Function at 0x41c8a1
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
mov eax, 0x4db3cc
call fcn.004b36d0
sub esp, 0x1d0
push ebx
push esi
push edi
push 1
lea eax, [ebp + 8]
pop esi
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
call fcn.004cf1e2
lea eax, [ebp - 0x20]
push eax
call fcn.00430c19
add esp, 4
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
mov byte [ebp - 4], 2
call fcn.004cf1e2
lea eax, [ebp - 0x14]
push eax
call fcn.00430c19
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], ebx
je 0x41c9d1
cmp eax, 2
je 0x41c9ae
jle 0x41c978
cmp eax, 4
jle 0x41cdf4
cmp eax, 5
jne 0x41c978
lea eax, [ebp - 0x1dc]
push pe_nt_image_headers32
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x1dc]
lea ecx, [ebp + 0x10]
push eax
call fcn.004cf4db
mov byte [ebp - 4], 0xd
call fcn.00411c61
cmp eax, ebx
jne 0x41c952
xor eax, eax
jmp 0x41c955
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push 0x507ce8
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x10]
jmp 0x41cde3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004cf46d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004cf46d
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004cf46d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004cf46d
xor eax, eax
jmp 0x41cfbb
call fcn.00411c61
cmp eax, ebx
jne 0x41c9bb
xor eax, eax
jmp 0x41c9be
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x20]
push str.explore
jmp 0x41ce12
lea eax, [ebp - 0x5c]
push 3
push eax
lea ecx, [ebp - 0x14]
call fcn.004c9834
mov esi, 0x508a34
mov byte [ebp - 4], 4
push esi
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
mov edi, str.WAIT
je 0x41ca29
lea eax, [ebp - 0x48]
push 4
push eax
lea ecx, [ebp - 0x14]
call fcn.004c9834
push edi
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x48]
sete byte [ebp + 0x13]
call fcn.004cf46d
cmp byte [ebp + 0x13], bl
mov byte [ebp + 0x13], bl
je 0x41ca2d
mov byte [ebp + 0x13], 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.004cf46d
cmp byte [ebp + 0x13], bl
je 0x41cdf4
mov eax, dword [0x52041c]
mov dword [ebp - 0x18], eax
or dword [ebp - 0x24], 0xffffffff
lea eax, [ebp - 0x38]
push 8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
mov byte [ebp + 0x13], bl
call fcn.004c9834
push str.TOPMOST_
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x38]
sete byte [ebp - 0xd]
call fcn.004cf46d
cmp byte [ebp - 0xd], bl
je 0x41caeb
lea eax, [ebp - 0x64]
push 8
push eax
lea ecx, [ebp - 0x14]
mov byte [0x52b118], 1
call fcn.004c96ff
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.004cf5a6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x64]
call fcn.004cf46d
push str.__Dde.E
push ebx
lea ecx, [ebp - 0x18]
call fcn.004cf89d
push eax
call fcn.004b5dac
push eax
call fcn.004b5788
push 0x522f00
push ebx
mov dword [ebp - 0x24], eax
call fcn.004b5dac
add esp, 0x14
lea ecx, [ebp - 0x18]
push eax
call fcn.004cf5f6
jmp 0x41cc43
lea eax, [ebp - 0x40]
push 7
push eax
lea ecx, [ebp - 0x14]
call fcn.004c9834
push str.TOPMOST
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x40]
sete byte [ebp - 0xd]
call fcn.004cf46d
cmp byte [ebp - 0xd], bl
je 0x41cb48
lea eax, [ebp - 0x60]
push 7
push eax
lea ecx, [ebp - 0x14]
mov byte [0x52b118], 1
call fcn.004c96ff
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004cf5a6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x60]
jmp 0x41cc3e
lea eax, [ebp - 0x30]
push 4
push eax
lea ecx, [ebp - 0x14]
call fcn.004c9834
push str.TOP_
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x30]
sete byte [ebp - 0xd]
call fcn.004cf46d
cmp byte [ebp - 0xd], bl
je 0x41cb9e
lea eax, [ebp - 0x6c]
push 4
push eax
lea ecx, [ebp - 0x14]
call fcn.004c96ff
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.004cf5a6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6c]
jmp 0x41caad
lea eax, [ebp - 0x50]
push 3
push eax
lea ecx, [ebp - 0x14]
call fcn.004c9834
push esi
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x50]
sete byte [ebp - 0xd]
call fcn.004cf46d
cmp byte [ebp - 0xd], bl
je 0x41cbed
lea eax, [ebp - 0x68]
push 3
push eax
lea ecx, [ebp - 0x14]
call fcn.004c96ff
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.004cf5a6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
jmp 0x41cc3e
lea eax, [ebp - 0x58]
push 4
push eax
lea ecx, [ebp - 0x14]
call fcn.004c9834
push edi
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x58]
sete byte [ebp - 0xd]
call fcn.004cf46d
cmp byte [ebp - 0xd], bl
je 0x41cc43
lea eax, [ebp - 0x34]
push 4
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp + 0x13], 1
call fcn.004c96ff
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call fcn.004cf5a6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.004cf46d
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
call fcn.004cf5a6
lea eax, [ebp - 0x3c]
push 5
push eax
lea ecx, [ebp - 0x14]
call fcn.004c9834
push str._WAIT
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x3c]
sete byte [ebp - 0xd]
call fcn.004cf46d
cmp byte [ebp - 0xd], bl
je 0x41cca9
lea eax, [ebp - 0x44]
push 5
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp + 0x13], 1
call fcn.004c96ff
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xb
call fcn.004cf5a6
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.004cf46d
lea eax, [ebp - 0x4c]
push 1
push eax
lea ecx, [ebp - 0x18]
call fcn.004c9834
mov esi, 0x5061dc
push esi
push dword [eax]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
lea ecx, [ebp - 0x4c]
setne byte [ebp - 0xd]
call fcn.004cf46d
cmp byte [ebp - 0xd], bl
je 0x41cd00
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004cf776
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.004cf5a6
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 5
call fcn.004cf46d
push 0x44
lea eax, [ebp - 0xdc]
pop esi
push esi
push ebx
push eax
call fcn.004b36f0
add esp, 0xc
lea eax, [ebp - 0x7c]
mov dword [ebp - 0xdc], esi
mov esi, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0xdc]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x18]
call fcn.004cf89d
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x41cdea
push dword [ebp - 0x24]
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x41cd66
push dword [ebp - 0x74]
push 0x41c850
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [ebp + 0x13], bl
je 0x41cdd9
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0x64
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push 1
push ebx
push ebx
lea eax, [ebp - 0x98]
push ebx
push eax
call esi
test eax, eax
je 0x41cdc0
cmp dword [ebp - 0x94], 0xf
jne 0x41cd89
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41cd89
cmp dword [ebp - 0x28], 0x103
je 0x41cd71
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x78]
call esi
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004cf46d
jmp 0x41ce1b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x41cddc
call fcn.00411c61
cmp eax, ebx
jne 0x41ce01
xor eax, eax
jmp 0x41ce04
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x20]
push 0x507ce8
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov edi, 0x522f00
lea ecx, [ebp - 0x1c]
push edi
call fcn.004cf4db
cmp esi, 0x1a
mov byte [ebp - 4], 0xe
ja 0x41cf1d
je 0x41cef0
sub esi, ebx
je 0x41cee9
dec esi
dec esi
je 0x41cec1
dec esi
je 0x41ce99
dec esi
dec esi
je 0x41ce71
sub esi, 3
je 0x41ce67
sub esi, 3
jne 0x41cf61
push str.The_.EXE_file_is_invalid__non_Win32_.EXE_or_error_in_.EXE_image_.
jmp 0x41cf59
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x41cf59
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x10]
push str.The_operating_system_denied_access_to_the_specified_file._n
push eax
call fcn.004cf776
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.004cf5a6
mov byte [ebp - 4], 0xe
lea ecx, [ebp + 0x10]
jmp 0x41cf16
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push str.The_specified_path_was_not_found._n
push eax
call fcn.004cf776
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x10
call fcn.004cf5a6
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x24]
jmp 0x41cf16
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push str.The_specified_file_was_not_found._n
push eax
call fcn.004cf776
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.004cf5a6
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
jmp 0x41cf16
push str.The_operating_system_is_out_of_memory_or_resources.
jmp 0x41cf59
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push str.A_sharing_violation_occurred._n
push eax
call fcn.004cf776
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.004cf5a6
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.004cf46d
jmp 0x41cf61
sub esi, 0x1b
je 0x41cf54
dec esi
je 0x41cf4d
dec esi
je 0x41cf46
dec esi
je 0x41cf3f
dec esi
je 0x41cf38
dec esi
jne 0x41cf61
push str.The_specified_dynamic_link_library_was_not_found.
jmp 0x41cf59
push str.There_is_no_application_associated_with_the_given_filename_extension.
jmp 0x41cf59
push str.The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.
jmp 0x41cf59
push str.The_DDE_transaction_failed.
jmp 0x41cf59
push str.The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.
jmp 0x41cf59
push str.The_filename_association_is_incomplete_or_invalid.
lea ecx, [ebp - 0x1c]
call fcn.004cf5f6
push edi
push dword [ebp - 0x1c]
call fcn.004b3750
pop ecx
cmp eax, ebx
pop ecx
je 0x41cf7b
push ebx
push 0x10
push dword [ebp - 0x1c]
call fcn.004d4116
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.004cf46d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004cf46d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004cf46d
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004cf46d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004cf46d
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc