Function at 0x416f4f
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
lea eax, [ebp - 8]
push ebx
test eax, eax
push esi
jne 0x417bf4
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x416fa5
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x416fa5
cmp byte [ebp - 7], 0x3a
jne 0x416fa5
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x416fe4
call esi
test eax, eax
je 0x416fd0
cmp byte [ebp - 3], 0x3a
jne 0x416fd0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x416ff8
call esi
test eax, eax
je 0x416ff8
cmp byte [ebp - 3], 0x3a
jne 0x416ff8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417012
cmp byte [ebp - 3], 0x3a
jne 0x417012
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41703e
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41703e
cmp byte [ebp - 7], 0x3a
jne 0x41703e
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417076
call esi
test eax, eax
je 0x417062
cmp byte [ebp - 3], 0x3a
jne 0x417062
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41708a
call esi
test eax, eax
je 0x41708a
cmp byte [ebp - 3], 0x3a
jne 0x41708a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4170a4
cmp byte [ebp - 3], 0x3a
jne 0x4170a4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4170d0
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4170d0
cmp byte [ebp - 7], 0x3a
jne 0x4170d0
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417108
call esi
test eax, eax
je 0x4170f4
cmp byte [ebp - 3], 0x3a
jne 0x4170f4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41711c
call esi
test eax, eax
je 0x41711c
cmp byte [ebp - 3], 0x3a
jne 0x41711c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417136
cmp byte [ebp - 3], 0x3a
jne 0x417136
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417170
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417170
cmp byte [ebp - 7], 0x3a
jne 0x417170
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4171a8
call esi
test eax, eax
je 0x417194
cmp byte [ebp - 3], 0x3a
jne 0x417194
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4171bc
call esi
test eax, eax
je 0x4171bc
cmp byte [ebp - 3], 0x3a
jne 0x4171bc
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4171d6
cmp byte [ebp - 3], 0x3a
jne 0x4171d6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41720d
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41720d
cmp byte [ebp - 7], 0x3a
jne 0x41720d
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417245
call esi
test eax, eax
je 0x417231
cmp byte [ebp - 3], 0x3a
jne 0x417231
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417259
call esi
test eax, eax
je 0x417259
cmp byte [ebp - 3], 0x3a
jne 0x417259
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417273
cmp byte [ebp - 3], 0x3a
jne 0x417273
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4172a1
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4172a1
cmp byte [ebp - 7], 0x3a
jne 0x4172a1
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4172d9
call esi
test eax, eax
je 0x4172c5
cmp byte [ebp - 3], 0x3a
jne 0x4172c5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4172ed
call esi
test eax, eax
je 0x4172ed
cmp byte [ebp - 3], 0x3a
jne 0x4172ed
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417307
cmp byte [ebp - 3], 0x3a
jne 0x417307
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41733b
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41733b
cmp byte [ebp - 7], 0x3a
jne 0x41733b
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417373
call esi
test eax, eax
je 0x41735f
cmp byte [ebp - 3], 0x3a
jne 0x41735f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417387
call esi
test eax, eax
je 0x417387
cmp byte [ebp - 3], 0x3a
jne 0x417387
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4173a1
cmp byte [ebp - 3], 0x3a
jne 0x4173a1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4173cf
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4173cf
cmp byte [ebp - 7], 0x3a
jne 0x4173cf
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417407
call esi
test eax, eax
je 0x4173f3
cmp byte [ebp - 3], 0x3a
jne 0x4173f3
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41741b
call esi
test eax, eax
je 0x41741b
cmp byte [ebp - 3], 0x3a
jne 0x41741b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417435
cmp byte [ebp - 3], 0x3a
jne 0x417435
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417461
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417461
cmp byte [ebp - 7], 0x3a
jne 0x417461
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417499
call esi
test eax, eax
je 0x417485
cmp byte [ebp - 3], 0x3a
jne 0x417485
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4174ad
call esi
test eax, eax
je 0x4174ad
cmp byte [ebp - 3], 0x3a
jne 0x4174ad
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4174c7
cmp byte [ebp - 3], 0x3a
jne 0x4174c7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4174f5
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4174f5
cmp byte [ebp - 7], 0x3a
jne 0x4174f5
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41752d
call esi
test eax, eax
je 0x417519
cmp byte [ebp - 3], 0x3a
jne 0x417519
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417541
call esi
test eax, eax
je 0x417541
cmp byte [ebp - 3], 0x3a
jne 0x417541
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41755b
cmp byte [ebp - 3], 0x3a
jne 0x41755b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417585
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417585
cmp byte [ebp - 7], 0x3a
jne 0x417585
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4175bd
call esi
test eax, eax
je 0x4175a9
cmp byte [ebp - 3], 0x3a
jne 0x4175a9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4175d1
call esi
test eax, eax
je 0x4175d1
cmp byte [ebp - 3], 0x3a
jne 0x4175d1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4175eb
cmp byte [ebp - 3], 0x3a
jne 0x4175eb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41761a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41761a
