Function at 0x408640
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Check if file exists
Check if process is running under wine
Delete file
Delete registry key
Delete registry value
Get common file path
Get file attributes
Get process heap flags
Query or enumerate registry value
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xe8
mov ebx, dword [ecx + 8]
mov dword [esp + 0x10], 0x419000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
js 0x408fb8
mov eax, dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [esp], str.XDG_CONFIG_HOME
mov dword [ebp - 0x74], eax
call eax
test eax, eax
je 0x408c00
mov dword [esp + 4], eax
mov dword [esp], str.__unix_s_menus_applications_merged
call fcn.00401ae0
movzx ecx, word [eax]
mov dword [0x41920c], eax
mov edx, eax
test cx, cx
je 0x4086ea
lea esi, [esi]
cmp cx, 0x2f
jne 0x4086de
mov edi, 0x5c
mov word [edx], di
movzx ecx, word [edx + 2]
add edx, 2
test cx, cx
jne 0x4086d0
mov edx, 0x5c
mov word [eax + 2], dx
call fcn.00401020
mov dword [esp], str.XDG_DATA_HOME
mov eax, dword [ebp - 0x74]
call eax
test eax, eax
je 0x408e61
mov dword [esp + 4], eax
mov dword [esp], str.__unix_s
call fcn.00401ae0
movzx ecx, word [eax]
mov dword [0x419208], eax
mov edx, eax
test cx, cx
je 0x40874a
lea esi, [esi]
nop
cmp cx, 0x2f
jne 0x40873e
mov ecx, 0x5c
mov word [edx], cx
movzx ecx, word [edx + 2]
add edx, 2
test cx, cx
jne 0x408730
mov esi, 0x5c
mov word [eax + 2], si
mov dword [esp + 4], eax
mov dword [esp], str._sdesktop_directories
call fcn.00401ae0
mov esi, eax
call fcn.00401020
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x5c], eax
call eax
sub esp, 0xc
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitialize]
sub esp, 4
test eax, eax
js 0x408fa6
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
test ebx, ebx
jne 0x408817
jmp 0x408972
mov dword [esp + 4], 0x40e7d8
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov dword [ebp - 0x64], eax
test eax, eax
je 0x408990
mov dword [esp + 4], 0x40e81c
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
jne 0x408b98
mov dword [ebp - 0x7c], 1
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x408972
cmp word [ebx], 0
je 0x408972
lea eax, [ebp - 0x50]
call fcn.004010d0
mov ebx, eax
test eax, eax
je 0x408972
mov dword [esp + 4], 0x40e2ae
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov dword [ebp - 0x64], eax
test eax, eax
jne 0x4087d0
mov eax, dword [sym.imp.advapi32.dll_RegCreateKeyW]
lea edi, [ebp - 0x38]
mov dword [ebp - 0x60], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x40e2b4
mov dword [esp], 0x80000001
mov dword [ebp - 0x68], eax
call eax
sub esp, 0xc
test eax, eax
jne 0x4088e2
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x4088e2
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x20
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Enable
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4088d6
movzx edx, byte [ebp - 0x38]
mov eax, edx
and eax, 0xffffffdf
cmp al, 0x54
sete cl
cmp al, 0x59
sete al
or al, cl
jne 0x4088d6
cmp dl, 0x31
jne 0x40948f
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [ebp - 0x4c], 0
mov dword [esp + 0xc], str.winemenubuilder_semaphore
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
mov dword [ebp - 0x4c], eax
sub esp, 0x10
lea eax, [ebp - 0x4c]
mov dword [esp + 0x10], 0x1cff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [sym.imp.user32.dll_MsgWaitForMultipleObjects]
sub esp, 0x14
test eax, eax
je 0x408c21
test byte [section..data], 2
jne 0x409081
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x50]
sub esp, 4
test ebx, ebx
jne 0x408817
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x78]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea eax, [ebp - 0x38]
mov dword [ebp - 0x60], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineMenuFiles
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x408bf1
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], eax
mov edi, dword fs:[0x18]
test eax, eax
je 0x40880c
lea esi, [esi]
mov dword [ebp - 0x40], 0x1000
mov eax, 0x1000
mov dword [ebp - 0x38], 0x1000
jmp 0x408a30
shl dword [ebp - 0x40], 1
shl dword [ebp - 0x38], 1
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov esi, dword [ebp - 0x5c]
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x40]
sub esp, 0xc
add eax, eax
call fcn.00401590
mov esi, eax
mov eax, dword [ebp - 0x38]
add eax, eax
call fcn.00401590
mov ebx, eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0xea
je 0x4089f0
test eax, eax
je 0x408b00
cmp eax, 0x103
je 0x408aa4
test byte [section..data], 2
jne 0x408b68
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov esi, dword [ebp - 0x5c]
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x68]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x40880c
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x408bc0
add dword [ebp - 0x64], 1
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x70], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov esi, dword [ebp - 0x5c]
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x70]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x4089d8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.error__ld_reading_registry_n
mov dword [esp + 8], str.cleanup_menus
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x408aa4
mov dword [esp + 4], 0x40e822
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
jne 0x408e82
mov dword [ebp - 0x80], 1
jmp 0x40880c
test byte [section..data], 8
jne 0x408f40
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
sub esp, 8
jmp 0x408b19
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
jmp 0x40880c
mov dword [esp], str.WINEHOMEDIR
mov eax, dword [ebp - 0x74]
call eax
mov dword [esp], str._s_.config_menus_applications_merged
mov dword [esp + 4], eax
call fcn.00401ae0
jmp 0x4086bb
mov eax, dword [0x419208]
mov dword [esp], str._smime
mov dword [esp + 4], eax
call fcn.00401ae0
mov dword [ebp - 0x94], eax
mov dword [esp + 4], eax
mov dword [esp], str._spackages
call fcn.00401ae0
mov dword [ebp - 0x98], eax
call fcn.00401020
mov eax, dword [0x419208]
mov dword [esp], str._s_applications
mov dword [esp + 4], eax
call fcn.00401ae0
mov dword [ebp - 0x8c], eax
call fcn.00401020
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0x401000
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [esp], str.XDG_DATA_DIRS
mov edi, dword [ebp - 0x74]
call edi
test eax, eax
je 0x409615
mov dword [esp], str.XDG_DATA_DIRS
call edi
mov ebx, eax
test eax, eax
je 0x4099a9
cmp word [eax], 0
je 0x40999f
nop
add eax, 2
cmp word [eax], 0
jne 0x408cc0
sub eax, ebx
add eax, 2
call fcn.00401590
mov esi, eax
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [ebx + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x408ce0
mov edx, dword [ebp - 0x60]
mov eax, dword [0x419208]
call fcn.004020f0
test eax, eax
jne 0x4090aa
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov eax, dword [ebp - 0x60]
sub esp, 0xc
call fcn.00401c80
test byte [section..data], 2
jne 0x4094c2
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], 0x40e2b4
mov dword [esp], 0x80000001
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x68]
call eax
sub esp, 0xc
mov edi, eax
test eax, eax
jne 0x4095df
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x4095df
mov dword [ebp - 0x68], esi
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], 0
jmp 0x408dc4
mov dword [esp + 8], eax
add edi, 1
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov eax, dword [ebp - 0x68]
mov edx, edi
call fcn.00401e70
mov ebx, eax
test eax, eax
je 0x408fc4
mov edx, eax
mov ecx, str.open
mov eax, 1
call fcn.00403040
test eax, eax
jne 0x408d80
mov eax, dword [ebp - 0x68]
mov ecx, str.DesktopFile
mov edx, ebx
call fcn.00402320
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x408e1f
test byte [section..data], 8
jne 0x4093cc
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x6c]
sub esp, 8
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebp - 0x6c], 1
sub esp, 0xc
jmp 0x408da4
mov dword [esp], str.WINEHOMEDIR
mov eax, dword [ebp - 0x74]
call eax
mov dword [esp], str._s_.local_share
mov dword [esp + 4], eax
call fcn.00401ae0
jmp 0x40871c
mov dword [esp + 4], 0x40e828
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x409658
cmp word [ebx], 0x2d
je 0x4096cd
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x7c]
mov eax, ebx
test ecx, ecx
jne 0x4094a0
call fcn.004077f0
test eax, eax
jne 0x40880c
mov dword [ebp - 0x78], 1
test byte [section..data], 2
je 0x40880c
mov eax, ebx
shr eax, 0x10
je 0x40a468
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x408f07
mov eax, ebx
call fcn.00401250
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_build_menu_item_for__s_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
mov dword [ebp - 0x78], 1
jmp 0x40880c
test esi, esi
je 0x409738
mov eax, esi
shr eax, 0x10
je 0x4096b5
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x408f79
mov eax, esi
call fcn.00401250
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.removing_menu_related_file__s_n
mov dword [esp + 8], str.cleanup_menus
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.00401540
jmp 0x408bcd
test byte [section..data], 2
jne 0x409688
lea esi, [esi]
nop
mov dword [ebp - 0x78], 1
jmp 0x408978
mov esi, dword [ebp - 0x68]
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x6c]
or dword [ebp - 0x64], ecx
sub esp, 4
mov ebx, dword [ebp - 0x64]
test ebx, ebx
jne 0x40942a
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x4c]
mov ebx, dword fs:[0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseSemaphore]
mov eax, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x94]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov edi, dword [ebp - 0x5c]
call edi
mov eax, dword [ebp - 0x98]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x8c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
jmp 0x40880c
mov dword [esp + 0xc], str.failed_wait_for_semaphore_n
mov dword [esp + 8], str.RefreshFileTypeAssociations
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x408958
lea eax, [ebp - 0x44]
mov dword [esp + 4], 0x40e368
mov dword [esp + 8], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcstok]
mov dword [esp], esi
mov dword [ebp - 0x6c], eax
call eax
test eax, eax
je 0x40a498
mov dword [ebp - 0x70], esi
mov edi, dword fs:[0x18]
lea esi, [esi]
nop
mov dword [esp + 4], eax
mov dword [esp], 0x40e36c
call fcn.00401ae0
movzx edx, word [eax]
mov esi, eax
test dx, dx
je 0x40911a
lea esi, [esi]
cmp dx, 0x2f
jne 0x40910e
mov edx, 0x5c
mov word [eax], dx
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
jne 0x409100
lea edx, [esi + 0x12]
cmp edx, eax
jae 0x409130
cmp word [eax - 2], 0x5c
jne 0x409130
xor ebx, ebx
mov word [eax - 2], bx
nop
mov edx, dword [ebp - 0x60]
mov eax, esi
call fcn.004020f0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov ebx, eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
test ebx, ebx
je 0x40a4b2
lea eax, [ebp - 0x44]
mov dword [esp + 4], 0x40e368
mov dword [esp + 8], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x6c]
call eax
test eax, eax
jne 0x4090e0
mov esi, dword [ebp - 0x70]
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov eax, dword fs:[0x18]
mov dword [ebp - 0x70], eax
jmp 0x4091db
mov dword [esp + 8], ebx
add esi, 1
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov edx, esi
mov eax, 0x80000000
call fcn.00401e70
mov ebx, eax
test eax, eax
je 0x4094eb
cmp word [eax], 0x2e
jne 0x4091b8
mov dword [esp + 4], str..com
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x4091b8
mov dword [esp + 4], str..exe
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x4091b8
mov dword [esp + 4], str..msi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x4091b8
mov ecx, str.open
mov edx, ebx
mov eax, 1
call fcn.00403040
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x409268
mov edx, eax
mov eax, ebx
call fcn.004023f0
mov dword [ebp - 0x88], eax
test eax, eax
je 0x409742
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xc0]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0xb8]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x84]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0xa0]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0xa4]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x9c]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x6c]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x88]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
jmp 0x4091b8
mov eax, ebx
shr eax, 0x10
je 0x4094aa
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x4093fd
mov eax, ebx
call fcn.00401250
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.removing_file_type_association_for__s_n
mov dword [esp + 8], str.cleanup_associations
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.00401540
jmp 0x408e10
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x38], str.update_mime_database
mov dword [esp], eax
call sub.kernel32.dll_wine_get_unix_file_name
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], eax
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x60]
mov dword [esp], edi
call sub.ntdll.dll___wine_unix_spawnvp
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x38], str.update_desktop_database
sub esp, 8
mov dword [esp], eax
call sub.kernel32.dll_wine_get_unix_file_name
mov dword [ebp - 0x34], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.ntdll.dll___wine_unix_spawnvp
sub esp, 8
jmp 0x408fe4
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x40880c
call fcn.00408350
jmp 0x408eba
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
jmp 0x4093fd
mov dword [esp + 0xc], str.could_not_build_native_MIME_types_n
mov dword [esp + 8], str.generate_associations
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x408d3d
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4095d2
lea esi, [esi]
lea esi, [esi]
mov esi, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x409500
mov eax, dword [esi + 8]
test eax, eax
jne 0x409500
mov edi, dword fs:[0x18]
mov eax, edi
mov edi, esi
mov esi, eax
lea esi, [esi]
mov ebx, dword [edi]
test ebx, ebx
je 0x40958c
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x409548
test eax, eax
je 0x409548
lea esi, [esi]
mov ebx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x409538
mov eax, dword [ebx + 8]
test eax, eax
jne 0x409538
mov eax, dword [edi - 4]
mov dword [esp + 4], 0
sub edi, 4
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov dword [esp + 8], edi
mov edi, ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
jmp 0x409520
mov eax, dword [edi - 4]
mov dword [esp + 4], 0
mov esi, edi
mov ebx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
sub esi, 4
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov edi, dword [ebp - 0x5c]
