Function at 0x40aca0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Check if file exists
Check if process is running under wine
Delete file
Delete registry key
Delete registry value
Get common file path
Get file attributes
Get process heap flags
Query or enumerate registry value
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xe8
mov ebx, dword [ecx + 8]
mov dword [esp + 0x10], 0x419000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.shell32.dll_SHGetFolderPathW
sub esp, 0x14
test eax, eax
js 0x40afd0
mov eax, dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [esp], str.XDG_CONFIG_HOME
mov dword [ebp - 0x78], eax
call eax
test eax, eax
je 0x40b257
mov dword [esp + 4], eax
mov dword [esp], str.__unix_s_menus_applications_merged
call fcn.00401ad0
movzx ecx, word [eax]
mov dword [0x41920c], eax
mov edx, eax
test cx, cx
je 0x40ad4a
lea esi, [esi]
cmp cx, 0x2f
jne 0x40ad3e
mov ecx, 0x5c
mov word [edx], cx
movzx ecx, word [edx + 2]
add edx, 2
test cx, cx
jne 0x40ad30
mov esi, 0x5c
mov word [eax + 2], si
call fcn.00401020
mov dword [esp], str.XDG_DATA_HOME
mov eax, dword [ebp - 0x78]
call eax
test eax, eax
je 0x40b4ed
mov dword [esp + 4], eax
mov dword [esp], str.__unix_s
call fcn.00401ad0
movzx ecx, word [eax]
mov dword [0x419208], eax
mov edx, eax
test cx, cx
je 0x40adaa
lea esi, [esi]
nop
cmp cx, 0x2f
jne 0x40ad9e
mov esi, 0x5c
mov word [edx], si
movzx ecx, word [edx + 2]
add edx, 2
test cx, cx
jne 0x40ad90
mov edi, 0x5c
mov word [eax + 2], di
mov dword [esp + 4], eax
mov dword [esp], str._sdesktop_directories
mov edi, dword fs:[0x18]
call fcn.00401ad0
mov esi, eax
call fcn.00401020
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x5c], eax
call eax
sub esp, 0xc
mov dword [esp], 0
call sub.ole32.dll_CoInitialize
sub esp, 4
test eax, eax
js 0x40afc0
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
test ebx, ebx
jne 0x40ae6f
jmp 0x40afb9
mov dword [esp + 4], 0x4107a0
mov dword [esp], ebx
call esi
mov dword [ebp - 0x64], eax
test eax, eax
je 0x40aff0
mov dword [esp + 4], 0x4107e4
mov dword [esp], ebx
call esi
test eax, eax
jne 0x40b1f0
mov dword [ebp - 0x7c], 1
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x40afb9
cmp word [ebx], 0
je 0x40afb9
lea eax, [ebp - 0x50]
call fcn.004010c0
mov ebx, eax
test eax, eax
je 0x40afb9
mov dword [esp + 4], 0x41026e
mov esi, dword [sym.imp.ucrtbase.dll_wcscmp]
mov dword [esp], eax
call esi
mov dword [ebp - 0x64], eax
test eax, eax
jne 0x40ae30
lea eax, [ebp - 0x38]
mov dword [esp + 4], 0x410274
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov dword [ebp - 0x60], eax
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
test eax, eax
jne 0x40af2a
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x40af2a
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Enable
mov dword [esp], ebx
mov dword [ebp - 0x40], 0x20
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x40af1f
movzx eax, byte [ebp - 0x38]
mov edx, eax
and edx, 0xffffffdf
cmp dl, 0x59
jne 0x40b4cd
mov dword [esp], ebx
call sub.advapi32.dll_RegCloseKey
sub esp, 4
mov dword [ebp - 0x4c], 0
mov dword [esp + 0xc], str.winemenubuilder_semaphore
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
sub esp, 0x10
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x10], 0x4ff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.user32.dll_MsgWaitForMultipleObjects
sub esp, 0x14
test eax, eax
je 0x40b278
test byte [section..data], 2
jne 0x40b6f0
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x50]
sub esp, 4
test ebx, ebx
jne 0x40ae6f
call sub.ole32.dll_CoUninitialize
jmp 0x40afd7
test byte [section..data], 2
jne 0x40be00
lea esi, [esi]
mov dword [ebp - 0x74], 1
mov eax, dword [ebp - 0x74]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea eax, [ebp - 0x38]
