Function at 0x42230a
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
lea eax, [ebp + 0xc]
xor esi, esi
test eax, eax
push edi
mov dword [ebp - 0xc], ecx
jne 0x422fb4
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422367
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422367
cmp byte [ebp - 7], 0x3a
jne 0x422367
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4223a5
call esi
test eax, eax
je 0x422391
cmp byte [ebp - 3], 0x3a
jne 0x422391
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4223b9
call esi
test eax, eax
je 0x4223b9
cmp byte [ebp - 3], 0x3a
jne 0x4223b9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4223d3
cmp byte [ebp - 3], 0x3a
jne 0x4223d3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x4223ff
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4223ff
cmp byte [ebp - 7], 0x3a
jne 0x4223ff
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422437
call esi
test eax, eax
je 0x422423
cmp byte [ebp - 3], 0x3a
jne 0x422423
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42244b
call esi
test eax, eax
je 0x42244b
cmp byte [ebp - 3], 0x3a
jne 0x42244b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422465
cmp byte [ebp - 3], 0x3a
jne 0x422465
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422491
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422491
cmp byte [ebp - 7], 0x3a
jne 0x422491
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4224c9
call esi
test eax, eax
je 0x4224b5
cmp byte [ebp - 3], 0x3a
jne 0x4224b5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4224dd
call esi
test eax, eax
je 0x4224dd
cmp byte [ebp - 3], 0x3a
jne 0x4224dd
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4224f7
cmp byte [ebp - 3], 0x3a
jne 0x4224f7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422531
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422531
cmp byte [ebp - 7], 0x3a
jne 0x422531
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422569
call esi
test eax, eax
je 0x422555
cmp byte [ebp - 3], 0x3a
jne 0x422555
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42257d
call esi
test eax, eax
je 0x42257d
cmp byte [ebp - 3], 0x3a
jne 0x42257d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422597
cmp byte [ebp - 3], 0x3a
jne 0x422597
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x4225ce
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4225ce
cmp byte [ebp - 7], 0x3a
jne 0x4225ce
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422606
call esi
test eax, eax
je 0x4225f2
cmp byte [ebp - 3], 0x3a
jne 0x4225f2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42261a
call esi
test eax, eax
je 0x42261a
cmp byte [ebp - 3], 0x3a
jne 0x42261a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422634
cmp byte [ebp - 3], 0x3a
jne 0x422634
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422662
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422662
cmp byte [ebp - 7], 0x3a
jne 0x422662
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42269a
call esi
test eax, eax
je 0x422686
cmp byte [ebp - 3], 0x3a
jne 0x422686
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4226ae
call esi
test eax, eax
je 0x4226ae
cmp byte [ebp - 3], 0x3a
jne 0x4226ae
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4226c8
cmp byte [ebp - 3], 0x3a
jne 0x4226c8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x4226fc
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4226fc
cmp byte [ebp - 7], 0x3a
jne 0x4226fc
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422734
call esi
test eax, eax
je 0x422720
cmp byte [ebp - 3], 0x3a
jne 0x422720
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422748
call esi
test eax, eax
je 0x422748
cmp byte [ebp - 3], 0x3a
jne 0x422748
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422762
cmp byte [ebp - 3], 0x3a
jne 0x422762
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422790
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422790
cmp byte [ebp - 7], 0x3a
jne 0x422790
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4227c8
call esi
test eax, eax
je 0x4227b4
cmp byte [ebp - 3], 0x3a
jne 0x4227b4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4227dc
call esi
test eax, eax
je 0x4227dc
cmp byte [ebp - 3], 0x3a
jne 0x4227dc
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4227f6
cmp byte [ebp - 3], 0x3a
jne 0x4227f6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422822
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422822
cmp byte [ebp - 7], 0x3a
jne 0x422822
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42285a
call esi
test eax, eax
je 0x422846
cmp byte [ebp - 3], 0x3a
jne 0x422846
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x42286e
call esi
test eax, eax
je 0x42286e
cmp byte [ebp - 3], 0x3a
jne 0x42286e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422888
cmp byte [ebp - 3], 0x3a
jne 0x422888
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x4228b6
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4228b6
cmp byte [ebp - 7], 0x3a
jne 0x4228b6
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4228ee
call esi
test eax, eax
je 0x4228da
cmp byte [ebp - 3], 0x3a
jne 0x4228da
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422902
call esi
test eax, eax
je 0x422902
cmp byte [ebp - 3], 0x3a
jne 0x422902
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x42291c
cmp byte [ebp - 3], 0x3a
jne 0x42291c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422946
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422946
cmp byte [ebp - 7], 0x3a
jne 0x422946
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42297e
call esi
test eax, eax
je 0x42296a
cmp byte [ebp - 3], 0x3a
jne 0x42296a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422992
call esi
test eax, eax
je 0x422992
cmp byte [ebp - 3], 0x3a
jne 0x422992
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4229ac
cmp byte [ebp - 3], 0x3a
jne 0x4229ac
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x4229db
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4229db
cmp byte [ebp - 7], 0x3a
jne 0x4229db
