Function at 0x406ad0
Capabilities:
Get process heap flags
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x21a8
call fcn.0040b4b8
sub esp, eax
mov eax, dword [esp + eax]
mov dword [ebp - 0x217c], edx
mov dword [ebp - 0x2180], ecx
mov ebx, eax
lea ecx, [ebp - 0x2178]
mov eax, edx
mov dword [ebp - 0x2174], 0
lea edx, [ebp - 0x2170]
mov dword [ebp - 0x2170], 0xffffffff
mov dword [ebp - 0x216c], 0
call fcn.00402240
test eax, eax
je 0x406ee0
mov eax, dword [ebp - 0x2170]
movzx edx, byte [section..data]
cmp eax, 0x19
ja 0x406fd8
mov ecx, 0x2410800
bt ecx, eax
jae 0x406fd8
lea eax, [ebp - 0x818]
and edx, 8
mov dword [ebp - 0x218c], eax
jne 0x4077a0
xor eax, eax
lea edi, [ebp - 0x1818]
mov word [ebp - 0x1818], ax
mov eax, dword [ebx]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x20]
lea eax, [ebp - 0x1e30]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0x104
mov dword [esp], edi
mov dword [ebp - 0x2184], eax
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x407640
xor eax, eax
mov word [ebp - 0x1818], ax
mov eax, dword [ebx]
mov dword [esp + 8], 0x400
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x18]
lea eax, [ebp - 0x1018]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2184]
mov dword [esp + 8], 0x400
mov dword [esp], edi
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x4074e0
mov ecx, dword [ebp - 0x218c]
mov edx, edi
mov eax, ebx
call fcn.00403a70
lea eax, [ebp - 0x2038]
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2184]
mov dword [esp], edi
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x407280
mov eax, dword [ebx]
xor edx, edx
mov dword [esp + 4], edi
lea esi, [ebp - 0x1c28]
mov word [ebp - 0x1818], dx
lea edx, [ebp - 0x2174]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x104
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebp - 0x2184]
sub esp, 0x10
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], edi
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x407130
xor edx, edx
cmp word [ebp - 0x2038], 0
mov word [ebp - 0x1a20], dx
jne 0x406d08
mov eax, dword [ebx]
lea edx, [ebp - 0x2168]
mov dword [esp], ebx
mov dword [ebp - 0x2168], 0
mov dword [esp + 4], edx
call dword [eax + 0x10]
mov eax, dword [ebp - 0x2168]
sub esp, 8
test eax, eax
je 0x406d08
lea edi, [ebp - 0x2038]
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.shell32.dll_SHGetPathFromIDListW]
sub esp, 8
test eax, eax
je 0x406d08
test byte [section..data], 8
jne 0x407ac8
lea esi, [esi]
cmp word [ebp - 0x1c28], 0
mov edx, dword [ebp - 0x2174]
mov ecx, dword [ebp - 0x2180]
je 0x407010
mov eax, esi
call fcn.00405f20
mov ebx, eax
test ebx, ebx
je 0x407025
cmp word [ebp - 0x2038], 0
jne 0x407990
mov dword [esp + 0xc], str.winemenubuilder_semaphore
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
sub esp, 0x10
mov dword [ebp - 0x216c], eax
lea eax, [ebp - 0x216c]
mov dword [esp + 0x10], 0x1cff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [sym.imp.user32.dll_MsgWaitForMultipleObjects]
sub esp, 0x14
test eax, eax
jne 0x407950
mov eax, dword [ebp - 0x2170]
mov edx, dword [ebp - 0x2178]
cmp eax, 0x10
je 0x4079e0
cmp eax, 0x19
je 0x4079ef
lea eax, [ebp - 0x1a20]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e30]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x217c]
mov dword [esp], 0
mov ecx, eax
call fcn.00403450
test eax, eax
mov dword [esp + 8], 0
sete al
sete byte [ebp - 0x217c]
movzx eax, al
mov dword [esp + 4], 1
mov esi, eax
mov eax, dword [ebp - 0x216c]
xor esi, 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseSemaphore]
sub esp, 0xc
mov eax, dword [ebp - 0x216c]
test eax, eax
je 0x406e49
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x2178]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 0x2180]
sub esp, 0xc
test ebx, ebx
jne 0x406ed0
cmp byte [ebp - 0x217c], 0
je 0x406ed0
test byte [section..data], 2
je 0x406ed0
mov dword [esp + 0xc], str.failed_to_build_the_menu_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.004014e0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 1
test byte [section..data], 4
je 0x406ed0
mov eax, dword [ebp - 0x217c]
shr eax, 0x10
je 0x407a78
mov edi, dword [ebp - 0x217c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x407a91
cmp word [edi], 0
je 0x4084e1
mov ecx, edi
mov edx, eax
lea eax, [eax + 1]
cmp word [ecx + edx*2 + 2], 0
jne 0x406f30
mov ecx, 0x224c
lea ebx, [ebp - 0x816]
lea esi, [ebp - 0x6f6]
mov word [ebp - 0x818], cx
jmp 0x406f95
cmp ax, 9
je 0x4081e8
cmp ax, 0xa
jne 0x408176
mov eax, 0x6e5c
add ebx, 2
mov word [ebx - 2], ax
lea eax, [edx - 1]
test edx, edx
jle 0x4082e8
cmp ebx, esi
ja 0x4082e8
mov edx, eax
add dword [ebp - 0x217c], 2
mov eax, dword [ebp - 0x217c]
movzx eax, word [eax - 2]
cmp ax, 0xd
je 0x408158
jbe 0x406f60
cmp ax, 0x22
je 0x4081d0
cmp ax, 0x5c
jne 0x408169
mov ecx, 0x5c5c
add ebx, 2
mov word [ebx - 2], cx
jmp 0x406f80
and edx, 4
mov esi, 1
je 0x406ed0
mov dword [esp + 0xc], str.Not_under_desktop_or_start_menu._Ignoring._n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 2
call fcn.004014e0
jmp 0x406ed0
lea eax, [ebp - 0x2038]
call fcn.00405f20
mov ebx, eax
test ebx, ebx
jne 0x406d33
mov edx, dword [ebp - 0x2180]
movzx eax, byte [section..data]
test edx, edx
jne 0x408130
test al, 2
je 0x406d33
cmp word [ebp - 0x1c28], 0
lea eax, [ebp - 0x2038]
cmove esi, eax
mov eax, esi
shr eax, 0x10
je 0x408508
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x408284
cmp word [esi], 0
je 0x4085f7
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x407090
mov eax, 0x224c
mov dword [ebp - 0x2184], ebx
lea ecx, [ebp - 0x2162]
mov word [ebp - 0x2164], ax
jmp 0x4070fb
cmp ax, 9
je 0x4083d0
cmp ax, 0xa
jne 0x408347
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea eax, [edx - 1]
test edx, edx
jle 0x408250
lea edi, [ebp - 0x2042]
cmp ecx, edi
ja 0x408250
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x4083b8
jbe 0x4070c0
cmp ax, 0x22
je 0x4083a0
cmp ax, 0x5c
jne 0x40833a
mov edi, 0x5c5c
add ecx, 2
mov word [ecx - 2], di
jmp 0x4070e0
mov eax, esi
shr eax, 0x10
je 0x4080e0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x40724c
cmp word [ebp - 0x1c28], 0
je 0x40721d
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x407170
mov eax, 0x224c
mov dword [ebp - 0x2184], ebx
lea ecx, [ebp - 0x1a1e]
mov edi, esi
mov word [ebp - 0x1a20], ax
lea eax, [ebp - 0x18fe]
mov dword [ebp - 0x2188], eax
jmp 0x4071e9
cmp ax, 9
je 0x407e88
cmp ax, 0xa
jne 0x407c6e
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
nop
lea eax, [edx - 1]
cmp ecx, dword [ebp - 0x2188]
ja 0x407fd0
test edx, edx
jle 0x407fd0
mov edx, eax
movzx eax, word [edi]
add edi, 2
cmp ax, 0xd
je 0x407eb8
jbe 0x4071a8
cmp ax, 0x22
je 0x407cc0
cmp ax, 0x5c
jne 0x407c61
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4071d0
mov edi, 0x224c
mov byte [ebp - 0x1a1e], 0x22
lea ecx, [ebp - 0x1a1e]
mov word [ebp - 0x1a20], di
lea eax, [ecx + 1]
lea ecx, [ebp - 0x1a20]
mov byte [eax], 0
mov dword [esp], ecx
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.icon_file__:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.004014e0
jmp 0x406c9e
lea eax, [ebp - 0x2038]
shr eax, 0x10
je 0x408100
lea eax, [ebp - 0x2038]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x4073ac
cmp word [ebp - 0x2038], 0
je 0x40737d
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [ebp + edx*2 - 0x2036], 0
jne 0x4072c8
mov eax, 0x224c
mov dword [ebp - 0x2190], ebx
lea ecx, [ebp - 0x1a1e]
lea esi, [ebp - 0x2038]
mov word [ebp - 0x1a20], ax
lea eax, [ebp - 0x18fe]
mov dword [ebp - 0x2188], eax
jmp 0x407349
cmp ax, 9
je 0x407be0
cmp ax, 0xa
jne 0x407cde
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
nop
lea eax, [edx - 1]
cmp ecx, dword [ebp - 0x2188]
ja 0x407fa0
test edx, edx
jle 0x407fa0
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x407bc8
jbe 0x407308
cmp ax, 0x22
je 0x407d30
cmp ax, 0x5c
jne 0x407cd1
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x407330
mov eax, 0x224c
mov byte [ebp - 0x1a1e], 0x22
lea ecx, [ebp - 0x1a1e]
mov word [ebp - 0x1a20], ax
lea eax, [ecx + 1]
lea ecx, [ebp - 0x1a20]
mov byte [eax], 0
mov dword [esp], ecx
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.path_______:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.004014e0
test byte [section..data], 8
je 0x406c47
mov eax, dword [ebp - 0x218c]
shr eax, 0x10
je 0x408090
mov esi, dword [ebp - 0x218c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x40791e
cmp word [ebp - 0x818], 0
je 0x4078ef
mov ecx, esi
lea esi, [esi]
nop
mov edx, eax
lea eax, [eax + 1]
cmp word [ecx + edx*2 + 2], 0
jne 0x407430
mov ecx, 0x224c
lea eax, [ebp - 0x18fe]
mov dword [ebp - 0x2190], ebx
mov esi, dword [ebp - 0x218c]
mov word [ebp - 0x1a20], cx
lea ecx, [ebp - 0x1a1e]
mov dword [ebp - 0x2188], eax
jmp 0x4074a9
cmp ax, 9
je 0x407bb0
cmp ax, 0xa
jne 0x407dae
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea eax, [edx - 1]
cmp ecx, dword [ebp - 0x2188]
ja 0x408030
test edx, edx
jle 0x408030
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x407d90
jbe 0x407470
cmp ax, 0x22
je 0x407e00
cmp ax, 0x5c
jne 0x407da1
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407490
lea eax, [ebp - 0x1018]
shr eax, 0x10
je 0x408060
lea eax, [ebp - 0x1018]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x40760c
cmp word [ebp - 0x1018], 0
je 0x4075dd
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [ebp + edx*2 - 0x1016], 0
jne 0x407528
mov eax, 0x224c
mov dword [ebp - 0x2190], ebx
lea ecx, [ebp - 0x816]
lea esi, [ebp - 0x1018]
mov word [ebp - 0x818], ax
lea eax, [ebp - 0x6f6]
mov dword [ebp - 0x2188], eax
jmp 0x4075a9
cmp ax, 9
je 0x407d78
cmp ax, 0xa
jne 0x407e1e
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
nop
lea eax, [edx - 1]
cmp ecx, dword [ebp - 0x2188]
ja 0x408000
test edx, edx
jle 0x408000
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x407ea0
jbe 0x407568
cmp ax, 0x22
je 0x407e70
cmp ax, 0x5c
jne 0x407e11
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x407590
mov eax, 0x224c
mov byte [ebp - 0x816], 0x22
lea ecx, [ebp - 0x816]
mov word [ebp - 0x818], ax
lea eax, [ecx + 1]
mov byte [eax], 0
mov eax, dword [ebp - 0x218c]
mov dword [esp], eax
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.description:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.004014e0
jmp 0x406c0b
lea eax, [ebp - 0x1e30]
shr eax, 0x10
je 0x4080b0
lea eax, [ebp - 0x1e30]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x40776c
cmp word [ebp - 0x1e30], 0
je 0x40773d
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [ebp + edx*2 - 0x1e2e], 0
jne 0x407688
mov eax, 0x224c
mov dword [ebp - 0x2190], ebx
lea ecx, [ebp - 0x816]
lea esi, [ebp - 0x1e30]
mov word [ebp - 0x818], ax
lea eax, [ebp - 0x6f6]
mov dword [ebp - 0x2188], eax
jmp 0x407709
cmp ax, 9
je 0x407d60
cmp ax, 0xa
jne 0x407bfe
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
nop
lea eax, [edx - 1]
cmp ecx, dword [ebp - 0x2188]
ja 0x407f70
test edx, edx
jle 0x407f70
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x407d48
jbe 0x4076c8
cmp ax, 0x22
je 0x407c50
cmp ax, 0x5c
jne 0x407bf1
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x4076f0
mov esi, 0x224c
mov byte [ebp - 0x816], 0x22
lea ecx, [ebp - 0x816]
mov word [ebp - 0x818], si
lea eax, [ecx + 1]
mov byte [eax], 0
mov eax, dword [ebp - 0x218c]
mov dword [esp], eax
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.workdir____:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.004014e0
jmp 0x406bbe
mov esi, dword [ebp - 0x2178]
test esi, esi
je 0x408320
mov eax, esi
shr eax, 0x10
je 0x4082b8
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x4078c2
cmp word [esi], 0
je 0x4083e1
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x4077e8
mov ecx, 0x224c
lea eax, [ebp - 0x6f6]
mov dword [ebp - 0x2188], ebx
mov word [ebp - 0x818], cx
lea ecx, [ebp - 0x816]
mov dword [ebp - 0x2184], eax
jmp 0x407851
cmp ax, 9
je 0x407f58
cmp ax, 0xa
jne 0x407eee
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea eax, [edx - 1]
cmp ecx, dword [ebp - 0x2184]
ja 0x407888
test edx, edx
jle 0x407888
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x407ed0
jbe 0x407820
cmp ax, 0x22
je 0x407f40
cmp ax, 0x5c
jne 0x407ee1
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x407840
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2188]
test eax, eax
jle 0x4083fa
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
mov byte [eax], 0
lea eax, [ebp - 0x818]
mov dword [esp], eax
mov dword [ebp - 0x218c], eax
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Link_______:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.004014e0
jmp 0x406b66
mov edx, 0x224c
mov byte [ebp - 0x1a1e], 0x22
lea ecx, [ebp - 0x1a1e]
mov word [ebp - 0x1a20], dx
lea eax, [ecx + 1]
lea ecx, [ebp - 0x1a20]
mov byte [eax], 0
mov dword [esp], ecx
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.args_______:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.004014e0
jmp 0x406c47
mov byte [ebp - 0x217c], 1
xor esi, esi
test byte [section..data], 2
je 0x406e33
mov dword [esp + 0xc], str.failed_wait_for_semaphore_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.004014e0
jmp 0x406e33
lea eax, [ebp - 0x2038]
mov dword [esp], eax
call dword [sym.imp.shlwapi.dll_PathFindFileNameW]
sub esp, 4
mov esi, eax
test eax, eax
je 0x406d41
xor eax, eax
lea ecx, [ebp - 0x1a20]
lea esi, [esi]
movzx edx, word [esi + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x4079b8
mov dword [esp], ecx
call dword [sym.imp.user32.dll_CharLowerW]
sub esp, 4
jmp 0x406d41
cmp eax, 0x19
je 0x4079ef
cmp word [ebp - 0x2038], 0
jne 0x407a30
lea eax, [ebp - 0x1a20]
mov dword [esp + 0x10], ebx
mov ecx, edx
xor edx, edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1e30]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x217c]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00402b20
jmp 0x406dfd
lea eax, [ebp - 0x1a20]
mov dword [esp + 0x10], ebx
mov ecx, edx
xor edx, edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1e30]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x218c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2038]
mov dword [esp], eax
xor eax, eax
call fcn.00402b20
jmp 0x406dfd
movzx edx, word [ebp - 0x217c]
mov dword [esp], str._04x
mov dword [esp + 4], edx
call fcn.00401420
mov edx, eax
mov dword [esp + 0x10], edx
mov esi, 1
mov dword [esp + 0xc], str.Unknown_link_location__s._Ignoring._n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 2
call fcn.004014e0
jmp 0x406ed0
mov eax, edi
shr eax, 0x10
je 0x4085d3
lea eax, [ebp - 0x2038]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x408488
cmp word [ebp - 0x2038], 0
je 0x408622
lea esi, [esi]
nop
mov edx, eax
lea eax, [eax + 1]
cmp word [ebp + edx*2 - 0x2036], 0
jne 0x407b10
mov eax, 0x224c
lea ecx, [ebp - 0x2162]
lea edi, [ebp - 0x2038]
mov word [ebp - 0x2164], ax
jmp 0x407b7b
cmp ax, 9
je 0x4085b8
cmp ax, 0xa
jne 0x408546
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea ebx, [ebp - 0x2042]
lea eax, [edx - 1]
cmp ecx, ebx
ja 0x40845a
test edx, edx
jle 0x40845a
mov edx, eax
movzx eax, word [edi]
add edi, 2
cmp ax, 0xd
je 0x408528
jbe 0x407b40
cmp ax, 0x22
je 0x4085a0
cmp ax, 0x5c
jne 0x408539
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407b60
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407490
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407330
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407330
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x408230
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x4076f0
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4076f0
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x408210
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x4071d0
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4071d0
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x408200
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407330
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407330
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4076f0
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4076f0
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407590
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407490
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x408240
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407490
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407490
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x408220
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407590
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407590
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4071d0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407590
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4071d0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407840
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x4082d8
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdefxmalloc]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefxmalloc]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407840
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x407840
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407840
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2190]
test eax, eax
jle 0x407756
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
jmp 0x407759
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2190]
test eax, eax
jle 0x407396
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
jmp 0x407399
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2184]
test eax, eax
jle 0x407236
mov edi, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], di
jmp 0x407239
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2190]
test eax, eax
jle 0x4075f6
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
jmp 0x4075f9
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2190]
test eax, eax
jle 0x407908
mov esi, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], si
jmp 0x40790b
lea eax, [ebp - 0x1018]
mov dword [esp], str._04x
mov dword [ebp - 0x2188], eax
movzx eax, word [ebp - 0x2188]
mov dword [esp + 4], eax
call fcn.00401420
mov edx, eax
jmp 0x40760c
movzx eax, word [ebp - 0x218c]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401420
mov edx, eax
jmp 0x40791e
lea eax, [ebp - 0x1e30]
mov dword [esp], str._04x
mov dword [ebp - 0x2188], eax
movzx eax, word [ebp - 0x2188]
mov dword [esp + 4], eax
call fcn.00401420
mov edx, eax
jmp 0x40776c
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401420
mov edx, eax
jmp 0x40724c
lea eax, [ebp - 0x2038]
mov dword [esp], str._04x
mov dword [ebp - 0x2188], eax
movzx eax, word [ebp - 0x2188]
mov dword [esp + 4], eax
call fcn.00401420
mov edx, eax
jmp 0x4073ac
test al, 4
jne 0x4084b8
mov eax, dword [ebp - 0x216c]
test eax, eax
je 0x408408
mov byte [ebp - 0x217c], 1
xor esi, esi
jmp 0x406e3d
mov eax, 0x725c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x406f80
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408330
mov edi, eax
mov byte [ebx], 0x5c
add ebx, 5
shr di, 0xc
movzx edi, di
movzx ecx, byte [edi + str.0123456789abcdefxmalloc]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ebx - 4], cl
movzx ecx, byte [edi + str.0123456789abcdefxmalloc]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and edi, 0xf
mov byte [ebx - 3], cl
movzx ecx, byte [edi + str.0123456789abcdefxmalloc]
mov byte [ebx - 1], al
mov byte [ebx - 2], cl
jmp 0x406f80
mov edi, 0x225c
add ebx, 2
mov word [ebx - 2], di
jmp 0x406f80
mov eax, 0x745c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x406f80
mov byte [ecx], al
add ecx, 1
jmp 0x407330
mov byte [ecx], al
add ecx, 1
jmp 0x4071d0
mov byte [ecx], al
add ecx, 1
jmp 0x407590
mov byte [ecx], al
add ecx, 1
jmp 0x4076f0
mov byte [ecx], al
add ecx, 1
jmp 0x407490
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2184]
test eax, eax
jle 0x408610
mov esi, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], si
mov byte [eax], 0
lea eax, [ebp - 0x2164]
mov dword [esp], eax
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.failed_to_extract_icon_from__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.004014e0
jmp 0x406d33
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.00401420
mov edx, eax
jmp 0x4078c2
mov byte [ecx], al
add ecx, 1
jmp 0x407840
mov byte [ebx], 0x22
test eax, eax
jle 0x4084fa
mov edx, 0x2e2e
mov byte [ebx + 3], 0x2e
lea eax, [ebx + 4]
mov word [ebx + 1], dx
mov byte [eax], 0
lea eax, [ebp - 0x818]
mov dword [esp], eax
call fcn.0040b160
mov edx, eax
jmp 0x407a91
mov edx, str._null_
jmp 0x4078c2
mov byte [ebx], al
add ebx, 1
jmp 0x406f80
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x4085c9
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdefxmalloc]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefxmalloc]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x4070e0
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4070e0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4070e0
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4070e0
mov eax, 0x224c
mov byte [ebp - 0x816], 0x22
lea ecx, [ebp - 0x816]
mov word [ebp - 0x818], ax
lea eax, [ecx + 1]
jmp 0x4078a9
mov dword [esp + 8], 0
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x2178]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
xor esi, esi
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
jmp 0x406ed0
mov byte [ecx], 0x22
test eax, eax
jle 0x408638
mov ebx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], bx
mov byte [eax], 0
lea eax, [ebp - 0x2164]
mov dword [esp], eax
call fcn.0040b160
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.pidl_path__:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.004014e0
jmp 0x406d08
mov dword [esp + 0xc], str.Unable_to_extract_icon__deferring._n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40c000
mov dword [esp], 2
call fcn.004014e0
jmp 0x408138
mov eax, 0x224c
mov byte [ebp - 0x816], 0x22
lea ebx, [ebp - 0x816]
mov word [ebp - 0x818], ax
lea eax, [ebx + 1]
jmp 0x408303
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.00401420
mov edx, eax
jmp 0x408284
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407b60
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x408618
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefxmalloc]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefxmalloc]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407b60
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407b60
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407b60
mov byte [ecx], al
add ecx, 1
jmp 0x4070e0
mov dword [ebp - 0x2184], edi
movzx eax, word [ebp - 0x2184]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401420
mov edx, eax
jmp 0x408488
mov eax, 0x224c
mov byte [ebp - 0x2162], 0x22
lea ecx, [ebp - 0x2162]
mov word [ebp - 0x2164], ax
lea eax, [ecx + 1]
jmp 0x408271
mov byte [ecx], al
add ecx, 1
jmp 0x407b60
mov word [ebp - 0x2164], 0x224c
lea ecx, [ebp - 0x2162]
mov byte [ebp - 0x2162], 0x22
lea eax, [ecx + 1]
jmp 0x408475