Function at 0x410aae
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x448df4
call fcn.00448330
push ecx
push ecx
push ebx
lea eax, [ebp + 0xc]
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x41175d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410af1
cmp byte [ebp - 0xf], 0x3a
jne 0x410af1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410b31
call edi
test eax, eax
je 0x410b1e
cmp byte [ebp - 0xf], 0x3a
jne 0x410b1e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410b48
call edi
test eax, eax
je 0x410b48
cmp byte [ebp - 0xf], 0x3a
jne 0x410b48
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410b63
cmp byte [ebp - 0xf], 0x3a
jne 0x410b63
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410b9d
call edi
test eax, eax
je 0x410b8a
cmp byte [ebp - 0xf], 0x3a
jne 0x410b8a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410bb4
call edi
test eax, eax
je 0x410bb4
cmp byte [ebp - 0xf], 0x3a
jne 0x410bb4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410be7
cmp byte [ebp - 0xf], 0x3a
jne 0x410be7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410c21
call edi
test eax, eax
je 0x410c0e
cmp byte [ebp - 0xf], 0x3a
jne 0x410c0e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410c38
call edi
test eax, eax
je 0x410c38
cmp byte [ebp - 0xf], 0x3a
jne 0x410c38
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410c5a
cmp byte [ebp - 0xf], 0x3a
jne 0x410c5a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410c94
call edi
test eax, eax
je 0x410c81
cmp byte [ebp - 0xf], 0x3a
jne 0x410c81
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410cab
call edi
test eax, eax
je 0x410cab
cmp byte [ebp - 0xf], 0x3a
jne 0x410cab
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410ccc
cmp byte [ebp - 0xf], 0x3a
jne 0x410ccc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410d06
call edi
test eax, eax
je 0x410cf3
cmp byte [ebp - 0xf], 0x3a
jne 0x410cf3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410d1d
call edi
test eax, eax
je 0x410d1d
cmp byte [ebp - 0xf], 0x3a
jne 0x410d1d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410d59
cmp byte [ebp - 0xf], 0x3a
jne 0x410d59
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410d93
call edi
test eax, eax
je 0x410d80
cmp byte [ebp - 0xf], 0x3a
jne 0x410d80
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410daa
call edi
test eax, eax
je 0x410daa
cmp byte [ebp - 0xf], 0x3a
jne 0x410daa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410dd5
cmp byte [ebp - 0xf], 0x3a
jne 0x410dd5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410e0f
call edi
test eax, eax
je 0x410dfc
cmp byte [ebp - 0xf], 0x3a
jne 0x410dfc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410e26
call edi
test eax, eax
je 0x410e26
cmp byte [ebp - 0xf], 0x3a
jne 0x410e26
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410e50
cmp byte [ebp - 0xf], 0x3a
jne 0x410e50
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410e8a
call edi
test eax, eax
je 0x410e77
cmp byte [ebp - 0xf], 0x3a
jne 0x410e77
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410ea1
call edi
test eax, eax
je 0x410ea1
cmp byte [ebp - 0xf], 0x3a
jne 0x410ea1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410ece
cmp byte [ebp - 0xf], 0x3a
jne 0x410ece
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410f08
call edi
test eax, eax
je 0x410ef5
cmp byte [ebp - 0xf], 0x3a
jne 0x410ef5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410f1f
call edi
test eax, eax
je 0x410f1f
cmp byte [ebp - 0xf], 0x3a
jne 0x410f1f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410f52
cmp byte [ebp - 0xf], 0x3a
jne 0x410f52
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x410f8c
call edi
test eax, eax
je 0x410f79
cmp byte [ebp - 0xf], 0x3a
jne 0x410f79
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x410fa3
call edi
test eax, eax
je 0x410fa3
cmp byte [ebp - 0xf], 0x3a
jne 0x410fa3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x410fd2
cmp byte [ebp - 0xf], 0x3a
jne 0x410fd2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41100c
call edi
test eax, eax
je 0x410ff9
cmp byte [ebp - 0xf], 0x3a
jne 0x410ff9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411023
call edi
test eax, eax
je 0x411023
cmp byte [ebp - 0xf], 0x3a
jne 0x411023
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411045
cmp byte [ebp - 0xf], 0x3a
jne 0x411045
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41107f
call edi
test eax, eax
je 0x41106c
cmp byte [ebp - 0xf], 0x3a
jne 0x41106c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411096
call edi
test eax, eax
je 0x411096
cmp byte [ebp - 0xf], 0x3a
jne 0x411096
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4110b8
cmp byte [ebp - 0xf], 0x3a
jne 0x4110b8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4110f2
call edi
test eax, eax
je 0x4110df
cmp byte [ebp - 0xf], 0x3a
jne 0x4110df
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411109
call edi
test eax, eax
je 0x411109
cmp byte [ebp - 0xf], 0x3a
jne 0x411109
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411133
cmp byte [ebp - 0xf], 0x3a
jne 0x411133
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41116d
call edi
test eax, eax
je 0x41115a
cmp byte [ebp - 0xf], 0x3a
jne 0x41115a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411184
call edi
test eax, eax
je 0x411184
cmp byte [ebp - 0xf], 0x3a
jne 0x411184
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4111af
cmp byte [ebp - 0xf], 0x3a
jne 0x4111af
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4111e9
call edi
test eax, eax
je 0x4111d6
cmp byte [ebp - 0xf], 0x3a
jne 0x4111d6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411200
call edi
test eax, eax
je 0x411200
cmp byte [ebp - 0xf], 0x3a
jne 0x411200
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41122b
cmp byte [ebp - 0xf], 0x3a
jne 0x41122b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411265
call edi
test eax, eax
je 0x411252
cmp byte [ebp - 0xf], 0x3a
jne 0x411252
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41127c
call edi
test eax, eax
je 0x41127c
cmp byte [ebp - 0xf], 0x3a
jne 0x41127c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4112a6
cmp byte [ebp - 0xf], 0x3a
jne 0x4112a6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4112e0
call edi
test eax, eax
je 0x4112cd
cmp byte [ebp - 0xf], 0x3a
jne 0x4112cd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4112f7
call edi
test eax, eax
je 0x4112f7
cmp byte [ebp - 0xf], 0x3a
jne 0x4112f7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41131b
cmp byte [ebp - 0xf], 0x3a
jne 0x41131b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411355
call edi
test eax, eax
je 0x411342
cmp byte [ebp - 0xf], 0x3a
jne 0x411342
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41136c
call edi
test eax, eax
je 0x41136c
cmp byte [ebp - 0xf], 0x3a
jne 0x41136c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411395
cmp byte [ebp - 0xf], 0x3a
jne 0x411395
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4113cf
call edi
test eax, eax
je 0x4113bc
cmp byte [ebp - 0xf], 0x3a
jne 0x4113bc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4113e6
call edi
test eax, eax
je 0x4113e6
cmp byte [ebp - 0xf], 0x3a
jne 0x4113e6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41140f
cmp byte [ebp - 0xf], 0x3a
jne 0x41140f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411449
call edi
test eax, eax
je 0x411436
cmp byte [ebp - 0xf], 0x3a
jne 0x411436
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411460
call edi
test eax, eax
je 0x411460
cmp byte [ebp - 0xf], 0x3a
jne 0x411460
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41148e
cmp byte [ebp - 0xf], 0x3a
jne 0x41148e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4114c8
call edi
test eax, eax
je 0x4114b5
cmp byte [ebp - 0xf], 0x3a
jne 0x4114b5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4114df
call edi
test eax, eax
je 0x4114df
cmp byte [ebp - 0xf], 0x3a
jne 0x4114df
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411508
cmp byte [ebp - 0xf], 0x3a
jne 0x411508
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411542
call edi
test eax, eax
je 0x41152f
cmp byte [ebp - 0xf], 0x3a
jne 0x41152f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411559
call edi
test eax, eax
je 0x411559
cmp byte [ebp - 0xf], 0x3a
jne 0x411559
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x41157b
cmp byte [ebp - 0xf], 0x3a
jne 0x41157b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4115b5
call edi
test eax, eax
je 0x4115a2
cmp byte [ebp - 0xf], 0x3a
jne 0x4115a2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4115cc
call edi
test eax, eax
je 0x4115cc
cmp byte [ebp - 0xf], 0x3a
jne 0x4115cc
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4115f5
cmp byte [ebp - 0xf], 0x3a
jne 0x4115f5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x41162f
call edi
test eax, eax
je 0x41161c
cmp byte [ebp - 0xf], 0x3a
jne 0x41161c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x411646
call edi
test eax, eax
je 0x411646
cmp byte [ebp - 0xf], 0x3a
jne 0x411646
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x411670
cmp byte [ebp - 0xf], 0x3a
jne 0x411670
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4116aa
call edi
test eax, eax
je 0x411697
cmp byte [ebp - 0xf], 0x3a
jne 0x411697
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4116c1
call edi
test eax, eax
je 0x4116c1
cmp byte [ebp - 0xf], 0x3a
jne 0x4116c1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4116ec
cmp byte [ebp - 0xf], 0x3a
jne 0x4116ec
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 0xc]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x411726
call edi
test eax, eax
je 0x411713
cmp byte [ebp - 0xf], 0x3a
jne 0x411713
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x41173d
call edi
test eax, eax
je 0x41173d
cmp byte [ebp - 0xf], 0x3a
jne 0x41173d
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea eax, [eax + esi - 0x6e]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
sub esi, eax
mov eax, dword [ebp + 0x1c]
add eax, esi
push eax
mov dword [ebp + 0x10], eax
call sub.MFC42.DLL_operatornew
push dword [ebp + 0x10]
mov edi, eax
mov eax, dword [0x4503d0]
push ebx
push edi
call dword [eax + 0x21c]
add esi, 0xffffff92
push esi
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp + 0x10]
push 0x6e
push dword [ebp - 0x14]
lea esi, [edi + eax]
lea eax, [esi - 0x6e]
push eax
mov dword [ebp - 0x10], eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [0x4503d0]
add esp, 0x28
call dword [eax + 0x8c]
mov dword [esi - 0x66], eax
add eax, 0xfffff843
mov dword [edi + 0xffc], eax
cmp dword [esi - 0x6a], ebx
jne 0x4117f6
lea ecx, [ebp + 0xc]
call fcn.00434457
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ebx
push edi
call fcn.004344a6
or dword [ebp - 4], 0xffffffff
mov dword [esi - 0x6a], eax
lea ecx, [ebp + 0xc]
jmp 0x41181b
lea ecx, [ebp + 0xc]
call fcn.00434457
push dword [esi - 0x6a]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
push edi
call fcn.00434562
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00434485
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
cmp dword [ebp + 0x18], ebx
push 2
mov dword [ecx], eax
pop esi
je 0x411856
lea ecx, [ebp + 0xc]
call fcn.0043463e
push dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 0x14]
push edi
call fcn.004346ec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00434663
mov eax, dword [0x4503d0]
push ebx
push 0x80
push esi
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [eax + 0x50]
mov esi, eax
cmp esi, 0xffffffff
je 0x411892
lea eax, [ebp + 0x1c]
push ebx
push eax
mov eax, dword [0x4503d0]
push dword [ebp + 0x10]
push edi
push esi
call dword [eax + 0x78]
mov eax, dword [0x4503d0]
push esi
call dword [eax + 0x44]
push edi
call fcn.00448301
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18