Function at 0x40ef5e
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov edi, ecx
xor ebx, ebx
test eax, eax
mov dword [ebp - 0xc], edi
jne 0x40fc12
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40efa3
cmp byte [ebp - 3], 0x3a
jne 0x40efa3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40efe3
call edi
test eax, eax
je 0x40efd0
cmp byte [ebp - 3], 0x3a
jne 0x40efd0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40effa
call edi
test eax, eax
je 0x40effa
cmp byte [ebp - 3], 0x3a
jne 0x40effa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f015
cmp byte [ebp - 3], 0x3a
jne 0x40f015
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f04f
call edi
test eax, eax
je 0x40f03c
cmp byte [ebp - 3], 0x3a
jne 0x40f03c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f066
call edi
test eax, eax
je 0x40f066
cmp byte [ebp - 3], 0x3a
jne 0x40f066
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f099
cmp byte [ebp - 3], 0x3a
jne 0x40f099
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f0d3
call edi
test eax, eax
je 0x40f0c0
cmp byte [ebp - 3], 0x3a
jne 0x40f0c0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f0ea
call edi
test eax, eax
je 0x40f0ea
cmp byte [ebp - 3], 0x3a
jne 0x40f0ea
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f10c
cmp byte [ebp - 3], 0x3a
jne 0x40f10c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f146
call edi
test eax, eax
je 0x40f133
cmp byte [ebp - 3], 0x3a
jne 0x40f133
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f15d
call edi
test eax, eax
je 0x40f15d
cmp byte [ebp - 3], 0x3a
jne 0x40f15d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f17e
cmp byte [ebp - 3], 0x3a
jne 0x40f17e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f1b8
call edi
test eax, eax
je 0x40f1a5
cmp byte [ebp - 3], 0x3a
jne 0x40f1a5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f1cf
call edi
test eax, eax
je 0x40f1cf
cmp byte [ebp - 3], 0x3a
jne 0x40f1cf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f20b
cmp byte [ebp - 3], 0x3a
jne 0x40f20b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f245
call edi
test eax, eax
je 0x40f232
cmp byte [ebp - 3], 0x3a
jne 0x40f232
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f25c
call edi
test eax, eax
je 0x40f25c
cmp byte [ebp - 3], 0x3a
jne 0x40f25c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f287
cmp byte [ebp - 3], 0x3a
jne 0x40f287
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f2c1
call edi
test eax, eax
je 0x40f2ae
cmp byte [ebp - 3], 0x3a
jne 0x40f2ae
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f2d8
call edi
test eax, eax
je 0x40f2d8
cmp byte [ebp - 3], 0x3a
jne 0x40f2d8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f302
cmp byte [ebp - 3], 0x3a
jne 0x40f302
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f33c
call edi
test eax, eax
je 0x40f329
cmp byte [ebp - 3], 0x3a
jne 0x40f329
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f353
call edi
test eax, eax
je 0x40f353
cmp byte [ebp - 3], 0x3a
jne 0x40f353
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f380
cmp byte [ebp - 3], 0x3a
jne 0x40f380
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f3ba
call edi
test eax, eax
je 0x40f3a7
cmp byte [ebp - 3], 0x3a
jne 0x40f3a7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f3d1
call edi
test eax, eax
je 0x40f3d1
cmp byte [ebp - 3], 0x3a
jne 0x40f3d1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f404
cmp byte [ebp - 3], 0x3a
jne 0x40f404
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f43e
call edi
test eax, eax
je 0x40f42b
cmp byte [ebp - 3], 0x3a
jne 0x40f42b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f455
call edi
test eax, eax
je 0x40f455
cmp byte [ebp - 3], 0x3a
jne 0x40f455
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f484
cmp byte [ebp - 3], 0x3a
jne 0x40f484
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f4be
call edi
test eax, eax
je 0x40f4ab
cmp byte [ebp - 3], 0x3a
jne 0x40f4ab
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f4d5
call edi
test eax, eax
je 0x40f4d5
cmp byte [ebp - 3], 0x3a
jne 0x40f4d5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f4f7
cmp byte [ebp - 3], 0x3a
jne 0x40f4f7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f531
call edi
test eax, eax
je 0x40f51e
cmp byte [ebp - 3], 0x3a
jne 0x40f51e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f548
call edi
test eax, eax
je 0x40f548
cmp byte [ebp - 3], 0x3a
jne 0x40f548
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f56a
cmp byte [ebp - 3], 0x3a
jne 0x40f56a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f5a4
call edi
test eax, eax
je 0x40f591
cmp byte [ebp - 3], 0x3a
jne 0x40f591
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f5bb
call edi
test eax, eax
je 0x40f5bb
cmp byte [ebp - 3], 0x3a
jne 0x40f5bb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f5e5
cmp byte [ebp - 3], 0x3a
jne 0x40f5e5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f61f
call edi
test eax, eax
je 0x40f60c
cmp byte [ebp - 3], 0x3a
jne 0x40f60c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f636
