Function at 0x401470
Capabilities:
Access peb ldr_data
Get process heap flags
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x368
mov edi, dword [ecx + 4]
mov ebx, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], 1
call ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__fileno]
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__setmode]
lea eax, [edi + 4]
mov esi, eax
mov dword [ebp - 0x32c], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x401aa0
mov dword [ebp - 0x340], 0
mov edx, esi
mov dword [ebp - 0x330], 1
mov dword [ebp - 0x334], ebx
jmp 0x40150a
mov esi, ebx
mov dword [ebp - 0x330], ebx
mov ecx, 1
lea edx, [edi + esi*4]
mov eax, dword [edx]
test eax, eax
je 0x401567
test cl, cl
je 0x401567
mov ecx, dword [ebp - 0x330]
cmp word [eax], 0x2d
lea ebx, [ecx + 1]
jne 0x4014f0
cmp word [eax + 2], 0x2d
jne 0x4018f3
xor ecx, ecx
cmp word [eax + 4], 0
jne 0x401bf6
mov eax, dword [ebp - 0x330]
lea edx, [edi + eax*4]
mov esi, eax
cmp dword [edx], 0
je 0x4014fd
shl eax, 2
sub edx, eax
lea esi, [esi]
lea esi, [esi]
mov eax, dword [edi + ebx*4]
mov dword [edx + ebx*4 - 4], eax
add ebx, 1
test eax, eax
jne 0x401550
lea edx, [edi + esi*4]
mov eax, dword [edx]
test eax, eax
jne 0x401506
mov eax, dword [ebp - 0x340]
mov ebx, dword [ebp - 0x334]
mov dword [ebp - 0x334], 0xa
test al, 0x10
je 0x401592
xor eax, 0x10
mov dword [ebp - 0x340], eax
xor eax, eax
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x340]
test eax, eax
je 0x401aaa
xor esi, esi
and eax, 4
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x33c], eax
jne 0x401c98
mov eax, dword [ebp - 0x340]
xor ecx, ecx
and eax, 8
mov dword [ebp - 0x338], eax
jne 0x401afc
mov eax, dword [edi + 4]
mov edi, dword [ebp - 0x340]
mov edx, edi
and edi, 1
and edx, 2
mov dword [ebp - 0x344], edi
mov dword [ebp - 0x340], edx
test eax, eax
je 0x4019ee
mov dword [ebp - 0x348], ecx
jmp 0x401641
mov eax, dword [ebp - 0x344]
test eax, eax
jne 0x4016a6
mov eax, dword [ebp - 0x33c]
test eax, eax
jne 0x401702
mov ecx, dword [ebp - 0x338]
test ecx, ecx
jne 0x4017ab
add dword [ebp - 0x32c], 4
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax]
test eax, eax
je 0x4019ee
mov edx, dword [ebp - 0x340]
mov byte [ebp - 0x324], 0
test edx, edx
je 0x401600
lea esi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
lea ebx, [ebp - 0x324]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetLongPathNameW]
sub esp, 0xc
test eax, eax
jne 0x4019fb
mov eax, dword [ebp - 0x334]
mov dword [esp + 4], ebx
mov dword [esp], str._s_c
mov dword [esp + 8], eax
call fcn.00401040
mov eax, dword [ebp - 0x344]
test eax, eax
je 0x40160e
mov eax, dword [ebp - 0x32c]
lea esi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
lea ebx, [ebp - 0x324]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetShortPathNameW]
sub esp, 0xc
test eax, eax
jne 0x401a40
mov eax, dword [ebp - 0x334]
mov dword [esp + 4], ebx
mov dword [esp], str._s_c
mov dword [esp + 8], eax
call fcn.00401040
mov eax, dword [ebp - 0x33c]
test eax, eax
je 0x40161c
mov eax, dword [ebp - 0x32c]
mov edi, dword [eax]
cmp word [edi], 0
mov ebx, edi
je 0x401721
lea esi, [esi]
add ebx, 2
cmp word [ebx], 0
jne 0x401718
sub ebx, edi
lea eax, [ebx + 2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [edi + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x401738
mov eax, dword [ebp - 0x330]
mov dword [esp], esi
add ebx, esi
call eax
mov edx, eax
test eax, eax
je 0x40177a
jmp 0x401c6d
movzx eax, word [ebx]
cmp ax, 0x2f
je 0x401958
cmp ax, 0x5c
je 0x401958
sub ebx, 2
cmp esi, ebx
jne 0x401760
mov eax, dword [ebp - 0x334]
mov dword [esp], 0x404169
mov dword [esp + 4], eax
call fcn.00401040
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
mov ecx, dword [ebp - 0x338]
test ecx, ecx
je 0x40162a
mov eax, dword [ebp - 0x32c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
mov dword [esp + 8], eax
call edi
sub esp, 0x20
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov esi, eax
mov eax, dword [ebp - 0x32c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
mov dword [esp + 8], eax
call edi
mov eax, dword [ebp - 0x348]
sub esp, 0x20
mov dword [esp], esi
call eax
test eax, eax
je 0x401a85
lea ebx, [ebp - 0x324]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [ebp - 0x34c], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
call edi
mov eax, dword [ebp - 0x334]
sub esp, 0x20
mov dword [esp + 4], ebx
mov dword [esp], str._s_c
mov dword [esp + 8], eax
call fcn.00401040
mov edx, dword [ebp - 0x34c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40162a
mov eax, dword [edx]
mov esi, 4
movzx eax, word [eax + 2]
test ax, ax
je 0x401949
mov dword [ebp - 0x338], ebx
mov ebx, dword [ebp - 0x340]
mov dword [ebp - 0x33c], edi
mov edi, esi
mov esi, edx
lea esi, [esi]
xor edx, edx
call fcn.00401330
or ebx, eax
mov eax, dword [esi]
movzx eax, word [eax + edi]
add edi, 2
test ax, ax
jne 0x401920
mov dword [ebp - 0x340], ebx
mov ebx, dword [ebp - 0x338]
mov edi, dword [ebp - 0x33c]
mov ecx, 1
jmp 0x401531
movzx eax, word [ebx + 2]
lea edi, [ebx + 2]
mov ecx, edi
cmp ax, 0x2a
je 0x40199e
test ax, ax
je 0x4019a7
cmp ax, 0x3e
je 0x40177e
ja 0x4019d8
cmp ax, 0x22
je 0x40177e
cmp ax, 0x3c
je 0x40177e
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
je 0x4019a7
cmp ax, 0x2a
jne 0x40196c
test ax, ax
jne 0x40177e
test edx, edx
je 0x4019b3
mov eax, 0x2f
mov word [edx], ax
xor eax, eax
mov word [ebx], ax
mov eax, dword [ebp - 0x330]
mov dword [esp], esi
call eax
test eax, eax
jne 0x401b5f
mov edx, ebx
jmp 0x40177a
cmp ax, 0x3f
je 0x40177e
cmp ax, 0x7c
je 0x40177e
jmp 0x40198c
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
jmp 0x40167e
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
jmp 0x4016da
mov eax, dword [ebp - 0x334]
mov dword [esp], 0x404169
mov dword [esp + 4], eax
call fcn.00401040
jmp 0x4018e5
mov dword [ebp - 0x334], 0xa
mov dword [esp], str.KERNEL32
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push esi
mov dword [esp + 4], str.wine_get_unix_file_name
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x330], eax
push edx
push edx
test eax, eax
je 0x401cd1
mov dword [ebp - 0x33c], 4
xor ecx, ecx
mov dword [ebp - 0x338], ecx
xor ecx, ecx
mov dword [ebp - 0x340], 4
jmp 0x4015ce
mov dword [esp], str.KERNEL32
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push ecx
mov dword [esp + 4], str.wine_get_dos_file_name
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x338], 8
push esi
mov ecx, eax
push esi
test eax, eax
jne 0x4015ce
mov dword [esp], 2
call ebx
mov dword [esp + 8], str.winepath
mov dword [esp + 4], str._s:_cannot_get_the_address_of_wine_get_dos_file_name_n
mov dword [esp], eax
call fcn.00401000
mov dword [esp], 3
call dword [sym.imp.ucrtbase.dll_exit]
mov dword [ebp - 0x34c], eax
xor edx, edx
xor eax, eax
lea ebx, [ebp - 0x324]
mov dword [esp + 4], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp], 0xfdf2
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x334]
sub esp, 0x20
mov dword [esp + 8], ebx
mov dword [esp], str._s__s_c
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
call fcn.00401040
mov edx, dword [ebp - 0x34c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x401794
mov esi, 0x4040b0
xor ecx, ecx
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x33c], edi
mov ebx, esi
mov edi, ecx
mov esi, edx
jmp 0x401c2a
add edi, 1
mov ebx, dword [edi*4 + 0x404498]
test ebx, ebx
je 0x40193d
mov dword [esp + 4], ebx
mov eax, dword [esi]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x401c18
mov edx, esi
mov esi, ebx
mov edi, dword [ebp - 0x33c]
movzx eax, word [esi]
mov edx, dword [edx]
mov ebx, dword [ebp - 0x338]
call fcn.00401330
mov ecx, 1
or dword [ebp - 0x340], eax
jmp 0x401531
mov eax, dword [ebp - 0x334]
mov dword [esp + 4], edx
mov dword [esp], str._s_c
mov dword [ebp - 0x34c], edx
mov dword [esp + 8], eax
call fcn.00401040
mov edx, dword [ebp - 0x34c]
jmp 0x401bcd
mov dword [esp], str.KERNEL32
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push edx
mov dword [esp + 4], str.wine_get_unix_file_name
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x33c], 4
push ecx
mov dword [ebp - 0x330], eax
push ecx
test eax, eax
jne 0x4015b7
mov dword [esp], 2
call ebx
mov dword [esp + 8], str.winepath
mov dword [esp + 4], str._s:_cannot_get_the_address_of_wine_get_unix_file_name_n
mov dword [esp], eax
call fcn.00401000
mov dword [esp], 3
call dword [sym.imp.ucrtbase.dll_exit]
nop
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strdup]
mov edx, 1
mov ebx, eax
lock xadd dword [0x405080], edx
add edx, 1
and edx, 0x1f
xchg dword [edx*4 + section..bss], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret