Function at 0x409b50
Capabilities:
Check for peb beingdebugged flag
Check if file exists
Check if process is running under wine
Delete file
Delete registry value
Get common file path
Get file attributes
Get process heap flags
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov ebx, dword [ecx + 8]
mov dword [esp + 0x10], 0x40c120
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
js 0x409d28
mov dword [esp], str.XDG_CONFIG_HOME
mov esi, dword [sym.imp.ucrtbase.dll__wgetenv]
call esi
test eax, eax
je 0x409fe0
mov dword [esp + 4], eax
mov dword [esp], str.__unix_s_menus_applications_merged
call sym._heap_wprintf
mov dword [0x40c340], eax
mov ecx, eax
movzx edx, word [ecx]
mov eax, ecx
test dx, dx
je 0x409bfa
lea esi, [esi]
nop
cmp dx, 0x2f
jne 0x409bee
mov edx, 0x5c
mov word [eax], dx
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
jne 0x409be0
mov edi, 0x5c
mov eax, ecx
mov word [ecx + 2], di
call sym._create_directories
mov dword [esp], str.XDG_DATA_HOME
call esi
test eax, eax
je 0x40a005
mov dword [esp + 4], eax
mov dword [esp], str.__unix_s
call sym._heap_wprintf
mov dword [0x40c100], eax
mov ecx, eax
movzx edx, word [ecx]
mov eax, ecx
test dx, dx
je 0x409c5a
lea esi, [esi]
cmp dx, 0x2f
jne 0x409c4e
mov esi, 0x5c
mov word [eax], si
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
jne 0x409c40
mov edi, 0x5c
mov word [ecx + 2], di
mov dword [esp + 4], ecx
mov dword [esp], str._sdesktop_directories
call sym._heap_wprintf
mov esi, eax
call sym._create_directories
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x34], eax
call eax
sub esp, 0xc
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitialize]
sub esp, 4
test eax, eax
js 0x409d18
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
nop
mov esi, dword [sym.imp.ucrtbase.dll_wcscmp]
test ebx, ebx
je 0x409d10
cmp word [ebx], 0
je 0x409d10
lea eax, [ebp - 0x24]
call sym._next_token
mov ebx, eax
test eax, eax
je 0x409d10
mov dword [esp + 4], 0x40e0de
mov dword [esp], eax
call esi
test eax, eax
jne 0x409d40
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jne 0x409cda
lea esi, [esi]
lea esi, [esi]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409d2f
test byte [section..data], 2
jne 0x40a146
lea esi, [esi]
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 4], 0x40e0e4
mov dword [esp], ebx
call esi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x409d80
mov dword [esp + 4], 0x40e128
mov dword [esp], ebx
call esi
test eax, eax
jne 0x409f78
mov dword [ebp - 0x40], 1
mov ebx, dword [ebp - 0x24]
jmp 0x409cd0
lea eax, [ebp - 0x1c]
mov dword [esp + 4], str.SoftwareWineMenuFiles
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x409fd1
mov eax, dword [ebp - 0x1c]
mov edi, dword fs:[0x18]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x409d70
mov dword [ebp - 0x20], 0x1000
mov eax, 0x1000
mov dword [ebp - 0x1c], 0x1000
jmp 0x409e10
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x34]
mov dword [esp + 4], 0
shl dword [ebp - 0x1c], 1
mov eax, dword [edi + 0x30]
shl dword [ebp - 0x20], 1
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x20]
sub esp, 0xc
add eax, eax
call sym._xmalloc
mov esi, eax
mov eax, dword [ebp - 0x1c]
add eax, eax
call sym._xmalloc
mov dword [esp + 0x14], 0
mov ebx, eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0xea
je 0x409dd0
test eax, eax
je 0x409ee0
cmp eax, 0x103
je 0x409e84
test byte [section..data], 2
jne 0x409f48
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x34]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x30]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x409d70
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x409fa0
inc dword [ebp - 0x2c]
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x34]
mov edx, dword fs:[0x18]
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x3c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x3c]
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x409db8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.error__ld_reading_registry_n
mov dword [esp + 8], str.cleanup_menus
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x409e84
mov dword [esp + 4], 0x40e12e
mov dword [esp], ebx
call esi
test eax, eax
jne 0x40a02a
mov dword [ebp - 0x44], 1
jmp 0x409d70
test byte [section..data], 8
jne 0x40a0e0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
sub esp, 8
jmp 0x409ef8
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
jmp 0x409d70
mov dword [esp], str.WINEHOMEDIR
call esi
mov dword [esp], str._s_.config_menus_applications_merged
mov dword [esp + 4], eax
call sym._heap_wprintf
mov dword [0x40c340], eax
mov ecx, eax
jmp 0x409bcd
mov dword [esp], str.WINEHOMEDIR
call esi
mov dword [esp], str._s_.local_share
mov dword [esp + 4], eax
call sym._heap_wprintf
mov dword [0x40c100], eax
mov ecx, eax
jmp 0x409c32
mov dword [esp + 4], 0x40e134
mov dword [esp], ebx
call esi
test eax, eax
je 0x40a1de
cmp word [ebx], 0x2d
je 0x40a173
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
mov eax, ebx
test ecx, ecx
je 0x40a226
call sym._Process_URL
test eax, eax
jne 0x409d70
mov dword [ebp - 0x38], 1
test byte [section..data], 2
je 0x409d70
mov eax, ebx
shr eax, 0x10
je 0x40a23a
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40a0ab
mov eax, ebx
call sym._wine_dbgstr_wn.part.0.constprop.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_build_menu_item_for__s_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
mov dword [ebp - 0x38], 1
jmp 0x409d70
test esi, esi
je 0x40a230
mov eax, esi
shr eax, 0x10
je 0x40a20e
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40a119
mov eax, esi
call sym._wine_dbgstr_wn.part.0.constprop.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.removing_menu_related_file__s_n
mov dword [esp + 8], str.cleanup_menus
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x409fad
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.could_not_initialize_COM__error_0x_08lX_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x409d28
test byte [section..data], 2
je 0x409d70
mov eax, ebx
shr eax, 0x10
je 0x40a252
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40a1b1
mov eax, ebx
call sym._wine_dbgstr_wn.part.0.constprop.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unknown_option__s_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x409d70
lea eax, [ebp - 0x24]
call sym._next_token
mov ebx, eax
test eax, eax
je 0x409d70
lea eax, [ebp - 0x24]
call sym._next_token
mov edx, eax
test eax, eax
je 0x409d70
mov eax, ebx
call sym._thumbnail_lnk
jmp 0x409d70
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0
jmp 0x40a119
call sym._Process_Link
jmp 0x40a05e
mov eax, str._null_
jmp 0x40a119
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
jmp 0x40a0ab
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
jmp 0x40a1b1