 0x428257
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428281
call edi
test eax, eax
je 0x428281
cmp byte [ebp - 3], 0x3a
jne 0x428281
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4282a3
cmp byte [ebp - 3], 0x3a
jne 0x4282a3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4282dd
call edi
test eax, eax
je 0x4282ca
cmp byte [ebp - 3], 0x3a
jne 0x4282ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4282f4
call edi
test eax, eax
je 0x4282f4
cmp byte [ebp - 3], 0x3a
jne 0x4282f4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42831e
cmp byte [ebp - 3], 0x3a
jne 0x42831e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428358
call edi
test eax, eax
je 0x428345
cmp byte [ebp - 3], 0x3a
jne 0x428345
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42836f
call edi
test eax, eax
je 0x42836f
cmp byte [ebp - 3], 0x3a
jne 0x42836f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42839a
cmp byte [ebp - 3], 0x3a
jne 0x42839a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4283d4
call edi
test eax, eax
je 0x4283c1
cmp byte [ebp - 3], 0x3a
jne 0x4283c1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4283eb
call edi
test eax, eax
je 0x4283eb
cmp byte [ebp - 3], 0x3a
jne 0x4283eb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428416
cmp byte [ebp - 3], 0x3a
jne 0x428416
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428450
call edi
test eax, eax
je 0x42843d
cmp byte [ebp - 3], 0x3a
jne 0x42843d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428467
call edi
test eax, eax
je 0x428467
cmp byte [ebp - 3], 0x3a
jne 0x428467
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428491
cmp byte [ebp - 3], 0x3a
jne 0x428491
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4284cb
call edi
test eax, eax
je 0x4284b8
cmp byte [ebp - 3], 0x3a
jne 0x4284b8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4284e2
call edi
test eax, eax
je 0x4284e2
cmp byte [ebp - 3], 0x3a
jne 0x4284e2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428506
cmp byte [ebp - 3], 0x3a
jne 0x428506
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428540
call edi
test eax, eax
je 0x42852d
cmp byte [ebp - 3], 0x3a
jne 0x42852d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428557
call edi
test eax, eax
je 0x428557
cmp byte [ebp - 3], 0x3a
jne 0x428557
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428580
cmp byte [ebp - 3], 0x3a
jne 0x428580
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4285ba
call edi
test eax, eax
je 0x4285a7
cmp byte [ebp - 3], 0x3a
jne 0x4285a7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4285d1
call edi
test eax, eax
je 0x4285d1
cmp byte [ebp - 3], 0x3a
jne 0x4285d1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4285fa
cmp byte [ebp - 3], 0x3a
jne 0x4285fa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428634
call edi
test eax, eax
je 0x428621
cmp byte [ebp - 3], 0x3a
jne 0x428621
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42864b
call edi
test eax, eax
je 0x42864b
cmp byte [ebp - 3], 0x3a
jne 0x42864b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428679
cmp byte [ebp - 3], 0x3a
jne 0x428679
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4286b3
call edi
test eax, eax
je 0x4286a0
cmp byte [ebp - 3], 0x3a
jne 0x4286a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4286ca
call edi
test eax, eax
je 0x4286ca
cmp byte [ebp - 3], 0x3a
jne 0x4286ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4286f3
cmp byte [ebp - 3], 0x3a
jne 0x4286f3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42872d
call edi
test eax, eax
je 0x42871a
cmp byte [ebp - 3], 0x3a
jne 0x42871a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428744
call edi
test eax, eax
je 0x428744
cmp byte [ebp - 3], 0x3a
jne 0x428744
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x428766
cmp byte [ebp - 3], 0x3a
jne 0x428766
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4287a0
call edi
test eax, eax
je 0x42878d
cmp byte [ebp - 3], 0x3a
jne 0x42878d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4287b7
call edi
test eax, eax
je 0x4287b7
cmp byte [ebp - 3], 0x3a
jne 0x4287b7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4287e0
cmp byte [ebp - 3], 0x3a
jne 0x4287e0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42881a
call edi
test eax, eax
je 0x428807
cmp byte [ebp - 3], 0x3a
jne 0x428807
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428831
call edi
test eax, eax
je 0x428831
cmp byte [ebp - 3], 0x3a
jne 0x428831
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42885b
cmp byte [ebp - 3], 0x3a
jne 0x42885b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428895
call edi
test eax, eax
je 0x428882
cmp byte [ebp - 3], 0x3a
jne 0x428882
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4288ac
call edi
test eax, eax
je 0x4288ac
cmp byte [ebp - 3], 0x3a
jne 0x4288ac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4288d7
cmp byte [ebp - 3], 0x3a
jne 0x4288d7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x428911
call edi
test eax, eax
je 0x4288fe
cmp byte [ebp - 3], 0x3a
jne 0x4288fe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x428928
call edi
test eax, eax
je 0x428928
cmp byte [ebp - 3], 0x3a
jne 0x428928
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret