Function at 0x43370f
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x448e6b
call fcn.00448330
mov eax, 0x19128
call fcn.00448360
push ebx
lea eax, [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x4343ce
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43375d
cmp byte [ebp - 0xf], 0x3a
jne 0x43375d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43379d
call edi
test eax, eax
je 0x43378a
cmp byte [ebp - 0xf], 0x3a
jne 0x43378a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4337b4
call edi
test eax, eax
je 0x4337b4
cmp byte [ebp - 0xf], 0x3a
jne 0x4337b4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4337cf
cmp byte [ebp - 0xf], 0x3a
jne 0x4337cf
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433809
call edi
test eax, eax
je 0x4337f6
cmp byte [ebp - 0xf], 0x3a
jne 0x4337f6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433820
call edi
test eax, eax
je 0x433820
cmp byte [ebp - 0xf], 0x3a
jne 0x433820
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433853
cmp byte [ebp - 0xf], 0x3a
jne 0x433853
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43388d
call edi
test eax, eax
je 0x43387a
cmp byte [ebp - 0xf], 0x3a
jne 0x43387a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4338a4
call edi
test eax, eax
je 0x4338a4
cmp byte [ebp - 0xf], 0x3a
jne 0x4338a4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4338c6
cmp byte [ebp - 0xf], 0x3a
jne 0x4338c6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433900
call edi
test eax, eax
je 0x4338ed
cmp byte [ebp - 0xf], 0x3a
jne 0x4338ed
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433917
call edi
test eax, eax
je 0x433917
cmp byte [ebp - 0xf], 0x3a
jne 0x433917
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433938
cmp byte [ebp - 0xf], 0x3a
jne 0x433938
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433972
call edi
test eax, eax
je 0x43395f
cmp byte [ebp - 0xf], 0x3a
jne 0x43395f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433989
call edi
test eax, eax
je 0x433989
cmp byte [ebp - 0xf], 0x3a
jne 0x433989
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4339c5
cmp byte [ebp - 0xf], 0x3a
jne 0x4339c5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4339ff
call edi
test eax, eax
je 0x4339ec
cmp byte [ebp - 0xf], 0x3a
jne 0x4339ec
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433a16
call edi
test eax, eax
je 0x433a16
cmp byte [ebp - 0xf], 0x3a
jne 0x433a16
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433a41
cmp byte [ebp - 0xf], 0x3a
jne 0x433a41
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433a7b
call edi
test eax, eax
je 0x433a68
cmp byte [ebp - 0xf], 0x3a
jne 0x433a68
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433a92
call edi
test eax, eax
je 0x433a92
cmp byte [ebp - 0xf], 0x3a
jne 0x433a92
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433abc
cmp byte [ebp - 0xf], 0x3a
jne 0x433abc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433af6
call edi
test eax, eax
je 0x433ae3
cmp byte [ebp - 0xf], 0x3a
jne 0x433ae3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433b0d
call edi
test eax, eax
je 0x433b0d
cmp byte [ebp - 0xf], 0x3a
jne 0x433b0d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433b3a
cmp byte [ebp - 0xf], 0x3a
jne 0x433b3a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433b74
call edi
test eax, eax
je 0x433b61
cmp byte [ebp - 0xf], 0x3a
jne 0x433b61
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433b8b
call edi
test eax, eax
je 0x433b8b
cmp byte [ebp - 0xf], 0x3a
jne 0x433b8b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433bbe
cmp byte [ebp - 0xf], 0x3a
jne 0x433bbe
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433bf8
call edi
test eax, eax
je 0x433be5
cmp byte [ebp - 0xf], 0x3a
jne 0x433be5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433c0f
call edi
test eax, eax
je 0x433c0f
cmp byte [ebp - 0xf], 0x3a
jne 0x433c0f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433c3e
cmp byte [ebp - 0xf], 0x3a
jne 0x433c3e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433c78
call edi
test eax, eax
je 0x433c65
cmp byte [ebp - 0xf], 0x3a
jne 0x433c65
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433c8f
call edi
test eax, eax
je 0x433c8f
cmp byte [ebp - 0xf], 0x3a
jne 0x433c8f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433cb1
cmp byte [ebp - 0xf], 0x3a
jne 0x433cb1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433ceb
call edi
test eax, eax
je 0x433cd8
cmp byte [ebp - 0xf], 0x3a
jne 0x433cd8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433d02
call edi
test eax, eax
je 0x433d02
cmp byte [ebp - 0xf], 0x3a
jne 0x433d02
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433d24
cmp byte [ebp - 0xf], 0x3a
jne 0x433d24
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433d5e
call edi
test eax, eax
je 0x433d4b
cmp byte [ebp - 0xf], 0x3a
jne 0x433d4b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433d75
call edi
test eax, eax
je 0x433d75
cmp byte [ebp - 0xf], 0x3a
jne 0x433d75
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433d9f
cmp byte [ebp - 0xf], 0x3a
jne 0x433d9f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433dd9
call edi
test eax, eax
je 0x433dc6
cmp byte [ebp - 0xf], 0x3a
jne 0x433dc6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433df0
call edi
test eax, eax
je 0x433df0
cmp byte [ebp - 0xf], 0x3a
jne 0x433df0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433e1b
cmp byte [ebp - 0xf], 0x3a
jne 0x433e1b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433e55
call edi
test eax, eax
je 0x433e42
cmp byte [ebp - 0xf], 0x3a
jne 0x433e42
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433e6c
call edi
test eax, eax
je 0x433e6c
cmp byte [ebp - 0xf], 0x3a
jne 0x433e6c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433e97
cmp byte [ebp - 0xf], 0x3a
jne 0x433e97
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433ed1
call edi
test eax, eax
je 0x433ebe
cmp byte [ebp - 0xf], 0x3a
jne 0x433ebe
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433ee8
call edi
test eax, eax
je 0x433ee8
cmp byte [ebp - 0xf], 0x3a
jne 0x433ee8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433f12
cmp byte [ebp - 0xf], 0x3a
jne 0x433f12
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433f4c
call edi
test eax, eax
je 0x433f39
cmp byte [ebp - 0xf], 0x3a
jne 0x433f39
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433f63
call edi
test eax, eax
je 0x433f63
cmp byte [ebp - 0xf], 0x3a
jne 0x433f63
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x433f87
cmp byte [ebp - 0xf], 0x3a
jne 0x433f87
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x433fc1
call edi
test eax, eax
je 0x433fae
cmp byte [ebp - 0xf], 0x3a
jne 0x433fae
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x433fd8
call edi
test eax, eax
je 0x433fd8
cmp byte [ebp - 0xf], 0x3a
jne 0x433fd8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x434001
cmp byte [ebp - 0xf], 0x3a
jne 0x434001
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43403b
call edi
test eax, eax
je 0x434028
cmp byte [ebp - 0xf], 0x3a
jne 0x434028
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x434052
call edi
test eax, eax
je 0x434052
cmp byte [ebp - 0xf], 0x3a
jne 0x434052
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43407b
cmp byte [ebp - 0xf], 0x3a
jne 0x43407b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4340b5
call edi
test eax, eax
je 0x4340a2
cmp byte [ebp - 0xf], 0x3a
jne 0x4340a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4340cc
call edi
test eax, eax
je 0x4340cc
cmp byte [ebp - 0xf], 0x3a
jne 0x4340cc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4340fa
cmp byte [ebp - 0xf], 0x3a
jne 0x4340fa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x434134
call edi
test eax, eax
je 0x434121
cmp byte [ebp - 0xf], 0x3a
jne 0x434121
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43414b
call edi
test eax, eax
je 0x43414b
cmp byte [ebp - 0xf], 0x3a
jne 0x43414b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x434174
cmp byte [ebp - 0xf], 0x3a
jne 0x434174
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4341ae
call edi
test eax, eax
je 0x43419b
cmp byte [ebp - 0xf], 0x3a
jne 0x43419b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4341c5
call edi
test eax, eax
je 0x4341c5
cmp byte [ebp - 0xf], 0x3a
jne 0x4341c5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4341e7
cmp byte [ebp - 0xf], 0x3a
jne 0x4341e7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x434221
call edi
test eax, eax
je 0x43420e
cmp byte [ebp - 0xf], 0x3a
jne 0x43420e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x434238
call edi
test eax, eax
je 0x434238
cmp byte [ebp - 0xf], 0x3a
jne 0x434238
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x434261
cmp byte [ebp - 0xf], 0x3a
jne 0x434261
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43429b
call edi
test eax, eax
je 0x434288
cmp byte [ebp - 0xf], 0x3a
jne 0x434288
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4342b2
call edi
test eax, eax
je 0x4342b2
cmp byte [ebp - 0xf], 0x3a
jne 0x4342b2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4342dc
cmp byte [ebp - 0xf], 0x3a
jne 0x4342dc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x434316
call edi
test eax, eax
je 0x434303
cmp byte [ebp - 0xf], 0x3a
jne 0x434303
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43432d
call edi
test eax, eax
je 0x43432d
cmp byte [ebp - 0xf], 0x3a
jne 0x43432d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x434358
cmp byte [ebp - 0xf], 0x3a
jne 0x434358
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x434392
call edi
test eax, eax
je 0x43437f
cmp byte [ebp - 0xf], 0x3a
jne 0x43437f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4343a9
call edi
test eax, eax
je 0x4343a9
cmp byte [ebp - 0xf], 0x3a
jne 0x4343a9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
push dword [ecx + 8]
push dword [ecx + 4]
lea ecx, [ebp - 0x19134]
push dword [ebp + 8]
call fcn.0040a0fb
lea ecx, [ebp - 0x19134]
mov dword [ebp - 4], ebx
call fcn.0040bad4
cmp eax, 3
pop ebx
je 0x43443a
cmp eax, 1
lea ecx, [ebp - 0x19134]
jne 0x434426
call fcn.0040c81c
test eax, eax
jne 0x43443a
lea ecx, [ebp - 0x19134]
call fcn.0040d554
test eax, eax
je 0x43443a
lea ecx, [ebp - 0x19134]
call fcn.0040e249
jmp 0x43443a
call fcn.0040d554
test eax, eax
je 0x43443a
lea ecx, [ebp - 0x19134]
call fcn.0040ef5e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19134]
call fcn.0040ae09
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4