Function at 0x41aecc
Capabilities:
Check os version
Create process on windows
Enumerate gui resources
Enumerate processes
Get common file path

Disassembly:
mov eax, 0x4a77ab
call fcn.004817b4
sub esp, 0x798
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
push 1
lea eax, [ebp + 8]
pop edi
push ecx
mov dword [ebp - 4], edi
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.0049bb53
lea eax, [ebp - 0x14]
push eax
call fcn.0042d37b
add esp, 4
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
mov byte [ebp - 4], 2
call fcn.0049bb53
lea eax, [ebp - 0x28]
push eax
call fcn.0042d37b
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 3
cmp eax, edi
mov dword [ebp - 0x38], ebx
je 0x41b0d5
cmp eax, 2
je 0x41b0b5
jle 0x41b07f
cmp eax, 4
jle 0x41b053
cmp eax, 5
jne 0x41b07f
mov eax, dword [ebp - 0x14]
mov esi, 0x4d0178
mov eax, dword [eax - 8]
cmp eax, ebx
jle 0x41afac
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0049c0e7
push esi
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x18
push eax
call fcn.0049c073
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x19
call fcn.0049bf17
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x18
call fcn.0049bdde
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.0049bdde
mov eax, dword [ebp + 0xc]
cmp dword [eax - 8], ebx
jle 0x41affa
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x68]
push str.__ECPASA:
push eax
call fcn.0049c0e7
push esi
push eax
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x1a
push eax
call fcn.0049c073
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1b
call fcn.0049c1f6
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1a
call fcn.0049bdde
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.0049bdde
lea eax, [ebp - 0x39c]
push 0x100
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x39c]
lea ecx, [ebp + 0x10]
push eax
call fcn.0049be4c
mov byte [ebp - 4], 0x1c
call fcn.00418f1b
cmp eax, ebx
jne 0x41b02d
xor eax, eax
jmp 0x41b030
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push 0x4d1b74
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x10]
jmp 0x41b8dc
call fcn.00418f1b
cmp eax, ebx
jne 0x41b060
xor eax, eax
jmp 0x41b063
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push 0x4d1b74
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
jmp 0x41b8e1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0049bdde
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0049bdde
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0049bdde
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049bdde
xor eax, eax
jmp 0x41bb65
call fcn.00418f1b
cmp eax, ebx
jne 0x41b0c2
xor eax, eax
jmp 0x41b0c5
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push str.explore
jmp 0x41b071
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x6a0]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
call fcn.00483e63
push ebx
lea eax, [ebp - 0x6a0]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x7a4]
push eax
call fcn.004842ad
lea eax, [ebp - 0x49c]
push str..bat
push eax
call fcn.00482cb0
add esp, 0x30
lea ecx, [ebp - 0x28]
neg eax
sbb al, al
or dword [ebp - 0x24], 0xffffffff
inc al
push 0x20
mov byte [ebp - 0x31], al
mov dword [ebp - 0x20], 5
mov byte [ebp + 0x13], bl
call fcn.0049c2cc
mov esi, eax
cmp esi, 0xffffffff
jle 0x41b15e
lea eax, [esi + 1]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0049601f
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
jmp 0x41b179
push 0x4de958
lea ecx, [ebp - 0x60]
call fcn.0049be4c
mov dword [ebp - 0x10], 2
mov dword [ebp - 4], 5
push eax
lea ecx, [ebp - 0x2c]
call fcn.0049bb53
test byte [ebp - 0x10], 2
mov dword [ebp - 4], 8
je 0x41b19b
and dword [ebp - 0x10], 0xfffffffd
lea ecx, [ebp - 0x60]
call fcn.0049bdde
test byte [ebp - 0x10], 1
mov dword [ebp - 4], 7
je 0x41b1b4
and dword [ebp - 0x10], 0xfffffffe
lea ecx, [ebp - 0x74]
call fcn.0049bdde
cmp esi, 0xffffffff
jle 0x41b1d0
lea eax, [ebp - 0x70]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.00496154
or dword [ebp - 0x10], 4
mov byte [ebp - 4], 9
jmp 0x41b1d3
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0049bb53
test byte [ebp - 0x10], 4
mov dword [ebp - 4], 0xb
je 0x41b1f1
lea ecx, [ebp - 0x70]
call fcn.0049bdde
mov eax, dword [0x4dbfc4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xc
mov word [0x4e6b40], bx
mov dword [ebp - 0x10], ebx
mov esi, str.__Dde.E
push 0x2c
lea eax, [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x3c]
push eax
call fcn.0049ceba
test eax, eax
je 0x41b36f
push str.TOPMOST
lea ecx, [ebp - 0x1c]
call fcn.004961ee
test eax, eax
jne 0x41b295
push 0x28
lea ecx, [ebp - 0x1c]
mov word [0x4e6b40], 2
call fcn.0049c2cc
cmp eax, ebx
jle 0x41b36f
inc eax
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0049601f
push esi
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.0049c20e
push eax
call fcn.00483dbf
push eax
call fcn.0048383b
add esp, 0xc
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x84]
call fcn.0049bdde
jmp 0x41b36f
push 0x4d20c8
lea ecx, [ebp - 0x1c]
call fcn.004961ee
test eax, eax
jne 0x41b2f5
push 0x28
lea ecx, [ebp - 0x1c]
mov word [0x4e6b40], di
call fcn.0049c2cc
cmp eax, ebx
jle 0x41b36f
inc eax
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0049601f
push esi
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.0049c20e
push eax
call fcn.00483dbf
push eax
call fcn.0048383b
add esp, 0xc
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x7c]
jmp 0x41b28b
push str.WAIT
push dword [ebp - 0x1c]
call fcn.00482cb0
pop ecx
cmp eax, ebx
pop ecx
jne 0x41b30e
mov byte [ebp + 0x13], 1
jmp 0x41b36f
push str.HIDE
push dword [ebp - 0x1c]
call fcn.00482cb0
pop ecx
cmp eax, ebx
pop ecx
jne 0x41b326
mov dword [ebp - 0x20], ebx
jmp 0x41b36f
push str.MAXIMIZE
push dword [ebp - 0x1c]
call fcn.00482cb0
pop ecx
cmp eax, ebx
pop ecx
jne 0x41b342
mov dword [ebp - 0x20], 3
jmp 0x41b36f
push str.MINIMIZE
push dword [ebp - 0x1c]
call fcn.00482cb0
pop ecx
cmp eax, ebx
pop ecx
jne 0x41b35e
mov dword [ebp - 0x20], 7
jmp 0x41b36f
cmp dword [ebp - 0x10], ebx
jne 0x41b36f
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0049bf17
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x41b20c
cmp byte [ebp + 0x13], bl
je 0x41b38e
cmp dword [ebp - 0x20], 7
jne 0x41b38e
mov dword [ebp - 0x20], 2
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x29c], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push dword [ebp - 0x14]
lea eax, [ebp - 0x5a0]
push eax
call fcn.00482ee0
cmp byte [ebp - 0x31], bl
pop ecx
pop ecx
je 0x41b4d7
mov eax, dword [0x4dbfc4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x2c]
cmp dword [ebp - 0x28c], edi
mov byte [ebp - 4], 0xf
push dword [ebp - 0x14]
jne 0x41b411
lea eax, [ebp - 0x10]
push str._C___s___s
push eax
call fcn.00496574
add esp, 0x10
lea eax, [ebp - 0x5a0]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x5a0]
push str.winoa386.mod
push eax
call fcn.00482ef0
pop ecx
pop ecx
jmp 0x41b422
lea eax, [ebp - 0x10]
push str._C____s___s_
push eax
call fcn.00496574
add esp, 0x10
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0049bf17
push str.COMSPEC
call fcn.0048420f
cmp eax, ebx
pop ecx
je 0x41b451
push eax
lea eax, [ebp - 0x14]
push 0x4d156c
push eax
call fcn.00496574
add esp, 0xc
jmp 0x41b4cb
cmp dword [ebp - 0x28c], edi
push ecx
mov ecx, esp
jne 0x41b492
mov dword [ebp - 0x30], esp
push str._Windows_
call fcn.0049be4c
lea eax, [ebp - 0x6c]
push eax
call fcn.0042d37b
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x10
push str._scommand.com
push eax
call fcn.00496574
add esp, 0x14
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6c]
jmp 0x41b4c6
mov dword [ebp - 0x30], esp
push str._System_
call fcn.0049be4c
lea eax, [ebp - 0x78]
push eax
call fcn.0042d37b
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x11
push str._scmd.exe
push eax
call fcn.00496574
add esp, 0x14
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x78]
call fcn.0049bdde
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.0049bdde
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.00483e63
add esp, 0x14
cmp dword [ebp - 0x28c], edi
je 0x41b519
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
lea eax, [ebp - 0x5a0]
push ebx
push eax
call fcn.004842ad
add esp, 0x14
lea eax, [ebp - 0x39c]
push 0x4d2034
push eax
call fcn.00482cb0
pop ecx
test eax, eax
pop ecx
jne 0x41b547
lea eax, [ebp - 0x49c]
push str..exe
push eax
call fcn.00482cb0
pop ecx
test eax, eax
pop ecx
je 0x41b575
lea eax, [ebp - 0x39c]
push str.command
push eax
call fcn.00482cb0
pop ecx
test eax, eax
pop ecx
jne 0x41b582
lea eax, [ebp - 0x49c]
push str..com
push eax
call fcn.00482cb0
pop ecx
test eax, eax
pop ecx
jne 0x41b582
cmp dword [ebp - 0x24], 0xffffffff
jne 0x41b582
mov dword [ebp - 0x24], 0xfa
push 0x3c
lea eax, [ebp - 0xc4]
pop esi
push esi
push ebx
push eax
call fcn.004817e0
add esp, 0xc
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x8040
call fcn.00418f1b
cmp eax, ebx
jne 0x41b5b7
mov dword [ebp - 0xbc], ebx
jmp 0x41b5c0
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x14]
mov esi, 0x4ad860
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0xb8], 0x4d1b74
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0x11
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 8
push 0x49
xor eax, eax
pop ecx
lea edi, [ebp - 0x204]
mov dword [ebp - 0x208], ebx
push ebx
rep stosd dword es:[edi], eax
push 2
mov byte [ebp - 4], 0x12
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41b648
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x13
xor esi, esi
jmp 0x41b86e
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x128
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32First
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x41b6e9
push dword [ebp - 0x200]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x30], eax
je 0x41b6d6
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
lea eax, [ebp - 0x1e4]
push ebx
push eax
call fcn.00483e63
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.00482cb0
add esp, 0x1c
test eax, eax
jne 0x41b6d1
mov eax, dword [ebp - 0x200]
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0x20], eax
call fcn.0041dbad
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x30]
call edi
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x41b66b
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x41b89a
cmp word [0x4e6b40], bx
jle 0x41b7f3
push dword [ebp - 0x24]
push dword [ebp - 0x8c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x41b733
push dword [ebp - 0x24]
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
push 2
mov dword [ebp - 0x24], ebx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41b752
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x14
jmp 0x41b641
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x128
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x41b7db
push dword [ebp - 0x200]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x41b7bc
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.00482cb0
pop ecx
test eax, eax
pop ecx
jne 0x41b7b7
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x200]
call fcn.0041da34
test eax, eax
je 0x41b7cd
push dword [ebp - 0x20]
call edi
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32Next
jmp 0x41b76b
mov eax, dword [ebp - 0x200]
push dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
call edi
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x24], ebx
jbe 0x41b7f3
push dword [ebp - 0x24]
push 0x41bb76
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x5c]
call fcn.0041da76
cmp byte [ebp + 0x13], bl
je 0x41b864
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0x64
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push 1
push ebx
push ebx
lea eax, [ebp - 0xe0]
push ebx
push eax
call edi
test eax, eax
je 0x41b85b
cmp dword [ebp - 0xdc], 0xf
jne 0x41b824
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41b824
cmp dword [ebp - 0x38], 0x103
je 0x41b806
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x5c]
call fcn.0041da76
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.0049bdde
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.0049bdde
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
jmp 0x41ba91
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jne 0x41bacc
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x17
call fcn.0041da76
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.0049bdde
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.0049bdde
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0049bdde
mov esi, 0x4de958
lea ecx, [ebp - 0x18]
push esi
call fcn.0049be4c
cmp edi, 0x1c
mov byte [ebp - 4], 0x1d
ja 0x41ba0d
je 0x41ba06
cmp edi, 8
ja 0x41b9b7
je 0x41b9ad
sub edi, ebx
je 0x41b9a3
dec edi
dec edi
je 0x41b97b
dec edi
je 0x41b953
dec edi
dec edi
jne 0x41ba6d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push str.The_operating_system_denied_access_to_the_specified_file._n
push eax
call fcn.0049c0e7
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x20
call fcn.0049bf17
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x30]
jmp 0x41b9f8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push str.The_specified_path_was_not_found._n
push eax
call fcn.0049c0e7
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1f
call fcn.0049bf17
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x24]
jmp 0x41b9f8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push str.The_specified_file_was_not_found._n
push eax
call fcn.0049c0e7
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1e
call fcn.0049bf17
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x20]
jmp 0x41b9f8
push str.The_operating_system_is_out_of_memory_or_resources.
jmp 0x41ba65
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x41ba65
sub edi, 0xb
je 0x41b9ff
sub edi, 0xf
je 0x41b9d2
dec edi
jne 0x41ba6d
push str.The_filename_association_is_incomplete_or_invalid.
jmp 0x41ba65
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push str.A_sharing_violation_occurred._n
push eax
call fcn.0049c0e7
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x21
call fcn.0049bf17
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x10]
call fcn.0049bdde
jmp 0x41ba6d
push str.The_.EXE_file_is_invalid__non_Win32_.EXE_or_error_in_.EXE_image_.
jmp 0x41ba65
push str.The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.
jmp 0x41ba65
mov eax, 0x483
cmp edi, eax
ja 0x41ba42
je 0x41ba3b
sub edi, 0x1d
je 0x41ba60
dec edi
je 0x41ba34
dec edi
je 0x41ba2d
dec edi
jne 0x41ba6d
push str.The_specified_dynamic_link_library_was_not_found.
jmp 0x41ba65
push str.There_is_no_application_associated_with_the_given_filename_extension.
jmp 0x41ba65
push str.The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.
jmp 0x41ba65
push str.There_is_no_application_associated_with_the_given_file_name_extension.
jmp 0x41ba65
sub edi, 0x484
je 0x41ba60
dec edi
je 0x41ba59
sub edi, 0x42
jne 0x41ba6d
push str.The_function_prompted_the_user_for_additional_information__but_the_user_canceled_the_request.
jmp 0x41ba65
push str.One_of_the_library_files_necessary_to_run_the_application_cant_be_found.
jmp 0x41ba65
push str.The_DDE_transaction_failed.
lea ecx, [ebp - 0x18]
call fcn.0049bf67
push esi
push dword [ebp - 0x18]
call fcn.00481840
pop ecx
cmp eax, ebx
pop ecx
je 0x41ba87
push ebx
push 0x10
push dword [ebp - 0x18]
call fcn.004a0771
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.0049bdde
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0049bdde
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0049bdde
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0049bdde
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049bdde
mov eax, esi
jmp 0x41bb65
push ebx
lea ecx, [ebp + 0x10]
push ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
push 0x40
push str.Error
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x16
call fcn.0041da76
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.0049bdde
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.0049bdde
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0049bdde
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0049bdde
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0049bdde
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0049bdde
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049bdde
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc