Function at 0x41f0e9
Capabilities:
Check os version
Create process on windows
Enumerate gui resources
Enumerate processes
Get common file path

Disassembly:
mov eax, 0x4e1743
call fcn.004b8e80
sub esp, 0x798
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
push 1
lea eax, [ebp + 8]
pop edi
push ecx
mov dword [ebp - 4], edi
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.004d4f11
lea eax, [ebp - 0x14]
push eax
call fcn.004345bb
add esp, 4
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
mov byte [ebp - 4], 2
call fcn.004d4f11
lea eax, [ebp - 0x28]
push eax
call fcn.004345bb
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 3
cmp eax, edi
mov dword [ebp - 0x38], ebx
je 0x41f2f2
cmp eax, 2
je 0x41f2d2
jle 0x41f29c
cmp eax, 4
jle 0x41f270
cmp eax, 5
jne 0x41f29c
mov eax, dword [ebp - 0x14]
mov esi, 0x50e188
mov eax, dword [eax - 8]
cmp eax, ebx
jle 0x41f1c9
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004d54a5
push esi
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x18
push eax
call fcn.004d5431
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x19
call fcn.004d52d5
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x18
call fcn.004d519c
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.004d519c
mov eax, dword [ebp + 0xc]
cmp dword [eax - 8], ebx
jle 0x41f217
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x68]
push str.__ECPASA:
push eax
call fcn.004d54a5
push esi
push eax
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x1a
push eax
call fcn.004d5431
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1b
call fcn.004d55b4
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1a
call fcn.004d519c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.004d519c
lea eax, [ebp - 0x39c]
push 0x100
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x39c]
lea ecx, [ebp + 0x10]
push eax
call fcn.004d520a
mov byte [ebp - 4], 0x1c
call fcn.0041344a
cmp eax, ebx
jne 0x41f24a
xor eax, eax
jmp 0x41f24d
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push 0x50fd7c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x10]
jmp 0x41faf9
call fcn.0041344a
cmp eax, ebx
jne 0x41f27d
xor eax, eax
jmp 0x41f280
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push 0x50fd7c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
jmp 0x41fafe
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004d519c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d519c
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004d519c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004d519c
xor eax, eax
jmp 0x41fd82
call fcn.0041344a
cmp eax, ebx
jne 0x41f2df
xor eax, eax
jmp 0x41f2e2
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push str.explore
jmp 0x41f28e
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x6a0]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
call fcn.004bb5e3
push ebx
lea eax, [ebp - 0x6a0]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x7a4]
push eax
call fcn.004bba2d
lea eax, [ebp - 0x49c]
push str..bat
push eax
call fcn.004ba370
add esp, 0x30
lea ecx, [ebp - 0x28]
neg eax
sbb al, al
or dword [ebp - 0x24], 0xffffffff
inc al
push 0x20
mov byte [ebp - 0x31], al
mov dword [ebp - 0x20], 5
mov byte [ebp + 0x13], bl
call fcn.004d568a
mov esi, eax
cmp esi, 0xffffffff
jle 0x41f37b
lea eax, [esi + 1]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004cf0f3
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
jmp 0x41f396
push 0x52be40
lea ecx, [ebp - 0x60]
call fcn.004d520a
mov dword [ebp - 0x10], 2
mov dword [ebp - 4], 5
push eax
lea ecx, [ebp - 0x2c]
call fcn.004d4f11
test byte [ebp - 0x10], 2
mov dword [ebp - 4], 8
je 0x41f3b8
and dword [ebp - 0x10], 0xfffffffd
lea ecx, [ebp - 0x60]
call fcn.004d519c
test byte [ebp - 0x10], 1
mov dword [ebp - 4], 7
je 0x41f3d1
and dword [ebp - 0x10], 0xfffffffe
lea ecx, [ebp - 0x74]
call fcn.004d519c
cmp esi, 0xffffffff
jle 0x41f3ed
lea eax, [ebp - 0x70]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.004cf228
or dword [ebp - 0x10], 4
mov byte [ebp - 4], 9
jmp 0x41f3f0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004d4f11
test byte [ebp - 0x10], 4
mov dword [ebp - 4], 0xb
je 0x41f40e
lea ecx, [ebp - 0x70]
call fcn.004d519c
mov eax, dword [0x52933c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xc
mov word [0x534058], bx
mov dword [ebp - 0x10], ebx
mov esi, str.__Dde.E
push 0x2c
lea eax, [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x3c]
push eax
call fcn.004d6318
test eax, eax
je 0x41f58c
push str.TOPMOST
lea ecx, [ebp - 0x1c]
call fcn.004cf2c2
test eax, eax
jne 0x41f4b2
push 0x28
lea ecx, [ebp - 0x1c]
mov word [0x534058], 2
call fcn.004d568a
cmp eax, ebx
jle 0x41f58c
inc eax
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004cf0f3
push esi
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.004d55cc
push eax
call fcn.004bb53f
push eax
call fcn.004bafbb
add esp, 0xc
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x84]
call fcn.004d519c
jmp 0x41f58c
push 0x510ce0
lea ecx, [ebp - 0x1c]
call fcn.004cf2c2
test eax, eax
jne 0x41f512
push 0x28
lea ecx, [ebp - 0x1c]
mov word [0x534058], di
call fcn.004d568a
cmp eax, ebx
jle 0x41f58c
inc eax
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004cf0f3
push esi
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.004d55cc
push eax
call fcn.004bb53f
push eax
call fcn.004bafbb
add esp, 0xc
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x7c]
jmp 0x41f4a8
push str.WAIT
push dword [ebp - 0x1c]
