Function at 0x405ee0
Capabilities:
Check if process is running under wine
Contain obfuscated stackstrings
Create process on windows
Create thread
Get number of processors
Get process heap flags
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x64c
mov edi, dword [ebp + 8]
movzx esi, word [edi]
mov dword [ebp - 0x5d4], edi
test si, si
je 0x4079bf
mov word [ebp - 0x5cc], si
mov eax, esi
mov edx, edi
jmp 0x405f19
test ax, ax
je 0x4067e1
cmp ax, 0x20
mov esi, edx
sete bl
cmp ax, 9
movzx eax, word [edx + 2]
sete cl
add edx, 2
or bl, cl
je 0x405f10
mov dword [ebp - 0x5d4], edx
mov edx, dword [ebp - 0x5d4]
mov word [esi], 0
test ax, ax
jne 0x405f60
jmp 0x406fba
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
je 0x406fba
cmp ax, 0x20
je 0x405f50
cmp ax, 9
je 0x405f50
mov dword [ebp - 0x5d4], edx
movzx esi, word [edi]
cmp si, 0x3d
je 0x405f81
cmp si, 0x2c
jne 0x405f94
movzx eax, word [edi + 2]
test ax, ax
je 0x405f94
cmp ax, 0x2c
jne 0x4076d2
mov dword [ebp - 0x48c], 0x208
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetThreadDesktop]
sub esp, 4
test eax, eax
je 0x405feb
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], 0x412160
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetUserObjectInformationW]
sub esp, 0x14
test eax, eax
jne 0x407220
lea eax, [ebp - 0x360]
mov dword [esp + 4], str.SoftwareWineExplorer
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [ebp - 0x5cc], eax
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
test eax, eax
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x5dc], eax
jne 0x406073
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x360]
mov dword [esp + 0x10], 0x412160
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Desktop
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x360]
je 0x40704c
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x5b8]
mov dword [ebp - 0x5d8], eax
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_UuidCreate]
test byte [0x4120c4], 8
mov dword [ebp - 0x5e0], 0
push eax
jne 0x406fc2
mov dword [ebp - 0x5fc], 0
mov eax, dword [sym.imp.ucrtbase.dll_wcschr]
mov dword [ebp - 0x5d0], eax
mov ecx, dword [ebp - 0x5cc]
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + str.mac_x11]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x4060c0
lea eax, [ebp - 0x5bc]
mov dword [esp + 4], str.SoftwareWineDrivers
mov dword [ebp - 0x5e4], eax
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
test eax, eax
je 0x407799
mov esi, dword [ebp - 0x5cc]
jmp 0x406134
mov dword [esp + 8], eax
lea eax, [ebp - 0x568]
mov dword [esp + 4], str.Unknown_error___lu_.
mov dword [esp], eax
call sym._sprintf.constprop.0
test ebx, ebx
je 0x4061e3
mov esi, ebx
mov dword [esp + 4], 0x2c
mov eax, dword [ebp - 0x5d0]
xor ebx, ebx
mov dword [esp], esi
call eax
test eax, eax
je 0x406155
xor edx, edx
lea ebx, [eax + 2]
mov word [eax], dx
mov dword [esp + 4], str.null
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x40684e
lea eax, [ebp - 0x5a8]
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.wine_s.drv
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x5a8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
jne 0x4068cf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
cmp eax, 0x7e
je 0x406758
cmp eax, 0x45a
jne 0x406110
lea eax, [ebp - 0x568]
mov esi, str.Make_sure_that_your_X_server_is_running_and_that__DISPLAY_is_set_correctly.
mov ecx, 0x13
mov edi, eax
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
jne 0x406132
mov dword [ebp - 0x5e8], 0
xor esi, esi
test byte [0x4120c4], 8
jne 0x406886
movzx eax, byte [ebp - 0x5a9]
mov edi, dword [ebp - 0x5dc]
mov dword [esp + 8], str.SystemCurrentControlSetControlVideo_08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x0000
mov dword [esp + 4], 0x86
mov dword [esp + 0x34], eax
movzx eax, byte [ebp - 0x5aa]
mov dword [esp], edi
mov dword [esp + 0x30], eax
movzx eax, byte [ebp - 0x5ab]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebp - 0x5ac]
mov dword [esp + 0x28], eax
movzx eax, byte [ebp - 0x5ad]
mov dword [esp + 0x24], eax
movzx eax, byte [ebp - 0x5ae]
mov dword [esp + 0x20], eax
movzx eax, byte [ebp - 0x5af]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebp - 0x5b0]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x5b2]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x5b4]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x5b8]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x5e4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
jne 0x406360
cmp dword [ebp - 0x5e8], 0
mov ebx, dword [ebp - 0x5bc]
jne 0x4062fb
test esi, esi
je 0x407167
cmp word [ebp - 0x5a8], 0
lea eax, [ebp - 0x5a8]
je 0x406319
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x406310
lea edi, [ebp - 0x5a8]
mov dword [esp + 0xc], 1
sub eax, edi
mov dword [esp + 0x10], edi
add eax, 2
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov dword [esp + 4], str.GraphicsDriver
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov eax, dword [ebp - 0x5bc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x5e0]
test eax, eax
je 0x407260
mov edx, dword [ebp - 0x5c4]
test edx, edx
je 0x406386
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
jne 0x407844
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov ebx, dword [sym.imp.user32.dll_CreateWindowExW]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x86000000
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8001
mov dword [esp], 0
call ebx
mov dword [ebp - 0x5d8], eax
sub esp, 0x30
test eax, eax
jne 0x4068dc
mov dword [ebp - 0x5d8], 0
mov esi, dword [0x41c558]
mov dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d4]
test eax, eax
je 0x4064b6
lea edx, [ebp - 0x35c]
mov ecx, 0x10
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x360], 0x44
test byte [0x4120c4], 8
jne 0x4073c4
mov eax, dword [ebp - 0x5dc]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x5cc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x5d4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x4073a1
mov eax, dword [ebp - 0x5cc]
mov dword [0x4123a0], 0x418ba0
mov dword [0x4123a4], 0x4188c0
mov dword [0x4123a8], 0x4188e0
mov dword [esp], eax
call dword [0x41c5cc]
sub esp, 4
test eax, eax
js 0x406513
mov eax, dword [ebp - 0x360]
mov edx, dword [eax]
mov dword [esp + 0xc], 0x4123ac
mov dword [esp + 8], 0x417000
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x20]
sub esp, 0x10
mov dword [esp], 0
call esi
mov dword [0x412560], 0x418940
sub esp, 4
mov dword [esp], 0x412564
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [0x412564]
sub esp, 4
mov dword [eax + 0x18], str..._src_wine_programs_explorer_desktop.c:_shellwindows.cs
mov dword [esp + 0x10], 0x4125a4
mov dword [esp + 0xc], 1
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4125a0
mov dword [esp], 0x414d50
call dword [0x41c55c]
sub esp, 0x14
test eax, eax
js 0x406814
mov ebx, dword [ebp - 0x5d8]
test ebx, ebx
je 0x4067f7
xor eax, eax
lea edi, [ebp - 0x35c]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x360], 0x44
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x5cc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.C:windows_system32_tabtip.exe
call dword [sym.imp.kernel32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x4077f6
mov eax, dword [ebp - 0x488]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
push ecx
mov dword [esp + 0xc], str.TABTIP_STARTED_EVENT
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x48c]
sub esp, 0x10
mov dword [esp + 0xc], 0xffffffff
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x568]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub esp, 0x10
dec eax
je 0x40791d
mov eax, dword [ebp - 0x568]
mov dword [esp], eax
call ebx
mov edi, dword [ebp - 0x48c]
push eax
movzx eax, byte [0x4120c4]
test al, 8
jne 0x40742f
mov dword [ebp - 0x5d4], edi
mov ebx, dword [sym.imp.user32.dll_GetMessageW]
mov esi, dword [sym.imp.user32.dll_DispatchMessageW]
mov edi, dword [ebp - 0x5cc]
jmp 0x4066c8
mov dword [esp], edi
call esi
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call ebx
sub esp, 0x10
test eax, eax
jne 0x4066c0
mov edi, dword [ebp - 0x5d4]
test byte [0x4120c4], 8
jne 0x4073fc
mov eax, dword [ebp - 0x5d0]
test eax, eax
je 0x406713
mov dword [esp], 0
call eax
push eax
test edi, edi
je 0x406747
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_TerminateProcess]
push eax
push eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push eax
push eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [ebp - 0x568], 0x20656854
mov eax, 0x21
mov dword [ebp - 0x564], 0x70617267
mov dword [ebp - 0x560], 0x73636968
mov dword [ebp - 0x55c], 0x69726420
mov dword [ebp - 0x558], 0x20726576
mov dword [ebp - 0x554], 0x6d207369
mov dword [ebp - 0x550], 0x69737369
mov dword [ebp - 0x54c], 0x202e676e
mov dword [ebp - 0x548], 0x63656843
mov dword [ebp - 0x544], 0x6f79206b
mov dword [ebp - 0x540], 0x62207275
mov dword [ebp - 0x53c], 0x646c6975
mov word [ebp - 0x538], ax
jmp 0x40612a
movzx esi, word [ebp - 0x5cc]
mov dword [ebp - 0x5d4], 0
jmp 0x405f75
mov eax, dword [ebp - 0x5d0]
test eax, eax
je 0x406747
mov dword [esp], 0
call eax
push edi
jmp 0x406747
test byte [0x4120c4], 4
je 0x40657d
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_register_ShellWindows_object:__08lx_n
mov dword [esp + 8], str.shellwindows_init
mov dword [esp + 4], 0x4120c4
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x40657d
test byte [0x4120c4], 8
jne 0x4078d4
lea eax, [ebp - 0x5a8]
mov dword [esp + 4], str.null
mov esi, 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [ebp - 0x5e8], 0
jmp 0x4061ef
lea eax, [ebp - 0x5a8]
call sym._wine_dbgstr_wn.constprop.0
mov ebx, eax
mov eax, dword [ebp - 0x5d8]
call sym._wine_dbgstr_guid
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.display__s_driver__s_n
mov dword [esp + 8], str.load_graphics_driver
mov dword [esp + 4], 0x4120c4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x4061fc
mov dword [ebp - 0x5e8], eax
xor esi, esi
jmp 0x4061ef
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0x64
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x86000000
mov dword [esp + 8], 0
mov dword [esp + 4], str.Message
mov dword [esp], 0
call ebx
mov edi, dword [ebp - 0x5d8]
sub esp, 0x30
mov dword [esp + 8], sym._desktop_wnd_proc_16
mov dword [esp + 4], 0xfffffffc
mov dword [esp], edi
call dword [sym.imp.user32.dll_SetWindowLongW]
sub esp, 0xc
mov dword [0x41239c], eax
mov dword [esp + 4], 0x7f05
mov dword [esp], 0
call dword [sym.imp.user32.dll_LoadIconW]
push esi
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], edi
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, dword [ebp - 0x5e0]
sub esp, 0x10
cmp word [eax], 0
je 0x4079ce
nop
add eax, 2
cmp word [eax], 0
jne 0x4069b0
sub eax, dword [ebp - 0x5e0]
mov dword [esp + 4], 0
add eax, 0x22
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x5e0]
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x4079ce
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x406a00
mov dword [esp + 4], 0x41865c
mov dword [esp], ebx
call sym._lstrcatW_8
push ecx
push ecx
mov dword [esp + 4], str.Wine_desktop
mov dword [esp], ebx
call sym._lstrcatW_8
mov eax, dword [ebp - 0x5d8]
push esi
push esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowTextW]
push edi
push edi
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov ebx, dword [sym.imp.user32.dll_GetSystemMetrics]
mov dword [esp], 0x4f
call ebx
push edi
mov edi, eax
mov dword [esp], 0x4e
call ebx
mov dword [ebp - 0x604], ebx
push edx
mov esi, eax
mov dword [esp], 0x4d
call ebx
push ecx
mov ebx, eax
mov eax, dword [ebp - 0x604]
mov dword [esp], 0x4c
call eax
push edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowPos]
mov eax, dword [ebp - 0x5e4]
sub esp, 0x1c
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._clipboard_thread_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x610], eax
call eax
sub esp, 0x18
test eax, eax
je 0x406b2e
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push esi
mov eax, dword [sym.imp.user32.dll_SystemParametersInfoW]
mov dword [esp + 0xc], 0
lea edi, [ebp - 0x568]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x14
mov dword [ebp - 0x60c], eax
call eax
sub esp, 0x10
mov dword [esp], 0
call dword [sym.imp.user32.dll_ClipCursor]
xor eax, eax
mov ecx, 0x37
mov dword [ebp - 0x360], 0x348
push ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x35c]
mov word [ebp - 0x524], 0xdc
mov eax, edi
shr eax, 0x10
mov dword [ebp - 0x600], eax
xor eax, eax
mov ecx, dword [ebp - 0x5cc]
mov dword [esp + 4], eax
lea esi, [eax + 1]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp], 0
call dword [sym.imp.user32.dll_EnumDisplayDevicesW]
sub esp, 0x10
test eax, eax
je 0x406e6c
lea eax, [ebp - 0x568]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.user32.dll_EnumDisplaySettingsExW]
sub esp, 0x10
test eax, eax
je 0x406c88
test byte [0x4120c4], 8
jne 0x406cd0
lea eax, [ebp - 0x568]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10000009
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.user32.dll_ChangeDisplaySettingsExW]
sub esp, 0x14
test eax, eax
je 0x406c47
test byte [0x4120c4], 2
jne 0x406c4e
mov eax, esi
jmp 0x406ba0
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str.Failed_to_initialize_registry_display_settings_for__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.initialize_display_settings
mov dword [esp + 4], 0x4120c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
mov eax, esi
jmp 0x406ba0
test byte [0x4120c4], 2
je 0x406c47
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str.Failed_to_query_current_display_settings_for__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.initialize_display_settings
mov dword [esp + 4], 0x4120c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
mov eax, esi
jmp 0x406ba0
mov eax, dword [ebp - 0x518]
mov ecx, dword [ebp - 0x600]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x5f8], eax
test ecx, ecx
je 0x406f9d
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40715d
cmp word [ebp - 0x35c], 0
je 0x40777b
mov ecx, dword [ebp - 0x5cc]
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [ecx + edx*2 + 6], 0
jne 0x406d58
mov word [ebp - 0x48c], 0x224c
lea ecx, [ebp - 0x48a]
mov dword [ebp - 0x5d0], edi
mov dword [ebp - 0x608], esi
jmp 0x406dbb
cmp ax, 9
je 0x406e5f
cmp ax, 0xa
jne 0x406e01
mov word [ecx], 0x6e5c
add ecx, 2
lea eax, [edx - 1]
test edx, edx
jle 0x406f05
lea esi, [ebp - 0x36a]
cmp ecx, esi
ja 0x406f05
mov edx, eax
add dword [ebp - 0x5d0], 2
mov eax, dword [ebp - 0x5d0]
movzx eax, word [eax - 2]
cmp ax, 0xd
je 0x406dea
jbe 0x406d88
cmp ax, 0x22
je 0x406e52
cmp ax, 0x5c
jne 0x406df4
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x406da0
mov word [ecx], 0x725c
add ecx, 2
jmp 0x406da0
lea esi, [eax - 0x20]
cmp si, 0x5e
jbe 0x406fb2
mov esi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr si, 0xc
movzx esi, si
movzx ebx, byte [esi + 0x418844]
mov esi, eax
shr si, 8
and esi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [esi + 0x418844]
mov esi, eax
and eax, 0xf
shr si, 4
movzx eax, byte [eax + 0x418844]
and esi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [esi + 0x418844]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x406da0
mov word [ecx], 0x225c
add ecx, 2
jmp 0x406da0
mov word [ecx], 0x745c
add ecx, 2
jmp 0x406da0
mov dword [ebp - 0x5d0], eax
call sym._initialize_appbar
mov edx, dword [0x4126c0]
mov eax, dword [ebp - 0x5d0]
test edx, edx
cmove eax, dword [ebp - 0x5fc]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e8]
mov dword [esp], eax
call sym._initialize_systray
cmp dword [0x4126c0], 0
mov esi, dword [0x41c558]
je 0x407462
mov dword [esp], str.shell32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov dword [ebp - 0x5d0], 0
push ecx
test eax, eax
je 0x40641a
mov dword [esp + 4], 0xbc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x5d0], eax
push edx
push edx
test eax, eax
je 0x40641a
mov dword [esp], 1
call eax
push eax
jmp 0x40641a
mov byte [ecx], 0x22
mov esi, dword [ebp - 0x608]
test eax, eax
jle 0x407791
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
mov eax, dword [ebp - 0x5dc]
mov dword [esp], eax
call sym.___wine_dbg_strdup
mov ecx, dword [ebp - 0x5e0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Device__s_current_display_mode__lux_lu__luBits__luHz_at__ld__ld._n
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x5e4]
mov dword [esp + 8], str.initialize_display_settings
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x5ec]
mov dword [esp + 4], 0x4120c4
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0x5f0]
mov dword [esp], 3
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x5f4]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x5f8]
mov dword [esp + 0x14], ecx
call sym._wine_dbg_log.constprop.0_1
jmp 0x406c0c
movzx eax, di
mov dword [esp], 0x4132c1
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x406f34
mov byte [ecx], al
inc ecx
jmp 0x406da0
movzx esi, word [edi]
jmp 0x4067e8
mov eax, dword [sym.imp.ucrtbase.dll_wcschr]
xor ebx, ebx
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x5d8]
call sym._wine_dbgstr_guid
mov dword [esp + 0xc], str.display_guid__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 4], 0x4120c4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x5cc]
lea ecx, [ebp - 0x15a]
test ebx, ebx
je 0x4060b5
movzx edx, word [ebx]
test dx, dx
je 0x407036
add eax, 2
add ebx, 2
mov word [eax - 2], dx
cmp eax, ecx
jne 0x407020
mov word [eax], 0
lea eax, [ebp - 0x5bc]
mov dword [ebp - 0x5e4], eax
jmp 0x4060ff
cmp word [0x412160], 0
mov dword [esp], eax
je 0x4071a8
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ecx
lea ecx, [ebp - 0x5c0]
lea edx, [ebp - 0x5c4]
mov eax, 0x412160
call sym._get_default_desktop_size
test eax, eax
je 0x4071f0
mov eax, dword [sym.imp.ucrtbase.dll_wcschr]
xor ebx, ebx
mov dword [ebp - 0x5e0], 0x412160
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x568]
mov dword [esp + 4], 0x4185c0
mov dword [ebp - 0x360], 4
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
test eax, eax
jne 0x4071c4
mov eax, dword [ebp - 0x5cc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x5dc]
mov dword [esp + 8], str.EnableShell
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x568]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegGetValueW]
sub esp, 0x1c
test eax, eax
jne 0x4071b4
mov eax, dword [ebp - 0x568]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push edx
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x5fc], eax
lea eax, [ebp - 0x5b8]
mov dword [ebp - 0x5d8], eax
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_UuidCreate]
push edi
test byte [0x4120c4], 8
je 0x40700c
jmp 0x406fd9
mov eax, 0x4132b7
jmp 0x406f34
lea esi, [ebp - 0x568]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0x10], esi
inc eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.DriverError
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
sub esp, 0x18
jmp 0x406350
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ebx
jmp 0x406073
mov eax, dword [ebp - 0x568]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ecx
mov eax, dword [ebp - 0x5e0]
mov dword [esp + 4], 0x4188d0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
push edx
sete al
push edx
movzx eax, al
mov dword [ebp - 0x48c], eax
jmp 0x407129
mov eax, dword [sym.imp.ucrtbase.dll_wcschr]
xor ebx, ebx
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5e0], 0x412160
mov dword [ebp - 0x5d0], eax
jmp 0x407099
mov dword [esp + 4], 0x418590
mov dword [esp], 0x412160
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x405feb
lea eax, [ebp - 0x360]
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x5dc], eax
jmp 0x407064
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov ebx, dword [sym.imp.user32.dll_CreateWindowExW]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x86000000
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8001
mov dword [esp], 0
call ebx
mov dword [ebp - 0x5d8], eax
sub esp, 0x30
test eax, eax
je 0x406400
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0x64
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x86000000
mov dword [esp + 8], 0
mov dword [esp + 4], str.Message
mov dword [esp], 0
call ebx
mov edi, dword [ebp - 0x5d8]
sub esp, 0x30
mov dword [esp + 8], sym._desktop_wnd_proc_16
mov dword [esp + 4], 0xfffffffc
mov dword [esp], edi
call dword [sym.imp.user32.dll_SetWindowLongW]
sub esp, 0xc
mov dword [0x41239c], eax
mov dword [esp + 4], 0x7f05
mov dword [esp], 0
call dword [sym.imp.user32.dll_LoadIconW]
push ebx
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], edi
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
jmp 0x406a6d
mov eax, dword [ebp - 0x488]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x48c]
push edi
mov dword [esp], eax
call ebx
push eax
jmp 0x4064b6
mov eax, dword [ebp - 0x5d4]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str.starting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 4], 0x4120c4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x406450
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 0xc], str.desktop_message_loop_exiting_for_hwnd__p_n
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x4120c4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x4066ff
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 0xc], str.desktop_message_loop_starting_on_hwnd__p_n
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x4120c4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x4066a6
mov eax, dword [ebp - 0x5d8]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDC]
mov ebx, dword [ebp - 0x5cc]
mov ecx, dword [ebp - 0x60c]
push edi
mov edi, eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x5c
mov dword [esp], 0x1f
call ecx
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_CreateFontIndirectW]
mov ebx, dword [sym.imp.gdi32.dll_SelectObject]
push edx
mov dword [esp], edi
mov dword [esp + 4], eax
call ebx
push ecx
push ecx
mov ecx, dword [ebp - 0x5dc]
mov dword [ebp - 0x5d0], eax
mov dword [esp + 4], ecx
mov dword [esp], edi
call dword [sym.imp.gdi32.dll_GetTextMetricsW]
mov ecx, dword [ebp - 0x5d0]
push edx
push edx
mov dword [ebp - 0x5e0], eax
mov dword [esp + 4], ecx
mov dword [esp], edi
call ebx
push ecx
push ecx
mov dword [esp + 4], edi
mov edi, dword [ebp - 0x5d8]
mov dword [esp], edi
call dword [sym.imp.user32.dll_ReleaseDC]
cmp dword [ebp - 0x5e0], 0
push ebx
push ebx
je 0x406eb5
mov edi, dword [ebp - 0x604]
mov dword [esp], 0xb
call edi
push edx
mov dword [ebp - 0x604], edi
mov dword [0x4123cc], eax
mov dword [esp], 0xc
call edi
mov ebx, dword [0x4123cc]
mov dword [0x412654], 4
push ecx
mov ecx, eax
cmp eax, ebx
mov dword [0x4123d4], eax
mov eax, ebx
cmovge eax, ecx
imul edx, dword [ebp - 0x478], 0xe
mov dword [esp], 0
mov edi, eax
mov eax, dword [ebp - 0x48c]
add eax, eax
mov dword [0x412650], eax
lea eax, [edi + eax + 4]
cmp eax, edx
cmovl eax, edx
mov dword [0x41264c], eax
add eax, 8
mov dword [0x4123f8], eax
sub eax, ebx
mov ebx, 2
cdq
idiv ebx
mov dword [0x4123e4], eax
mov eax, edi
sub eax, ecx
cdq
idiv ebx
add eax, 4
mov dword [0x4123e8], eax
lea eax, [edi + 8]
mov edi, dword [ebp - 0x604]
mov dword [0x412658], eax
call edi
cdq
push ebx
mov ebx, dword [0x41c5d8]
idiv dword [0x4123f8]
mov dword [esp + 0xc], 0x412394
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8000
mov dword [esp], 0x415120
mov edx, 1
test eax, eax
cmove eax, edx
mov dword [0x412400], eax
call ebx
sub esp, 0x10
test eax, eax
js 0x4079ec
mov dword [esp + 0xc], 0x412398
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8000
mov dword [esp], 0x415440
call ebx
sub esp, 0x10
test eax, eax
js 0x407a67
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [0x4123fc], eax
sub esp, 0xc
test eax, eax
je 0x406eb5
mov dword [0x4124a4], 2
mov dword [esp], 0
call esi
push ebx
mov ebx, eax
mov eax, dword [0x412394]
call sym._add_folder
mov eax, dword [0x412398]
call sym._add_folder
test ebx, ebx
js 0x407691
call dword [0x41c568]
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x610]
mov dword [esp + 8], sym._watch_desktop_folders_4
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x18
jmp 0x406eb5
lea eax, [edi + 2]
mov dword [esp + 4], 0x2c
mov dword [ebp - 0x5e0], eax
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcschr]
mov dword [ebp - 0x5d0], eax
call eax
mov ebx, eax
test eax, eax
je 0x40790c
lea esi, [eax + 2]
mov word [eax], 0
mov eax, dword [ebp - 0x5d0]
mov dword [esp + 4], 0x2c
mov dword [esp], esi
call eax
mov ebx, eax
test eax, eax
je 0x407726
mov word [eax], 0
add ebx, 2
lea edi, [ebp - 0x5c0]
lea edx, [ebp - 0x5c4]
mov eax, esi
mov ecx, edi
mov dword [ebp - 0x5cc], edx
call sym._parse_size
mov edx, dword [ebp - 0x5cc]
test eax, eax
jne 0x407758
mov eax, dword [ebp - 0x5e0]
mov ecx, edi
call sym._get_default_desktop_size
lea eax, [ebp - 0x360]
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x5dc], eax
jmp 0x407099
mov word [ebp - 0x48c], 0x224c
lea ecx, [ebp - 0x48a]
mov byte [ebp - 0x48a], 0x22
lea eax, [ecx + 1]
jmp 0x406f23
mov eax, dword [ebp - 0x5dc]
mov dword [esp + 0xc], 0
mov dword [ebp - 0x48c], 0x208
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x5cc]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x5bc]
mov dword [esp + 4], str.Graphics
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x5bc]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ecx
jmp 0x4060ff
movzx eax, byte [0x4120c4]
xor edi, edi
test al, 2
je 0x40669e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Couldnt_start_tabtip.exe:_error__lu_n
mov dword [esp + 8], str.start_tabtip_process
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x4120c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
movzx eax, byte [0x4120c4]
jmp 0x40669e
mov edi, dword [ebp - 0x5cc]
xor eax, eax
mov ecx, 0x37
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x5e0]
mov dword [ebp - 0x2b4], edx
mov dword [ebp - 0x2b0], ebx
mov dword [esp + 4], str.root
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wcsicmp]
mov dword [esp + 0x14], 0
test eax, eax
mov dword [esp + 0x10], 0x1ff
sete al
movzx eax, al
mov dword [0x4126c0], eax
jne 0x407978
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.user32.dll_CreateDesktopW]
sub esp, 0x18
test eax, eax
je 0x4079a9
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetThreadDesktop]
push eax
jmp 0x406386
mov eax, dword [ebp - 0x5d8]
call sym._wine_dbgstr_guid
mov dword [esp + 0xc], str.display__s_using_null_driver_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.load_graphics_driver
mov dword [esp + 4], 0x4120c4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x40685b
lea edi, [ebp - 0x5c0]
lea edx, [ebp - 0x5c4]
jmp 0x40774b
lea eax, [ebp - 0x5a8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push edx
push edx
test byte [0x4120c4], 2
je 0x406685
mov eax, dword [ebp - 0x5a8]
mov dword [esp + 0xc], str.Unexpected_termination_of_tabtip.exe___exit_code__ld_n
mov dword [esp + 8], str.start_tabtip_process
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x4120c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x406685
mov eax, dword [ebp - 0x5cc]
mov dword [esp + 0xc], 0x80000000
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.user32.dll_CreateDesktopW]
sub esp, 0x18
jmp 0x4078bd
test byte [0x4120c4], 2
jne 0x407a22
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [ebp - 0x5d4], 0
jmp 0x405f94
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 4], str.Wine_desktop
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowTextW]
push eax
push eax
jmp 0x406a6d
test byte [0x4120c4], 2
je 0x406eb5
mov dword [esp + 0xc], str.Could_not_get_user_desktop_folder_n
mov dword [esp + 8], str.initialize_launchers
mov dword [esp + 4], 0x4120c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x406eb5
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, dword [ebp - 0x5e0]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_create_desktop__s_error__ld_n
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 4], 0x4120c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x4079b2
test byte [0x4120c4], 2
jne 0x407a8a
mov eax, dword [0x412394]
mov dword [esp], eax
call dword [0x41c564]
push esi
mov esi, dword [0x41c558]
jmp 0x406eb5
mov dword [esp + 0xc], str.Could_not_get_public_desktop_folder_n
mov dword [esp + 8], str.initialize_launchers
mov dword [esp + 4], 0x4120c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x407a70