Function at 0x425040
Capabilities:
Check os version
Create process on windows
Enumerate gui resources
Enumerate processes
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4becf5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7a0
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x24], edi
push ecx
lea eax, [esp + 0x7c4]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
mov dword [esp + 0x7c0], 1
call fcn.004b2520
lea ecx, [esp + 0x14]
push ecx
call fcn.0043e160
add esp, 4
lea edx, [esp + 0x7c8]
mov ecx, esp
mov dword [esp + 0x60], esp
push edx
mov byte [esp + 0x7c0], 2
call fcn.004b2520
lea eax, [esp + 0x24]
push eax
call fcn.0043e160
add esp, 8
mov ecx, dword [esp + 0x7c8]
mov byte [esp + 0x7b8], 3
mov dword [esp + 0x58], edi
lea eax, [ecx - 1]
cmp eax, 4
ja case.default.0x4250d8
jmp dword [eax*4 + 0x4262a0]
lea edx, [esp + 0x2a8]
lea eax, [esp + 0x5ac]
push edx
mov edx, dword [esp + 0x14]
push edi
lea ecx, [esp + 0x68]
push eax
push ecx
push edx
call fcn.0049a650
push edi
lea eax, [esp + 0x5c4]
push edi
lea ecx, [esp + 0x7c]
push eax
lea edx, [esp + 0x6cc]
push ecx
push edx
call fcn.0049aaa0
lea eax, [esp + 0x2d0]
push str..bat
push eax
call fcn.004996d0
add esp, 0x30
lea ecx, [esp + 0x20]
test eax, eax
sete byte [esp + 0x53]
or ebp, 0xffffffff
push 0x20
mov dword [esp + 0x30], 5
mov byte [esp + 0x23], 0
mov dword [esp + 0x34], ebp
call fcn.004b2c99
mov esi, eax
cmp esi, 0xffffffff
jle 0x425182
lea ecx, [esi + 1]
lea edx, [esp + 0x68]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.004acc3b
mov ebx, 1
mov dword [esp + 0x24], ebx
mov byte [esp + 0x7b8], 4
jmp 0x4251a4
push 0x4f77a0
lea ecx, [esp + 0x74]
call fcn.004b2819
mov ebx, 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x7b8], 5
push eax
lea ecx, [esp + 0x2c]
call fcn.004b2520
test bl, 2
mov dword [esp + 0x7b8], 8
je 0x4251ce
and ebx, 0xfffffffd
lea ecx, [esp + 0x70]
mov dword [esp + 0x24], ebx
call fcn.004b27ab
test bl, 1
mov dword [esp + 0x7b8], 7
je 0x4251ee
and ebx, 0xfffffffe
lea ecx, [esp + 0x68]
mov dword [esp + 0x24], ebx
call fcn.004b27ab
cmp esi, 0xffffffff
jle 0x425213
lea eax, [esp + 0x6c]
push esi
push eax
lea ecx, [esp + 0x28]
call fcn.004acd70
or ebx, 4
mov dword [esp + 0x24], ebx
mov byte [esp + 0x7b8], 9
jmp 0x425217
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x58]
call fcn.004b2520
test bl, 4
mov dword [esp + 0x7b8], 0xb
je 0x42523a
lea ecx, [esp + 0x6c]
call fcn.004b27ab
mov ecx, dword [0x4f4df4]
mov dword [esp + 0x18], ecx
mov esi, dword [esp + 0x2c]
mov byte [esp + 0x7b8], 0xc
mov word [0x4ff9a0], di
xor ebx, ebx
mov edx, dword [esp + 0x54]
push 0x2c
push ebx
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004b3933
test eax, eax
je 0x4253f0
push str.TOPMOST
lea ecx, [esp + 0x1c]
call fcn.004ace0a
test eax, eax
jne 0x4252f3
push 0x28
lea ecx, [esp + 0x1c]
mov word [0x4ff9a0], 2
call fcn.004b2c99
cmp eax, edi
jle 0x4253f0
inc eax
lea ecx, [esp + 0x88]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.004acc3b
push str.__DdEe.