mov dword [esp + 4], str.SoftwareWineMenuFiles
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov dword [ebp - 0x60], eax
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
test eax, eax
jne 0x40b248
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], eax
test eax, eax
je 0x40ae64
mov dword [ebp - 0x40], 0x1000
mov eax, 0x1000
mov dword [ebp - 0x38], 0x1000
jmp 0x40b088
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x5c]
mov dword [esp + 4], 0
shl dword [ebp - 0x40], 1
shl dword [ebp - 0x38], 1
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x40]
sub esp, 0xc
add eax, eax
call fcn.00401510
mov esi, eax
mov eax, dword [ebp - 0x38]
add eax, eax
call fcn.00401510
mov dword [esp + 0x14], 0
mov ebx, eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.advapi32.dll_RegEnumValueW
sub esp, 0x20
cmp eax, 0xea
je 0x40b048
test eax, eax
je 0x40b158
cmp eax, 0x103
je 0x40b0fb
test byte [section..data], 2
jne 0x40b1c0
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x5c]
mov edx, dword fs:[0x18]
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x60], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x60]
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x68]
sub esp, 0xc
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x40ae64
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x40b218
add dword [ebp - 0x64], 1
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x5c]
mov edx, dword fs:[0x18]
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x70], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x70]
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x40b02d
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.error__ld_reading_registry_n
mov dword [esp + 8], str.cleanup_menus
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40b0fb
mov dword [esp + 4], 0x4107ea
mov dword [esp], ebx
call esi
test eax, eax
jne 0x40b50e
mov dword [ebp - 0x80], 1
jmp 0x40ae64
test byte [section..data], 8
jne 0x40b5c8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov eax, dword [ebp - 0x68]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteValueW
sub esp, 8
jmp 0x40b171
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
jmp 0x40ae64
mov dword [esp], str.WINEHOMEDIR
mov eax, dword [ebp - 0x78]
call eax
mov dword [esp], str._s_.config_menus_applications_merged
mov dword [esp + 4], eax
call fcn.00401ad0
jmp 0x40ad1a
mov eax, dword [0x419208]
mov dword [esp], str._smime
mov dword [esp + 4], eax
call fcn.00401ad0
mov dword [esp], str._spackages
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], eax
call fcn.00401ad0
mov dword [ebp - 0x90], eax
call fcn.00401020
mov eax, dword [0x419208]
mov dword [esp], str._s_applications
mov dword [esp + 4], eax
call fcn.00401ad0
mov dword [ebp - 0x70], eax
call fcn.00401020
mov eax, dword [ebp - 0x60]
mov ebx, dword [ebp - 0x78]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0x401000
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [esp], str.XDG_DATA_DIRS
call ebx
test eax, eax
je 0x40beb1
mov dword [esp], str.XDG_DATA_DIRS
call ebx
mov ecx, eax
test eax, eax
je 0x40c39f
cmp word [eax], 0
je 0x40c395
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x40b318
sub eax, ecx
add eax, 2
mov dword [ebp - 0x68], ecx
call fcn.00401510
mov ecx, dword [ebp - 0x68]
mov ebx, eax
xor eax, eax
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x40b338
mov edx, dword [ebp - 0x60]
mov eax, dword [0x419208]
call fcn.004020e0
test eax, eax
jne 0x40b777
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov eax, dword [ebp - 0x60]
sub esp, 0xc
call fcn.00401c70
test byte [section..data], 2
jne 0x40c23d
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], 0x410274
mov dword [esp], 0x80000001
mov dword [esp + 8], eax
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
mov ebx, eax
test eax, eax
jne 0x40bef8
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x84], esi
test esi, esi
je 0x40bef8
mov eax, dword fs:[0x18]
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x88], edi
jmp 0x40b436
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x68]
add ebx, 1
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov edx, ebx
mov eax, esi
call fcn.00401e60
mov edi, eax
test eax, eax
je 0x40b62e
mov edx, eax
mov ecx, str.open
mov eax, 1
call fcn.00402ad0
test eax, eax
jne 0x40b3f0
mov ecx, str.DesktopFile
mov edx, edi
mov eax, esi
call fcn.00402340
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x40b48f
test byte [section..data], 8
jne 0x40b719
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.advapi32.dll_RegDeleteKeyW
mov eax, dword [ebp - 0x6c]
sub esp, 8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov dword [ebp - 0x6c], 1
sub esp, 0xc
jmp 0x40b413
cmp al, 0x74
je 0x40af1f
cmp al, 0x54
je 0x40af1f
mov dword [esp], ebx
cmp al, 0x31
jne 0x40b145
jmp 0x40af22
mov dword [esp], str.WINEHOMEDIR
mov eax, dword [ebp - 0x78]
call eax
mov dword [esp], str._s_.local_share
mov dword [esp + 4], eax
call fcn.00401ad0
jmp 0x40ad7c
mov dword [esp + 4], 0x4107f0
mov dword [esp], ebx
call esi
test eax, eax
je 0x40be81
cmp word [ebx], 0x2d
je 0x40bf50
mov esi, dword [ebp - 0x80]
mov edx, dword [ebp - 0x7c]
mov eax, ebx
test esi, esi
jne 0x40be2d
call fcn.00408c70
test eax, eax
jne 0x40ae64
mov dword [ebp - 0x74], 1
test byte [section..data], 2
je 0x40ae64
mov eax, ebx
shr eax, 0x10
je 0x40cb9e
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40b58f
mov eax, ebx
call fcn.004012a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_build_menu_item_for__s_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
mov dword [ebp - 0x74], 1
jmp 0x40ae64
test esi, esi
je 0x40c216
mov eax, esi
shr eax, 0x10
je 0x40bf38
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40b601
mov eax, esi
call fcn.004012a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.removing_menu_related_file__s_n
mov dword [esp + 8], str.cleanup_menus
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x40b225
mov eax, dword [ebp - 0x84]
mov edi, dword [ebp - 0x88]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov ecx, dword [ebp - 0x6c]
or dword [ebp - 0x64], ecx
sub esp, 4
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x40bd9e
mov eax, dword [ebp - 0x4c]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseSemaphore]
mov eax, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x5c]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ebx, dword fs:[0x18]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x90]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x70]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x40ae64
mov dword [esp + 0xc], str.failed_wait_for_semaphore_n
mov dword [esp + 8], str.RefreshFileTypeAssociations
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40af9f
mov eax, edi
shr eax, 0x10
je 0x40be37
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x40b74a
mov eax, edi
call fcn.004012a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.removing_file_type_association_for__s_n
mov dword [esp + 8], str.cleanup_associations
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x40b480
lea eax, [ebp - 0x44]
mov dword [esp + 4], 0x410328
mov dword [esp + 8], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcstok]
mov dword [esp], ebx
mov dword [ebp - 0x68], eax
call eax
test eax, eax
je 0x40b873
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x6c], ebx
mov ecx, dword fs:[0x18]
mov ebx, ecx
lea esi, [esi]
nop
mov dword [esp + 4], eax
mov dword [esp], 0x41032c
call fcn.00401ad0
movzx edx, word [eax]
mov esi, eax
test dx, dx
je 0x40b7f2
lea esi, [esi]
cmp dx, 0x2f
jne 0x40b7e6
mov ecx, 0x5c
mov word [eax], cx
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
jne 0x40b7d8
lea edx, [esi + 0x12]
cmp eax, edx
jbe 0x40b810
cmp word [eax - 2], 0x5c
jne 0x40b810
xor edx, edx
mov word [eax - 2], dx
lea esi, [esi]
lea esi, [esi]
mov edx, dword [ebp - 0x60]
mov eax, esi
call fcn.004020e0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov edi, eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
test edi, edi
je 0x40bfbb
lea eax, [ebp - 0x44]
mov dword [esp + 4], 0x410328
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x68]
mov dword [esp], 0
call eax
test eax, eax
jne 0x40b7b8
mov ebx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x84]
mov esi, dword [ebp - 0x88]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
xor eax, eax
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x88], 0
sub esp, 0xc
mov esi, eax
mov dword [ebp - 0xc0], edi
jmp 0x40b8de
mov dword [esp + 8], ebx
add esi, 1
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov edx, esi
mov eax, 0x80000000
call fcn.00401e60
mov ebx, eax
test eax, eax
je 0x40bc90
cmp word [eax], 0x2e
jne 0x40b8b8
mov edi, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov dword [esp + 4], str..com
mov dword [esp], eax
mov dword [ebp - 0x6c], edi
call edi
test eax, eax
je 0x40b8b8
mov dword [esp + 4], str..exe
mov dword [esp], ebx
call edi
test eax, eax
je 0x40b8b8
mov dword [esp + 4], str..msi
mov dword [esp], ebx
call edi
test eax, eax
je 0x40b8b8
mov dword [esp], ebx
mov edi, dword [sym.imp.ucrtbase.dll__wcslwr]
call edi
xor ecx, ecx
mov edx, ebx
mov eax, 3
call fcn.00402ad0
xor ecx, ecx
mov edx, ebx
mov dword [ebp - 0x94], eax
mov eax, 0xf
call fcn.00402ad0
xor ecx, ecx
mov edx, ebx
mov dword [ebp - 0x98], eax
mov eax, 0xe
call fcn.00402ad0
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x40bfc9
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x38]
lea edi, [eax - 8]
cmp dword [ebp - 0x60], eax
je 0x40c290
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x84], esi
mov esi, dword [ebp - 0x60]
mov eax, dword [edi + 4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.shlwapi.dll_PathMatchSpecW
sub esp, 8
test eax, eax
je 0x40b9f6
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40be4f
mov ecx, dword [edi + 4]
cmp word [ecx], 0
je 0x40c266
mov eax, ecx
add eax, 2
cmp word [eax], 0
jne 0x40b9e0
sub eax, ecx
sar eax, 1
cmp dword [ebp - 0x64], eax
jl 0x40bf2e
mov eax, dword [edi + 8]
lea edi, [eax - 8]
cmp esi, eax
jne 0x40b9b0
mov eax, dword [ebp - 0x68]
mov esi, dword [ebp - 0x84]
test eax, eax
je 0x40c282
cmp word [eax], 0
je 0x40cbce
add eax, 2
cmp word [eax], 0
jne 0x40ba1b
sub eax, dword [ebp - 0x68]
add eax, 2
call fcn.00401510
mov edi, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov ecx, eax
xor eax, eax
lea esi, [esi]
movzx edx, word [edi + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x40ba40
mov ecx, str.open
mov edx, ebx
mov eax, 1
call fcn.00402ad0
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x40c220
mov ecx, str.open
mov edx, ebx
mov eax, 2
call fcn.00402ad0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xb4], eax
test eax, eax
je 0x40ba9d
mov edx, eax
xor eax, eax
call fcn.00401b80
mov dword [ebp - 0x68], eax
mov ecx, str.open
mov edx, ebx
mov eax, 4
call fcn.00402ad0
mov edx, ebx
test eax, eax
mov ecx, eax
mov eax, str.A_Wine_application
cmovne eax, ecx
xor ecx, ecx
mov dword [ebp - 0x84], eax
mov eax, 0x80000000
call fcn.00402340
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x40bb75
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], str._s__s
mov dword [esp + 4], eax
call fcn.00401ad0
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xac], edi
test edi, edi
je 0x40cc21
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0xa4], esi
mov esi, eax
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb0], ecx
mov ebx, ecx
jmp 0x40bb33
mov eax, dword [edi + 4]
cmovns eax, dword [edi + 8]
mov edi, eax
test eax, eax
je 0x40c309
mov dword [esp + 4], edi
mov dword [esp], esi
call ebx
test eax, eax
jne 0x40bb22
mov ecx, dword [ebp - 0xa0]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov esi, dword [ebp - 0xa4]
mov ebx, dword [ebp - 0xbc]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0xc4]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0xb4]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x68]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x94]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x98]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x9c]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x64]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, dword [ebp - 0x6c]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
jmp 0x40b8b8
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0xc0]
test eax, eax
je 0x40bd88
lea esi, [esi]
mov esi, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x40bca8
mov eax, dword [esi + 8]
test eax, eax
jne 0x40bca8
mov dword [ebp - 0x64], edi
mov edi, esi
mov edx, dword fs:[0x18]
mov esi, edx
lea esi, [esi]
lea esi, [esi]
mov ebx, dword [edi]
test ebx, ebx
je 0x40bd3c
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x40bcf8
test eax, eax
je 0x40bcf8
lea esi, [esi]
mov ebx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x40bce8
mov eax, dword [ebx + 8]
test eax, eax
jne 0x40bce8
mov eax, dword [edi - 4]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
lea ecx, [edi - 4]
mov edi, ebx
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
jmp 0x40bcd0
mov esi, edi
mov edi, dword [ebp - 0x64]
mov eax, dword [esi - 4]
mov dword [esp + 4], 0
sub esi, 4
mov ebx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x60]
call fcn.00401c70
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x64], eax
jmp 0x40b395
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x38], str.update_mime_database
mov dword [esp], eax
call sub.kernel32.dll_wine_get_unix_file_name
mov ebx, dword [ebp - 0x60]
mov dword [esp + 4], 0
mov dword [ebp - 0x34], eax
mov dword [esp], ebx
mov dword [ebp - 0x30], 0
call sub.ntdll.dll___wine_unix_spawnvp
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x38], str.update_desktop_database
sub esp, 8
mov dword [esp], eax
call sub.kernel32.dll_wine_get_unix_file_name
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [ebp - 0x34], eax
call sub.ntdll.dll___wine_unix_spawnvp
sub esp, 8
jmp 0x40b656
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.could_not_initialize_COM__error_0x_08lX_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40afd0
call fcn.0040a840
jmp 0x40b542
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x40b74a
mov ecx, dword [edi + 4]
mov eax, dword [edi]
cmp word [ecx], 0
mov dword [ebp - 0x68], eax
je 0x40be75
mov eax, ecx
nop
add eax, 2
cmp word [eax], 0
jne 0x40be60
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x64], eax
jmp 0x40b9f6
mov dword [ebp - 0x64], 0
jmp 0x40b9f6
lea eax, [ebp - 0x50]
call fcn.004010c0
mov ebx, eax
test eax, eax
je 0x40ae64
lea eax, [ebp - 0x50]
call fcn.004010c0
mov edx, eax
test eax, eax
je 0x40ae64
mov eax, ebx
call fcn.004092f0
jmp 0x40ae64
mov edx, 0x75
mov eax, str._usr_local_share_:_usr_share_
jmp 0x40bec1
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
jne 0x40bebd
sub eax, 0x41005a
call fcn.00401510
mov edx, 0x2f
mov ebx, eax
xor eax, eax
jmp 0x40bee7
movzx edx, word [eax + str._usr_local_share_:_usr_share_]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x40bee0
jmp 0x40b348
test byte [section..data], 2
je 0x40b64b
mov dword [esp + 0xc], str.could_not_open_file_associations_key_n
mov dword [esp + 8], str.cleanup_associations
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40b64b
mov eax, dword [edi]
mov dword [ebp - 0x68], eax
jmp 0x40be5d
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x40b601
test byte [section..data], 2
je 0x40ae64
mov eax, ebx
shr eax, 0x10
je 0x40cbb6
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40bf8e
mov eax, ebx
call fcn.004012a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unknown_option__s_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40ae64
mov ebx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x84]
jmp 0x40b35d
mov eax, dword [ebp - 0x38]
lea edi, [eax - 8]
cmp dword [ebp - 0x60], eax
jne 0x40b999
mov dword [esp + 4], str..lnk
mov eax, dword [ebp - 0x6c]
mov dword [esp], ebx
call eax
test eax, eax
je 0x40cbd8
lea eax, [ebx + 2]
mov dword [esp], str.application_x_wine_extension__s
mov dword [esp + 4], eax
mov dword [ebp - 0x6c], eax
call fcn.00401ad0
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x40c0f6
mov edi, dword [ebp - 0x64]
test edi, edi
je 0x40df24
mov eax, dword [ebp - 0x64]
cmp word [eax], 0
je 0x40cc62
add eax, 2
cmp word [eax], 0
jne 0x40c02f
sub eax, dword [ebp - 0x64]
add eax, 2
call fcn.00401510
mov ecx, dword [ebp - 0x64]
mov edi, eax
xor eax, eax
movzx edx, word [ecx + eax]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x40c04a
movzx eax, word [edi]
mov edx, edi
test ax, ax
je 0x40c07e
cmp ax, 0x2f
jne 0x40c072
mov ecx, 0x2d
mov word [edx], cx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x40c064
mov eax, dword [ebp - 0x98]
mov dword [esp + 4], 0x2c
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
xor edx, edx
test eax, eax
je 0x40c0bf
xor edx, edx
add eax, 2
mov word [eax - 2], dx
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcstol]
mov edx, eax
mov dword [esp], 0
mov eax, dword [ebp - 0x98]
mov ecx, edi
call fcn.00406a40
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x40ca53
mov eax, dword [ebp - 0x6c]
mov dword [esp], str._sx_wine_extension__s.xml
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [esp + 4], eax
call fcn.00401ad0
mov dword [esp + 4], 0x40f368
mov dword [ebp - 0x68], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wfopen]
mov edi, eax
test eax, eax
je 0x40c9dc
mov dword [esp + 4], str.__xml_version_1.0__encoding_UTF_8____n
mov dword [esp], eax
call fcn.00401190
mov dword [esp + 4], str._mime_info_xmlns_http:__www.freedesktop.org_standards_shared_mime_info___n
mov dword [esp], edi
call fcn.00401190
mov eax, dword [ebp - 0x64]
call fcn.00401d20
mov dword [esp + 4], str.___mime_type_type__s___n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401190
mov eax, ebx
call fcn.00401d20
mov dword [esp + 4], str._____glob_pattern__s____n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401190
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x40c1b8
call fcn.00401d20
mov dword [esp + 4], str._____comment__s__comment__n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401190
mov dword [esp + 4], str.____mime_type__n
mov dword [esp], edi
call fcn.00401190
mov dword [esp + 4], str.__mime_info__n
mov dword [esp], edi
call fcn.00401190
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_fclose]
mov ecx, dword [ebp - 0x68]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov dword [ebp - 0x88], 1
sub esp, 0xc
jmp 0x40ba50
mov eax, str._null_
jmp 0x40b601
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xb4], 0
jmp 0x40bb75
mov dword [esp + 0xc], str.could_not_build_native_MIME_types_n
mov dword [esp + 8], str.generate_associations
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40b395
mov edx, dword [ebp - 0x64]
test edx, edx
jns 0x40b9f6
mov eax, dword [edi]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], eax
jmp 0x40b9f6
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x40bfd8
mov edi, dword [ebp - 0x9c]
mov dword [esp + 4], 0x2f
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x40bfd8
cmp word [edi], 0
mov eax, edi
je 0x40cc44
add eax, 2
cmp word [eax], 0
jne 0x40c2bb
sub eax, dword [ebp - 0x9c]
add eax, 2
call fcn.00401510
mov dword [ebp - 0x64], eax
xor eax, eax
mov ecx, dword [ebp - 0x9c]
movzx edx, word [ecx + eax]
mov ecx, dword [ebp - 0x64]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x40c2d7
lea eax, [ebx + 2]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x40c022
jmp 0x40c0f6
mov eax, 0x14
mov esi, dword [ebp - 0xa4]
mov ebx, dword [ebp - 0xbc]
call fcn.00401510
mov ecx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xac]
mov dword [ebp - 0xa4], eax
mov dword [eax], ecx
jmp 0x40c346
lea ecx, [edi + 4]
lea edx, [edi + 8]
cmovs edx, ecx
mov eax, dword [edx]
test eax, eax
je 0x40c3a6
mov edi, eax
mov eax, dword [ebp - 0xa0]
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [ebp - 0xb0]
call eax
test eax, eax
jne 0x40c335
test byte [section..data], 2
je 0x40bb75
mov dword [esp + 0xc], str.error_updating_rb_tree_n
mov dword [esp + 8], str.generate_associations
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40bb75
mov eax, 2
jmp 0x40b326
xor ebx, ebx
jmp 0x40b348
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], edi
lea edi, [eax + 4]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xac]
mov byte [ebp - 0xa0], 0
mov dword [eax + 0x10], 1
mov dword [eax + 4], ecx
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [edx], edi
mov eax, dword [edi]
test eax, eax
je 0x40c438
test byte [eax + 0xc], 1
je 0x40c426
mov edx, dword [eax]
mov ecx, dword [edx + 4]
cmp ecx, eax
je 0x40d0bf
test ecx, ecx
je 0x40d04b
test byte [ecx + 0xc], 1
je 0x40d04b
xor dword [edx + 0xc], 1
xor dword [ecx + 0xc], 1
mov eax, dword [edx + 8]
xor dword [eax + 0xc], 1
mov eax, dword [edi]
mov edi, dword [eax]
mov eax, dword [edi]
test eax, eax
jne 0x40c3e8
cmp byte [ebp - 0xa0], 0
je 0x40c438
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
and dword [eax + 0xc], 0xfffffffe
lea eax, [ebp - 0x44]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x410274
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
test eax, eax
jne 0x40cb44
mov edi, dword [ebp - 0x44]
test edi, edi
je 0x40cb44
mov edx, ebx
mov ecx, str.MimeType
mov eax, edi
call fcn.00402340
mov dword [ebp - 0xa0], 1
mov edx, eax
test eax, eax
je 0x40c4ba
mov eax, dword [ebp - 0x64]
mov dword [esp], edx
mov dword [ebp - 0xa4], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa8]
call eax
mov edx, dword [ebp - 0xa4]
test eax, eax
setne al
movzx eax, al
mov dword [ebp - 0xa0], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov edx, ebx
mov ecx, str.ProgID
mov eax, edi
sub esp, 0xc
call fcn.00402340
mov edx, eax
test eax, eax
je 0x40c513
mov eax, dword [ebp - 0x6c]
mov dword [esp], edx
mov dword [ebp - 0xa4], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa8]
call eax
mov edx, dword [ebp - 0xa4]
test eax, eax
je 0x40c51d
mov dword [ebp - 0xa0], 1
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov edx, ebx
mov ecx, str.AppName
mov eax, edi
sub esp, 0xc
call fcn.00402340
mov edx, eax
test eax, eax
je 0x40c579
mov eax, dword [ebp - 0x84]
mov dword [esp], edx
mov dword [ebp - 0xa4], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa8]
call eax
mov edx, dword [ebp - 0xa4]
test eax, eax
je 0x40c583
mov dword [ebp - 0xa0], 1
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0xac], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov ecx, str.OpenWithIcon
mov edx, ebx
mov eax, edi
sub esp, 0xc
