Function at 0x401640
Capabilities:
Check for peb beingdebugged flag
Check if file exists
Get file attributes
Get process heap flags
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x88b8
call fcn.00403a18
sub esp, eax
mov eax, dword [esp + eax]
mov dword [esp + 0x3c], edx
mov dword [esp + 4], 0x405056
mov edi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
je 0x401b59
mov eax, dword [sym.imp.kernel32.dll_GetFullPathNameW]
lea ebx, [esp + 0x8b0]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x2000
mov dword [esp], edi
mov dword [esp + 8], ebx
mov dword [esp + 0x38], eax
call eax
sub esp, 0x10
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
mov esi, eax
mov dword [esp + 0x30], 0
je 0x4016db
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
setne al
movzx eax, al
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x250]
xor eax, eax
mov dword [esp + 0x34], ecx
nop
lea esi, [esi]
movzx edx, word [esi + eax + 2]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x4016f0
mov word [esi + 2], 0
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x48b0]
mov dword [esp + 8], 0x2000
mov dword [esp], str.PATHEXT
mov dword [esp + 4], eax
call esi
sub eax, 1
sub esp, 0xc
cmp eax, 0x1ffe
jbe 0x401757
xor eax, eax
nop
lea esi, [esi]
movzx edx, word [eax + str..bat_.com_.cmd_.exe]
mov word [esp + eax + 0x48b0], dx
add eax, 2
test dx, dx
jne 0x401740
test byte [0x404000], 8
jne 0x401c1f
lea ebp, [esp + 0x458]
mov dword [esp + 0x2c], ebx
nop
mov ecx, 0x82
mov edi, ebp
xor eax, eax
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x2c]
jmp 0x401790
mov ecx, eax
xor ecx, 1
cmp dx, 0x22
cmove eax, ecx
add ebx, 2
test eax, eax
movzx edx, word [ebx]
jne 0x4017a1
cmp dx, 0x3b
je 0x401ab0
test dx, dx
jne 0x401781
mov ecx, dword [esp + 0x2c]
xor eax, eax
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [ebp + eax], dx
add eax, 2
test dx, dx
jne 0x4017b0
movzx edx, word [esp + 0x458]
mov dword [esp + 0x2c], 0
test dx, dx
je 0x401aec
mov eax, ebp
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4017e0
sub eax, ebp
sar eax, 1
sub eax, 1
cmp word [esp + eax*2 + 0x458], 0x22
je 0x401b10
xor eax, eax
cmp dx, 0x22
jne 0x401815
jmp 0x401a71
movzx edx, word [ebp + eax]
mov word [esp + eax + 0x48], dx
add eax, 2
test dx, dx
jne 0x401810
lea eax, [esp + 0x48]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x104
mov dword [esp], eax
mov eax, dword [esp + 0x38]
call eax
sub esp, 0x10
cmp word [esp + 0x458], 0
je 0x401b43
mov eax, ebp
mov esi, esi
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x401860
sub eax, ebp
sar eax, 1
cmp word [esp + eax*2 + 0x456], 0x5c
je 0x4018b2
mov edx, ebp
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x401880
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [eax + 0x4050c8]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401890
cmp word [esp + 0x458], 0
je 0x401a90
mov edx, ebp
add edx, 2
cmp word [edx], 0
jne 0x4018b4
mov ebx, dword [esp + 0x34]
xor eax, eax
movzx ecx, word [ebx + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4018c3
cmp word [esp + 0x458], 0
mov ebx, ebp
je 0x401b30
add ebx, 2
cmp word [ebx], 0
jne 0x4018e4
mov edx, dword [esp + 0x30]
test edx, edx
je 0x401919
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
jne 0x4019fd
cmp word [esp + 0x458], 0
je 0x401b3c
mov edx, ebp
nop
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x401920
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [eax + 0x4050cc]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401930
lea eax, [esp + 0x660]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
sub esp, 8
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
cmp esi, 0xffffffff
je 0x401aa0
lea esi, [esp + 0x48b0]
jmp 0x4019be
mov edx, eax
mov dword [esp + 4], esi
mov dword [esp], ebx
sub edx, esi
xor esi, esi
mov dword [esp + 8], edx
mov dword [esp + 0x28], edx
call sym._memcpy
mov edx, dword [esp + 0x28]
mov word [ebx + edx], si
mov dword [esp], ebp
lea esi, [edi + 2]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
jne 0x4019fd
test esi, esi
je 0x401aa0
mov dword [esp + 4], 0x3b
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
mov edi, eax
jne 0x401980
add esi, 2
movzx eax, word [esi - 2]
add ebx, 2
test ax, ax
mov word [ebx - 2], ax
jne 0x4019d5
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x401aa0
cmp word [esp + 0x458], 0
mov eax, ebp
je 0x401a13
add eax, 2
cmp word [eax], 0
jne 0x401a0a
sub eax, ebp
mov dword [esp + 4], 0
and eax, 0xfffffffe
add eax, 2
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov edi, dword [esp + 0x3c]
mov dword [edi], eax
je 0x401a61
xor edx, edx
lea esi, [esi]
movzx ecx, word [ebp + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x401a50
mov eax, 1
add esp, 0x88bc
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, word [esp + eax + 0x45a]
mov word [esp + eax + 0x48], dx
add eax, 2
test dx, dx
jne 0x401a71
jmp 0x401822
mov edx, ebp
jmp 0x4018bd
mov edi, dword [esp + 0x2c]
test edi, edi
jne 0x401770
xor eax, eax
jmp 0x401a66
mov eax, dword [esp + 0x2c]
mov esi, ebx
mov dword [esp], ebp
sub esi, eax
mov dword [esp + 4], eax
mov dword [esp + 8], esi
sar esi, 1
call sym._memcpy
xor ecx, ecx
lea eax, [ebx + 2]
mov word [esp + esi*2 + 0x458], cx
movzx edx, word [esp + 0x458]
mov dword [esp + 0x2c], eax
test dx, dx
jne 0x4017da
cmp word [esp + 0x456], 0x22
je 0x401b03
mov word [esp + 0x48], 0
jmp 0x401822
or eax, 0xffffffff
lea esi, [esi]
lea edi, [edi]
xor edx, edx
mov word [esp + eax*2 + 0x458], dx
movzx edx, word [esp + 0x458]
jmp 0x4017ff
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4018f5
mov edx, ebp
jmp 0x401929
cmp word [esp + 0x456], 0x5c
je 0x401a90
mov edx, ebp
jmp 0x401889
lea ebx, [esp + 0x8b0]
movzx edx, word [eax + 0x40505e]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x401b60
lea eax, [esp + 0x8b4]
mov dword [esp + 8], 0x1ffe
mov dword [esp], 0x405064
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov dword [esp + 4], eax
call esi
sub eax, 1
sub esp, 0xc
cmp eax, 0x1ffc
jbe 0x401bb7
xor eax, eax
movzx edx, word [eax + 0x40506e]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x401ba4
mov dword [esp + 4], 0x2e
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
cmp word [edi], 0
mov edx, edi
je 0x401bd9
add edx, 2
cmp word [edx], 0
jne 0x401bd0
sub edx, edi
cmp edx, 0x206
jg 0x401aac
lea ebp, [esp + 0x250]
xor edx, edx
mov dword [esp + 0x34], ebp
movzx ecx, word [edi + edx]
mov word [ebp + edx], cx
add edx, 2
test cx, cx
jne 0x401bf4
test eax, eax
setne al
movzx eax, al
mov dword [esp + 0x30], eax
mov eax, dword [sym.imp.kernel32.dll_GetFullPathNameW]
mov dword [esp + 0x38], eax
jmp 0x40170d
mov eax, dword [esp + 0x34]
call sym._wine_dbgstr_wn.constprop.1
mov esi, eax
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.1
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Searching_in__s_for__s_n
mov dword [esp + 8], str.search_path
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.2
jmp 0x401764