Function at 0x408360
Capabilities:
Check if process is running under wine
Contain obfuscated stackstrings
Create process on windows
Create thread
Get number of processors
Get process heap flags
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58c
mov ebx, dword [ebp + 8]
movzx ecx, word [ebx]
mov edx, ebx
mov eax, ecx
test cx, cx
je 0x409765
nop
cmp ax, 0x20
je 0x4086a8
cmp ax, 9
je 0x4086a8
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x408380
mov dword [ebp - 0x528], 0
cmp cx, 0x3d
je 0x4083b6
cmp cx, 0x2c
jne 0x4083c9
movzx eax, word [ebx + 2]
test ax, ax
je 0x4083c9
cmp ax, 0x2c
jne 0x4092af
mov dword [ebp - 0x46c], 0x208
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sub.user32.dll_GetThreadDesktop
sub esp, 4
test eax, eax
je 0x40841c
xor edx, edx
mov dword [esp + 0xc], 0x104
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0x418000
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.user32.dll_GetUserObjectInformationW
sub esp, 0x14
test eax, eax
jne 0x409154
lea eax, [ebp - 0x360]
mov dword [esp + 4], str.SoftwareWineExplorer
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov dword [ebp - 0x520], eax
call sub.advapi32.dll_RegOpenKeyW
sub esp, 0xc
test eax, eax
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x524], eax
jne 0x4084ad
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x360]
xor edi, edi
mov dword [esp + 0x10], 0x418000
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], str.Desktop
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x360]
jne 0x4084a4
cmp word [section..bss], 0
je 0x4084a4
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push esi
jmp 0x409171
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push ebx
lea eax, [ebp - 0x50c]
xor edi, edi
mov dword [esp], eax
mov dword [ebp - 0x52c], eax
call sub.rpcrt4.dll_UuidCreate
test byte [0x411020], 8
mov dword [ebp - 0x534], 0
push eax
mov dword [ebp - 0x548], 0
jne 0x4086f6
mov ecx, dword [ebp - 0x520]
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + 0x4142d0]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x4084f0
lea eax, [ebp - 0x510]
mov dword [esp + 4], str.SoftwareWineDrivers
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov dword [ebp - 0x538], eax
call sub.advapi32.dll_RegOpenKeyW
sub esp, 0xc
test eax, eax
je 0x409693
mov eax, dword [sym.imp.ucrtbase.dll_wcschr]
mov dword [ebp - 0x530], edi
mov esi, dword [ebp - 0x520]
mov dword [ebp - 0x51c], eax
jmp 0x40857f
cmp eax, 0x45a
je 0x408770
mov dword [esp + 8], eax
lea eax, [ebp - 0x4bc]
mov dword [esp + 4], str.Unknown_error___lu_.
mov dword [esp], eax
call fcn.00404df0
test ebx, ebx
je 0x408693
mov esi, ebx
mov eax, dword [ebp - 0x51c]
mov dword [esp + 4], 0x2c
xor ebx, ebx
mov dword [esp], esi
call eax
test eax, eax
je 0x4085a0
lea ebx, [eax + 2]
xor edi, edi
mov word [eax], di
mov dword [esp + 4], str.null
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x408789
lea eax, [ebp - 0x4fc]
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.wine_s.drv
mov dword [esp + 4], 0x20
mov dword [esp], eax
call fcn.00401d40
lea eax, [ebp - 0x4fc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
jne 0x4090fa
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
cmp eax, 0x7e
jne 0x408550
mov dword [ebp - 0x4bc], 0x20656854
mov ecx, 0x21
mov dword [ebp - 0x4b8], 0x70617267
mov dword [ebp - 0x4b4], 0x73636968
mov dword [ebp - 0x4b0], 0x69726420
mov dword [ebp - 0x4ac], 0x20726576
mov dword [ebp - 0x4a8], 0x6d207369
mov dword [ebp - 0x4a4], 0x69737369
mov dword [ebp - 0x4a0], 0x202e676e
mov dword [ebp - 0x49c], 0x63656843
mov dword [ebp - 0x498], 0x6f79206b
mov dword [ebp - 0x494], 0x62207275
mov dword [ebp - 0x490], 0x646c6975
mov word [ebp - 0x48c], cx
test ebx, ebx
jne 0x40857d
xor edx, edx
mov edi, dword [ebp - 0x530]
xor esi, esi
mov dword [ebp - 0x530], edx
jmp 0x4087c0
lea eax, [edx + 2]
mov word [edx], 0
mov dword [ebp - 0x528], eax
movzx eax, word [edx + 2]
mov edx, dword [ebp - 0x528]
test ax, ax
jne 0x4086dc
movzx ecx, word [ebx]
jmp 0x4083a0
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
je 0x4086c5
cmp ax, 0x20
je 0x4086d0
cmp ax, 9
je 0x4086d0
movzx ecx, word [ebx]
mov dword [ebp - 0x528], edx
jmp 0x4083aa
xor ebx, ebx
mov eax, dword [ebp - 0x52c]
call fcn.00404ee0
mov dword [esp + 0xc], str.display_guid__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 4], 0x411020
mov dword [esp], 3
call fcn.00402610
mov eax, dword [ebp - 0x520]
lea ecx, [ebp - 0x15a]
test ebx, ebx
jne 0x40874e
jmp 0x4084e5
add eax, 2
add ebx, 2
mov word [eax - 2], dx
cmp eax, ecx
je 0x408756
movzx edx, word [ebx]
test dx, dx
jne 0x408740
mov word [eax], 0
lea eax, [ebp - 0x510]
mov dword [ebp - 0x538], eax
jmp 0x408532
lea eax, [ebp - 0x4bc]
mov esi, str.Make_sure_that_your_X_server_is_running_and_that__DISPLAY_is_set_correctly.
mov ecx, 0x13
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x408575
mov edi, dword [ebp - 0x530]
test byte [0x411020], 8
jne 0x4096e8
xor ebx, ebx
mov dword [esp + 4], str.null
mov esi, 1
lea eax, [ebp - 0x4fc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [ebp - 0x530], ebx
test byte [0x411020], 8
jne 0x40909c
movzx eax, byte [ebp - 0x4fd]
mov dword [esp + 8], str.SystemCurrentControlSetControlVideo_08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x0000
mov ebx, dword [ebp - 0x524]
mov dword [esp + 4], 0x86
mov dword [esp + 0x34], eax
movzx eax, byte [ebp - 0x4fe]
mov dword [esp], ebx
mov dword [esp + 0x30], eax
movzx eax, byte [ebp - 0x4ff]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebp - 0x500]
mov dword [esp + 0x28], eax
movzx eax, byte [ebp - 0x501]
mov dword [esp + 0x24], eax
movzx eax, byte [ebp - 0x502]
mov dword [esp + 0x20], eax
movzx eax, byte [ebp - 0x503]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebp - 0x504]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x506]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x508]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x50c]
mov dword [esp + 0xc], eax
call fcn.00401d40
mov eax, dword [ebp - 0x538]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
sub esp, 0x24
test eax, eax
jne 0x40892c
cmp dword [ebp - 0x530], 0
mov ebx, dword [ebp - 0x510]
jne 0x4088cb
test esi, esi
je 0x40933c
cmp word [ebp - 0x4fc], 0
lea eax, [ebp - 0x4fc]
je 0x4088e9
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x4088e0
lea ecx, [ebp - 0x4fc]
mov dword [esp + 0xc], 1
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 4], str.GraphicsDriver
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push eax
mov eax, dword [ebp - 0x52c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x86000000
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8001
mov dword [esp], 0
call sub.user32.dll_CreateWindowExW
sub esp, 0x30
mov dword [ebp - 0x51c], eax
test eax, eax
je 0x408ce8
xor eax, eax
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x1c], 0x64
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], 0x64
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x86000000
mov dword [esp + 4], str.Message
mov dword [esp], eax
call sub.user32.dll_CreateWindowExW
mov eax, dword [ebp - 0x51c]
sub esp, 0x30
mov dword [esp + 8], 0x4051f0
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call sub.user32.dll_SetWindowLongW
sub esp, 0xc
cmp dword [ebp - 0x534], 0
mov dword [0x418208], eax
je 0x408a61
mov eax, dword [ebp - 0x530]
mov esi, dword [ebp - 0x514]
mov ebx, dword [ebp - 0x518]
test eax, eax
je 0x408a61
mov dword [esp + 4], str.wine_create_desktop
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push ecx
push ecx
test eax, eax
je 0x408a61
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
test eax, eax
sete al
movzx eax, al
jmp 0x408a66
mov eax, 1
xor esi, esi
mov dword [esp + 4], 0x7f05
mov dword [esp], esi
mov dword [0x418294], eax
call sub.user32.dll_LoadIconW
push edx
push edx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x51c]
mov dword [esp + 8], 1
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
test edi, edi
je 0x408b6a
cmp word [edi], 0
mov eax, edi
je 0x40937c
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x408ac0
sub eax, edi
xor ebx, ebx
add eax, 0x22
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x40937c
lea esi, [esi]
movzx edx, word [edi + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x408b00
mov dword [esp + 4], 0x413df4
mov dword [esp], ebx
call fcn.00401a90
push eax
push eax
mov dword [esp + 4], str.Wine_desktop
mov dword [esp], ebx
call fcn.00401a90
push eax
push eax
mov eax, dword [ebp - 0x51c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.user32.dll_SetWindowTextW
xor edx, edx
push eax
push eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], 0x4f
call sub.user32.dll_GetSystemMetrics
push ebx
mov edi, eax
mov dword [esp], 0x4e
call sub.user32.dll_GetSystemMetrics
push esi
mov esi, eax
mov dword [esp], 0x4d
call sub.user32.dll_GetSystemMetrics
push edx
mov ebx, eax
mov dword [esp], 0x4c
call sub.user32.dll_GetSystemMetrics
push ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x51c]
mov dword [esp + 0xc], ebx
xor ebx, ebx
mov dword [esp + 0x14], edi
xor edi, edi
mov dword [esp + 0x10], esi
xor esi, esi
mov dword [esp + 0x18], 0x40
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.user32.dll_SetWindowPos
sub esp, 0x1c
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov dword [esp], 0x14
call sub.user32.dll_SystemParametersInfoW
sub esp, 0x10
mov dword [esp], edi
call sub.user32.dll_ClipCursor
mov edi, dword [ebp - 0x524]
mov ecx, 0x37
mov dword [ebp - 0x360], 0x348
push eax
xor eax, eax
mov esi, dword [ebp - 0x524]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x35c]
mov word [ebp - 0x428], 0xdc
mov eax, edi
shr eax, 0x10
mov dword [ebp - 0x54c], eax
xor eax, eax
lea esi, [esi]
lea esi, [esi]
mov ecx, dword [ebp - 0x520]
mov dword [esp + 4], eax
lea ebx, [eax + 1]
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov dword [esp + 8], ecx
call sub.user32.dll_EnumDisplayDevicesW
sub esp, 0x10
test eax, eax
je 0x409021
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call sub.user32.dll_EnumDisplaySettingsExW
sub esp, 0x10
test eax, eax
je 0x408ef8
test byte [0x411020], 8
jne 0x408f40
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10000009
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.user32.dll_ChangeDisplaySettingsExW
sub esp, 0x14
test eax, eax
je 0x408cdc
test byte [0x411020], 2
jne 0x408ebc
mov eax, ebx
jmp 0x408c40
xor ebx, ebx
mov eax, dword [ebp - 0x528]
test eax, eax
je 0x408d6a
lea edx, [ebp - 0x35c]
mov ecx, 0x10
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x360], 0x44
test byte [0x411020], 8
jne 0x40965b
mov eax, dword [ebp - 0x524]
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x520]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x528]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x409638
mov eax, 0x414128
mov edi, 0x414140
mov dword [0x418218], 0x4140e0
movd xmm1, eax
mov eax, dword [ebp - 0x520]
movd xmm0, edi
punpckldq xmm0, xmm1
movq qword [0x418210], xmm0
mov dword [esp], eax
call fcn.0040f184
sub esp, 4
test eax, eax
js 0x408dd0
mov eax, dword [ebp - 0x360]
mov edx, dword [eax]
mov dword [esp + 0xc], 0x41821c
mov dword [esp + 8], 0x41615c
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x20]
sub esp, 0x10
mov edi, dword [ebp - 0x51c]
test edi, edi
je 0x408e9f
xor edx, edx
mov dword [esp], edx
call fcn.0040f30c
mov dword [0x418220], 0x414280
push ecx
mov dword [esp], 0x418224
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [0x418224]
push esi
mov dword [eax + 0x18], str._Users_gcenx_Documents_GitHub_ff_wine_programs_explorer_desktop.c:_shellwindows.cs
mov dword [esp + 0x10], 0x41101c
mov dword [esp + 0xc], 1
mov dword [esp + 8], 4
mov dword [esp + 4], 0x411018
mov dword [esp], 0x41593c
call fcn.0040f2fc
movzx edx, byte [0x411020]
sub esp, 0x14
test eax, eax
js 0x40910d
and dl, 8
jne 0x4095ff
mov esi, dword [ebp - 0x520]
jmp 0x408e6b
mov dword [esp], esi
call sub.user32.dll_DispatchMessageW
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.user32.dll_GetMessageW
sub esp, 0x10
test eax, eax
jne 0x408e60
test byte [0x411020], 8
jne 0x4095cc
test ebx, ebx
je 0x408eaf
mov dword [esp], 0
call ebx
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, edi
call fcn.00404f80
mov dword [esp + 0xc], str.Failed_to_initialize_registry_display_settings_for__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.initialize_display_settings
mov dword [esp + 4], 0x411020
mov dword [esp], 1
call fcn.00402610
mov eax, ebx
jmp 0x408c40
test byte [0x411020], 2
je 0x408cdc
mov eax, edi
call fcn.00404f80
mov dword [esp + 0xc], str.Failed_to_query_current_display_settings_for__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.initialize_display_settings
mov dword [esp + 4], 0x411020
mov dword [esp], 1
call fcn.00402610
mov eax, ebx
jmp 0x408c40
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x54c]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x544], eax
test ecx, ecx
je 0x4090e5
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40914a
mov eax, edi
call fcn.00402450
mov ecx, dword [ebp - 0x52c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Device__s_current_display_mode__lux_lu__luBits__luHz_at__ld__ld._n
mov dword [esp + 8], str.initialize_display_settings
mov dword [esp + 4], 0x411020
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x534]
mov dword [esp], 3
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x538]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0x53c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x540]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x544]
mov dword [esp + 0x14], ecx
call fcn.00402610
jmp 0x408ca4
mov esi, eax
call fcn.00401960
mov edx, dword [0x418294]
mov eax, dword [ebp - 0x530]
test edx, edx
mov dword [esp + 4], edx
cmove esi, dword [ebp - 0x548]
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040ee70
cmp dword [0x418294], 0
je 0x409399
mov dword [esp], str.shell32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
push ebx
test eax, eax
je 0x408ce8
mov dword [esp + 4], 0xbc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
push ecx
push ecx
test eax, eax
je 0x408cea
mov dword [esp], 1
call eax
push edx
jmp 0x408cea
lea eax, [ebp - 0x4fc]
call fcn.00404f80
mov ebx, eax
mov eax, dword [ebp - 0x52c]
call fcn.00404ee0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.display__s_driver__s_n
mov dword [esp + 8], str.load_graphics_driver
mov dword [esp + 4], 0x411020
mov dword [esp], 3
call fcn.00402610
jmp 0x4087cd
mov dword [esp + 4], edi
mov dword [esp], 0x412465
call fcn.00404e80
jmp 0x408fb8
mov edi, dword [ebp - 0x530]
xor esi, esi
mov dword [ebp - 0x530], eax
jmp 0x4087c0
test dl, 4
je 0x408e4b
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_register_ShellWindows_object:__08lx_n
mov dword [esp + 8], str.shellwindows_init
mov dword [esp + 4], 0x411020
mov dword [esp], 2
call fcn.00402610
movzx edx, byte [0x411020]
jmp 0x408e4b
mov eax, 0x41245b
jmp 0x408fb8
mov dword [esp + 4], str.Default
mov dword [esp], section..bss
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x40841c
lea ecx, [ebp - 0x514]
mov eax, section..bss
lea edx, [ebp - 0x518]
call fcn.00401c70
test eax, eax
jne 0x409199
xor ecx, ecx
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x518], ecx
mov edi, section..bss
xor ebx, ebx
lea eax, [ebp - 0x4bc]
mov dword [esp + 4], 0x413fc0
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov dword [ebp - 0x360], 4
call sub.advapi32.dll_RegOpenKeyW
sub esp, 0xc
test eax, eax
jne 0x409223
lea eax, [ebp - 0x360]
xor ecx, ecx
mov dword [esp + 4], edi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x46c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x4bc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.EnableShell
mov dword [esp], eax
call sub.advapi32.dll_RegGetValueW
mov esi, eax
mov eax, dword [ebp - 0x4bc]
sub esp, 0x1c
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push eax
test esi, esi
je 0x409244
mov dword [esp + 4], str.shell
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
push edx
sete al
push edx
movzx eax, al
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x518], 0
mov dword [ebp - 0x548], eax
je 0x409270
cmp dword [ebp - 0x514], 0
jne 0x409720
lea eax, [ebp - 0x50c]
mov dword [esp], eax
mov dword [ebp - 0x52c], eax
call sub.rpcrt4.dll_UuidCreate
test byte [0x411020], 8
push eax
lea eax, [ebp - 0x360]
mov dword [ebp - 0x520], eax
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x524], eax
je 0x40872b
jmp 0x4086f8
mov eax, dword [sym.imp.ucrtbase.dll_wcschr]
lea edi, [ebx + 2]
mov dword [esp + 4], 0x2c
mov dword [esp], edi
mov dword [ebp - 0x51c], eax
call eax
mov ebx, eax
test eax, eax
je 0x4097a8
lea esi, [eax + 2]
mov word [eax], 0
mov eax, dword [ebp - 0x51c]
mov dword [esp + 4], 0x2c
mov dword [esp], esi
call eax
mov ebx, eax
test eax, eax
je 0x4092fd
mov word [eax], 0
add ebx, 2
lea ecx, [ebp - 0x514]
mov eax, esi
lea edx, [ebp - 0x518]
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x51c], edx
call fcn.00401bf0
mov edx, dword [ebp - 0x51c]
test eax, eax
mov ecx, dword [ebp - 0x520]
jne 0x4091a0
mov eax, edi
call fcn.00401c70
jmp 0x4091a0
lea esi, [ebp - 0x4bc]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0x10], esi
add eax, 1
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.DriverError
mov dword [esp], ebx
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
jmp 0x40891d
mov eax, dword [ebp - 0x51c]
mov dword [esp + 4], str.Wine_desktop
mov dword [esp], eax
call sub.user32.dll_SetWindowTextW
push ecx
push ecx
jmp 0x408b6a
mov eax, dword [ebp - 0x51c]
mov dword [esp], eax
call sub.user32.dll_GetDC
push edi
mov edi, dword [ebp - 0x520]
mov ebx, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x5c
mov dword [esp], 0x1f
mov dword [esp + 8], edi
call sub.user32.dll_SystemParametersInfoW
sub esp, 0x10
mov dword [esp], edi
call sub.gdi32.dll_CreateFontIndirectW
push edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.gdi32.dll_SelectObject
push ecx
mov edi, eax
push ecx
mov ecx, dword [ebp - 0x524]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call sub.gdi32.dll_GetTextMetricsW
push esi
push esi
mov esi, eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x51c]
push edi
push edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.user32.dll_ReleaseDC
push eax
push eax
test esi, esi
je 0x40905a
mov dword [esp], 0xb
call sub.user32.dll_GetSystemMetrics
push edx
mov dword [esp], 0xc
mov dword [0x418288], eax
call sub.user32.dll_GetSystemMetrics
mov ebx, dword [0x418288]
mov dword [0x418270], 4
push ecx
mov ecx, eax
mov dword [0x418284], eax
cmp eax, ebx
mov esi, ebx
cmovge esi, eax
mov eax, dword [ebp - 0x46c]
imul edx, dword [ebp - 0x458], 0xe
add eax, eax
mov dword [0x418274], eax
lea eax, [esi + eax + 4]
cmp eax, edx
cmovl eax, edx
mov dword [0x418278], eax
add eax, 8
mov dword [0x418268], eax
sub eax, ebx
mov ebx, 2
cdq
idiv ebx
mov dword [0x418280], eax
mov eax, esi
add esi, 8
sub eax, ecx
mov dword [0x41826c], esi
cdq
idiv ebx
xor ebx, ebx
mov dword [esp], ebx
add eax, 4
mov dword [0x41827c], eax
call sub.user32.dll_GetSystemMetrics
cdq
push esi
idiv dword [0x418268]
test eax, eax
jne 0x4094d3
mov eax, 1
xor edi, edi
mov dword [esp + 0xc], 0x418290
mov dword [esp + 8], edi
mov dword [esp + 4], 0x8000
mov dword [esp], 0x41512c
mov dword [0x418264], eax
call fcn.0040f144
sub esp, 0x10
test eax, eax
js 0x409772
xor esi, esi
mov dword [esp + 0xc], 0x41828c
mov dword [esp + 8], esi
mov dword [esp + 4], 0x8000
mov dword [esp], 0x414e0c
call fcn.0040f144
sub esp, 0x10
test eax, eax
js 0x4097cf
xor ecx, ecx
mov dword [esp + 8], 8
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [0x418260], eax
test eax, eax
je 0x40905a
mov dword [0x418258], 2
xor eax, eax
mov dword [esp], eax
call fcn.0040f30c
mov ebx, eax
mov eax, dword [0x418290]
push edx
call fcn.00402310
mov eax, dword [0x41828c]
call fcn.00402310
test ebx, ebx
js 0x409599
call fcn.0040f2cc
mov eax, dword [ebp - 0x51c]
xor esi, esi
xor edi, edi
mov dword [esp + 8], 0x4049d0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
jmp 0x40905a
mov eax, dword [ebp - 0x51c]
mov dword [esp + 0xc], str.desktop_message_loop_exiting_for_hwnd__p_n
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 4], 0x411020
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.00402610
jmp 0x408e9f
mov eax, dword [ebp - 0x51c]
mov dword [esp + 0xc], str.desktop_message_loop_starting_on_hwnd__p_n
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 4], 0x411020
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.00402610
mov esi, dword [ebp - 0x520]
jmp 0x408e6b
mov eax, dword [ebp - 0x468]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call esi
push eax
mov eax, dword [ebp - 0x46c]
mov dword [esp], eax
call esi
push eax
jmp 0x408d6a
mov eax, dword [ebp - 0x528]
call fcn.00404f80
mov dword [esp + 0xc], str.starting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 4], 0x411020
mov dword [esp], 3
call fcn.00402610
jmp 0x408d1c
mov eax, dword [ebp - 0x524]
mov dword [esp + 4], str.Graphics
mov dword [ebp - 0x46c], 0x208
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x520]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, dword [ebp - 0x510]
sub esp, 0x18
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push eax
jmp 0x408532
mov eax, dword [ebp - 0x52c]
call fcn.00404ee0
mov dword [esp + 0xc], str.display__s_using_null_driver_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.load_graphics_driver
mov dword [esp + 4], 0x411020
mov dword [esp], 3
call fcn.00402610
jmp 0x40879c
xor edx, edx
xor eax, eax
mov dword [esp + 0x10], 0x1ff
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], edi
call sub.user32.dll_CreateDesktopW
sub esp, 0x18
mov dword [ebp - 0x534], eax
test eax, eax
je 0x4097b9
mov eax, dword [ebp - 0x534]
mov dword [esp], eax
call sub.user32.dll_SetThreadDesktop
push eax
jmp 0x409270
xor ecx, ecx
mov dword [ebp - 0x528], ecx
jmp 0x4083c9
test byte [0x411020], 2
je 0x40905a
mov dword [esp + 0xc], str.Could_not_get_user_desktop_folder_n
mov dword [esp + 8], str.initialize_launchers
mov dword [esp + 4], 0x411020
mov dword [esp], 1
call fcn.00402610
jmp 0x40905a
lea ecx, [ebp - 0x514]
lea edx, [ebp - 0x518]
jmp 0x409330
test byte [0x411020], 2
jne 0x4097eb
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
test byte [0x411020], 2
jne 0x409829
mov eax, dword [0x418290]
mov dword [esp], eax
call fcn.0040f2dc
push ebx
jmp 0x40905a
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, edi
call fcn.00404f80
mov dword [esp + 0xc], str.failed_to_create_desktop__s_error__ld_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.manage_desktop
mov dword [esp + 0x14], ebx
mov dword [esp + 4], 0x411020
mov dword [esp], 1
call fcn.00402610
jmp 0x4097c2
mov dword [esp + 0xc], str.Could_not_get_public_desktop_folder_n
mov dword [esp + 8], str.initialize_launchers
mov dword [esp + 4], 0x411020
mov dword [esp], 1
call fcn.00402610
jmp 0x4097d8