call edi
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov eax, dword [ebp - 0x60]
call fcn.00401c80
jmp 0x408d3d
test byte [section..data], 2
je 0x408fd9
mov dword [esp + 0xc], str.could_not_open_file_associations_key_n
mov dword [esp + 8], str.cleanup_associations
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x408fd9
mov eax, str._usr_local_share_:_usr_share_
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x409620
sub eax, 0x40e09a
call fcn.00401590
mov esi, eax
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [eax + str._usr_local_share_:_usr_share_]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x409640
jmp 0x408cf0
lea eax, [ebp - 0x50]
call fcn.004010d0
mov ebx, eax
test eax, eax
je 0x40880c
lea eax, [ebp - 0x50]
call fcn.004010d0
mov edx, eax
test eax, eax
je 0x40880c
mov eax, ebx
call fcn.00405ef0
jmp 0x40880c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.could_not_initialize_COM__error_0x_08lX_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x408fb8
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
jmp 0x408f79
test byte [section..data], 2
je 0x40880c
mov eax, ebx
shr eax, 0x10
je 0x40a480
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40970b
mov eax, ebx
call fcn.00401250
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unknown_option__s_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x40880c
mov eax, str._null_
jmp 0x408f79
mov dword [esp], ebx
mov edi, dword [sym.imp.ucrtbase.dll__wcslwr]
call edi
xor ecx, ecx
mov edx, ebx
mov eax, 3
call fcn.00403040
xor ecx, ecx
mov edx, ebx
mov dword [ebp - 0xa0], eax
mov eax, 0xf
call fcn.00403040
xor ecx, ecx
mov edx, ebx
mov dword [ebp - 0xa4], eax
mov eax, 0xe
call fcn.00403040
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x409a5b
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x38]
lea edi, [eax - 8]
cmp dword [ebp - 0x60], eax
je 0x409e9a
mov dword [ebp - 0x6c], 0
xor ecx, ecx
mov dword [ebp - 0x84], esi
mov esi, ebx
mov ebx, ecx
mov eax, dword [edi + 4]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.shlwapi.dll_PathMatchSpecW]
sub esp, 8
test eax, eax
je 0x409808
test ebx, ebx
je 0x409973
mov ecx, dword [edi + 4]
cmp word [ecx], 0
je 0x4099b0
mov eax, ecx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4097f0
sub eax, ecx
mov edx, dword [ebp - 0x6c]
sar eax, 1
cmp eax, edx
jg 0x409999
mov eax, dword [edi + 8]
lea edi, [eax - 8]
cmp dword [ebp - 0x60], eax
jne 0x4097be
mov ecx, ebx
mov ebx, esi
mov esi, dword [ebp - 0x84]
test ecx, ecx
je 0x409e8c
cmp word [ecx], 0
je 0x40a8bb
mov eax, ecx
add eax, 2
cmp word [eax], 0
jne 0x409831
sub eax, ecx
add eax, 2
mov dword [ebp - 0x84], ecx
call fcn.00401590
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x6c], eax
mov edi, eax
xor eax, eax
movzx edx, word [ecx + eax]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x409857
mov ecx, str.open
mov edx, ebx
mov eax, 2
call fcn.00403040
mov dword [ebp - 0x84], 0
mov dword [ebp - 0xb8], eax
test eax, eax
je 0x40989b
mov edx, eax
xor eax, eax
call fcn.00401b90
mov dword [ebp - 0x84], eax
mov ecx, str.open
mov edx, ebx
mov eax, 4
call fcn.00403040
mov edx, ebx
test eax, eax
mov ecx, eax
mov eax, str.A_Wine_application
cmovne eax, ecx
xor ecx, ecx
mov dword [ebp - 0x90], eax
mov eax, 0x80000000
call fcn.00402320
mov dword [ebp - 0x88], eax
test eax, eax
je 0x4092ab
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], str._s__s
mov dword [esp + 4], eax
call fcn.00401ae0
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xac], edi
test edi, edi
je 0x40aaaf
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb0], eax
mov eax, edi
mov edi, ebx
mov ebx, eax
jmp 0x40992a
mov eax, dword [ebx + 4]
cmovns eax, dword [ebx + 8]
mov ebx, eax
test eax, eax
je 0x4099c9
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0xb0]
call eax
test eax, eax
jne 0x409919
mov ecx, dword [ebp - 0xa8]
mov dword [esp + 4], 0
mov ebx, edi
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
jmp 0x4092ab
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
cmp word [ecx], 0
je 0x409e13
mov eax, ecx
add ecx, 2
cmp word [ecx], 0
jne 0x409984
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x6c], ecx
jmp 0x409808
mov ebx, dword [edi]
mov eax, ecx
jmp 0x409984
mov eax, 2
jmp 0x408cce
xor esi, esi
jmp 0x408cf0
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
jns 0x409808
mov dword [ebp - 0x6c], 0
mov ebx, dword [edi]
jmp 0x409808
mov eax, 0x14
mov ebx, edi
call fcn.00401590
mov ecx, eax
mov eax, dword [ebp - 0xa8]
mov edi, ecx
mov dword [ecx], eax
jmp 0x409a06
mov edx, dword [ebp - 0xac]
lea ecx, [edx + 4]
add edx, 8
test eax, eax
mov eax, ecx
cmovns eax, edx
mov edx, dword [eax]
test edx, edx
je 0x409e1f
mov dword [ebp - 0xac], edx
mov edx, dword [ebp - 0xac]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0xb0]
call eax
test eax, eax
jne 0x4099e3
test byte [section..data], 2
je 0x4092ab
mov dword [esp + 0xc], str.error_updating_rb_tree_n
mov dword [esp + 8], str.generate_associations
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x4092ab
mov eax, dword [ebp - 0x38]
lea edi, [eax - 8]
cmp dword [ebp - 0x60], eax
jne 0x4097ab
mov dword [esp + 4], str..lnk
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x40aad6
lea eax, [ebx + 2]
mov dword [ebp - 0x84], eax
mov dword [esp + 4], eax
mov dword [esp], str.application_x_wine_extension__s
call fcn.00401ae0
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x6c], eax
test edx, edx
je 0x409b93
test eax, eax
je 0x40b874
mov eax, dword [ebp - 0x6c]
cmp word [eax], 0
je 0x40aace
add eax, 2
cmp word [eax], 0
jne 0x409ac2
mov ecx, dword [ebp - 0x6c]
sub eax, ecx
add eax, 2
call fcn.00401590
mov edi, eax
xor eax, eax
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx + eax]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x409adc
movzx eax, word [edi]
mov edx, edi
test ax, ax
je 0x409b13
cmp ax, 0x2f
jne 0x409b07
mov eax, 0x2d
mov word [edx], ax
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x409af9
mov dword [esp + 4], 0x2c
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x409b56
xor ecx, ecx
add eax, 2
mov word [eax - 2], cx
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcstol]
mov dword [ebp - 0x88], eax
mov dword [esp], 0
mov edx, dword [ebp - 0x88]
mov ecx, edi
mov eax, dword [ebp - 0xa4]
call fcn.00406380
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x409d22
mov eax, dword [ebp - 0x84]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x98]
mov dword [esp], str._sx_wine_extension__s.xml
mov dword [esp + 4], eax
call fcn.00401ae0
mov dword [ebp - 0x64], eax
mov dword [esp + 4], 0x40d33c
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wfopen]
mov edi, eax
test eax, eax
je 0x409cb3
mov dword [esp + 4], str.__xml_version_1.0__encoding_UTF_8____n
mov dword [esp], eax
call fcn.00401190
mov dword [esp + 4], str._mime_info_xmlns_http:__www.freedesktop.org_standards_shared_mime_info___n
mov dword [esp], edi
call fcn.00401190
mov eax, dword [ebp - 0x6c]
call fcn.00401d30
mov dword [esp + 4], str.___mime_type_type__s___n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401190
mov eax, ebx
call fcn.00401d30
mov dword [esp + 4], str._____glob_pattern__s____n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401190
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x409c58
call fcn.00401d30
mov dword [esp + 4], str._____comment__s__comment__n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401190
mov dword [esp + 4], str.____mime_type__n
mov dword [esp], edi
call fcn.00401190
mov dword [esp + 4], str.__mime_info__n
mov dword [esp], edi
call fcn.00401190
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_fclose]
mov ecx, dword [ebp - 0x64]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov dword [ebp - 0x64], 1
sub esp, 0xc
jmp 0x409867
test byte [section..data], 2
je 0x409c81
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x40ab31
shr eax, 0x10
je 0x40ab18
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x64]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40ab0e
mov eax, edi
call fcn.00401250
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.error_writing_file__s_n
mov dword [esp + 8], str.write_freedesktop_mime_type_entry
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x409c81
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x40ab7e
shr eax, 0x10
je 0x40ab60
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xa0]
mov edi, str._invalid_
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x409d69
mov eax, dword [ebp - 0xa0]
call fcn.00401250
mov edi, eax
mov eax, ebx
shr eax, 0x10
je 0x40ab45
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x64], str._invalid_
sub esp, 8
test eax, eax
jne 0x409d9d
mov eax, ebx
call fcn.00401250
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x40ab3b
shr eax, 0x10
je 0x40aa96
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x409ddb
mov eax, dword [ebp - 0x6c]
call fcn.00401250
mov dword [esp + 0x18], edi
mov ecx, dword [ebp - 0x64]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], str.writing_MIME_type__s__extension_s__comment_s_n
mov dword [esp + 8], str.write_freedesktop_mime_type_entry
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.00401540
jmp 0x409ba0
mov dword [ebp - 0x6c], 0
jmp 0x409808
mov ecx, edi
lea edi, [edi + 4]
mov edx, dword [ebp - 0xac]
mov dword [ecx + 0x10], 1
mov dword [ecx + 8], 0
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0
mov dword [eax], edi
mov eax, dword [edi]
test eax, eax
je 0x409f18
test byte [eax + 0xc], 1
je 0x409f18
mov edx, dword [eax]
mov ecx, dword [edx + 4]
cmp ecx, eax
je 0x40a88e
test ecx, ecx
je 0x40aa2e
test byte [ecx + 0xc], 1
je 0x40aa2e
xor dword [edx + 0xc], 1
xor dword [ecx + 0xc], 1
mov eax, dword [edx + 8]
xor dword [eax + 0xc], 1
mov eax, dword [edi]
mov edi, dword [eax]
jmp 0x409e44
mov ecx, dword [ebp - 0x9c]
test ecx, ecx
je 0x409a6a
mov dword [esp + 4], 0x2f
mov edi, dword [ebp - 0x9c]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x409a6a
cmp word [edi], 0
mov eax, edi
je 0x40aa23
add eax, 2
cmp word [eax], 0
jne 0x409ec5
mov ecx, dword [ebp - 0x9c]
sub eax, ecx
add eax, 2
call fcn.00401590
mov dword [ebp - 0x6c], eax
xor eax, eax
mov ecx, dword [ebp - 0x9c]
movzx edx, word [ecx + eax]
mov ecx, dword [ebp - 0x6c]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x409ee3
mov edx, dword [ebp - 0xa4]
lea eax, [ebx + 2]
mov dword [ebp - 0x84], eax
test edx, edx
jne 0x409ab5
jmp 0x409b93
mov eax, dword [ebp - 0x3c]
and dword [eax + 0xc], 0xfffffffe
lea eax, [ebp - 0x44]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e2b4
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x68]
call eax
sub esp, 0xc
test eax, eax
jne 0x40a858
mov edi, dword [ebp - 0x44]
test edi, edi
je 0x40a858
mov edx, ebx
mov ecx, str.MimeType
mov eax, edi
call fcn.00402320
mov dword [ebp - 0xa8], 1
mov edx, eax
test eax, eax
je 0x409f98
mov eax, dword [ebp - 0x6c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0xac], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0xac]
test eax, eax
setne al
movzx eax, al
mov dword [ebp - 0xa8], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov edx, ebx
mov ecx, str.ProgID
mov eax, edi
sub esp, 0xc
call fcn.00402320
mov edx, eax
test eax, eax
je 0x409ff2
mov eax, dword [ebp - 0x88]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0xac], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0xac]
test eax, eax
je 0x409ffc
mov dword [ebp - 0xa8], 1
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov edx, ebx
mov ecx, str.AppName
mov eax, edi
sub esp, 0xc
call fcn.00402320
mov edx, eax
test eax, eax
je 0x40a056
mov eax, dword [ebp - 0x90]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0xac], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0xac]
test eax, eax
je 0x40a060
mov dword [ebp - 0xa8], 1
mov eax, dword fs:[0x18]
mov dword [ebp - 0xac], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, str.OpenWithIcon
mov edx, ebx
mov eax, edi
sub esp, 0xc
call fcn.00402320
mov edx, eax
mov eax, dword [ebp - 0x84]
test eax, eax
setne cl
test edx, edx
setne al
cmp cl, al
je 0x40a65c
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0xc
mov dword [esp], edi
mov dword [ebp - 0xb4], eax
call eax
sub esp, 4
lea eax, [ebx + 2]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], str._swine_extension__s.desktop
mov dword [esp + 4], eax
call fcn.00401ae0
mov dword [esp], str.WINECONFIGDIR
mov edi, eax
mov eax, dword [ebp - 0x74]
call eax
mov dword [ebp - 0xc4], eax
test byte [section..data], 8
jne 0x40a4c7
mov dword [esp + 4], 0x40d33c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wfopen]
test eax, eax
je 0x40ab88
mov dword [esp + 4], str._Desktop_Entry__n
mov dword [ebp - 0x64], eax
mov dword [esp], eax
call fcn.00401190
mov dword [esp + 4], str.TypeApplication_n
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
mov eax, dword [ebp - 0x90]
call fcn.00401690
mov dword [esp + 4], str.Name_s_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
mov eax, dword [ebp - 0x6c]
call fcn.00401690
mov dword [esp + 4], str.MimeType_s__n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
mov ecx, dword [ebp - 0xc4]
test ecx, ecx
je 0x40a9fc
mov dword [esp], ecx
call sub.kernel32.dll_wine_get_unix_file_name
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x88]
call fcn.00401f50
mov dword [esp + 0xc], str.wine
mov dword [esp + 0x10], eax
mov ecx, dword [ebp - 0xa8]
mov dword [esp + 4], str.Execenv_WINEPREFIX__s___s_start__ProgIDOpen__s___f_n
mov dword [esp + 8], ecx
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
mov ecx, dword [ebp - 0xa8]
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov dword [esp + 4], str.NoDisplaytrue_n
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
mov dword [esp + 4], str.StartupNotifytrue_n
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
mov ecx, dword [ebp - 0x84]
test ecx, ecx
je 0x40a26a
mov eax, ecx
call fcn.00401690
mov dword [esp + 4], str.Icon_s_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fclose]
xor ecx, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e2b4
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x68]
call eax
sub esp, 0xc
test eax, eax
jne 0x40a91c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xa8], eax
test eax, eax
je 0x40a91c
lea eax, [ebp - 0x48]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0x68]
call eax
sub esp, 0xc
test eax, eax
jne 0x40a8c5
mov ecx, dword [ebp - 0x6c]
cmp word [ecx], 0
mov eax, ecx
je 0x40a2ea
add eax, 2
cmp word [eax], 0
jne 0x40a2e1
mov ecx, dword [ebp - 0x6c]
mov dword [esp + 0xc], 1
mov dword [esp + 4], str.MimeType
sub eax, ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
add eax, 2
mov dword [esp + 8], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegSetValueExW]
mov dword [ebp - 0x64], eax
call eax
mov eax, dword [ebp - 0x88]
sub esp, 0x18
cmp word [eax], 0
je 0x40a9e6
add eax, 2
cmp word [eax], 0
jne 0x40a333
mov ecx, dword [ebp - 0x88]
xor edx, edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], edx
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 4], str.ProgID
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [ebp - 0x64]
call eax
mov eax, dword [ebp - 0x90]
sub esp, 0x18
cmp word [eax], 0
je 0x40a9f1
add eax, 2
cmp word [eax], 0
jne 0x40a383
mov ecx, dword [ebp - 0x90]
mov dword [esp + 0xc], 1
mov dword [esp + 4], str.AppName
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [ebp - 0x64]
call eax
mov eax, edi
sub esp, 0x18
cmp word [edi], 0
je 0x40a3d4
add eax, 2
cmp word [eax], 0
jne 0x40a3cb
sub eax, edi
mov dword [esp + 0x10], edi
add eax, 2
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.DesktopFile
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [ebp - 0x64]
call eax
mov eax, dword [ebp - 0x84]
sub esp, 0x18
test eax, eax
je 0x40abfa
cmp word [eax], 0
je 0x40abef
add eax, 2
cmp word [eax], 0
jne 0x40a41d
mov ecx, dword [ebp - 0x84]
mov dword [esp + 0xc], 1
mov dword [esp + 4], str.OpenWithIcon
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [ebp - 0x64]
call eax
sub esp, 0x18
jmp 0x40a8ce
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.00401430
jmp 0x408f07
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.00401430
jmp 0x40970b
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
jmp 0x409196
mov esi, dword [ebp - 0x70]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov eax, dword [edi + 0x30]
jmp 0x408d1a
test edi, edi
je 0x40a846
mov eax, edi
shr eax, 0x10
je 0x40a828
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push ecx
push ecx
test eax, eax
jne 0x40a819
mov eax, edi
call fcn.00401250
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x40a80a
shr eax, 0x10
je 0x40a7e8
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40a7d9
mov eax, dword [ebp - 0x84]
call fcn.00401250
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x88]
shr eax, 0x10
je 0x40a7b7
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push ecx
push ecx
test eax, eax
jne 0x40a7a8
mov eax, dword [ebp - 0x88]
call fcn.00401250
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x40a799
shr eax, 0x10
je 0x40a77a
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40a76b
mov eax, dword [ebp - 0x6c]
call fcn.00401250
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x90]
shr eax, 0x10
je 0x40a74f
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push ecx
push ecx
test eax, eax
jne 0x40a6a9
mov eax, dword [ebp - 0x90]
call fcn.00401250
mov ecx, dword [ebp - 0xb0]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0xac]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0xa8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], str.friendlyAppName_s__MIME_type__s__progID_s__icon_s_to_file__s_n
mov dword [esp + 8], str.write_freedesktop_association_entry
mov dword [esp + 4], 0x40c000
mov dword [esp], 3
call fcn.00401540
jmp 0x40a125
cmp dword [ebp - 0x84], 0
jne 0x40a6b3
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0xc
mov dword [esp], edi
mov dword [ebp - 0xb4], eax
call eax
push eax
cmp dword [ebp - 0xa8], 0
je 0x4092ab
jmp 0x40a0e7
mov eax, str._invalid_
jmp 0x40a607
mov eax, dword [ebp - 0x84]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0xb0], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0xb0]
test eax, eax
jne 0x40a0b1
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0xc
mov dword [esp], edi
mov dword [ebp - 0xb4], eax
call eax
push eax
cmp dword [ebp - 0xa8], 0
jne 0x40a0e7
mov ecx, dword [ebp - 0x84]
test ecx, ecx
je 0x4092ab
test byte [ebp - 0x64], 1
je 0x4092ab
xor edi, edi
xor edx, edx
mov dword [esp], edi
mov eax, dword [ebp - 0xb8]
call fcn.00406380
mov dword [ebp - 0x64], 1
jmp 0x4092ab
movzx eax, word [ebp - 0x90]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
jmp 0x40a607
mov dword [ebp - 0xa8], str._invalid_
jmp 0x40a5cc
movzx eax, word [ebp - 0x6c]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
mov dword [ebp - 0xa8], eax
jmp 0x40a5cc
mov dword [ebp - 0xa8], str._null_
jmp 0x40a5cc
mov dword [ebp - 0xbc], str._invalid_
jmp 0x40a58c
movzx eax, word [ebp - 0x88]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
mov dword [ebp - 0xbc], eax
jmp 0x40a58c
mov dword [ebp - 0xac], str._invalid_
jmp 0x40a54b
movzx eax, word [ebp - 0x84]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
mov dword [ebp - 0xac], eax
jmp 0x40a54b
mov dword [ebp - 0xac], str._null_
jmp 0x40a54b
mov dword [ebp - 0xb0], str._invalid_
jmp 0x40a502
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
mov dword [ebp - 0xb0], eax
jmp 0x40a502
mov dword [ebp - 0xb0], str._null_
jmp 0x40a502
test byte [section..data], 2
je 0x40a719
mov dword [esp + 0xc], str.error_opening_associations_registry_key_n
mov dword [esp + 8], str.has_association_changed
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x40a719
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x40a97e
test byte [ecx + 0xc], 1
je 0x40a97e
xor dword [edx + 0xc], 1
xor dword [eax + 0xc], 1
mov eax, dword [edx + 8]
xor dword [eax + 0xc], 1
mov eax, dword [edi]
mov edi, dword [eax]
jmp 0x409e44
mov eax, 2
jmp 0x40983f
test byte [section..data], 2
jne 0x40a92f
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0xb4]
call eax
push ecx
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [ebp - 0xb4]
call eax
push eax
mov dword [ebp - 0x64], 1
xor edx, edx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
jmp 0x40a719
test byte [section..data], 2
jne 0x40a958
xor eax, eax
mov dword [ebp - 0xa8], eax
jmp 0x40a8ce
mov dword [esp + 0xc], str.could_not_create_extension_subkey_n
mov dword [esp + 8], str.update_association
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x40a8ce
mov dword [esp + 0xc], str.could_not_open_file_associations_key_n
mov dword [esp + 8], str.update_association
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x40a925
cmp dword [eax + 8], edi
je 0x40a9ca
mov eax, dword [edi]
and dword [eax + 0xc], 0xfffffffe
mov eax, dword [edi]
mov eax, dword [eax]
or dword [eax + 0xc], 1
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
test ecx, ecx
je 0x40a9c5
cmp eax, dword [ecx + 4]
je 0x40a9c0
mov dword [ecx + 8], edx
mov ecx, dword [edx + 8]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x40a9b2
mov dword [ecx], eax
mov dword [edx + 8], eax
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [eax], edx
jmp 0x409e44
mov dword [ecx + 4], edx
jmp 0x40a9a6
mov dword [ebp - 0x3c], edx
jmp 0x40a9a6
mov dword [edx + 4], edi
mov edx, dword [edi + 4]
mov dword [eax + 8], edx
test edx, edx
je 0x40a9d9
mov dword [edx], eax
mov dword [edi + 4], eax
mov edx, dword [eax]
mov dword [edi], edx
mov dword [eax], edi
mov edi, eax
jmp 0x40a983
mov eax, dword [ebp - 0x88]
jmp 0x40a33c
mov eax, dword [ebp - 0x90]
jmp 0x40a38c
mov eax, dword [ebp - 0x88]
call fcn.00401f50
mov dword [esp + 4], str.Execwine_start__ProgIDOpen__s___f_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.00401190
jmp 0x40a21c
mov eax, dword [ebp - 0x9c]
jmp 0x409ece
cmp dword [eax + 4], edi
je 0x40aa7a
mov eax, dword [edi]
and dword [eax + 0xc], 0xfffffffe
mov eax, dword [edi]
mov eax, dword [eax]
or dword [eax + 0xc], 1
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
test ecx, ecx
je 0x40aa75
cmp eax, dword [ecx + 4]
je 0x40aa70
mov dword [ecx + 8], edx
mov ecx, dword [edx + 4]
mov dword [eax + 8], ecx
test ecx, ecx
je 0x40aa62
mov dword [ecx], eax
mov dword [edx + 4], eax
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [eax], edx
jmp 0x409e44
mov dword [ecx + 4], edx
jmp 0x40aa56
mov dword [ebp - 0x3c], edx
jmp 0x40aa56
mov dword [edx + 8], edi
mov edx, dword [edi + 8]
mov dword [eax + 4], edx
test edx, edx
je 0x40aa89
mov dword [edx], eax
mov dword [edi + 8], eax
mov edx, dword [eax]
mov dword [edi], edx
mov dword [eax], edi
mov edi, eax
jmp 0x40aa33
movzx eax, word [ebp - 0x6c]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
jmp 0x409ddb
mov eax, 0x14
call fcn.00401590
mov ecx, eax
mov eax, dword [ebp - 0xa8]
lea edi, [ecx + 4]
mov dword [ecx], eax
lea eax, [ebp - 0x3c]
jmp 0x409e24
mov eax, dword [ebp - 0x6c]
jmp 0x409acb
mov eax, str.application_x_ms_shortcut
add eax, 2
cmp word [eax], 0
jne 0x40aadb
sub eax, 0x40e0d6
call fcn.00401590
mov dword [ebp - 0x6c], eax
xor eax, eax
movzx edx, word [eax + str.application_x_ms_shortcut]
mov ecx, dword [ebp - 0x6c]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x40aaf3
jmp 0x409efc
mov eax, str._invalid_
jmp 0x409cf5
movzx eax, word [ebp - 0x64]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
jmp 0x409cf5
mov eax, str._null_
jmp 0x409cf5
mov eax, str._null_
jmp 0x409ddb
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
mov dword [ebp - 0x64], eax
jmp 0x409d9d
movzx eax, word [ebp - 0xa0]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
mov edi, eax
jmp 0x409d69
mov edi, str._null_
jmp 0x409d69
test byte [section..data], 2
je 0x40a8f6
test edi, edi
je 0x40ac31
mov eax, edi
shr eax, 0x10
je 0x40ac1c
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40ac15
mov eax, edi
call fcn.00401250
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.error_writing_association_file__s_n
mov dword [esp + 8], str.write_freedesktop_association_entry
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401540
jmp 0x40a8f6
mov eax, dword [ebp - 0x84]
jmp 0x40a426
mov dword [esp + 4], str.OpenWithIcon
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
push eax
push eax
jmp 0x40a8ce
mov eax, str._invalid_
jmp 0x40abc2
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401430
jmp 0x40abc2
mov eax, str._null_
jmp 0x40abc2
movzx eax, word [pe_dos_header]
ud2