Function at 0x425d21
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x4269ca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425d5e
cmp byte [ebp - 3], 0x3a
jne 0x425d5e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425d9e
call edi
test eax, eax
je 0x425d8b
cmp byte [ebp - 3], 0x3a
jne 0x425d8b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425db5
call edi
test eax, eax
je 0x425db5
cmp byte [ebp - 3], 0x3a
jne 0x425db5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425dd0
cmp byte [ebp - 3], 0x3a
jne 0x425dd0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425e0a
call edi
test eax, eax
je 0x425df7
cmp byte [ebp - 3], 0x3a
jne 0x425df7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425e21
call edi
test eax, eax
je 0x425e21
cmp byte [ebp - 3], 0x3a
jne 0x425e21
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425e54
cmp byte [ebp - 3], 0x3a
jne 0x425e54
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425e8e
call edi
test eax, eax
je 0x425e7b
cmp byte [ebp - 3], 0x3a
jne 0x425e7b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425ea5
call edi
test eax, eax
je 0x425ea5
cmp byte [ebp - 3], 0x3a
jne 0x425ea5
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425ec7
cmp byte [ebp - 3], 0x3a
jne 0x425ec7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425f01
call edi
test eax, eax
je 0x425eee
cmp byte [ebp - 3], 0x3a
jne 0x425eee
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425f18
call edi
test eax, eax
je 0x425f18
cmp byte [ebp - 3], 0x3a
jne 0x425f18
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425f39
cmp byte [ebp - 3], 0x3a
jne 0x425f39
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x425f73
call edi
test eax, eax
je 0x425f60
cmp byte [ebp - 3], 0x3a
jne 0x425f60
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x425f8a
call edi
test eax, eax
je 0x425f8a
cmp byte [ebp - 3], 0x3a
jne 0x425f8a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x425fc6
cmp byte [ebp - 3], 0x3a
jne 0x425fc6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426000
call edi
test eax, eax
je 0x425fed
cmp byte [ebp - 3], 0x3a
jne 0x425fed
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426017
call edi
test eax, eax
je 0x426017
cmp byte [ebp - 3], 0x3a
jne 0x426017
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426042
cmp byte [ebp - 3], 0x3a
jne 0x426042
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42607c
call edi
test eax, eax
je 0x426069
cmp byte [ebp - 3], 0x3a
jne 0x426069
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426093
call edi
test eax, eax
je 0x426093
cmp byte [ebp - 3], 0x3a
jne 0x426093
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4260bd
cmp byte [ebp - 3], 0x3a
jne 0x4260bd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4260f7
call edi
test eax, eax
je 0x4260e4
cmp byte [ebp - 3], 0x3a
jne 0x4260e4
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42610e
call edi
test eax, eax
je 0x42610e
cmp byte [ebp - 3], 0x3a
jne 0x42610e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42613b
cmp byte [ebp - 3], 0x3a
jne 0x42613b
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426175
call edi
test eax, eax
je 0x426162
cmp byte [ebp - 3], 0x3a
jne 0x426162
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42618c
call edi
test eax, eax
je 0x42618c
cmp byte [ebp - 3], 0x3a
jne 0x42618c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4261bf
cmp byte [ebp - 3], 0x3a
jne 0x4261bf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4261f9
call edi
test eax, eax
je 0x4261e6
cmp byte [ebp - 3], 0x3a
jne 0x4261e6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426210
call edi
test eax, eax
je 0x426210
cmp byte [ebp - 3], 0x3a
jne 0x426210
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42623f
cmp byte [ebp - 3], 0x3a
jne 0x42623f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426279
call edi
test eax, eax
je 0x426266
cmp byte [ebp - 3], 0x3a
jne 0x426266
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426290
call edi
test eax, eax
je 0x426290
cmp byte [ebp - 3], 0x3a
jne 0x426290
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4262b2
cmp byte [ebp - 3], 0x3a
jne 0x4262b2
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4262ec
call edi
test eax, eax
je 0x4262d9
cmp byte [ebp - 3], 0x3a
jne 0x4262d9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426303
call edi
test eax, eax
je 0x426303
cmp byte [ebp - 3], 0x3a
jne 0x426303
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426325
cmp byte [ebp - 3], 0x3a
jne 0x426325
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42635f
call edi
test eax, eax
je 0x42634c
cmp byte [ebp - 3], 0x3a
jne 0x42634c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426376
call edi
test eax, eax
je 0x426376
cmp byte [ebp - 3], 0x3a
jne 0x426376
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4263a0
cmp byte [ebp - 3], 0x3a
jne 0x4263a0
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4263da
call edi
test eax, eax
je 0x4263c7
cmp byte [ebp - 3], 0x3a
jne 0x4263c7
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4263f1
call edi
test eax, eax
je 0x4263f1
cmp byte [ebp - 3], 0x3a
jne 0x4263f1
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42641c
cmp byte [ebp - 3], 0x3a
jne 0x42641c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426456
call edi
test eax, eax
je 0x426443
cmp byte [ebp - 3], 0x3a
jne 0x426443
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42646d
call edi
test eax, eax
je 0x42646d
cmp byte [ebp - 3], 0x3a
jne 0x42646d
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426498
cmp byte [ebp - 3], 0x3a
jne 0x426498
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4264d2
call edi
test eax, eax
je 0x4264bf
cmp byte [ebp - 3], 0x3a
jne 0x4264bf
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4264e9
call edi
test eax, eax
je 0x4264e9
cmp byte [ebp - 3], 0x3a
jne 0x4264e9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426513
cmp byte [ebp - 3], 0x3a
jne 0x426513
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42654d
call edi
test eax, eax
je 0x42653a
cmp byte [ebp - 3], 0x3a
jne 0x42653a
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426564
call edi
test eax, eax
je 0x426564
cmp byte [ebp - 3], 0x3a
jne 0x426564
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426588
cmp byte [ebp - 3], 0x3a
jne 0x426588
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4265c2
call edi
test eax, eax
je 0x4265af
cmp byte [ebp - 3], 0x3a
jne 0x4265af
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4265d9
call edi
test eax, eax
je 0x4265d9
cmp byte [ebp - 3], 0x3a
jne 0x4265d9
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426602
cmp byte [ebp - 3], 0x3a
jne 0x426602
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42663c
call edi
test eax, eax
je 0x426629
cmp byte [ebp - 3], 0x3a
jne 0x426629
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426653
call edi
test eax, eax
je 0x426653
cmp byte [ebp - 3], 0x3a
jne 0x426653
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x42667c
cmp byte [ebp - 3], 0x3a
jne 0x42667c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4266b6
call edi
test eax, eax
je 0x4266a3
cmp byte [ebp - 3], 0x3a
jne 0x4266a3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4266cd
call edi
test eax, eax
je 0x4266cd
cmp byte [ebp - 3], 0x3a
jne 0x4266cd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4266fb
cmp byte [ebp - 3], 0x3a
jne 0x4266fb
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426735
call edi
test eax, eax
je 0x426722
cmp byte [ebp - 3], 0x3a
jne 0x426722
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42674c
call edi
test eax, eax
je 0x42674c
cmp byte [ebp - 3], 0x3a
jne 0x42674c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426775
cmp byte [ebp - 3], 0x3a
jne 0x426775
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4267af
call edi
test eax, eax
je 0x42679c
cmp byte [ebp - 3], 0x3a
jne 0x42679c
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4267c6
call edi
test eax, eax
je 0x4267c6
cmp byte [ebp - 3], 0x3a
jne 0x4267c6
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4267e8
cmp byte [ebp - 3], 0x3a
jne 0x4267e8
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426822
call edi
test eax, eax
je 0x42680f
cmp byte [ebp - 3], 0x3a
jne 0x42680f
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x426839
call edi
test eax, eax
je 0x426839
cmp byte [ebp - 3], 0x3a
jne 0x426839
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426862
cmp byte [ebp - 3], 0x3a
jne 0x426862
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x42689c
call edi
test eax, eax
je 0x426889
cmp byte [ebp - 3], 0x3a
jne 0x426889
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4268b3
call edi
test eax, eax
je 0x4268b3
cmp byte [ebp - 3], 0x3a
jne 0x4268b3
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x4268dd
cmp byte [ebp - 3], 0x3a
jne 0x4268dd
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426917
call edi
test eax, eax
je 0x426904
cmp byte [ebp - 3], 0x3a
jne 0x426904
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x42692e
call edi
test eax, eax
je 0x42692e
cmp byte [ebp - 3], 0x3a
jne 0x42692e
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x426959
cmp byte [ebp - 3], 0x3a
jne 0x426959
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x426993
call edi
test eax, eax
je 0x426980
cmp byte [ebp - 3], 0x3a
jne 0x426980
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x42
push eax
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], bl
call esi
jmp 0x4269aa
call edi
test eax, eax
je 0x4269aa
cmp byte [ebp - 3], 0x3a
jne 0x4269aa
movzx eax, byte [ebp - 4]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
push 0x70
push 0x6f
push 0x74
push 0x6b
push 0x73
push 0x65
lea eax, [ebp - 0x6c]
push 0x64
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e0]
add esp, 0x2c
test eax, eax
jne 0x426a02
xor eax, eax
jmp 0x426f80
push ebx
push 0xe6
push 0xc3
push 0xc0
lea eax, [ebp - 0x6c]
push 0xd7
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push dword [ebp + 0xc]
call dword [eax + 0x1e0]
add esp, 0x20
test eax, eax
je 0x4269fb
push ebx
push 0x5c
pop esi
lea eax, [ebp - 0x6c]
push esi
push 0x70
push 0x6d
push 0x65
push 0x74
push esi
push eax
call fcn.0041591e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x28
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x73
push 0x77
push 0x6f
push 0x64
push 0x6e
push 0x69
push 0x77
push esi
lea eax, [ebp - 0x6c]
push 0x3a
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x38
test eax, eax
jne 0x4269fb
push ebx
push 0x66
push 0x65
push 0x69
push 0x68
push 0x74
push 0x74
push 0x65
lea eax, [ebp - 0x6c]
push 0x6e
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x4269fb
push ebx
push 0x72
push 0x65
push 0x64
push 0x6e
push 0x69
push 0x62
push 0x65
push 0x78
lea eax, [ebp - 0x6c]
push 0x65
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x34
test eax, eax
jne 0x4269fb
push ebx
push 0x71
push 0x71
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x1c
test eax, eax
jne 0x4269fb
push ebx
push 0x6f
push 0x69
push 0x64
push 0x75
push 0x74
push 0x73
push 0x20
push 0x6c
push 0x61
push 0x75
push 0x73
push 0x69
lea eax, [ebp - 0x6c]
push 0x76
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x44
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x65
push 0x63
push 0x69
push 0x66
push 0x66
push 0x6f
push 0x20
push 0x74
push 0x66
push 0x6f
push 0x73
push 0x6f
push 0x72
push 0x63
push 0x69
push 0x6d
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x58
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x72
push 0x65
push 0x64
push 0x6e
push 0x75
push 0x68
push 0x74
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x34
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x30
push 0x36
push 0x33
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x24
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x67
push 0x6e
push 0x61
push 0x77
push 0x67
push 0x6e
push 0x61
push 0x77
push 0x69
push 0x6c
push 0x61
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x44
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x72
push 0x65
pop eax
push eax
push 0x72
push 0x6f
push 0x6c
push 0x70
push 0x78
push eax
push 0x20
push 0x74
push eax
push 0x6e
push 0x72
push eax
push 0x74
push 0x6e
push 0x69
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x5c
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x73
push 0x73
push 0x65
push 0x72
push 0x70
push 0x78
push 0x65
push 0x20
push 0x6b
push 0x6f
push 0x6f
push 0x6c
push 0x74
push 0x75
push 0x6f
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x54
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x72
push 0x65
push 0x76
push 0x72
push 0x65
push 0x73
push 0x20
push 0x6c
push 0x71
push 0x73
push 0x20
push 0x74
push 0x66
push 0x6f
push 0x73
push 0x6f
push 0x72
push 0x63
push 0x69
push 0x6d
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x68
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x72
push 0x65
pop eax
push eax
push 0x67
push 0x6e
push eax
push 0x73
push 0x73
push eax
push 0x6d
push esi
push eax
push 0x76
push 0x69
push 0x6c
push 0x20
push 0x73
push 0x77
push 0x6f
push 0x64
push 0x6e
push 0x69
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x70
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x70
push 0x69
push 0x7a
push 0x6e
push 0x69
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x72
push 0x61
push 0x72
push 0x6e
push 0x69
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x65
push 0x6d
push 0x61
push 0x67
push esi
push 0x6b
push 0x6e
push 0x69
push 0x6c
push 0x6c
push 0x61
push 0x62
push 0x6f
push 0x6c
push 0x67
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x54
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x72
push 0x6f
push 0x74
push 0x63
push 0x6f
push 0x64
push 0x71
push 0x71
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x38
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x67
push 0x6e
push 0x69
push 0x73
push 0x69
push 0x72
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x4269fb
push ebx
push 0x78
push 0x6f
push 0x66
push 0x65
push 0x72
push 0x69
push 0x66
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x30
test eax, eax
jne 0x4269fb
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x6d
push 0x69
push 0x69
push 0x6c
push 0x61
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x38
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x61
push 0x72
push 0x69
push 0x76
push 0x61
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x2c
test eax, eax
jne 0x4269fb
push ebx
push esi
push 0x74
push 0x66
push 0x61
push 0x72
push 0x63
push 0x72
push 0x61
push 0x77
push 0x20
push 0x66
push 0x6f
push 0x20
push 0x64
push 0x6c
push 0x72
push 0x6f
push 0x77
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0041591e
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x4503d0]
push edi
call dword [eax + 0x1e4]
add esp, 0x5c
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8