Function at 0x424cfc
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Create thread
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
mov dword [ebp - 0xc], ecx
jne 0x425aa4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x424d3e
cmp byte [ebp - 3], 0x3a
jne 0x424d3e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x424d7f
call edi
test eax, eax
je 0x424d6c
cmp byte [ebp - 3], 0x3a
jne 0x424d6c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x424d96
call edi
test eax, eax
je 0x424d96
cmp byte [ebp - 3], 0x3a
jne 0x424d96
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x424db1
cmp byte [ebp - 3], 0x3a
jne 0x424db1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x424deb
call edi
test eax, eax
je 0x424dd8
cmp byte [ebp - 3], 0x3a
jne 0x424dd8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x424e02
call edi
test eax, eax
je 0x424e02
cmp byte [ebp - 3], 0x3a
jne 0x424e02
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x424e35
cmp byte [ebp - 3], 0x3a
jne 0x424e35
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x424e6f
call edi
test eax, eax
je 0x424e5c
cmp byte [ebp - 3], 0x3a
jne 0x424e5c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x424e86
call edi
test eax, eax
je 0x424e86
cmp byte [ebp - 3], 0x3a
jne 0x424e86
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x424ead
cmp byte [ebp - 3], 0x3a
jne 0x424ead
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x424ee7
call edi
test eax, eax
je 0x424ed4
cmp byte [ebp - 3], 0x3a
jne 0x424ed4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x424efe
call edi
test eax, eax
je 0x424efe
cmp byte [ebp - 3], 0x3a
jne 0x424efe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x424f20
cmp byte [ebp - 3], 0x3a
jne 0x424f20
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x424f5a
call edi
test eax, eax
je 0x424f47
cmp byte [ebp - 3], 0x3a
jne 0x424f47
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x424f71
call edi
test eax, eax
je 0x424f71
cmp byte [ebp - 3], 0x3a
jne 0x424f71
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x424f93
cmp byte [ebp - 3], 0x3a
jne 0x424f93
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x424fcd
call edi
test eax, eax
je 0x424fba
cmp byte [ebp - 3], 0x3a
jne 0x424fba
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x424fe4
call edi
test eax, eax
je 0x424fe4
cmp byte [ebp - 3], 0x3a
jne 0x424fe4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425012
cmp byte [ebp - 3], 0x3a
jne 0x425012
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42504c
call edi
test eax, eax
je 0x425039
cmp byte [ebp - 3], 0x3a
jne 0x425039
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425063
call edi
test eax, eax
je 0x425063
cmp byte [ebp - 3], 0x3a
jne 0x425063
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42509f
cmp byte [ebp - 3], 0x3a
jne 0x42509f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4250d9
call edi
test eax, eax
je 0x4250c6
cmp byte [ebp - 3], 0x3a
jne 0x4250c6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4250f0
call edi
test eax, eax
je 0x4250f0
cmp byte [ebp - 3], 0x3a
jne 0x4250f0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42511b
cmp byte [ebp - 3], 0x3a
jne 0x42511b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425155
call edi
test eax, eax
je 0x425142
cmp byte [ebp - 3], 0x3a
jne 0x425142
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42516c
call edi
test eax, eax
je 0x42516c
cmp byte [ebp - 3], 0x3a
jne 0x42516c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425196
cmp byte [ebp - 3], 0x3a
jne 0x425196
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4251d0
call edi
test eax, eax
je 0x4251bd
cmp byte [ebp - 3], 0x3a
jne 0x4251bd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4251e7
call edi
test eax, eax
je 0x4251e7
cmp byte [ebp - 3], 0x3a
jne 0x4251e7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425214
cmp byte [ebp - 3], 0x3a
jne 0x425214
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42524e
call edi
test eax, eax
je 0x42523b
cmp byte [ebp - 3], 0x3a
jne 0x42523b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425265
call edi
test eax, eax
je 0x425265
cmp byte [ebp - 3], 0x3a
jne 0x425265
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425298
cmp byte [ebp - 3], 0x3a
jne 0x425298
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4252d2
call edi
test eax, eax
je 0x4252bf
cmp byte [ebp - 3], 0x3a
jne 0x4252bf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4252e9
call edi
test eax, eax
je 0x4252e9
cmp byte [ebp - 3], 0x3a
jne 0x4252e9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425318
cmp byte [ebp - 3], 0x3a
jne 0x425318
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425352
call edi
test eax, eax
je 0x42533f
cmp byte [ebp - 3], 0x3a
jne 0x42533f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425369
call edi
test eax, eax
je 0x425369
cmp byte [ebp - 3], 0x3a
jne 0x425369
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42538b
cmp byte [ebp - 3], 0x3a
jne 0x42538b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4253c5
call edi
test eax, eax
je 0x4253b2
cmp byte [ebp - 3], 0x3a
jne 0x4253b2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4253dc
call edi
test eax, eax
je 0x4253dc
cmp byte [ebp - 3], 0x3a
jne 0x4253dc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4253fe
cmp byte [ebp - 3], 0x3a
jne 0x4253fe
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425438
call edi
test eax, eax
je 0x425425
cmp byte [ebp - 3], 0x3a
jne 0x425425
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42544f
call edi
test eax, eax
je 0x42544f
cmp byte [ebp - 3], 0x3a
jne 0x42544f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425479
cmp byte [ebp - 3], 0x3a
jne 0x425479
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4254b3
call edi
test eax, eax
je 0x4254a0
cmp byte [ebp - 3], 0x3a
jne 0x4254a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4254ca
call edi
test eax, eax
je 0x4254ca
cmp byte [ebp - 3], 0x3a
jne 0x4254ca
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4254f5
cmp byte [ebp - 3], 0x3a
jne 0x4254f5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42552f
call edi
test eax, eax
je 0x42551c
cmp byte [ebp - 3], 0x3a
jne 0x42551c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425546
call edi
test eax, eax
je 0x425546
cmp byte [ebp - 3], 0x3a
jne 0x425546
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425571
cmp byte [ebp - 3], 0x3a
jne 0x425571
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4255ab
call edi
test eax, eax
je 0x425598
cmp byte [ebp - 3], 0x3a
jne 0x425598
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4255c2
call edi
test eax, eax
je 0x4255c2
cmp byte [ebp - 3], 0x3a
jne 0x4255c2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4255ec
cmp byte [ebp - 3], 0x3a
jne 0x4255ec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425626
call edi
test eax, eax
je 0x425613
cmp byte [ebp - 3], 0x3a
jne 0x425613
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42563d
call edi
test eax, eax
je 0x42563d
cmp byte [ebp - 3], 0x3a
jne 0x42563d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425661
cmp byte [ebp - 3], 0x3a
jne 0x425661
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42569b
call edi
test eax, eax
je 0x425688
cmp byte [ebp - 3], 0x3a
jne 0x425688
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4256b2
call edi
test eax, eax
je 0x4256b2
cmp byte [ebp - 3], 0x3a
jne 0x4256b2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4256db
cmp byte [ebp - 3], 0x3a
jne 0x4256db
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425715
call edi
test eax, eax
je 0x425702
cmp byte [ebp - 3], 0x3a
jne 0x425702
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42572c
call edi
test eax, eax
je 0x42572c
cmp byte [ebp - 3], 0x3a
jne 0x42572c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425755
cmp byte [ebp - 3], 0x3a
jne 0x425755
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42578f
call edi
test eax, eax
je 0x42577c
cmp byte [ebp - 3], 0x3a
jne 0x42577c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4257a6
call edi
test eax, eax
je 0x4257a6
cmp byte [ebp - 3], 0x3a
jne 0x4257a6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4257d4
cmp byte [ebp - 3], 0x3a
jne 0x4257d4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42580e
call edi
test eax, eax
je 0x4257fb
cmp byte [ebp - 3], 0x3a
jne 0x4257fb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425825
call edi
test eax, eax
je 0x425825
cmp byte [ebp - 3], 0x3a
jne 0x425825
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42584e
cmp byte [ebp - 3], 0x3a
jne 0x42584e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425888
call edi
test eax, eax
je 0x425875
cmp byte [ebp - 3], 0x3a
jne 0x425875
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42589f
call edi
test eax, eax
je 0x42589f
cmp byte [ebp - 3], 0x3a
jne 0x42589f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4258c1
cmp byte [ebp - 3], 0x3a
jne 0x4258c1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4258fb
call edi
test eax, eax
je 0x4258e8
cmp byte [ebp - 3], 0x3a
jne 0x4258e8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425912
call edi
test eax, eax
je 0x425912
cmp byte [ebp - 3], 0x3a
jne 0x425912
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42593b
cmp byte [ebp - 3], 0x3a
jne 0x42593b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425975
call edi
test eax, eax
je 0x425962
cmp byte [ebp - 3], 0x3a
jne 0x425962
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42598c
call edi
test eax, eax
je 0x42598c
cmp byte [ebp - 3], 0x3a
jne 0x42598c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4259b6
cmp byte [ebp - 3], 0x3a
jne 0x4259b6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4259f0
call edi
test eax, eax
je 0x4259dd
cmp byte [ebp - 3], 0x3a
jne 0x4259dd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425a07
call edi
test eax, eax
je 0x425a07
cmp byte [ebp - 3], 0x3a
jne 0x425a07
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425a32
cmp byte [ebp - 3], 0x3a
jne 0x425a32
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425a6c
call edi
test eax, eax
je 0x425a59
cmp byte [ebp - 3], 0x3a
jne 0x425a59
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425a83
call edi
test eax, eax
je 0x425a83
cmp byte [ebp - 3], 0x3a
jne 0x425a83
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
push dword [ebp + 8]
mov eax, dword [0x4543d0]
call dword [eax + 0x1f0]
test eax, eax
pop ecx
je 0x425c08
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push ebx
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x21c]
push dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1e8]
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x210]
add esp, 0x18
lea eax, [ebp - 0x278]
push esi
push eax
mov eax, dword [0x4543d0]
push ebx
call dword [eax + 0x74]
lea eax, [ebp - 0x278]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x210]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1e0]
add esp, 0xc
test eax, eax
je 0x425c08
cmp byte [ebp - 0x10f], 0x3a
jne 0x425c08
cmp byte [ebp - 0x10e], 0x5c
jne 0x425c08
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4543d0]
call dword [eax + 0x1f0]
mov esi, eax
pop ecx
lea eax, [ebp - 0x110]
push ebx
sub eax, 4
push 0x65
add esi, eax
push 0x78
push 0x65
lea eax, [ebp - 0x174]
push 0x2e
push eax
call fcn.004171ee
lea eax, [ebp - 0x174]
push eax
mov eax, dword [0x4543d0]
push esi
call dword [eax + 0x1e0]
add esp, 0x20
test eax, eax
jne 0x425c08
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00426a86
test eax, eax
je 0x425c08
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00428682
test eax, eax
je 0x425c08
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x110]
push eax
call fcn.0042789e
cmp eax, ebx
je 0x425c08
cmp eax, 0xa00000
ja 0x425c08
cmp eax, 0x2800
jb 0x425c08
push 1
pop eax
jmp 0x425c0a
xor eax, eax
pop esi
pop ebx
leave
ret 4