cmp byte [ebp - 7], 0x3a
jne 0x41761a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417652
call esi
test eax, eax
je 0x41763e
cmp byte [ebp - 3], 0x3a
jne 0x41763e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417666
call esi
test eax, eax
je 0x417666
cmp byte [ebp - 3], 0x3a
jne 0x417666
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417680
cmp byte [ebp - 3], 0x3a
jne 0x417680
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4176ae
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4176ae
cmp byte [ebp - 7], 0x3a
jne 0x4176ae
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4176e6
call esi
test eax, eax
je 0x4176d2
cmp byte [ebp - 3], 0x3a
jne 0x4176d2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4176fa
call esi
test eax, eax
je 0x4176fa
cmp byte [ebp - 3], 0x3a
jne 0x4176fa
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417714
cmp byte [ebp - 3], 0x3a
jne 0x417714
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417742
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417742
cmp byte [ebp - 7], 0x3a
jne 0x417742
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41777a
call esi
test eax, eax
je 0x417766
cmp byte [ebp - 3], 0x3a
jne 0x417766
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41778e
call esi
test eax, eax
je 0x41778e
cmp byte [ebp - 3], 0x3a
jne 0x41778e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4177a8
cmp byte [ebp - 3], 0x3a
jne 0x4177a8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x4177d4
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4177d4
cmp byte [ebp - 7], 0x3a
jne 0x4177d4
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41780c
call esi
test eax, eax
je 0x4177f8
cmp byte [ebp - 3], 0x3a
jne 0x4177f8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417820
call esi
test eax, eax
je 0x417820
cmp byte [ebp - 3], 0x3a
jne 0x417820
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41783a
cmp byte [ebp - 3], 0x3a
jne 0x41783a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41786a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41786a
cmp byte [ebp - 7], 0x3a
jne 0x41786a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4178a2
call esi
test eax, eax
je 0x41788e
cmp byte [ebp - 3], 0x3a
jne 0x41788e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4178b6
call esi
test eax, eax
je 0x4178b6
cmp byte [ebp - 3], 0x3a
jne 0x4178b6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4178d0
cmp byte [ebp - 3], 0x3a
jne 0x4178d0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417909
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417909
cmp byte [ebp - 7], 0x3a
jne 0x417909
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417941
call esi
test eax, eax
je 0x41792d
cmp byte [ebp - 3], 0x3a
jne 0x41792d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417955
call esi
test eax, eax
je 0x417955
cmp byte [ebp - 3], 0x3a
jne 0x417955
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41796f
cmp byte [ebp - 3], 0x3a
jne 0x41796f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x41799e
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41799e
cmp byte [ebp - 7], 0x3a
jne 0x41799e
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4179d6
call esi
test eax, eax
je 0x4179c2
cmp byte [ebp - 3], 0x3a
jne 0x4179c2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4179ea
call esi
test eax, eax
je 0x4179ea
cmp byte [ebp - 3], 0x3a
jne 0x4179ea
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417a04
cmp byte [ebp - 3], 0x3a
jne 0x417a04
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417a30
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417a30
cmp byte [ebp - 7], 0x3a
jne 0x417a30
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417a68
call esi
test eax, eax
je 0x417a54
cmp byte [ebp - 3], 0x3a
jne 0x417a54
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417a7c
call esi
test eax, eax
je 0x417a7c
cmp byte [ebp - 3], 0x3a
jne 0x417a7c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417a96
cmp byte [ebp - 3], 0x3a
jne 0x417a96
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417ac6
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417ac6
cmp byte [ebp - 7], 0x3a
jne 0x417ac6
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417afe
call esi
test eax, eax
je 0x417aea
cmp byte [ebp - 3], 0x3a
jne 0x417aea
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417b12
call esi
test eax, eax
je 0x417b12
cmp byte [ebp - 3], 0x3a
jne 0x417b12
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x417b2c
cmp byte [ebp - 3], 0x3a
jne 0x417b2c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 8]
cmp eax, 0xd5
jne 0x417b8d
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x417b8d
cmp byte [ebp - 7], 0x3a
jne 0x417b8d
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp - 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x417bc5
call esi
test eax, eax
je 0x417bb1
cmp byte [ebp - 3], 0x3a
jne 0x417bb1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x417bd9
call esi
test eax, eax
je 0x417bd9
cmp byte [ebp - 3], 0x3a
jne 0x417bd9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
pop edi
je 0x417bf4
cmp byte [ebp - 3], 0x3a
jne 0x417bf4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0x7d
push 0x39
push 0x39
push 0x31
push 0x37
push 0x38
push 0x33
pop eax
push eax
push 0x32
push eax
push 0x36
push 0x32
push 0x46
push 0x32
push 0x2d
pop ecx
push ecx
push 0x36
push 0x31
push 0x43
push 0x39
push ecx
push eax
push 0x65
push 0x31
push 0x34
push ecx
push eax
push 0x34
push 0x30
push 0x46
push ecx
push 0x44
push 0x46
push 0x30
push 0x34
push eax
push 0x37
push eax
push 0x41
lea eax, [ebp - 0x6c]
push 0x7b
push eax
call fcn.004105df
add esp, 0xa0
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4513d0]
push 0
push 0x1f0003
call dword [eax + 0x30]
mov esi, eax
test esi, esi
je 0x417c78
mov eax, dword [0x4513d0]
push esi
call dword [eax + 0x48]
mov eax, dword [0x4513d0]
push esi
call dword [eax + 0x44]
pop esi
pop ebx
leave
ret