Function at 0x41ab70
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Get file system object information
Query environment variable
Terminate process

Disassembly:
push ebp
mov eax, 0x89bc
mov ebp, esp
push edi
push esi
push ebx
call fcn.00401050
sub esp, eax
test byte [0x423030], 8
jne 0x41aee0
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WCMD_parameter
mov ebx, eax
test eax, eax
je 0x41abd0
cmp word [eax], 0
jne 0x41abe0
mov dword [0x4231f0], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x43770c
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
je 0x41b255
lea edi, [ebp - 0x8018]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0x2000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFullPathNameW]
sub esp, 0x10
test eax, eax
je 0x41abd0
cmp eax, 0x2000
ja 0x41b027
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcsrchr]
mov dword [ebp - 0x8988], 0
mov ebx, eax
test eax, eax
je 0x41ac6e
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
setne al
movzx eax, al
mov dword [ebp - 0x8988], eax
lea ecx, [ebp - 0x86dc]
xor eax, eax
mov dword [ebp - 0x8984], ecx
lea esi, [esi]
movzx edx, word [ebx + eax + 2]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x41ac80
xor ecx, ecx
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x898c], 1
mov word [ebx + 2], cx
lea eax, [ebp - 0x4018]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
mov dword [esp], 0x437728
call esi
dec eax
sub esp, 0xc
cmp eax, 0x1ffe
jbe 0x41acf7
xor eax, eax
mov edx, 0x2e
jmp 0x41ace7
movzx edx, word [eax + str..bat_.com_.cmd_.exe]
mov word [ebp + eax - 0x4018], dx
add eax, 2
test dx, dx
jne 0x41ace0
test byte [0x423030], 8
jne 0x41b34a
mov dword [ebp - 0x8980], edi
lea esi, [esi]
mov edx, dword [ebp - 0x898c]
mov ecx, 0x82
lea edi, [ebp - 0x84d4]
xor eax, eax
rep stosd dword es:[edi], eax
test edx, edx
je 0x41af20
mov ecx, dword [ebp - 0x8980]
lea esi, [esi]
nop
movzx edx, word [ecx + eax]
mov word [ebp + eax - 0x84d4], dx
add eax, 2
test dx, dx
jne 0x41ad38
mov dword [ebp - 0x8980], 0
cmp word [ebp - 0x84d4], 0
lea edx, [ebp - 0x84d4]
je 0x41ad79
lea esi, [esi]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x41ad70
xor eax, eax
mov ecx, 0x5c
jmp 0x41ad8f
movzx ecx, word [eax + 0x43777c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41ad88
cmp word [ebp - 0x84d4], 0
lea edx, [ebp - 0x84d4]
je 0x41adb9
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x41adb0
mov ebx, dword [ebp - 0x8984]
xor eax, eax
lea esi, [esi]
movzx ecx, word [ebx + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41adc8
cmp word [ebp - 0x84d4], 0
lea ebx, [ebp - 0x84d4]
je 0x41b240
lea esi, [esi]
add ebx, 2
cmp word [ebx], 0
jne 0x41adf0
mov ecx, dword [ebp - 0x8988]
test ecx, ecx
je 0x41ae2c
lea eax, [ebp - 0x84d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
jne 0x41b113
cmp word [ebp - 0x84d4], 0
je 0x41b33f
lea edx, [ebp - 0x84d4]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x41ae38
xor eax, eax
mov ecx, 0x2e
jmp 0x41ae57
movzx ecx, word [eax + 0x437780]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41ae50
lea eax, [ebp - 0x82cc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x84d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
sub esp, 8
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
cmp esi, 0xffffffff
jne 0x41b070
mov eax, dword [ebp - 0x8980]
test eax, eax
jne 0x41ad10
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x41b6b1
mov dword [esp], 0x410
call sym._WCMD_LoadMessage
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], edi
call sym._WCMD_output_stderr
mov dword [0x4231f0], 0x2331
jmp 0x41abd0
mov eax, dword [ebp + 8]
call sym._wine_dbgstr_wn.constprop.0_2
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xc], str.Running__s___d__n
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], str.WCMD_run_program
mov dword [esp + 4], 0x423030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x41ab8f
mov ebx, dword [ebp - 0x8980]
xor eax, eax
jmp 0x41af3f
mov ecx, eax
xor ecx, 1
cmp dx, 0x22
cmove eax, ecx
add ebx, 2
movzx edx, word [ebx]
test eax, eax
jne 0x41af50
cmp dx, 0x3b
je 0x41b1b8
test dx, dx
jne 0x41af30
mov ecx, dword [ebp - 0x8980]
xor eax, eax
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [ebp + eax - 0x84d4], dx
add eax, 2
test dx, dx
jne 0x41af60
movzx edx, word [ebp - 0x84d4]
mov dword [ebp - 0x8980], 0
test dx, dx
je 0x41b1fd
lea eax, [ebp - 0x84d4]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x41af98
lea edi, [ebp - 0x84d4]
sub eax, edi
sar eax, 1
cmp word [ebp + eax*2 - 0x84d6], 0x22
lea ecx, [eax - 1]
je 0x41b220
xor eax, eax
cmp dx, 0x22
jne 0x41afd8
jmp 0x41b050
movzx edx, word [ebp + eax - 0x84d4]
mov word [ebp + eax - 0x88e4], dx
add eax, 2
test dx, dx
jne 0x41afd0
lea eax, [ebp - 0x84d4]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x88e4]
mov dword [esp + 4], 0x104
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFullPathNameW]
sub esp, 0x10
test eax, eax
je 0x41abd0
cmp eax, 0x104
jbe 0x41ad56
mov dword [esp], 0x416
call sym._WCMD_LoadMessage
mov edx, eax
mov eax, 0xfffffff4
call sym._WCMD_output_asis_handle
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, word [ebp + eax - 0x84d2]
mov word [ebp + eax - 0x88e4], dx
add eax, 2
test dx, dx
jne 0x41b050
jmp 0x41afe8
lea esi, [ebp - 0x4018]
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 4], 0x3b
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcschr]
mov edi, eax
test eax, eax
je 0x41b0e0
mov edx, eax
mov dword [esp + 4], esi
sub edx, esi
mov dword [esp], ebx
lea esi, [edi + 2]
mov dword [esp + 8], edx
mov dword [ebp - 0x897c], edx
call sym._memcpy
mov edx, dword [ebp - 0x897c]
xor eax, eax
mov word [ebx + edx], ax
lea eax, [ebp - 0x84d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x41b080
jmp 0x41b113
xor eax, eax
lea esi, [esi]
movzx edx, word [esi + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x41b0e8
lea eax, [ebp - 0x84d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x41ae96
lea eax, [ebp - 0x84d4]
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
mov ebx, eax
test byte [0x423030], 8
jne 0x41b74f
test ebx, ebx
je 0x41b38f
mov dword [esp + 4], str..bat
mov esi, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov dword [esp], ebx
call esi
test eax, eax
je 0x41b16d
mov dword [esp + 4], str..cmd
mov dword [esp], ebx
call esi
test eax, eax
jne 0x41b38f
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 0
mov ebx, dword [0x4232e8]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [0x4232e8], 0
mov dword [esp + 4], eax
lea eax, [ebp - 0x84d4]
mov dword [esp], eax
call sym._WCMD_batch
mov dword [0x4232e8], ebx
jmp 0x41abd0
mov eax, dword [ebp - 0x8980]
mov esi, ebx
sub esi, eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x84d4]
mov dword [esp + 8], esi
sar esi, 1
mov dword [esp], eax
call sym._memcpy
xor edx, edx
lea eax, [ebx + 2]
mov word [ebp + esi*2 - 0x84d4], dx
movzx edx, word [ebp - 0x84d4]
mov dword [ebp - 0x8980], eax
test dx, dx
jne 0x41af8e
cmp word [ebp - 0x84d6], 0x22
je 0x41b215
xor eax, eax
mov word [ebp - 0x88e4], ax
jmp 0x41afe8
mov ecx, 0xffffffff
lea esi, [esi]
xor eax, eax
mov word [ebp + ecx*2 - 0x84d4], ax
movzx edx, word [ebp - 0x84d4]
jmp 0x41afbd
mov eax, dword [ebp - 0x8988]
test eax, eax
jne 0x41ae03
mov edx, ebx
jmp 0x41ae41
mov edx, 0x2e
lea edi, [ebp - 0x8018]
jmp 0x41b26f
movzx edx, word [eax + 0x437714]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x41b268
lea eax, [ebp - 0x8014]
mov dword [esp + 8], 0x1ffe
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov dword [esp + 4], eax
mov dword [esp], 0x43771a
call esi
dec eax
sub esp, 0xc
cmp eax, 0x1ffc
jbe 0x41b2c3
xor eax, eax
mov edx, 0x2e
jmp 0x41b2b7
movzx edx, word [eax + 0x437724]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x41b2b0
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcschr]
movzx edx, word [ebx]
test eax, eax
setne al
movzx eax, al
mov dword [ebp - 0x8988], eax
test dx, dx
je 0x41b306
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x41b2f0
sub eax, ebx
cmp eax, 0x206
jg 0x41b732
lea ecx, [ebp - 0x86dc]
xor eax, eax
mov dword [ebp - 0x8984], ecx
jmp 0x41b324
movzx edx, word [ebx + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x41b320
mov dword [ebp - 0x898c], 0
jmp 0x41aca7
lea edx, [ebp - 0x84d4]
jmp 0x41ae41
mov eax, dword [ebp - 0x8984]
call sym._wine_dbgstr_wn.constprop.0_2
mov ebx, eax
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Searching_in__s_for__s_n
mov dword [esp + 8], str.WCMD_run_program
mov dword [esp + 4], 0x423030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x41ad04
lea eax, [ebp - 0x84d4]
lea ebx, [ebp - 0x88e4]
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.shell32.dll_FindExecutableW]
mov dword [ebp - 0x8980], 0
sub esp, 0xc
cmp eax, 0x1f
jg 0x41b678
lea edx, [ebp - 0x8968]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x896c], 0x44
mov dword [ebp - 0x8928], 0x44
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x8928]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
movzx esi, word [ebp - 0x88f6]
mov edi, dword [ebp - 0x88f4]
sub esp, 4
mov word [ebp - 0x893a], si
mov dword [ebp - 0x8938], edi
test edi, edi
je 0x41b50e
test si, si
je 0x41b50e
mov eax, dword [edi]
cmp si, 0x13
mov dword [ebp - 0x897c], eax
mov eax, 0x13
cmovae eax, esi
mov word [ebp - 0x8988], ax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x41b787
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x897c]
mov dword [esp + 8], esi
mov dword [esp], ebx
lea ecx, [ebx + eax + 4]
mov dword [ebp - 0x8984], ecx
call sym._memcpy
movzx edi, word [ebp - 0x8988]
mov dword [ebp - 0x8938], ebx
mov word [ebp - 0x893a], di
mov edi, dword [ebp - 0x897c]
test edi, edi
je 0x41b49a
test byte [ebx + 4], 1
je 0x41b4b6
mov dword [esp], 0xfffffff6
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, dword [ebp - 0x8984]
sub esp, 4
mov dword [edi], eax
or byte [ebx + 4], 1
cmp dword [ebp - 0x897c], 1
jbe 0x41b4c5
test byte [ebx + 5], 1
je 0x41b4e2
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, dword [ebp - 0x8984]
sub esp, 4
mov dword [edi + 4], eax
or byte [ebx + 5], 1
cmp dword [ebp - 0x897c], 2
jbe 0x41b4f1
test byte [ebx + 6], 1
je 0x41b50e
mov dword [esp], 0xfffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, dword [ebp - 0x8984]
sub esp, 4
mov dword [edi + 8], eax
or byte [ebx + 6], 1
lea eax, [ebp - 0x8928]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x896c]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], 0
mov dword [esp + 4], eax
lea eax, [ebp - 0x84d4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov ebx, eax
mov eax, dword [ebp - 0x8938]
sub esp, 0x28
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [0x4243a8]
or eax, dword [0x4243ac]
jne 0x41b61f
test ebx, ebx
je 0x41aea4
mov esi, dword [0x4232e8]
test esi, esi
je 0x41b5ae
mov eax, dword [ebp - 0x8980]
test eax, eax
je 0x41b5c8
shr eax, 0x10
jne 0x41b5c8
mov eax, dword [ebp - 0x8928]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [ebp - 0x8928]
mov dword [esp + 4], 0x4231f0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
sub esp, 8
cmp dword [0x4231f0], 0x103
jne 0x41b5f8
mov dword [0x4231f0], 0
mov eax, dword [ebp - 0x8928]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x8924]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
jmp 0x41abd0
mov eax, ebx
or eax, dword [0x4243b0]
jne 0x41b58d
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 2
jne 0x41aea4
mov eax, dword [ebp + 8]
cmp word [eax], 0x22
jne 0x41aea4
mov dword [esp], eax
call sym._WCMD_strip_quotes
mov eax, dword [ebp + 0xc]
mov dword [0x4243b0], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._WCMD_run_program
jmp 0x41abd0
lea eax, [ebp - 0x82cc]
mov dword [esp + 0x10], 0x2000
mov dword [esp + 0xc], 0x2b4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.shell32.dll_SHGetFileInfoW]
mov dword [ebp - 0x8980], eax
sub esp, 0x14
jmp 0x41b3c6
lea eax, [ebp - 0x82cc]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x82cc], 0
mov dword [esp], eax
call sym._WCMD_ReadAndParseLine
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x82cc]
mov dword [esp], eax
call sym._WCMD_process_commands
mov ebx, dword [ebp - 0x82cc]
mov edi, dword [sym.imp.ucrtbase.dll_free]
test ebx, ebx
je 0x41abd0
lea esi, [esi]
mov esi, ebx
mov ebx, dword [ebx + 8]
mov eax, dword [esi]
mov dword [esp], eax
call edi
mov eax, dword [esi + 4]
mov dword [esp], eax
call edi
mov dword [esp], esi
call edi
test ebx, ebx
jne 0x41b710
jmp 0x41abd0
mov dword [esp], 0x40b
call sym._WCMD_LoadMessage
mov edx, eax
mov eax, 0xfffffff4
call sym._WCMD_output_asis_handle
jmp 0x41abd0
lea eax, [ebp - 0x84d4]
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0xc], str.Found_as__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.WCMD_run_program
mov dword [esp + 4], 0x423030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x41b139
test byte [0x423030], 2
jne 0x41b79d
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Out_of_memory_n
mov dword [esp + 8], str.xalloc
mov dword [esp + 4], 0x423030
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_3
jmp 0x41b790