Function at 0x412f00
Capabilities:
Allocate thread local storage
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set console window title
Set current directory
Set environment variable
Set file attributes
Suspend thread
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp + 8]
push ebx
test eax, eax
jne 0x413ba9
push esi
xor esi, esi
push edi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x412f5a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x412f5a
cmp byte [ebp - 7], 0x3a
jne 0x412f5a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x412f98
call esi
test eax, eax
je 0x412f84
cmp byte [ebp - 3], 0x3a
jne 0x412f84
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x412fac
call esi
test eax, eax
je 0x412fac
cmp byte [ebp - 3], 0x3a
jne 0x412fac
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x412fc6
cmp byte [ebp - 3], 0x3a
jne 0x412fc6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x412ff2
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x412ff2
cmp byte [ebp - 7], 0x3a
jne 0x412ff2
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41302a
call esi
test eax, eax
je 0x413016
cmp byte [ebp - 3], 0x3a
jne 0x413016
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41303e
call esi
test eax, eax
je 0x41303e
cmp byte [ebp - 3], 0x3a
jne 0x41303e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413058
cmp byte [ebp - 3], 0x3a
jne 0x413058
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413084
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413084
cmp byte [ebp - 7], 0x3a
jne 0x413084
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4130bc
call esi
test eax, eax
je 0x4130a8
cmp byte [ebp - 3], 0x3a
jne 0x4130a8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4130d0
call esi
test eax, eax
je 0x4130d0
cmp byte [ebp - 3], 0x3a
jne 0x4130d0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4130ea
cmp byte [ebp - 3], 0x3a
jne 0x4130ea
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413124
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413124
cmp byte [ebp - 7], 0x3a
jne 0x413124
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41315c
call esi
test eax, eax
je 0x413148
cmp byte [ebp - 3], 0x3a
jne 0x413148
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413170
call esi
test eax, eax
je 0x413170
cmp byte [ebp - 3], 0x3a
jne 0x413170
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41318a
cmp byte [ebp - 3], 0x3a
jne 0x41318a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4131c1
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4131c1
cmp byte [ebp - 7], 0x3a
jne 0x4131c1
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4131f9
call esi
test eax, eax
je 0x4131e5
cmp byte [ebp - 3], 0x3a
jne 0x4131e5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41320d
call esi
test eax, eax
je 0x41320d
cmp byte [ebp - 3], 0x3a
jne 0x41320d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413227
cmp byte [ebp - 3], 0x3a
jne 0x413227
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413255
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413255
cmp byte [ebp - 7], 0x3a
jne 0x413255
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41328d
call esi
test eax, eax
je 0x413279
cmp byte [ebp - 3], 0x3a
jne 0x413279
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4132a1
call esi
test eax, eax
je 0x4132a1
cmp byte [ebp - 3], 0x3a
jne 0x4132a1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4132bb
cmp byte [ebp - 3], 0x3a
jne 0x4132bb
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4132ef
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4132ef
cmp byte [ebp - 7], 0x3a
jne 0x4132ef
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413327
call esi
test eax, eax
je 0x413313
cmp byte [ebp - 3], 0x3a
jne 0x413313
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41333b
call esi
test eax, eax
je 0x41333b
cmp byte [ebp - 3], 0x3a
jne 0x41333b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413355
cmp byte [ebp - 3], 0x3a
jne 0x413355
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413383
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413383
cmp byte [ebp - 7], 0x3a
jne 0x413383
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4133bb
call esi
test eax, eax
je 0x4133a7
cmp byte [ebp - 3], 0x3a
jne 0x4133a7
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4133cf
call esi
test eax, eax
je 0x4133cf
cmp byte [ebp - 3], 0x3a
jne 0x4133cf
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4133e9
cmp byte [ebp - 3], 0x3a
jne 0x4133e9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413415
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413415
cmp byte [ebp - 7], 0x3a
jne 0x413415
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41344d
call esi
test eax, eax
je 0x413439
cmp byte [ebp - 3], 0x3a
jne 0x413439
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413461
call esi
test eax, eax
je 0x413461
cmp byte [ebp - 3], 0x3a
jne 0x413461
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41347b
cmp byte [ebp - 3], 0x3a
jne 0x41347b
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4134a9
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4134a9
cmp byte [ebp - 7], 0x3a
jne 0x4134a9
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4134e1
call esi
test eax, eax
je 0x4134cd
cmp byte [ebp - 3], 0x3a
jne 0x4134cd
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4134f5
call esi
test eax, eax
je 0x4134f5
cmp byte [ebp - 3], 0x3a
jne 0x4134f5
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41350f
cmp byte [ebp - 3], 0x3a
jne 0x41350f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413539
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413539
cmp byte [ebp - 7], 0x3a
jne 0x413539
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413571
call esi
test eax, eax
je 0x41355d
cmp byte [ebp - 3], 0x3a
jne 0x41355d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413585
call esi
test eax, eax
je 0x413585
cmp byte [ebp - 3], 0x3a
jne 0x413585
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41359f
cmp byte [ebp - 3], 0x3a
jne 0x41359f
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4135ce
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4135ce
cmp byte [ebp - 7], 0x3a
jne 0x4135ce
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413606
call esi
test eax, eax
je 0x4135f2
cmp byte [ebp - 3], 0x3a
jne 0x4135f2
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41361a
call esi
test eax, eax
je 0x41361a
cmp byte [ebp - 3], 0x3a
jne 0x41361a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413634
cmp byte [ebp - 3], 0x3a
jne 0x413634
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413662
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413662
cmp byte [ebp - 7], 0x3a
jne 0x413662
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41369a
call esi
test eax, eax
je 0x413686
cmp byte [ebp - 3], 0x3a
jne 0x413686
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4136ae
call esi
test eax, eax
je 0x4136ae
cmp byte [ebp - 3], 0x3a
jne 0x4136ae
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4136c8
cmp byte [ebp - 3], 0x3a
jne 0x4136c8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4136f6
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4136f6
cmp byte [ebp - 7], 0x3a
jne 0x4136f6
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41372e
call esi
test eax, eax
je 0x41371a
cmp byte [ebp - 3], 0x3a
jne 0x41371a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413742
call esi
test eax, eax
je 0x413742
cmp byte [ebp - 3], 0x3a
jne 0x413742
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x41375c
cmp byte [ebp - 3], 0x3a
jne 0x41375c
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413788
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413788
cmp byte [ebp - 7], 0x3a
jne 0x413788
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4137c0
call esi
test eax, eax
je 0x4137ac
cmp byte [ebp - 3], 0x3a
jne 0x4137ac
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x4137d4
call esi
test eax, eax
je 0x4137d4
cmp byte [ebp - 3], 0x3a
jne 0x4137d4
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4137ee
cmp byte [ebp - 3], 0x3a
jne 0x4137ee
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x41381e
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x41381e
cmp byte [ebp - 7], 0x3a
jne 0x41381e
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413856
call esi
test eax, eax
je 0x413842
cmp byte [ebp - 3], 0x3a
jne 0x413842
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41386a
call esi
test eax, eax
je 0x41386a
cmp byte [ebp - 3], 0x3a
jne 0x41386a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413884
cmp byte [ebp - 3], 0x3a
jne 0x413884
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4138bd
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4138bd
cmp byte [ebp - 7], 0x3a
jne 0x4138bd
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x4138f5
call esi
test eax, eax
je 0x4138e1
cmp byte [ebp - 3], 0x3a
jne 0x4138e1
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413909
call esi
test eax, eax
je 0x413909
cmp byte [ebp - 3], 0x3a
jne 0x413909
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413923
cmp byte [ebp - 3], 0x3a
jne 0x413923
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413952
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413952
cmp byte [ebp - 7], 0x3a
jne 0x413952
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x41398a
call esi
test eax, eax
je 0x413976
cmp byte [ebp - 3], 0x3a
jne 0x413976
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x41399e
call esi
test eax, eax
je 0x41399e
cmp byte [ebp - 3], 0x3a
jne 0x41399e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x4139b8
cmp byte [ebp - 3], 0x3a
jne 0x4139b8
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x4139e4
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x4139e4
cmp byte [ebp - 7], 0x3a
jne 0x4139e4
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413a1c
call esi
test eax, eax
je 0x413a08
cmp byte [ebp - 3], 0x3a
jne 0x413a08
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413a30
call esi
test eax, eax
je 0x413a30
cmp byte [ebp - 3], 0x3a
jne 0x413a30
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413a4a
cmp byte [ebp - 3], 0x3a
jne 0x413a4a
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413a7a
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413a7a
cmp byte [ebp - 7], 0x3a
jne 0x413a7a
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413ab2
call esi
test eax, eax
je 0x413a9e
cmp byte [ebp - 3], 0x3a
jne 0x413a9e
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413ac6
call esi
test eax, eax
je 0x413ac6
cmp byte [ebp - 3], 0x3a
jne 0x413ac6
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
test eax, eax
je 0x413ae0
cmp byte [ebp - 3], 0x3a
jne 0x413ae0
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp + 8]
cmp eax, 0xd5
jne 0x413b41
lea eax, [ebp - 8]
push eax
push 3
call esi
test eax, eax
je 0x413b41
cmp byte [ebp - 7], 0x3a
jne 0x413b41
movzx eax, byte [ebp - 8]
push eax
call ebx
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 4]
push eax
push 3
jne 0x413b79
call esi
test eax, eax
je 0x413b65
cmp byte [ebp - 3], 0x3a
jne 0x413b65
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
and byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x3a
call edi
jmp 0x413b8d
call esi
test eax, eax
je 0x413b8d
cmp byte [ebp - 3], 0x3a
jne 0x413b8d
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 4]
push eax
push 3
call esi
pop edi
pop esi
test eax, eax
je 0x413ba9
cmp byte [ebp - 3], 0x3a
jne 0x413ba9
movzx eax, byte [ebp - 4]
push eax
call ebx
pop ecx
lea eax, [ebp - 0x148]
push eax
mov eax, dword [0x4513d0]
push dword [ebp + 8]
call dword [eax + 0x64]
cmp eax, 0xffffffff
pop ebx
jne 0x413bc5
xor eax, eax
jmp 0x413bd1
push eax
mov eax, dword [0x4513d0]
call dword [eax + 0x60]
push 1
pop eax
leave
ret 4