call fcn.004ba370
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f52b
mov byte [ebp + 0x13], 1
jmp 0x41f58c
push str.HIDE
push dword [ebp - 0x1c]
call fcn.004ba370
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f543
mov dword [ebp - 0x20], ebx
jmp 0x41f58c
push str.MAXIMIZE
push dword [ebp - 0x1c]
call fcn.004ba370
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f55f
mov dword [ebp - 0x20], 3
jmp 0x41f58c
push str.MINIMIZE
push dword [ebp - 0x1c]
call fcn.004ba370
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f57b
mov dword [ebp - 0x20], 7
jmp 0x41f58c
cmp dword [ebp - 0x10], ebx
jne 0x41f58c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004d52d5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x41f429
cmp byte [ebp + 0x13], bl
je 0x41f5ab
cmp dword [ebp - 0x20], 7
jne 0x41f5ab
mov dword [ebp - 0x20], 2
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x29c], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push dword [ebp - 0x14]
lea eax, [ebp - 0x5a0]
push eax
call fcn.004ba5a0
cmp byte [ebp - 0x31], bl
pop ecx
pop ecx
je 0x41f6f4
mov eax, dword [0x52933c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x2c]
cmp dword [ebp - 0x28c], edi
mov byte [ebp - 4], 0xf
push dword [ebp - 0x14]
jne 0x41f62e
lea eax, [ebp - 0x10]
push str._C___s___s
push eax
call fcn.004cf648
add esp, 0x10
lea eax, [ebp - 0x5a0]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x5a0]
push str.winoa386.mod
push eax
call fcn.004ba5b0
pop ecx
pop ecx
jmp 0x41f63f
lea eax, [ebp - 0x10]
push str._C____s___s_
push eax
call fcn.004cf648
add esp, 0x10
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004d52d5
push str.COMSPEC
call fcn.004bb98f
cmp eax, ebx
pop ecx
je 0x41f66e
push eax
lea eax, [ebp - 0x14]
push 0x510190
push eax
call fcn.004cf648
add esp, 0xc
jmp 0x41f6e8
cmp dword [ebp - 0x28c], edi
push ecx
mov ecx, esp
jne 0x41f6af
mov dword [ebp - 0x30], esp
push str._Windows_
call fcn.004d520a
lea eax, [ebp - 0x6c]
push eax
call fcn.004345bb
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x10
push str._scommand.com
push eax
call fcn.004cf648
add esp, 0x14
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6c]
jmp 0x41f6e3
mov dword [ebp - 0x30], esp
push str._System_
call fcn.004d520a
lea eax, [ebp - 0x78]
push eax
call fcn.004345bb
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x11
push str._scmd.exe
push eax
call fcn.004cf648
add esp, 0x14
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x78]
call fcn.004d519c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.004d519c
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.004bb5e3
add esp, 0x14
cmp dword [ebp - 0x28c], edi
je 0x41f736
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
lea eax, [ebp - 0x5a0]
push ebx
push eax
call fcn.004bba2d
add esp, 0x14
lea eax, [ebp - 0x39c]
push 0x510c4c
push eax
call fcn.004ba370
pop ecx
test eax, eax
pop ecx
jne 0x41f764
lea eax, [ebp - 0x49c]
push str..exe
push eax
call fcn.004ba370
pop ecx
test eax, eax
pop ecx
je 0x41f792
lea eax, [ebp - 0x39c]
push str.command
push eax
call fcn.004ba370
pop ecx
test eax, eax
pop ecx
jne 0x41f79f
lea eax, [ebp - 0x49c]
push str..com
push eax
call fcn.004ba370
pop ecx
test eax, eax
pop ecx
jne 0x41f79f
cmp dword [ebp - 0x24], 0xffffffff
jne 0x41f79f
mov dword [ebp - 0x24], 0xfa
push 0x3c
lea eax, [ebp - 0xc4]
pop esi
push esi
push ebx
push eax
call fcn.004b8ea0
add esp, 0xc
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x8040
call fcn.0041344a
cmp eax, ebx
jne 0x41f7d4
mov dword [ebp - 0xbc], ebx
jmp 0x41f7dd
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x14]
mov esi, 0x4e9028
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0xb8], 0x50fd7c
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0x11
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 8
push 0x49
xor eax, eax
pop ecx
lea edi, [ebp - 0x204]
mov dword [ebp - 0x208], ebx
push ebx
rep stosd dword es:[edi], eax
push 2
mov byte [ebp - 4], 0x12
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41f865
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x13
xor esi, esi
jmp 0x41fa8b
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x128
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32First
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x41f906
push dword [ebp - 0x200]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x30], eax
je 0x41f8f3
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
lea eax, [ebp - 0x1e4]
push ebx
push eax
call fcn.004bb5e3
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.004ba370
add esp, 0x1c
test eax, eax
jne 0x41f8ee
mov eax, dword [ebp - 0x200]
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0x20], eax
call fcn.004221cc
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x30]
call edi
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x41f888
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x41fab7
cmp word [0x534058], bx
jle 0x41fa10
push dword [ebp - 0x24]
push dword [ebp - 0x8c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x41f950
push dword [ebp - 0x24]
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
push 2
mov dword [ebp - 0x24], ebx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41f96f
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x14
jmp 0x41f85e
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x128
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x41f9f8
push dword [ebp - 0x200]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x41f9d9
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.004ba370
pop ecx
test eax, eax
pop ecx
jne 0x41f9d4
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x200]
call fcn.00422053
test eax, eax
je 0x41f9ea
push dword [ebp - 0x20]
call edi
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32Next
jmp 0x41f988
mov eax, dword [ebp - 0x200]
push dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
call edi
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x24], ebx
jbe 0x41fa10
push dword [ebp - 0x24]
push 0x41fd93
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x5c]
call fcn.00422095
cmp byte [ebp + 0x13], bl
je 0x41fa81
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0x64
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push 1
push ebx
push ebx
lea eax, [ebp - 0xe0]
push ebx
push eax
call edi
test eax, eax
je 0x41fa78
cmp dword [ebp - 0xdc], 0xf
jne 0x41fa41
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41fa41
cmp dword [ebp - 0x38], 0x103
je 0x41fa23
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x5c]
call fcn.00422095
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004d519c
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004d519c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
jmp 0x41fcae
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jne 0x41fce9
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x17
call fcn.00422095
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004d519c
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004d519c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004d519c
mov esi, 0x52be40
lea ecx, [ebp - 0x18]
push esi
call fcn.004d520a
cmp edi, 0x1c
mov byte [ebp - 4], 0x1d
ja 0x41fc2a
je 0x41fc23
cmp edi, 8
ja 0x41fbd4
je 0x41fbca
sub edi, ebx
je 0x41fbc0
dec edi
dec edi
je 0x41fb98
dec edi
je 0x41fb70
dec edi
dec edi
jne 0x41fc8a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push str.The_operating_system_denied_access_to_the_specified_file._n
push eax
call fcn.004d54a5
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x20
call fcn.004d52d5
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x30]
jmp 0x41fc15
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push str.The_specified_path_was_not_found._n
push eax
call fcn.004d54a5
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1f
call fcn.004d52d5
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x24]
jmp 0x41fc15
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push str.The_specified_file_was_not_found._n
push eax
call fcn.004d54a5
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1e
call fcn.004d52d5
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x20]
jmp 0x41fc15
push str.The_operating_system_is_out_of_memory_or_resources.
jmp 0x41fc82
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x41fc82
sub edi, 0xb
je 0x41fc1c
sub edi, 0xf
je 0x41fbef
dec edi
jne 0x41fc8a
push str.The_filename_association_is_incomplete_or_invalid.
jmp 0x41fc82
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push str.A_sharing_violation_occurred._n
push eax
call fcn.004d54a5
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x21
call fcn.004d52d5
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x10]
call fcn.004d519c
jmp 0x41fc8a
push str.The_.EXE_file_is_invalid__non_Win32_.EXE_or_error_in_.EXE_image_.
jmp 0x41fc82
push str.The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.
jmp 0x41fc82
mov eax, 0x483
cmp edi, eax
ja 0x41fc5f
je 0x41fc58
sub edi, 0x1d
je 0x41fc7d
dec edi
je 0x41fc51
dec edi
je 0x41fc4a
dec edi
jne 0x41fc8a
push str.The_specified_dynamic_link_library_was_not_found.
jmp 0x41fc82
push str.There_is_no_application_associated_with_the_given_filename_extension.
jmp 0x41fc82
push str.The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.
jmp 0x41fc82
push str.There_is_no_application_associated_with_the_given_file_name_extension.
jmp 0x41fc82
sub edi, 0x484
je 0x41fc7d
dec edi
je 0x41fc76
sub edi, 0x42
jne 0x41fc8a
push str.The_function_prompted_the_user_for_additional_information__but_the_user_canceled_the_request.
jmp 0x41fc82
push str.One_of_the_library_files_necessary_to_run_the_application_cant_be_found.
jmp 0x41fc82
push str.The_DDE_transaction_failed.
lea ecx, [ebp - 0x18]
call fcn.004d5325
push esi
push dword [ebp - 0x18]
call fcn.004b8f00
pop ecx
cmp eax, ebx
pop ecx
je 0x41fca4
push ebx
push 0x10
push dword [ebp - 0x18]
call fcn.004d9f03
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004d519c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004d519c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d519c
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004d519c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004d519c
mov eax, esi
jmp 0x41fd82
push ebx
lea ecx, [ebp + 0x10]
push ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
push pe_nt_image_headers32
push str.Error
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x16
call fcn.00422095
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004d519c
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004d519c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004d519c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004d519c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d519c
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004d519c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004d519c
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc