Function at 0x401d30
Capabilities:
Get common file path
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x2b8
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov ebx, dword [ecx + 8]
mov edi, dword [ecx + 0x10]
mov dword [ebp - 0x278], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x270], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x274], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x26c], eax
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x401d89
xor edx, edx
call section..text
test eax, eax
jne 0x402030
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x218]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x27c], 0
sub esp, 0x10
test byte [0x40d004], 8
jne 0x4024a0
mov ecx, dword [section..bss]
test ecx, ecx
je 0x401ec8
mov dword [esp], esi
call fcn.004062f0
mov dword [esp], 0x40f140
mov dword [esp + 4], eax
mov esi, eax
call fcn.004011d0
mov edx, dword [ebp - 0x278]
mov eax, 0x40f0ee
test edx, edx
mov edx, 0x40f0f2
cmovne edx, eax
mov eax, str.IsMenu
call fcn.00401220
mov eax, str.Root
mov edx, ebx
call fcn.00401220
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x401e2f
mov edx, eax
mov eax, str.Path
call fcn.00401220
test edi, edi
je 0x401e3f
mov edx, edi
mov eax, str.Args
call fcn.00401220
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x401e55
mov edx, eax
mov eax, str.Icon
call fcn.00401220
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x401e6b
mov edx, eax
mov eax, str.Description
call fcn.00401220
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x401e81
mov edx, eax
mov eax, str.Arch
call fcn.00401220
mov dword [esp], 0x40f172
xor ebx, ebx
call fcn.004011d0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov edx, str.wineshelllink
mov eax, str.__utf8
mov dword [ebp - 0x260], str.__root
movd xmm0, edx
movd xmm1, eax
punpckldq xmm0, xmm1
movq qword [ebp - 0x268], xmm0
mov dword [esp], ebx
mov ebx, 9
call fcn.004062f0
mov dword [ebp - 0x258], str.__link
mov dword [ebp - 0x25c], eax
mov dword [esp], esi
call fcn.004062f0
mov dword [ebp - 0x250], str.__path
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call fcn.004062f0
mov edx, str.__desktop
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x278]
test eax, eax
mov eax, str.__menu
cmovne eax, edx
mov dword [ebp - 0x248], eax
test edi, edi
je 0x401f62
cmp word [edi], 0
jne 0x4022f0
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x401f8c
mov dword [ebp + ebx*4 - 0x268], str.__icon
lea esi, [ebx + 1]
add ebx, 2
mov dword [esp], eax
call fcn.004062f0
mov dword [ebp + esi*4 - 0x268], eax
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x401fa0
cmp word [eax], 0
jne 0x402320
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x401fb4
cmp word [eax], 0
jne 0x402358
lea eax, [ebp - 0x268]
mov dword [ebp + ebx*4 - 0x268], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.ntdll.dll___wine_unix_spawnvp]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x401eb3
test byte [0x40d004], 2
je 0x401eb3
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x268]
mov dword [esp + 0xc], str._s_returned__d_n
mov dword [esp + 8], str.cx_wineshelllink
mov dword [esp + 4], 0x40d004
mov dword [esp + 0x10], eax
mov dword [esp], 1
call fcn.00401600
jmp 0x401eb3
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x218]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathW]
sub esp, 0x10
test byte [0x40d004], 8
je 0x4024ff
mov eax, str.x86_64
shr eax, 0x10
test eax, eax
je 0x402380
mov dword [esp + 4], 0xffffffff
mov dword [esp], str.x86_64
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x402480
mov eax, str.x86_64
call fcn.00401380
mov dword [ebp - 0x27c], str.x86_64
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x4024d0
shr eax, 0x10
test eax, eax
je 0x402458
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x290], 0x40f022
sub esp, 8
test eax, eax
jne 0x4020ff
mov eax, dword [ebp - 0x26c]
call fcn.00401380
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x4024c0
shr eax, 0x10
test eax, eax
je 0x402430
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x274]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x28c], 0x40f022
sub esp, 8
test eax, eax
jne 0x402151
mov eax, dword [ebp - 0x274]
call fcn.00401380
mov dword [ebp - 0x28c], eax
test edi, edi
je 0x4024f0
mov eax, edi
shr eax, 0x10
test eax, eax
je 0x402410
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x288], 0x40f022
sub esp, 8
test eax, eax
jne 0x402195
mov eax, edi
call fcn.00401380
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x4024e0
shr eax, 0x10
test eax, eax
je 0x4023e8
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x284], 0x40f022
sub esp, 8
test eax, eax
jne 0x4021e7
mov eax, dword [ebp - 0x270]
call fcn.00401380
mov dword [ebp - 0x284], eax
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x4023b0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x280], 0x40f022
sub esp, 8
test eax, eax
jne 0x402223
mov eax, ebx
call fcn.00401380
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x278]
mov edx, str.menu
test eax, eax
mov eax, str.desktop
cmove eax, edx
mov dword [ebp - 0x294], eax
test esi, esi
je 0x4024b0
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x4023d0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40f022
test edx, edx
jne 0x402279
mov eax, esi
call fcn.00401380
mov edx, dword [ebp - 0x298]
mov dword [esp + 0x2c], edx
mov edx, dword [ebp - 0x290]
mov dword [esp + 0x28], edx
mov edx, dword [ebp - 0x28c]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x288]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x284]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x280]
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x294]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.link_s__s:__s_path_s_args_s_icon_s_desc_s_arch_s_n
mov dword [esp + 8], 0x40f2b4
mov dword [esp + 0x14], edx
mov dword [esp + 4], 0x40d004
mov dword [esp], 3
call fcn.00401600
jmp 0x401dc6
mov dword [ebp - 0x244], str.__args
mov ebx, 0xb
mov dword [esp], edi
call fcn.004062f0
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x274]
test eax, eax
jne 0x401f6c
jmp 0x401f8c
mov dword [ebp + ebx*4 - 0x268], str.__descr
lea esi, [ebx + 1]
add ebx, 2
mov dword [esp], eax
call fcn.004062f0
mov dword [ebp + esi*4 - 0x268], eax
mov eax, dword [ebp - 0x27c]
test eax, eax
jne 0x401faa
jmp 0x401fb4
mov dword [ebp + ebx*4 - 0x268], str.__arch
lea esi, [ebx + 1]
add ebx, 2
mov dword [esp], eax
call fcn.004062f0
mov dword [ebp + esi*4 - 0x268], eax
jmp 0x401fb4
mov dword [esp + 4], str.x86_64
mov dword [esp], 0x40f015
call fcn.00401540
mov dword [ebp - 0x27c], str.x86_64
mov dword [ebp - 0x298], eax
jmp 0x4020ad
mov dword [esp + 4], ebx
mov dword [esp], 0x40f015
call fcn.00401540
mov dword [ebp - 0x280], eax
jmp 0x402223
mov dword [esp + 4], esi
mov dword [esp], 0x40f015
call fcn.00401540
jmp 0x402279
mov eax, dword [ebp - 0x270]
mov dword [esp], 0x40f015
mov dword [esp + 4], eax
call fcn.00401540
mov dword [ebp - 0x284], eax
jmp 0x4021e7
mov dword [esp + 4], edi
mov dword [esp], 0x40f015
call fcn.00401540
mov dword [ebp - 0x288], eax
jmp 0x402195
mov eax, dword [ebp - 0x274]
mov dword [esp], 0x40f015
mov dword [esp + 4], eax
call fcn.00401540
mov dword [ebp - 0x28c], eax
jmp 0x402151
mov eax, dword [ebp - 0x26c]
mov dword [esp], 0x40f015
mov dword [esp + 4], eax
call fcn.00401540
mov dword [ebp - 0x290], eax
jmp 0x4020ff
mov dword [ebp - 0x27c], str.x86_64
mov dword [ebp - 0x298], 0x40f022
jmp 0x4020ad
mov dword [ebp - 0x298], 0x40f01b
jmp 0x4020ad
mov eax, 0x40f01b
jmp 0x402279
mov dword [ebp - 0x28c], 0x40f01b
jmp 0x402151
mov dword [ebp - 0x290], 0x40f01b
jmp 0x4020ff
mov dword [ebp - 0x284], 0x40f01b
jmp 0x4021e7
mov dword [ebp - 0x288], 0x40f01b
jmp 0x402195
mov dword [ebp - 0x27c], str.x86_64
jmp 0x401dc6