push edi
mov ecx, eax
mov byte [esp + 0x7c0], 0xd
call fcn.004b2bdb
push eax
call fcn.0049a5ac
push eax
call fcn.0049a028
add esp, 0xc
lea ecx, [esp + 0x88]
mov ebp, eax
mov byte [esp + 0x7b8], 0xc
call fcn.004b27ab
jmp 0x4253f0
push 0x4eb0e4
lea ecx, [esp + 0x1c]
call fcn.004ace0a
test eax, eax
jne 0x42536d
push 0x28
lea ecx, [esp + 0x1c]
mov word [0x4ff9a0], 1
call fcn.004b2c99
cmp eax, edi
jle 0x4253f0
inc eax
lea edx, [esp + 0x64]
push eax
push edx
lea ecx, [esp + 0x20]
call fcn.004acc3b
push str.__DdEe.
push edi
mov ecx, eax
mov byte [esp + 0x7c0], 0xe
call fcn.004b2bdb
push eax
call fcn.0049a5ac
push eax
call fcn.0049a028
add esp, 0xc
lea ecx, [esp + 0x64]
mov ebp, eax
mov byte [esp + 0x7b8], 0xc
call fcn.004b27ab
jmp 0x4253f0
mov eax, dword [esp + 0x18]
push str.WAIT
push eax
call fcn.004996d0
add esp, 8
cmp eax, edi
jne 0x42538a
mov byte [esp + 0x1f], 1
jmp 0x4253f0
mov ecx, dword [esp + 0x18]
push str.HIDE
push ecx
call fcn.004996d0
add esp, 8
cmp eax, edi
jne 0x4253a4
xor esi, esi
jmp 0x4253f0
mov edx, dword [esp + 0x18]
push str.MAXIMIZE
push edx
call fcn.004996d0
add esp, 8
cmp eax, edi
jne 0x4253c1
mov esi, 3
jmp 0x4253f0
mov eax, dword [esp + 0x18]
push str.MINIMIZE
push eax
call fcn.004996d0
add esp, 8
cmp eax, edi
jne 0x4253de
mov esi, 7
jmp 0x4253f0
cmp ebx, edi
jne 0x4253f0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004b28e4
inc ebx
cmp ebx, 3
jl 0x425259
mov al, byte [esp + 0x1f]
mov dword [esp + 0x2c], esi
test al, al
mov dword [esp + 0x30], ebp
je 0x425417
cmp esi, 7
jne 0x425417
mov dword [esp + 0x2c], 2
lea edx, [esp + 0x214]
mov dword [esp + 0x214], 0x94
push edx
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x3a8]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [esp + 0x53]
and ecx, 3
test al, al
rep movsb byte es:[edi], byte [esi]
je 0x4255e6
mov ecx, dword [0x4f4df4]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x224]
mov ebx, 1
cmp eax, ebx
mov eax, dword [esp + 0x28]
push eax
mov byte [esp + 0x7bc], 0xf
push edx
jne 0x4254e6
lea ecx, [esp + 0x2c]
push str._C___s___s
push ecx
call fcn.004ad14b
add esp, 0x10
lea edx, [esp + 0x3a8]
push 0x104
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, str.winoa386.mod
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4254f8
lea ecx, [esp + 0x2c]
push str._C____s___s_
push ecx
call fcn.004ad14b
add esp, 0x10
lea edx, [esp + 0x24]
lea ecx, [esp + 0x28]
push edx
call fcn.004b28e4
push str.COMSPEC
call fcn.0049aa02
add esp, 4
test eax, eax
je 0x42552f
push eax
lea eax, [esp + 0x14]
push 0x4ea5cc
push eax
call fcn.004ad14b
add esp, 0xc
jmp 0x4255cf
mov eax, dword [esp + 0x224]
push ecx
cmp eax, ebx
mov ecx, esp
jne 0x425586
mov dword [esp + 0x60], esp
push str._Windows_
call fcn.004b2819
lea ecx, [esp + 0x94]
push ecx
call fcn.0043e160
mov edx, dword [eax]
lea eax, [esp + 0x18]
push edx
push str._scommand.com
push eax
mov byte [esp + 0x7cc], 0x10
call fcn.004ad14b
add esp, 0x14
mov byte [esp + 0x7b8], 0xf
lea ecx, [esp + 0x90]
jmp 0x4255ca
mov dword [esp + 0x60], esp
push str._System_
call fcn.004b2819
lea ecx, [esp + 0x80]
push ecx
call fcn.0043e160
mov edx, dword [eax]
lea eax, [esp + 0x18]
push edx
push str._scmd.exe
push eax
mov byte [esp + 0x7cc], 0x11
call fcn.004ad14b
add esp, 0x14
mov byte [esp + 0x7b8], 0xf
lea ecx, [esp + 0x7c]
call fcn.004b27ab
lea ecx, [esp + 0x24]
mov byte [esp + 0x7b8], 0xc
call fcn.004b27ab
mov edx, dword [esp + 0x10]
jmp 0x4255eb
mov ebx, 1
lea ecx, [esp + 0x2a8]
lea eax, [esp + 0x4ac]
push ecx
push eax
push 0
push 0
push edx
call fcn.0049a650
mov eax, dword [esp + 0x238]
add esp, 0x14
cmp eax, ebx
je 0x425637
lea ecx, [esp + 0x2a8]
lea edx, [esp + 0x4ac]
push ecx
push edx
push 0
lea eax, [esp + 0x3b4]
push 0
push eax
call fcn.0049aaa0
add esp, 0x14
lea ecx, [esp + 0x4ac]
push 0x4eb050
push ecx
call fcn.004996d0
add esp, 8
test eax, eax
jne 0x425669
lea edx, [esp + 0x2a8]
push str..exe
push edx
call fcn.004996d0
add esp, 8
test eax, eax
je 0x42569b
lea eax, [esp + 0x4ac]
push str.command
push eax
call fcn.004996d0
add esp, 8
test eax, eax
jne 0x4256a8
lea ecx, [esp + 0x2a8]
push str..com
push ecx
call fcn.004996d0
add esp, 8
test eax, eax
jne 0x4256a8
cmp ebp, 0xffffffff
jne 0x4256a8
mov dword [esp + 0x30], 0xfa
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x94]
rep stosd dword es:[edi], eax
mov dword [esp + 0x94], 0x3c
mov dword [esp + 0x98], 0x8040
call fcn.004b44ad
test eax, eax
je 0x4256e2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x4256ef
mov dword [esp + 0x9c], 0
jmp 0x4256f9
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x9c], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xa4], ecx
lea ecx, [esp + 0x6ac]
mov ebx, 0x4c5b78
xor esi, esi
mov dword [esp + 0xa0], 0x4ea22c
mov dword [esp + 0xa8], edx
mov dword [esp + 0xb0], eax
mov dword [esp + 0xac], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0x11
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 8
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0xf0]
mov dword [esp + 0xec], esi
push esi
push 2
rep stosd dword es:[edi], eax
mov byte [esp + 0x7c0], 0x12
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4257cb
mov dword [esp + 0x34], ebx
mov edx, dword [esp + 0x38]
mov byte [esp + 0x7b8], 0x13
cmp edx, esi
je 0x425964
mov eax, dword [esp + 0x3c]
cmp eax, esi
jbe 0x425964
mov ecx, edx
mov edi, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x4257c0
mov eax, dword [eax]
cmp eax, esi
jne 0x4257ba
add ecx, 4
dec edi
jne 0x4257b4
jmp 0x425964
lea edx, [esp + 0xec]
mov dword [esp + 0xec], 0x128
push edx
push ebp
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4258c8
mov eax, dword [esp + 0xf4]
push eax
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x4258b2
lea ecx, [esp + 0x2a8]
lea edx, [esp + 0x4ac]
push ecx
push edx
push esi
lea eax, [esp + 0x11c]
push esi
push eax
call fcn.0049a650
lea ecx, [esp + 0x124]
lea edx, [esp + 0x3bc]
push ecx
push edx
call fcn.004996d0
add esp, 0x1c
test eax, eax
jne 0x4258ab
mov eax, dword [esp + 0xf4]
lea ecx, [esp + 0x2c]
push ecx
push eax
lea ecx, [esp + 0x3c]
mov edi, eax
mov esi, eax
call fcn.004287a0
test eax, eax
jne 0x4258a6
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x42587b
mov edx, dword [esp + 0x3c]
