Function at 0x41ee88
Capabilities:
Check os version
Create process on windows
Enumerate gui resources
Enumerate processes
Get common file path

Disassembly:
mov eax, 0x4e4813
call fcn.004bb144
sub esp, 0x798
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
push 1
lea eax, [ebp + 8]
pop edi
push ecx
mov dword [ebp - 4], edi
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.004d813d
lea eax, [ebp - 0x14]
push eax
call fcn.00435014
add esp, 4
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
mov byte [ebp - 4], 2
call fcn.004d813d
lea eax, [ebp - 0x28]
push eax
call fcn.00435014
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 3
cmp eax, edi
mov dword [ebp - 0x38], ebx
je 0x41f091
cmp eax, 2
je 0x41f071
jle 0x41f03b
cmp eax, 4
jle 0x41f00f
cmp eax, 5
jne 0x41f03b
mov eax, dword [ebp - 0x14]
mov esi, 0x511188
mov eax, dword [eax - 8]
cmp eax, ebx
jle 0x41ef68
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004d86d1
push esi
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x18
push eax
call fcn.004d865d
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x19
call fcn.004d8501
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x18
call fcn.004d83c8
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.004d83c8
mov eax, dword [ebp + 0xc]
cmp dword [eax - 8], ebx
jle 0x41efb6
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x68]
push str.__ECPASA:
push eax
call fcn.004d86d1
push esi
push eax
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x1a
push eax
call fcn.004d865d
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1b
call fcn.004d87e0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1a
call fcn.004d83c8
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.004d83c8
lea eax, [ebp - 0x39c]
push 0x100
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x39c]
lea ecx, [ebp + 0x10]
push eax
call fcn.004d8436
mov byte [ebp - 4], 0x1c
call fcn.004131d8
cmp eax, ebx
jne 0x41efe9
xor eax, eax
jmp 0x41efec
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push 0x512d7c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x10]
jmp 0x41f89c
call fcn.004131d8
cmp eax, ebx
jne 0x41f01c
xor eax, eax
jmp 0x41f01f
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push 0x512d7c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
jmp 0x41f8a1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004d83c8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d83c8
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004d83c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004d83c8
xor eax, eax
jmp 0x41fb25
call fcn.004131d8
cmp eax, ebx
jne 0x41f07e
xor eax, eax
jmp 0x41f081
mov eax, dword [eax + 0x1c]
push 5
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push str.explore
jmp 0x41f02d
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x6a0]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
call fcn.004bdac9
push ebx
lea eax, [ebp - 0x6a0]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x7a4]
push eax
call fcn.004bdf1d
lea eax, [ebp - 0x49c]
push str..bat
push eax
call fcn.004bc790
add esp, 0x30
lea ecx, [ebp - 0x28]
neg eax
sbb al, al
or dword [ebp - 0x24], 0xffffffff
inc al
push 0x20
mov byte [ebp - 0x31], al
mov dword [ebp - 0x20], 5
mov byte [ebp + 0x13], bl
call fcn.004d88b6
mov esi, eax
cmp esi, 0xffffffff
jle 0x41f11a
lea eax, [esi + 1]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004d2303
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
jmp 0x41f135
push 0x531e00
lea ecx, [ebp - 0x60]
call fcn.004d8436
mov dword [ebp - 0x10], 2
mov dword [ebp - 4], 5
push eax
lea ecx, [ebp - 0x2c]
call fcn.004d813d
test byte [ebp - 0x10], 2
mov dword [ebp - 4], 8
je 0x41f157
and dword [ebp - 0x10], 0xfffffffd
lea ecx, [ebp - 0x60]
call fcn.004d83c8
test byte [ebp - 0x10], 1
mov dword [ebp - 4], 7
je 0x41f170
and dword [ebp - 0x10], 0xfffffffe
lea ecx, [ebp - 0x74]
call fcn.004d83c8
cmp esi, 0xffffffff
jle 0x41f18c
lea eax, [ebp - 0x70]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.004d2438
or dword [ebp - 0x10], 4
mov byte [ebp - 4], 9
jmp 0x41f18f
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004d813d
test byte [ebp - 0x10], 4
mov dword [ebp - 4], 0xb
je 0x41f1ad
lea ecx, [ebp - 0x70]
call fcn.004d83c8
mov eax, dword [0x52d2c4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xc
mov word [0x53a018], bx
mov dword [ebp - 0x10], ebx
mov esi, str.__Dde.E
push 0x2c
lea eax, [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x3c]
push eax
call fcn.004d9541
test eax, eax
je 0x41f32b
push str.TOPMOST
lea ecx, [ebp - 0x1c]
call fcn.004d24d2
test eax, eax
jne 0x41f251
push 0x28
lea ecx, [ebp - 0x1c]
mov word [0x53a018], 2
call fcn.004d88b6
cmp eax, ebx
jle 0x41f32b
inc eax
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004d2303
push esi
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.004d87f8
push eax
call fcn.004bda25
push eax
call fcn.004bd3db
add esp, 0xc
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x84]
call fcn.004d83c8
jmp 0x41f32b
push 0x513cd4
lea ecx, [ebp - 0x1c]
call fcn.004d24d2
test eax, eax
jne 0x41f2b1
push 0x28
lea ecx, [ebp - 0x1c]
mov word [0x53a018], di
call fcn.004d88b6
cmp eax, ebx
jle 0x41f32b
inc eax
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004d2303
push esi
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.004d87f8
push eax
call fcn.004bda25
push eax
call fcn.004bd3db
add esp, 0xc
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x7c]
jmp 0x41f247
push str.WAIT
push dword [ebp - 0x1c]
call fcn.004bc790
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f2ca
mov byte [ebp + 0x13], 1
jmp 0x41f32b
push str.HIDE
push dword [ebp - 0x1c]
call fcn.004bc790
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f2e2
mov dword [ebp - 0x20], ebx
jmp 0x41f32b
push str.MAXIMIZE
push dword [ebp - 0x1c]
call fcn.004bc790
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f2fe
mov dword [ebp - 0x20], 3
jmp 0x41f32b
push str.MINIMIZE
push dword [ebp - 0x1c]
call fcn.004bc790
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f31a
mov dword [ebp - 0x20], 7
jmp 0x41f32b
cmp dword [ebp - 0x10], ebx
jne 0x41f32b
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004d8501
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x41f1c8
cmp byte [ebp + 0x13], bl
je 0x41f34a
cmp dword [ebp - 0x20], 7
jne 0x41f34a
mov dword [ebp - 0x20], 2
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x29c], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push dword [ebp - 0x14]
lea eax, [ebp - 0x5a0]
push eax
call fcn.004bc9c0
cmp byte [ebp - 0x31], bl
pop ecx
pop ecx
je 0x41f497
mov eax, dword [0x52d2c4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x2c]
cmp dword [ebp - 0x28c], edi
mov byte [ebp - 4], 0xf
push dword [ebp - 0x14]
jne 0x41f3cd
lea eax, [ebp - 0x10]
push str._C___s___s
push eax
call fcn.004d2858
add esp, 0x10
lea eax, [ebp - 0x5a0]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x5a0]
push str.winoa386.mod
push eax
call fcn.004bc9d0
pop ecx
pop ecx
jmp 0x41f3de
lea eax, [ebp - 0x10]
push str._C____s___s_
push eax
call fcn.004d2858
add esp, 0x10
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004d8501
push str.COMSPEC
call fcn.004bde7f
cmp eax, ebx
pop ecx
je 0x41f40d
push eax
lea eax, [ebp - 0x14]
push 0x513140
push eax
call fcn.004d2858
add esp, 0xc
jmp 0x41f48b
cmp dword [ebp - 0x28c], edi
push ecx
mov ecx, esp
jne 0x41f450
mov dword [ebp - 0x30], esp
push str._Windows_
call fcn.004d8436
lea eax, [ebp - 0x6c]
push eax
call fcn.00435014
pop ecx
pop ecx
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x10
push str._scommand.com
push eax
call fcn.004d2858
add esp, 0xc
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6c]
jmp 0x41f486
mov dword [ebp - 0x30], esp
push str._System_
call fcn.004d8436
lea eax, [ebp - 0x78]
push eax
call fcn.00435014
pop ecx
pop ecx
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x11
push str._scmd.exe
push eax
call fcn.004d2858
add esp, 0xc
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x78]
call fcn.004d83c8
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.004d83c8
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.004bdac9
add esp, 0x14
cmp dword [ebp - 0x28c], edi
je 0x41f4d9
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
lea eax, [ebp - 0x5a0]
push ebx
push eax
call fcn.004bdf1d
add esp, 0x14
lea eax, [ebp - 0x39c]
push 0x513c40
push eax
call fcn.004bc790
pop ecx
test eax, eax
pop ecx
jne 0x41f507
lea eax, [ebp - 0x49c]
push str..exe
push eax
call fcn.004bc790
pop ecx
test eax, eax
pop ecx
je 0x41f535
lea eax, [ebp - 0x39c]
push str.command
push eax
call fcn.004bc790
pop ecx
test eax, eax
pop ecx
jne 0x41f542
lea eax, [ebp - 0x49c]
push str..com
push eax
call fcn.004bc790
pop ecx
test eax, eax
pop ecx
jne 0x41f542
cmp dword [ebp - 0x24], 0xffffffff
jne 0x41f542
mov dword [ebp - 0x24], 0xfa
push 0x3c
lea eax, [ebp - 0xc4]
pop esi
push esi
push ebx
push eax
call fcn.004bb170
add esp, 0xc
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x8040
call fcn.004131d8
cmp eax, ebx
jne 0x41f577
mov dword [ebp - 0xbc], ebx
jmp 0x41f580
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x14]
mov esi, 0x4ebe78
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0xb8], 0x512d7c
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0x11
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 8
push 0x49
xor eax, eax
pop ecx
lea edi, [ebp - 0x204]
mov dword [ebp - 0x208], ebx
push ebx
rep stosd dword es:[edi], eax
push 2
mov byte [ebp - 4], 0x12
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41f608
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x13
xor esi, esi
jmp 0x41f82e
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x128
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32First
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x41f6a9
push dword [ebp - 0x200]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x30], eax
je 0x41f696
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
lea eax, [ebp - 0x1e4]
push ebx
push eax
call fcn.004bdac9
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.004bc790
add esp, 0x1c
test eax, eax
jne 0x41f691
mov eax, dword [ebp - 0x200]
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0x20], eax
call fcn.00422a31
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x30]
call edi
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x41f62b
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x41f85a
cmp word [0x53a018], bx
jle 0x41f7b3
push dword [ebp - 0x24]
push dword [ebp - 0x8c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x41f6f3
push dword [ebp - 0x24]
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
push 2
mov dword [ebp - 0x24], ebx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41f712
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x14
jmp 0x41f601
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x128
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x41f79b
push dword [ebp - 0x200]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x41f77c
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.004bc790
pop ecx
test eax, eax
pop ecx
jne 0x41f777
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x200]
call fcn.004228b8
test eax, eax
je 0x41f78d
push dword [ebp - 0x20]
call edi
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_Process32Next
jmp 0x41f72b
mov eax, dword [ebp - 0x200]
push dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
call edi
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x24], ebx
jbe 0x41f7b3
push dword [ebp - 0x24]
push 0x41fb36
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x5c]
call fcn.004228fa
cmp byte [ebp + 0x13], bl
je 0x41f824
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0x64
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push 1
push ebx
push ebx
lea eax, [ebp - 0xe0]
push ebx
push eax
call edi
test eax, eax
je 0x41f81b
cmp dword [ebp - 0xdc], 0xf
jne 0x41f7e4
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41f7e4
cmp dword [ebp - 0x38], 0x103
je 0x41f7c6
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x5c]
call fcn.004228fa
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004d83c8
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004d83c8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
jmp 0x41fa51
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jne 0x41fa8c
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x17
call fcn.004228fa
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004d83c8
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004d83c8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004d83c8
mov esi, 0x531e00
lea ecx, [ebp - 0x18]
push esi
call fcn.004d8436
cmp edi, 0x1c
mov byte [ebp - 4], 0x1d
ja 0x41f9cd
je 0x41f9c6
cmp edi, 8
ja 0x41f977
je 0x41f96d
sub edi, ebx
je 0x41f963
dec edi
dec edi
je 0x41f93b
dec edi
je 0x41f913
dec edi
dec edi
jne 0x41fa2d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push str.The_operating_system_denied_access_to_the_specified_file._n
push eax
call fcn.004d86d1
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x20
call fcn.004d8501
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x30]
jmp 0x41f9b8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push str.The_specified_path_was_not_found._n
push eax
call fcn.004d86d1
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1f
call fcn.004d8501
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x24]
jmp 0x41f9b8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push str.The_specified_file_was_not_found._n
push eax
call fcn.004d86d1
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1e
call fcn.004d8501
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x20]
jmp 0x41f9b8
push str.The_operating_system_is_out_of_memory_or_resources.
jmp 0x41fa25
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x41fa25
sub edi, 0xb
je 0x41f9bf
sub edi, 0xf
je 0x41f992
dec edi
jne 0x41fa2d
push str.The_filename_association_is_incomplete_or_invalid.
jmp 0x41fa25
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push str.A_sharing_violation_occurred._n
push eax
call fcn.004d86d1
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x21
call fcn.004d8501
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x10]
call fcn.004d83c8
jmp 0x41fa2d
push str.The_.EXE_file_is_invalid__non_Win32_.EXE_or_error_in_.EXE_image_.
jmp 0x41fa25
push str.The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.
jmp 0x41fa25
mov eax, 0x483
cmp edi, eax
ja 0x41fa02
je 0x41f9fb
sub edi, 0x1d
je 0x41fa20
dec edi
je 0x41f9f4
dec edi
je 0x41f9ed
dec edi
jne 0x41fa2d
push str.The_specified_dynamic_link_library_was_not_found.
jmp 0x41fa25
push str.There_is_no_application_associated_with_the_given_filename_extension.
jmp 0x41fa25
push str.The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.
jmp 0x41fa25
push str.There_is_no_application_associated_with_the_given_file_name_extension.
jmp 0x41fa25
sub edi, 0x484
je 0x41fa20
dec edi
je 0x41fa19
sub edi, 0x42
jne 0x41fa2d
push str.The_function_prompted_the_user_for_additional_information__but_the_user_canceled_the_request.
jmp 0x41fa25
push str.One_of_the_library_files_necessary_to_run_the_application_cant_be_found.
jmp 0x41fa25
push str.The_DDE_transaction_failed.
lea ecx, [ebp - 0x18]
call fcn.004d8551
push esi
push dword [ebp - 0x18]
call fcn.004bb1d0
pop ecx
cmp eax, ebx
pop ecx
je 0x41fa47
push ebx
push 0x10
push dword [ebp - 0x18]
call fcn.004dd15b
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004d83c8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004d83c8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d83c8
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004d83c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004d83c8
mov eax, esi
jmp 0x41fb25
push ebx
lea ecx, [ebp + 0x10]
push ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
push 0x40
push str.Error
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x16
call fcn.004228fa
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004d83c8
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004d83c8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004d83c8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004d83c8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d83c8
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004d83c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004d83c8
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc