Function at 0x441f30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ce66
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x48d800]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x160], ecx
push str.MyUnDelete_MUTEX_A9221D8C_6E6E_4352_A34A_C3E1BD54066A
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x441fb3
push 0x4766d4
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
je 0x441fac
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
jmp 0x44277a
mov ecx, 0x492344
call fcn.00445830
mov dword [ebp - 0x12c], 0x114
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x442000
mov edx, dword [ebp - 0x128]
shl edx, 0x10
add edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x160]
mov dword [eax + 0x35539], edx
jmp 0x442015
mov ecx, dword [ebp - 0x128]
shl ecx, 0x10
mov edx, dword [ebp - 0x160]
mov dword [edx + 0x35539], ecx
call fcn.00418477
call fcn.00416d09
push 0
mov eax, dword [ebp - 0x160]
add eax, 0x35515
push eax
mov ecx, dword [ebp - 0x160]
add ecx, 0x35511
push ecx
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x138], 8
mov dword [ebp - 0x134], 0xff
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x160]
call fcn.00415fdc
push 0
call fcn.00417759
add esp, 4
push 0x47670c
mov ecx, dword [ebp - 0x160]
call fcn.004151b2
push str.UserRights.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jne 0x4420ba
push 0x10
push 0x47674c
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_001
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.IsUserAdmin
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4420f0
push 0x10
push 0x476820
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_002
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
lea ecx, [ebp - 0x148]
push ecx
call dword [ebp - 0x10]
test eax, eax
jne 0x442119
push 0x10
push 0x4768e0
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_003
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
cmp dword [ebp - 0x148], 0
jne 0x44213d
push 0x10
push 0x4769a0
push str.You_have_not_enough_priviliges_to_run_this_program._Try_to_run_this_program_as_administrator._Error_004
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.UnDeletelib.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x442172
push 0x10
push 0x476ab4
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_005
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.NTFSGetDeletedFiles
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xa8], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xa8], 0
jne 0x4421ba
push 0x10
push 0x476b88
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_006
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.NTFSGetDeletedFiles2
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xac], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xac], 0
jne 0x442202
push 0x10
push 0x476c60
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_007
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.NTFSFreeFilesChain
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xb4], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xb4], 0
jne 0x44224a
push 0x10
push 0x476d20
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_008
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.NTFSRecoverFiles
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xb0], 0
jne 0x442292
push 0x10
push 0x476df4
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_009
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.FATGetDeletedFiles
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xb8], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xb8], 0
jne 0x4422da
push 0x10
push 0x476ec8
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_010
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.FATGetDeletedFiles2
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xbc], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xbc], 0
jne 0x442322
push 0x10
push 0x476f9c
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_011
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.FATRecoverFiles
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xc0], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xc0], 0
jne 0x44236a
push 0x10
push 0x477080
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_012
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.FATFreeFilesChain
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xc4], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xc4], 0
jne 0x4423b2
push 0x10
push 0x477140
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_013
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.GetPartitionsInfo
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xc8], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xc8], 0
jne 0x4423fa
push 0x10
push 0x477214
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_014
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.FreePartitionsInfo
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xcc], eax
mov edx, dword [ebp - 0x160]
cmp dword [edx + 0xcc], 0
jne 0x442442
push 0x10
push 0x4772e8
push str.Not_all_components_are_found._Try_to_reinstall_to_fix_this_problem._Error_015
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x44277a
push str.GetLongPathNameW
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0xd0], eax
mov dword [0x4b2674], 0
push str.cAnCeL_eVeNt_gfsj
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4c37ac], eax
push str.pAuSe_eVeNt_gfsj
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4c37b0], eax
cmp dword [0x4c37ac], 0
je 0x4424ad
cmp dword [0x4c37b0], 0
jne 0x4424b4
xor eax, eax
jmp 0x44277a
mov dword [0x4c37b8], 1
mov dword [ebp - 0x150], 0
jmp 0x4424d9
mov edx, dword [ebp - 0x150]
add edx, 1
mov dword [ebp - 0x150], edx
cmp dword [ebp - 0x150], 0xd
jae 0x44254e
push 0x20
mov eax, dword [ebp - 0x150]
shl eax, 6
mov ecx, dword [ebp - 0x160]
lea edx, [ecx + eax + 0x32499]
push edx
mov eax, dword [ebp - 0x150]
add eax, 0x12d
push eax
mov ecx, dword [0x4923ac]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x80
mov edx, dword [ebp - 0x150]
shl edx, 8
mov eax, dword [ebp - 0x160]
lea ecx, [eax + edx + 0x327d9]
push ecx
mov edx, dword [ebp - 0x150]
add edx, 0x141
push edx
mov eax, dword [0x4923ac]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x4424ca
mov dword [ebp - 0x154], 0
jmp 0x442569
mov ecx, dword [ebp - 0x154]
add ecx, 1
mov dword [ebp - 0x154], ecx
cmp dword [ebp - 0x154], 8
jae 0x4425a9
push 0x200
mov edx, dword [ebp - 0x154]
shl edx, 0xa
mov eax, dword [ebp - 0x160]
lea ecx, [eax + edx + 0x3350d]
push ecx
mov edx, dword [ebp - 0x154]
add edx, 0xd2
push edx
mov eax, dword [0x4923ac]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x44255a
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0x32458], 1
mov edx, dword [ebp - 0x160]
mov dword [edx + 0x32468], 1
mov eax, dword [ebp - 0x160]
mov dword [eax + 0x3246c], 0
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0x35541], 0
mov edx, dword [ebp - 0x160]
mov dword [edx + 0x35545], 0
mov eax, dword [ebp - 0x160]
mov dword [eax + 0x32480], 0
mov dword [eax + 0x32484], 0
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0x32488], 0
mov dword [ecx + 0x3248c], 0
mov edx, dword [ebp - 0x160]
mov dword [edx + 0x35541], 0
mov eax, dword [ebp - 0x160]
mov dword [eax + 0x35545], 0
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0x32470], 1
mov edx, dword [ebp - 0x160]
mov dword [edx + 0x32474], 1
mov eax, dword [ebp - 0x160]
mov dword [eax + 0x32478], 0
mov ecx, dword [ebp - 0x160]
mov dword [ecx + 0x3247c], 0
mov edx, dword [ebp - 0x160]
mov dword [edx + 0x32490], 1
mov eax, dword [ebp - 0x160]
mov dword [eax + 0x32494], 1
mov ecx, dword [ebp - 0x160]
mov byte [ecx + 0x32498], 0
push 0x16744
call fcn.00401060
mov dword [ebp - 0x15c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x15c], 0
je 0x4426ef
push 0
mov ecx, dword [ebp - 0x15c]
call fcn.0043cac0
mov dword [ebp - 0x164], eax
jmp 0x4426f9
mov dword [ebp - 0x164], 0
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x158], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x158]
mov dword [eax + 0xa4], ecx
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax + 0xa4]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x160]
mov eax, dword [edx + 0xa4]
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx + 0xa4]
mov edx, dword [eax]
mov eax, dword [edx + 0x14c]
call eax
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x160]
mov edx, dword [ecx + 0x35511]
push edx
call sub.gdiplus.dll_GdiplusShutdown
mov ecx, dword [ebp - 0x160]
call fcn.0043e4b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00427b2d
mov esp, ebp
pop ebp