push 1
push edx
lea ecx, [esp + 0x3c]
call fcn.004287e0
lea ecx, [esp + 0x34]
call fcn.00428850
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], esi
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x2c]
mov dword [ecx + edx*4], eax
mov dword [eax + 0xc], edi
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0xec]
push eax
push ebp
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4257ec
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x425cae
cmp word [0x4ff9a0], si
jle 0x425aea
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0xcc]
push edi
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x425919
mov eax, dword [esp + 0xcc]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
push 2
xor ebp, ebp
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x425a23
mov dword [esp + 0x34], 0x4c5b78
mov edx, dword [esp + 0x38]
mov byte [esp + 0x7b8], 0x14
cmp edx, esi
je 0x425964
mov eax, dword [esp + 0x3c]
cmp eax, esi
jbe 0x425964
mov ecx, edx
mov edi, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x42595e
mov eax, dword [eax]
cmp eax, esi
jne 0x425958
add ecx, 4
dec edi
jne 0x425952
push edx
call fcn.004b2da3
mov ecx, dword [esp + 0x4c]
add esp, 4
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.004ae6da
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], esi
mov byte [esp + 0x7b8], 0xb
call fcn.004b27ab
lea ecx, [esp + 0x54]
mov byte [esp + 0x7b8], 7
call fcn.004b27ab
lea ecx, [esp + 0x28]
mov byte [esp + 0x7b8], 3
call fcn.004b27ab
lea ecx, [esp + 0x20]
mov byte [esp + 0x7b8], 2
call fcn.004b27ab
lea ecx, [esp + 0x10]
mov byte [esp + 0x7b8], 1
call fcn.004b27ab
lea ecx, [esp + 0x7c0]
mov byte [esp + 0x7b8], 0
call fcn.004b27ab
lea ecx, [esp + 0x7c4]
mov dword [esp + 0x7b8], 0xffffffff
call fcn.004b27ab
xor eax, eax
mov ecx, dword [esp + 0x7b0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x7ac
ret 0xc
lea ecx, [esp + 0xec]
mov dword [esp + 0xec], 0x128
push ecx
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x425ad3
mov edx, dword [esp + 0xf4]
push edx
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x425ab3
lea eax, [esp + 0x110]
lea ecx, [esp + 0x3a8]
push eax
push ecx
call fcn.004996d0
add esp, 8
test eax, eax
jne 0x425aac
mov ecx, dword [esp + 0xf4]
xor edx, edx
mov eax, ecx
shr eax, 4
div dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x425aca
mov eax, dword [eax + edx*4]
cmp eax, esi
je 0x425aca
cmp dword [eax + 8], ecx
je 0x425aa8
mov eax, dword [eax]
cmp eax, esi
je 0x425aca
jmp 0x425a9b
cmp eax, esi
je 0x425aca
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea edx, [esp + 0xec]
push edx
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x425ad3
jmp 0x425a44
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp ebp, esi
jbe 0x425aea
push ebp
push 0x426300
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [esp + 0x38]
cmp edi, esi
je 0x425b10
mov eax, dword [esp + 0x3c]
cmp eax, esi
jbe 0x425b10
mov ecx, edi
mov edx, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x425b0a
mov eax, dword [eax]
cmp eax, esi
jne 0x425b04
add ecx, 4
dec edx
jne 0x425afe
push edi
call fcn.004b2da3
mov ecx, dword [esp + 0x4c]
add esp, 4
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.004ae6da
mov al, byte [esp + 0x1f]
mov dword [esp + 0x48], esi
test al, al
je 0x425bc9
mov edi, dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [esp + 0xcc]
push 0x64
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edx, dword [esp + 0xcc]
lea ecx, [esp + 0x58]
push ecx
push edx
call edi
push 1
push 0
push 0
lea eax, [esp + 0xdc]
push 0
push eax
call esi
test eax, eax
je 0x425bbf
cmp dword [esp + 0xd4], 0xf
jne 0x425ba9
lea ecx, [esp + 0xd0]
push ecx
call ebx
lea edx, [esp + 0xd0]
push edx
call ebp
push 1
push 0
push 0
lea eax, [esp + 0xdc]
push 0
push eax
call esi
test eax, eax
jne 0x425b8b
cmp dword [esp + 0x58], 0x103
je 0x425b56
mov edi, dword [esp + 0x58]
mov dword [esp + 0x34], 0x4c5b78
mov edx, dword [esp + 0x38]
xor ebx, ebx
cmp edx, ebx
mov byte [esp + 0x7b8], 0x15
je 0x425c05
mov eax, dword [esp + 0x3c]
cmp eax, ebx
jbe 0x425c05
mov ecx, edx
mov esi, eax
mov eax, dword [ecx]
cmp eax, ebx
je 0x425bff
mov eax, dword [eax]
cmp eax, ebx
jne 0x425bf9
add ecx, 4
dec esi
jne 0x425bf3
push edx
call fcn.004b2da3
mov ecx, dword [esp + 0x4c]
add esp, 4
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.004ae6da
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x7b8], 0xb
call fcn.004b27ab
lea ecx, [esp + 0x54]
mov byte [esp + 0x7b8], 7
call fcn.004b27ab
lea ecx, [esp + 0x28]
mov byte [esp + 0x7b8], 3
call fcn.004b27ab
lea ecx, [esp + 0x20]
mov byte [esp + 0x7b8], 2
call fcn.004b27ab
lea ecx, [esp + 0x10]
mov byte [esp + 0x7b8], 1
call fcn.004b27ab
lea ecx, [esp + 0x7c0]
mov byte [esp + 0x7b8], 0
call fcn.004b27ab
lea ecx, [esp + 0x7c4]
mov dword [esp + 0x7b8], 0xffffffff
call fcn.004b27ab
mov eax, edi
jmp 0x425a08
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, esi
jne 0x425d50
mov esi, dword [esp + 0xb4]
mov dword [esp + 0x34], 0x4c5b78
mov edi, dword [esp + 0x38]
xor ebx, ebx
cmp edi, ebx
mov byte [esp + 0x7b8], 0x17
je 0x425cfb
mov eax, dword [esp + 0x3c]
cmp eax, ebx
jbe 0x425cfb
mov ecx, edi
mov edx, eax
mov eax, dword [ecx]
cmp eax, ebx
je 0x425cf5
mov eax, dword [eax]
cmp eax, ebx
jne 0x425cef
add ecx, 4
dec edx
jne 0x425ce9
push edi
call fcn.004b2da3
mov ecx, dword [esp + 0x4c]
add esp, 4
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.004ae6da
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x7b8], 0xb
call fcn.004b27ab
lea ecx, [esp + 0x54]
mov byte [esp + 0x7b8], 7
call fcn.004b27ab
mov byte [esp + 0x7b8], 3
lea ecx, [esp + 0x28]
jmp 0x426038
push esi
lea ecx, [esp + 0x34]
push esi
push ecx
push 0x400
push eax
push esi
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov edx, dword [esp + 0x30]
push 0x40
push str.Error
push edx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x34], 0x4c5b78
mov edx, dword [esp + 0x38]
mov byte [esp + 0x7b8], 0x16
cmp edx, esi
je 0x425dc1
mov eax, dword [esp + 0x3c]
cmp eax, esi
jbe 0x425dc1
mov ecx, edx
mov edi, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x425dbb
mov eax, dword [eax]
cmp eax, esi
jne 0x425db5
add ecx, 4
dec edi
jne 0x425daf
push edx
call fcn.004b2da3
mov ecx, dword [esp + 0x4c]
add esp, 4
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.004ae6da
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], esi
mov byte [esp + 0x7b8], 0xb
call fcn.004b27ab
lea ecx, [esp + 0x54]
mov byte [esp + 0x7b8], 7
call fcn.004b27ab
lea ecx, [esp + 0x28]
mov byte [esp + 0x7b8], 3
call fcn.004b27ab
lea ecx, [esp + 0x20]
mov byte [esp + 0x7b8], 2
call fcn.004b27ab
lea ecx, [esp + 0x10]
mov byte [esp + 0x7b8], 1
call fcn.004b27ab
lea ecx, [esp + 0x7c0]
mov byte [esp + 0x7b8], 0
call fcn.004b27ab
lea ecx, [esp + 0x7c4]
mov dword [esp + 0x7b8], 0xffffffff
call fcn.004b27ab
mov eax, ebx
jmp 0x425a08
call fcn.004b44ad
cmp eax, edi
je 0x425e7e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
cmp eax, edi
jne 0x425e82
xor eax, eax
jmp 0x425e85
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push 5
push edi
push ecx
push edx
push str.explore
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
jmp 0x42603d
call fcn.004b44ad
cmp eax, edi
je 0x425eb9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
cmp eax, edi
jne 0x425ebd
xor eax, eax
jmp 0x425ec0
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push 5
push edi
push ecx
push edx
push 0x4ea22c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
jmp 0x42603d
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 8]
cmp eax, edi
jle 0x425f54
lea ecx, [esp + 0x10]
lea edx, [esp + 0x8c]
push ecx
push 0x4e9178
push edx
call fcn.004b2ab4
push 0x4e9178
push eax
lea eax, [esp + 0x80]
mov bl, 0x18
push eax
mov byte [esp + 0x7c4], bl
call fcn.004b2a40
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x7bc], 0x19
call fcn.004b28e4
lea ecx, [esp + 0x78]
mov byte [esp + 0x7b8], bl
call fcn.004b27ab
lea ecx, [esp + 0x8c]
mov byte [esp + 0x7b8], 3
call fcn.004b27ab
mov ecx, dword [esp + 0x7c4]
cmp dword [ecx - 8], edi
jle 0x425fc9
lea edx, [esp + 0x7c4]
lea eax, [esp + 0x74]
push edx
push str.__ECPASA:
push eax
call fcn.004b2ab4
push 0x4e9178
lea ecx, [esp + 0x88]
push eax
push ecx
mov byte [esp + 0x7c4], 0x1a
call fcn.004b2a40
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x7bc], 0x1b
call fcn.004b2bc3
lea ecx, [esp + 0x84]
mov byte [esp + 0x7b8], 0x1a
call fcn.004b27ab
lea ecx, [esp + 0x74]
mov byte [esp + 0x7b8], 3
call fcn.004b27ab
lea edx, [esp + 0x5ac]
push 0x100
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x5ac]
lea ecx, [esp + 0x30]
push eax
call fcn.004b2819
mov byte [esp + 0x7b8], 0x1c
call fcn.004b44ad
cmp eax, edi
je 0x42600a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
cmp eax, edi
jne 0x42600e
xor eax, eax
jmp 0x426011
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
push 5
push edi
push ecx
push edx
push 0x4ea22c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov byte [esp + 0x7b8], 3
lea ecx, [esp + 0x30]
call fcn.004b27ab
push 0x4f77a0
lea ecx, [esp + 0x18]
call fcn.004b2819
mov bl, 0x1d
cmp esi, 0x1a
mov byte [esp + 0x7b8], bl
ja 0x426180
je 0x426148
cmp esi, 0xb
ja case.default.0x426192
jmp dword [esi*4 + 0x4262b4]
push str.The_operating_system_is_out_of_memory_or_resources.
jmp 0x4261e6
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push str.The_specified_file_was_not_found._n
push ecx
call fcn.004b2ab4
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x7bc], 0x1e
call fcn.004b28e4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x7b8], bl
call fcn.004b27ab
jmp case.default.0x426192
lea edx, [esp + 0x10]
lea eax, [esp + 0x24]
push edx
push str.The_specified_path_was_not_found._n
push eax
call fcn.004b2ab4
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x7bc], 0x1f
call fcn.004b28e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x7b8], bl
call fcn.004b27ab
jmp case.default.0x426192
push str.The_.EXE_file_is_invalid__non_Win32_.EXE_or_error_in_.EXE_image_.
jmp 0x4261e6
lea ecx, [esp + 0x10]
lea edx, [esp + 0x80]
push ecx
push str.The_operating_system_denied_access_to_the_specified_file._n
push edx
call fcn.004b2ab4
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x7bc], 0x20
call fcn.004b28e4
lea ecx, [esp + 0x80]
mov byte [esp + 0x7b8], bl
call fcn.004b27ab
jmp case.default.0x426192
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x4261e6
lea eax, [esp + 0x10]
lea ecx, [esp + 0x5c]
push eax
push str.A_sharing_violation_occurred._n
push ecx
call fcn.004b2ab4
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x7bc], 0x21
call fcn.004b28e4
lea ecx, [esp + 0x5c]
mov byte [esp + 0x7b8], bl
call fcn.004b27ab
jmp case.default.0x426192
cmp esi, 0x483
ja 0x4261c3
je 0x4261bc
lea eax, [esi - 0x1b]
cmp eax, 5
ja case.default.0x426192
jmp dword [eax*4 + 0x4262e4]
push str.The_filename_association_is_incomplete_or_invalid.
jmp 0x4261e6
push str.The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.
jmp 0x4261e6
push str.The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.
jmp 0x4261e6
push str.The_specified_dynamic_link_library_was_not_found.
jmp 0x4261e6
push str.There_is_no_application_associated_with_the_given_filename_extension.
jmp 0x4261e6
push str.There_is_no_application_associated_with_the_given_file_name_extension.
jmp 0x4261e6
sub esi, 0x484
je case.0x426192.29
dec esi
je 0x4261da
sub esi, 0x42
jne case.default.0x426192
push str.The_function_prompted_the_user_for_additional_information__but_the_user_canceled_the_request.
jmp 0x4261e6
push str.One_of_the_library_files_necessary_to_run_the_application_cant_be_found.
jmp 0x4261e6
push str.The_DDE_transaction_failed.
lea ecx, [esp + 0x18]
call fcn.004b2934
mov edi, dword [esp + 0x14]
mov esi, 0x4f77a0
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x426222
test cl, cl
je 0x42621e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x426222
add eax, 2
add esi, 2
test cl, cl
jne 0x4261fa
xor eax, eax
jmp 0x426227
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x426235
push 0
push 0x10
push edi
call fcn.004b74cf
mov esi, dword [esp + 0x58]
lea ecx, [esp + 0x14]
mov byte [esp + 0x7b8], 3
call fcn.004b27ab
lea ecx, [esp + 0x20]
mov byte [esp + 0x7b8], 2
call fcn.004b27ab
lea ecx, [esp + 0x10]
mov byte [esp + 0x7b8], 1
call fcn.004b27ab
lea ecx, [esp + 0x7c0]
mov byte [esp + 0x7b8], 0
call fcn.004b27ab
lea ecx, [esp + 0x7c4]
mov dword [esp + 0x7b8], 0xffffffff
call fcn.004b27ab
mov eax, esi
jmp 0x425a08