Function at 0x42277b
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
push esi
test eax, eax
mov dword [ebp - 0xc], ecx
jne 0x42342b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4227bd
cmp byte [ebp - 3], 0x3a
jne 0x4227bd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4227fe
call edi
test eax, eax
je 0x4227eb
cmp byte [ebp - 3], 0x3a
jne 0x4227eb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422815
call edi
test eax, eax
je 0x422815
cmp byte [ebp - 3], 0x3a
jne 0x422815
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422830
cmp byte [ebp - 3], 0x3a
jne 0x422830
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42286a
call edi
test eax, eax
je 0x422857
cmp byte [ebp - 3], 0x3a
jne 0x422857
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422881
call edi
test eax, eax
je 0x422881
cmp byte [ebp - 3], 0x3a
jne 0x422881
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4228b4
cmp byte [ebp - 3], 0x3a
jne 0x4228b4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4228ee
call edi
test eax, eax
je 0x4228db
cmp byte [ebp - 3], 0x3a
jne 0x4228db
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422905
call edi
test eax, eax
je 0x422905
cmp byte [ebp - 3], 0x3a
jne 0x422905
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422927
cmp byte [ebp - 3], 0x3a
jne 0x422927
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422961
call edi
test eax, eax
je 0x42294e
cmp byte [ebp - 3], 0x3a
jne 0x42294e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422978
call edi
test eax, eax
je 0x422978
cmp byte [ebp - 3], 0x3a
jne 0x422978
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422999
cmp byte [ebp - 3], 0x3a
jne 0x422999
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4229d3
call edi
test eax, eax
je 0x4229c0
cmp byte [ebp - 3], 0x3a
jne 0x4229c0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4229ea
call edi
test eax, eax
je 0x4229ea
cmp byte [ebp - 3], 0x3a
jne 0x4229ea
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422a26
cmp byte [ebp - 3], 0x3a
jne 0x422a26
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422a60
call edi
test eax, eax
je 0x422a4d
cmp byte [ebp - 3], 0x3a
jne 0x422a4d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422a77
call edi
test eax, eax
je 0x422a77
cmp byte [ebp - 3], 0x3a
jne 0x422a77
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422aa2
cmp byte [ebp - 3], 0x3a
jne 0x422aa2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422adc
call edi
test eax, eax
je 0x422ac9
cmp byte [ebp - 3], 0x3a
jne 0x422ac9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422af3
call edi
test eax, eax
je 0x422af3
cmp byte [ebp - 3], 0x3a
jne 0x422af3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422b1d
cmp byte [ebp - 3], 0x3a
jne 0x422b1d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422b57
call edi
test eax, eax
je 0x422b44
cmp byte [ebp - 3], 0x3a
jne 0x422b44
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422b6e
call edi
test eax, eax
je 0x422b6e
cmp byte [ebp - 3], 0x3a
jne 0x422b6e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422b9b
cmp byte [ebp - 3], 0x3a
jne 0x422b9b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422bd5
call edi
test eax, eax
je 0x422bc2
cmp byte [ebp - 3], 0x3a
jne 0x422bc2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422bec
call edi
test eax, eax
je 0x422bec
cmp byte [ebp - 3], 0x3a
jne 0x422bec
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422c1f
cmp byte [ebp - 3], 0x3a
jne 0x422c1f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422c59
call edi
test eax, eax
je 0x422c46
cmp byte [ebp - 3], 0x3a
jne 0x422c46
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422c70
call edi
test eax, eax
je 0x422c70
cmp byte [ebp - 3], 0x3a
jne 0x422c70
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422c9f
cmp byte [ebp - 3], 0x3a
jne 0x422c9f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422cd9
call edi
test eax, eax
je 0x422cc6
cmp byte [ebp - 3], 0x3a
jne 0x422cc6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422cf0
call edi
test eax, eax
je 0x422cf0
cmp byte [ebp - 3], 0x3a
jne 0x422cf0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422d12
cmp byte [ebp - 3], 0x3a
jne 0x422d12
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422d4c
call edi
test eax, eax
je 0x422d39
cmp byte [ebp - 3], 0x3a
jne 0x422d39
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422d63
call edi
test eax, eax
je 0x422d63
cmp byte [ebp - 3], 0x3a
jne 0x422d63
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422d85
cmp byte [ebp - 3], 0x3a
jne 0x422d85
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422dbf
call edi
test eax, eax
je 0x422dac
cmp byte [ebp - 3], 0x3a
jne 0x422dac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422dd6
call edi
test eax, eax
je 0x422dd6
cmp byte [ebp - 3], 0x3a
jne 0x422dd6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422e00
cmp byte [ebp - 3], 0x3a
jne 0x422e00
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422e3a
call edi
test eax, eax
je 0x422e27
cmp byte [ebp - 3], 0x3a
jne 0x422e27
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422e51
call edi
test eax, eax
je 0x422e51
cmp byte [ebp - 3], 0x3a
jne 0x422e51
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422e7c
cmp byte [ebp - 3], 0x3a
jne 0x422e7c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422eb6
call edi
test eax, eax
je 0x422ea3
cmp byte [ebp - 3], 0x3a
jne 0x422ea3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422ecd
call edi
test eax, eax
je 0x422ecd
cmp byte [ebp - 3], 0x3a
jne 0x422ecd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422ef8
cmp byte [ebp - 3], 0x3a
jne 0x422ef8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422f32
call edi
test eax, eax
je 0x422f1f
cmp byte [ebp - 3], 0x3a
jne 0x422f1f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422f49
call edi
test eax, eax
je 0x422f49
cmp byte [ebp - 3], 0x3a
jne 0x422f49
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422f73
cmp byte [ebp - 3], 0x3a
jne 0x422f73
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422fad
call edi
test eax, eax
je 0x422f9a
cmp byte [ebp - 3], 0x3a
jne 0x422f9a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x422fc4
call edi
test eax, eax
je 0x422fc4
cmp byte [ebp - 3], 0x3a
jne 0x422fc4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x422fe8
cmp byte [ebp - 3], 0x3a
jne 0x422fe8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x423022
call edi
test eax, eax
je 0x42300f
cmp byte [ebp - 3], 0x3a
jne 0x42300f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x423039
call edi
test eax, eax
je 0x423039
cmp byte [ebp - 3], 0x3a
jne 0x423039
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x423062
cmp byte [ebp - 3], 0x3a
jne 0x423062
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42309c
call edi
test eax, eax
je 0x423089
cmp byte [ebp - 3], 0x3a
jne 0x423089
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4230b3
call edi
test eax, eax
je 0x4230b3
cmp byte [ebp - 3], 0x3a
jne 0x4230b3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4230dc
cmp byte [ebp - 3], 0x3a
jne 0x4230dc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x423116
call edi
test eax, eax
je 0x423103
cmp byte [ebp - 3], 0x3a
jne 0x423103
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42312d
call edi
test eax, eax
je 0x42312d
cmp byte [ebp - 3], 0x3a
jne 0x42312d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42315b
cmp byte [ebp - 3], 0x3a
jne 0x42315b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x423195
call edi
test eax, eax
je 0x423182
cmp byte [ebp - 3], 0x3a
jne 0x423182
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4231ac
call edi
test eax, eax
je 0x4231ac
cmp byte [ebp - 3], 0x3a
jne 0x4231ac
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4231d5
cmp byte [ebp - 3], 0x3a
jne 0x4231d5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42320f
call edi
test eax, eax
je 0x4231fc
cmp byte [ebp - 3], 0x3a
jne 0x4231fc
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x423226
call edi
test eax, eax
je 0x423226
cmp byte [ebp - 3], 0x3a
jne 0x423226
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x423248
cmp byte [ebp - 3], 0x3a
jne 0x423248
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x423282
call edi
test eax, eax
je 0x42326f
cmp byte [ebp - 3], 0x3a
jne 0x42326f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x423299
call edi
test eax, eax
je 0x423299
cmp byte [ebp - 3], 0x3a
jne 0x423299
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4232c2
cmp byte [ebp - 3], 0x3a
jne 0x4232c2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4232fc
call edi
test eax, eax
je 0x4232e9
cmp byte [ebp - 3], 0x3a
jne 0x4232e9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x423313
call edi
test eax, eax
je 0x423313
cmp byte [ebp - 3], 0x3a
jne 0x423313
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42333d
cmp byte [ebp - 3], 0x3a
jne 0x42333d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x423377
call edi
test eax, eax
je 0x423364
cmp byte [ebp - 3], 0x3a
jne 0x423364
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42338e
call edi
test eax, eax
je 0x42338e
cmp byte [ebp - 3], 0x3a
jne 0x42338e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4233b9
cmp byte [ebp - 3], 0x3a
jne 0x4233b9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4233f3
call edi
test eax, eax
je 0x4233e0
cmp byte [ebp - 3], 0x3a
jne 0x4233e0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42340a
call edi
test eax, eax
je 0x42340a
cmp byte [ebp - 3], 0x3a
jne 0x42340a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
push dword [ebp + 8]
mov eax, dword [0x4503d0]
call dword [eax + 0x1f0]
test eax, eax
pop ecx
je 0x42358f
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push ebx
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x21c]
push dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1e8]
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x210]
add esp, 0x18
lea eax, [ebp - 0x278]
push esi
push eax
mov eax, dword [0x4503d0]
push ebx
call dword [eax + 0x74]
lea eax, [ebp - 0x278]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x210]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1e0]
add esp, 0xc
test eax, eax
je 0x42358f
cmp byte [ebp - 0x10f], 0x3a
jne 0x42358f
cmp byte [ebp - 0x10e], 0x5c
jne 0x42358f
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4503d0]
call dword [eax + 0x1f0]
mov esi, eax
pop ecx
lea eax, [ebp - 0x110]
push ebx
sub eax, 4
push 0x65
add esi, eax
push 0x78
push 0x65
lea eax, [ebp - 0x174]
push 0x2e
push eax
call fcn.0041591e
lea eax, [ebp - 0x174]
push eax
mov eax, dword [0x4503d0]
push esi
call dword [eax + 0x1e0]
add esp, 0x20
test eax, eax
jne 0x42358f
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00424315
test eax, eax
je 0x42358f
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00425d21
test eax, eax
je 0x42358f
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x110]
push eax
call fcn.00425035
cmp eax, ebx
je 0x42358f
cmp eax, 0xa00000
ja 0x42358f
cmp eax, 0x2800
jb 0x42358f
push 1
pop eax
jmp 0x423591
xor eax, eax
pop esi
pop ebx
leave
ret 4