call edi
test eax, eax
je 0x40f636
cmp byte [ebp - 3], 0x3a
jne 0x40f636
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f661
cmp byte [ebp - 3], 0x3a
jne 0x40f661
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f69b
call edi
test eax, eax
je 0x40f688
cmp byte [ebp - 3], 0x3a
jne 0x40f688
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f6b2
call edi
test eax, eax
je 0x40f6b2
cmp byte [ebp - 3], 0x3a
jne 0x40f6b2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f6dd
cmp byte [ebp - 3], 0x3a
jne 0x40f6dd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f717
call edi
test eax, eax
je 0x40f704
cmp byte [ebp - 3], 0x3a
jne 0x40f704
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f72e
call edi
test eax, eax
je 0x40f72e
cmp byte [ebp - 3], 0x3a
jne 0x40f72e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f758
cmp byte [ebp - 3], 0x3a
jne 0x40f758
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f792
call edi
test eax, eax
je 0x40f77f
cmp byte [ebp - 3], 0x3a
jne 0x40f77f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f7a9
call edi
test eax, eax
je 0x40f7a9
cmp byte [ebp - 3], 0x3a
jne 0x40f7a9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f7cd
cmp byte [ebp - 3], 0x3a
jne 0x40f7cd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f807
call edi
test eax, eax
je 0x40f7f4
cmp byte [ebp - 3], 0x3a
jne 0x40f7f4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f81e
call edi
test eax, eax
je 0x40f81e
cmp byte [ebp - 3], 0x3a
jne 0x40f81e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f847
cmp byte [ebp - 3], 0x3a
jne 0x40f847
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f881
call edi
test eax, eax
je 0x40f86e
cmp byte [ebp - 3], 0x3a
jne 0x40f86e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f898
call edi
test eax, eax
je 0x40f898
cmp byte [ebp - 3], 0x3a
jne 0x40f898
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f8c1
cmp byte [ebp - 3], 0x3a
jne 0x40f8c1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f8fb
call edi
test eax, eax
je 0x40f8e8
cmp byte [ebp - 3], 0x3a
jne 0x40f8e8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f912
call edi
test eax, eax
je 0x40f912
cmp byte [ebp - 3], 0x3a
jne 0x40f912
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f940
cmp byte [ebp - 3], 0x3a
jne 0x40f940
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f97a
call edi
test eax, eax
je 0x40f967
cmp byte [ebp - 3], 0x3a
jne 0x40f967
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40f991
call edi
test eax, eax
je 0x40f991
cmp byte [ebp - 3], 0x3a
jne 0x40f991
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40f9ba
cmp byte [ebp - 3], 0x3a
jne 0x40f9ba
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40f9f4
call edi
test eax, eax
je 0x40f9e1
cmp byte [ebp - 3], 0x3a
jne 0x40f9e1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40fa0b
call edi
test eax, eax
je 0x40fa0b
cmp byte [ebp - 3], 0x3a
jne 0x40fa0b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40fa2d
cmp byte [ebp - 3], 0x3a
jne 0x40fa2d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40fa67
call edi
test eax, eax
je 0x40fa54
cmp byte [ebp - 3], 0x3a
jne 0x40fa54
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40fa7e
call edi
test eax, eax
je 0x40fa7e
cmp byte [ebp - 3], 0x3a
jne 0x40fa7e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40faa7
cmp byte [ebp - 3], 0x3a
jne 0x40faa7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40fae1
call edi
test eax, eax
je 0x40face
cmp byte [ebp - 3], 0x3a
jne 0x40face
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40faf8
call edi
test eax, eax
je 0x40faf8
cmp byte [ebp - 3], 0x3a
jne 0x40faf8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40fb22
cmp byte [ebp - 3], 0x3a
jne 0x40fb22
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40fb5c
call edi
test eax, eax
je 0x40fb49
cmp byte [ebp - 3], 0x3a
jne 0x40fb49
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40fb73
call edi
test eax, eax
je 0x40fb73
cmp byte [ebp - 3], 0x3a
jne 0x40fb73
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40fb9e
cmp byte [ebp - 3], 0x3a
jne 0x40fb9e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x40fbd8
call edi
test eax, eax
je 0x40fbc5
cmp byte [ebp - 3], 0x3a
jne 0x40fbc5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x40fbef
call edi
test eax, eax
je 0x40fbef
cmp byte [ebp - 3], 0x3a
jne 0x40fbef
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [ebp - 0xc]
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1e8]
mov eax, dword [0x4503d0]
pop ecx
pop ecx
push 1
push ebx
lea ecx, [ebp - 0x110]
push 0x2e
push ecx
lea esi, [eax + 0x21c]
call dword [eax + 0x1ec]
pop ecx
pop ecx
push eax
call dword [esi]
add esp, 0xc
lea eax, [ebp - 0x110]
mov ecx, edi
push eax
call fcn.004118aa
test eax, eax
jne 0x40fc85
lea eax, [ebp - 0x110]
mov ecx, edi
push eax
lea eax, [edi + 4]
push eax
call fcn.0041e55e
test eax, eax
je 0x40fc8c
lea eax, [ebp - 0x110]
mov ecx, edi
push eax
call fcn.00412592
mov ecx, edi
call fcn.0040e249
pop edi
pop esi
pop ebx
leave
ret