Function at 0x42f5d4
Capabilities:
Allocate thread local storage
Clear file content
Create directory
Delete directory
Delete file
Get common file path
Get graphical window text
Read file on windows
Resume thread
Set current directory
Set environment variable
Set file attributes
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x448e3c
call fcn.00448330
sub esp, 0x68
push ebx
push esi
lea eax, [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test eax, eax
jne 0x43028d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f61c
cmp byte [ebp - 0xf], 0x3a
jne 0x42f61c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f65d
call edi
test eax, eax
je 0x42f64a
cmp byte [ebp - 0xf], 0x3a
jne 0x42f64a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f674
call edi
test eax, eax
je 0x42f674
cmp byte [ebp - 0xf], 0x3a
jne 0x42f674
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f68f
cmp byte [ebp - 0xf], 0x3a
jne 0x42f68f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f6c9
call edi
test eax, eax
je 0x42f6b6
cmp byte [ebp - 0xf], 0x3a
jne 0x42f6b6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f6e0
call edi
test eax, eax
je 0x42f6e0
cmp byte [ebp - 0xf], 0x3a
jne 0x42f6e0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f713
cmp byte [ebp - 0xf], 0x3a
jne 0x42f713
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f74d
call edi
test eax, eax
je 0x42f73a
cmp byte [ebp - 0xf], 0x3a
jne 0x42f73a
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f764
call edi
test eax, eax
je 0x42f764
cmp byte [ebp - 0xf], 0x3a
jne 0x42f764
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f786
cmp byte [ebp - 0xf], 0x3a
jne 0x42f786
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f7c0
call edi
test eax, eax
je 0x42f7ad
cmp byte [ebp - 0xf], 0x3a
jne 0x42f7ad
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f7d7
call edi
test eax, eax
je 0x42f7d7
cmp byte [ebp - 0xf], 0x3a
jne 0x42f7d7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f7f8
cmp byte [ebp - 0xf], 0x3a
jne 0x42f7f8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f832
call edi
test eax, eax
je 0x42f81f
cmp byte [ebp - 0xf], 0x3a
jne 0x42f81f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f849
call edi
test eax, eax
je 0x42f849
cmp byte [ebp - 0xf], 0x3a
jne 0x42f849
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f885
cmp byte [ebp - 0xf], 0x3a
jne 0x42f885
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f8bf
call edi
test eax, eax
je 0x42f8ac
cmp byte [ebp - 0xf], 0x3a
jne 0x42f8ac
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f8d6
call edi
test eax, eax
je 0x42f8d6
cmp byte [ebp - 0xf], 0x3a
jne 0x42f8d6
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f901
cmp byte [ebp - 0xf], 0x3a
jne 0x42f901
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f93b
call edi
test eax, eax
je 0x42f928
cmp byte [ebp - 0xf], 0x3a
jne 0x42f928
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f952
call edi
test eax, eax
je 0x42f952
cmp byte [ebp - 0xf], 0x3a
jne 0x42f952
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f97c
cmp byte [ebp - 0xf], 0x3a
jne 0x42f97c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42f9b6
call edi
test eax, eax
je 0x42f9a3
cmp byte [ebp - 0xf], 0x3a
jne 0x42f9a3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42f9cd
call edi
test eax, eax
je 0x42f9cd
cmp byte [ebp - 0xf], 0x3a
jne 0x42f9cd
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42f9fa
cmp byte [ebp - 0xf], 0x3a
jne 0x42f9fa
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fa34
call edi
test eax, eax
je 0x42fa21
cmp byte [ebp - 0xf], 0x3a
jne 0x42fa21
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fa4b
call edi
test eax, eax
je 0x42fa4b
cmp byte [ebp - 0xf], 0x3a
jne 0x42fa4b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fa7e
cmp byte [ebp - 0xf], 0x3a
jne 0x42fa7e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fab8
call edi
test eax, eax
je 0x42faa5
cmp byte [ebp - 0xf], 0x3a
jne 0x42faa5
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42facf
call edi
test eax, eax
je 0x42facf
cmp byte [ebp - 0xf], 0x3a
jne 0x42facf
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fafe
cmp byte [ebp - 0xf], 0x3a
jne 0x42fafe
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fb38
call edi
test eax, eax
je 0x42fb25
cmp byte [ebp - 0xf], 0x3a
jne 0x42fb25
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fb4f
call edi
test eax, eax
je 0x42fb4f
cmp byte [ebp - 0xf], 0x3a
jne 0x42fb4f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fb71
cmp byte [ebp - 0xf], 0x3a
jne 0x42fb71
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fbab
call edi
test eax, eax
je 0x42fb98
cmp byte [ebp - 0xf], 0x3a
jne 0x42fb98
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fbc2
call edi
test eax, eax
je 0x42fbc2
cmp byte [ebp - 0xf], 0x3a
jne 0x42fbc2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fbe4
cmp byte [ebp - 0xf], 0x3a
jne 0x42fbe4
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fc1e
call edi
test eax, eax
je 0x42fc0b
cmp byte [ebp - 0xf], 0x3a
jne 0x42fc0b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fc35
call edi
test eax, eax
je 0x42fc35
cmp byte [ebp - 0xf], 0x3a
jne 0x42fc35
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fc5f
cmp byte [ebp - 0xf], 0x3a
jne 0x42fc5f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fc99
call edi
test eax, eax
je 0x42fc86
cmp byte [ebp - 0xf], 0x3a
jne 0x42fc86
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fcb0
call edi
test eax, eax
je 0x42fcb0
cmp byte [ebp - 0xf], 0x3a
jne 0x42fcb0
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fcdb
cmp byte [ebp - 0xf], 0x3a
jne 0x42fcdb
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fd15
call edi
test eax, eax
je 0x42fd02
cmp byte [ebp - 0xf], 0x3a
jne 0x42fd02
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fd2c
call edi
test eax, eax
je 0x42fd2c
cmp byte [ebp - 0xf], 0x3a
jne 0x42fd2c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fd57
cmp byte [ebp - 0xf], 0x3a
jne 0x42fd57
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fd91
call edi
test eax, eax
je 0x42fd7e
cmp byte [ebp - 0xf], 0x3a
jne 0x42fd7e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fda8
call edi
test eax, eax
je 0x42fda8
cmp byte [ebp - 0xf], 0x3a
jne 0x42fda8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fdd2
cmp byte [ebp - 0xf], 0x3a
jne 0x42fdd2
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fe0c
call edi
test eax, eax
je 0x42fdf9
cmp byte [ebp - 0xf], 0x3a
jne 0x42fdf9
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fe23
call edi
test eax, eax
je 0x42fe23
cmp byte [ebp - 0xf], 0x3a
jne 0x42fe23
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fe47
cmp byte [ebp - 0xf], 0x3a
jne 0x42fe47
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fe81
call edi
test eax, eax
je 0x42fe6e
cmp byte [ebp - 0xf], 0x3a
jne 0x42fe6e
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42fe98
call edi
test eax, eax
je 0x42fe98
cmp byte [ebp - 0xf], 0x3a
jne 0x42fe98
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42fec1
cmp byte [ebp - 0xf], 0x3a
jne 0x42fec1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fefb
call edi
test eax, eax
je 0x42fee8
cmp byte [ebp - 0xf], 0x3a
jne 0x42fee8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42ff12
call edi
test eax, eax
je 0x42ff12
cmp byte [ebp - 0xf], 0x3a
jne 0x42ff12
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42ff3b
cmp byte [ebp - 0xf], 0x3a
jne 0x42ff3b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42ff75
call edi
test eax, eax
je 0x42ff62
cmp byte [ebp - 0xf], 0x3a
jne 0x42ff62
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x42ff8c
call edi
test eax, eax
je 0x42ff8c
cmp byte [ebp - 0xf], 0x3a
jne 0x42ff8c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x42ffba
cmp byte [ebp - 0xf], 0x3a
jne 0x42ffba
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x42fff4
call edi
test eax, eax
je 0x42ffe1
cmp byte [ebp - 0xf], 0x3a
jne 0x42ffe1
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x43000b
call edi
test eax, eax
je 0x43000b
cmp byte [ebp - 0xf], 0x3a
jne 0x43000b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x430034
cmp byte [ebp - 0xf], 0x3a
jne 0x430034
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43006e
call edi
test eax, eax
je 0x43005b
cmp byte [ebp - 0xf], 0x3a
jne 0x43005b
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x430085
call edi
test eax, eax
je 0x430085
cmp byte [ebp - 0xf], 0x3a
jne 0x430085
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call sub.MSVCRT.dll_iswspace
pop ecx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x4300a7
cmp byte [ebp - 0xf], 0x3a
jne 0x4300a7
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4300e1
call edi
test eax, eax
je 0x4300ce
cmp byte [ebp - 0xf], 0x3a
jne 0x4300ce
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4300f8
call edi
test eax, eax
je 0x4300f8
cmp byte [ebp - 0xf], 0x3a
jne 0x4300f8
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x430121
cmp byte [ebp - 0xf], 0x3a
jne 0x430121
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x43015b
call edi
test eax, eax
je 0x430148
cmp byte [ebp - 0xf], 0x3a
jne 0x430148
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x430172
call edi
test eax, eax
je 0x430172
cmp byte [ebp - 0xf], 0x3a
jne 0x430172
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x43019c
cmp byte [ebp - 0xf], 0x3a
jne 0x43019c
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x4301d6
call edi
test eax, eax
je 0x4301c3
cmp byte [ebp - 0xf], 0x3a
jne 0x4301c3
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x4301ed
call edi
test eax, eax
je 0x4301ed
cmp byte [ebp - 0xf], 0x3a
jne 0x4301ed
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x430218
cmp byte [ebp - 0xf], 0x3a
jne 0x430218
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp + 8]
cmp eax, 0x4db
lea eax, [ebp - 0x10]
push eax
push 3
jne 0x430252
call edi
test eax, eax
je 0x43023f
cmp byte [ebp - 0xf], 0x3a
jne 0x43023f
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x42
push eax
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], bl
call esi
jmp 0x430269
call edi
test eax, eax
je 0x430269
cmp byte [ebp - 0xf], 0x3a
jne 0x430269
movzx eax, byte [ebp - 0x10]
push eax
call sub.MSVCRT.dll_toupper
pop ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push ebx
push ebx
call sub.MSVCRT.dll_vprintf
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, dword [ebp - 0x18]
pop edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00416665
cmp eax, ebx
jne 0x4302a1
xor eax, eax
jmp 0x4302d5
push 0x5e
push ebx
push dword [esi + 8]
lea ecx, [ebp - 0x74]
push dword [esi + 4]
call fcn.004356c6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], ebx
call fcn.00435785
test eax, eax
jne 0x4302c7
push 1
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00435777
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4