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422a13
call esi
test eax, eax
je 0x4229ff
cmp byte [ebp - 3], 0x3a
jne 0x4229ff
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422a27
call esi
test eax, eax
je 0x422a27
cmp byte [ebp - 3], 0x3a
jne 0x422a27
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422a41
cmp byte [ebp - 3], 0x3a
jne 0x422a41
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422a6f
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422a6f
cmp byte [ebp - 7], 0x3a
jne 0x422a6f
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422aa7
call esi
test eax, eax
je 0x422a93
cmp byte [ebp - 3], 0x3a
jne 0x422a93
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422abb
call esi
test eax, eax
je 0x422abb
cmp byte [ebp - 3], 0x3a
jne 0x422abb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422ad5
cmp byte [ebp - 3], 0x3a
jne 0x422ad5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422b03
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422b03
cmp byte [ebp - 7], 0x3a
jne 0x422b03
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422b3b
call esi
test eax, eax
je 0x422b27
cmp byte [ebp - 3], 0x3a
jne 0x422b27
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422b4f
call esi
test eax, eax
je 0x422b4f
cmp byte [ebp - 3], 0x3a
jne 0x422b4f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422b69
cmp byte [ebp - 3], 0x3a
jne 0x422b69
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422b95
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422b95
cmp byte [ebp - 7], 0x3a
jne 0x422b95
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422bcd
call esi
test eax, eax
je 0x422bb9
cmp byte [ebp - 3], 0x3a
jne 0x422bb9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422be1
call esi
test eax, eax
je 0x422be1
cmp byte [ebp - 3], 0x3a
jne 0x422be1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422bfb
cmp byte [ebp - 3], 0x3a
jne 0x422bfb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422c2b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422c2b
cmp byte [ebp - 7], 0x3a
jne 0x422c2b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422c63
call esi
test eax, eax
je 0x422c4f
cmp byte [ebp - 3], 0x3a
jne 0x422c4f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422c77
call esi
test eax, eax
je 0x422c77
cmp byte [ebp - 3], 0x3a
jne 0x422c77
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422c91
cmp byte [ebp - 3], 0x3a
jne 0x422c91
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422cca
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422cca
cmp byte [ebp - 7], 0x3a
jne 0x422cca
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422d02
call esi
test eax, eax
je 0x422cee
cmp byte [ebp - 3], 0x3a
jne 0x422cee
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422d16
call esi
test eax, eax
je 0x422d16
cmp byte [ebp - 3], 0x3a
jne 0x422d16
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422d30
cmp byte [ebp - 3], 0x3a
jne 0x422d30
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422d5f
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422d5f
cmp byte [ebp - 7], 0x3a
jne 0x422d5f
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422d97
call esi
test eax, eax
je 0x422d83
cmp byte [ebp - 3], 0x3a
jne 0x422d83
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422dab
call esi
test eax, eax
je 0x422dab
cmp byte [ebp - 3], 0x3a
jne 0x422dab
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422dc5
cmp byte [ebp - 3], 0x3a
jne 0x422dc5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422df1
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422df1
cmp byte [ebp - 7], 0x3a
jne 0x422df1
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422e29
call esi
test eax, eax
je 0x422e15
cmp byte [ebp - 3], 0x3a
jne 0x422e15
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422e3d
call esi
test eax, eax
je 0x422e3d
cmp byte [ebp - 3], 0x3a
jne 0x422e3d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422e57
cmp byte [ebp - 3], 0x3a
jne 0x422e57
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422e87
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422e87
cmp byte [ebp - 7], 0x3a
jne 0x422e87
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422ebf
call esi
test eax, eax
je 0x422eab
cmp byte [ebp - 3], 0x3a
jne 0x422eab
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422ed3
call esi
test eax, eax
je 0x422ed3
cmp byte [ebp - 3], 0x3a
jne 0x422ed3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422eed
cmp byte [ebp - 3], 0x3a
jne 0x422eed
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp + 0xc]
cmp eax, 0xd5
jne 0x422f4e
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x422f4e
cmp byte [ebp - 7], 0x3a
jne 0x422f4e
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x422f86
call esi
test eax, eax
je 0x422f72
cmp byte [ebp - 3], 0x3a
jne 0x422f72
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x422f9a
call esi
test eax, eax
je 0x422f9a
cmp byte [ebp - 3], 0x3a
jne 0x422f9a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x422fb4
cmp byte [ebp - 3], 0x3a
jne 0x422fb4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp - 0xc]
lea edi, [eax + 4]
mov ecx, edi
call fcn.0042ab4b
mov eax, dword [0x4513d0]
push 0
push 2
call dword [eax + 0xc]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x423085
mov esi, 0x128
lea eax, [ebp - 0x134]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x134]
mov dword [ebp - 0x134], esi
push eax
mov eax, dword [0x4513d0]
push ebx
call dword [eax + 8]
test eax, eax
je 0x423085
push 0x104
lea eax, [ebp - 0x238]
push 0
push eax
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x12c]
call fcn.00423eee
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x238]
push eax
call fcn.0042308c
test eax, eax
je 0x42305b
lea eax, [ebp - 0x238]
mov ecx, edi
push eax
call fcn.00429143
lea eax, [ebp - 0x134]
push eax
mov eax, dword [0x4513d0]
push ebx
call dword [eax + 4]
test eax, eax
jne 0x42300f
mov eax, dword [0x4513d0]
push ebx
call dword [eax + 0x44]
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0042b82f
pop edi
pop esi
pop ebx
leave
ret 8