call fcn.00402340
mov edx, eax
mov eax, dword [ebp - 0x68]
test eax, eax
setne byte [ebp - 0xa4]
test edx, edx
movzx ecx, byte [ebp - 0xa4]
setne al
cmp cl, al
je 0x40cea5
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov dword [esp], edi
call sub.advapi32.dll_RegCloseKey
sub esp, 4
lea eax, [ebx + 2]
mov dword [esp], str._swine_extension__s.desktop
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
call fcn.00401ad0
mov dword [esp], str.WINECONFIGDIR
mov edi, eax
mov eax, dword [ebp - 0x78]
call eax
mov dword [ebp - 0xc8], eax
test byte [section..data], 8
jne 0x40cd22
mov dword [esp + 4], 0x40f368
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wfopen]
test eax, eax
je 0x40ccb3
mov dword [esp + 4], str._Desktop_Entry__n
mov dword [esp], eax
mov dword [ebp - 0x88], eax
call fcn.00401190
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.TypeApplication_n
mov dword [esp], eax
call fcn.00401190
mov eax, dword [ebp - 0x84]
call fcn.00401610
mov dword [esp + 4], str.Name_s_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call fcn.00401190
mov eax, dword [ebp - 0x64]
call fcn.00401610
mov dword [esp + 4], str.MimeType_s__n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call fcn.00401190
mov ecx, dword [ebp - 0xc8]
test ecx, ecx
je 0x40cc8c
mov dword [esp], ecx
call sub.kernel32.dll_wine_get_unix_file_name
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x6c]
call fcn.00401f40
mov ecx, dword [ebp - 0xa0]
mov dword [esp + 0xc], str.wine
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x88]
mov dword [esp + 8], ecx
mov dword [esp + 4], str.Execenv_WINEPREFIX__s___s_start__ProgIDOpen__s___f_n
mov dword [esp], eax
call fcn.00401190
mov ecx, dword [ebp - 0xa0]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.NoDisplaytrue_n
mov dword [esp], eax
call fcn.00401190
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.StartupNotifytrue_n
mov dword [esp], eax
call fcn.00401190
mov ecx, dword [ebp - 0x68]
test ecx, ecx
je 0x40c79e
mov eax, ecx
call fcn.00401610
mov dword [esp + 4], str.Icon_s_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call fcn.00401190
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fclose]
lea eax, [ebp - 0x44]
mov dword [esp + 4], 0x410274
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov dword [ebp - 0x48], 0
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
test eax, eax
jne 0x40cf30
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x88], eax
test eax, eax
je 0x40cf30
lea eax, [ebp - 0x48]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
test eax, eax
jne 0x40cefa
mov ecx, dword [ebp - 0x64]
cmp word [ecx], 0
mov eax, ecx
je 0x40c823
add eax, 2
cmp word [eax], 0
jne 0x40c81a
mov ecx, dword [ebp - 0x64]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 4], str.MimeType
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x6c]
sub esp, 0x18
cmp word [eax], 0
je 0x40cc4f
add eax, 2
cmp word [eax], 0
jne 0x40c866
mov ecx, dword [ebp - 0x6c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 4], str.ProgID
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x84]
sub esp, 0x18
cmp word [eax], 0
je 0x40cc57
add eax, 2
cmp word [eax], 0
jne 0x40c8b5
mov ecx, dword [ebp - 0x84]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 4], str.AppName
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, edi
sub esp, 0x18
cmp word [edi], 0
je 0x40c908
add eax, 2
cmp word [eax], 0
jne 0x40c8ff
sub eax, edi
mov dword [esp + 0x10], edi
add eax, 2
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 8], 0
mov dword [esp + 4], str.DesktopFile
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x68]
sub esp, 0x18
test eax, eax
je 0x40cc72
cmp word [eax], 0
je 0x40cc6a
add eax, 2
cmp word [eax], 0
jne 0x40c950
mov ecx, dword [ebp - 0x68]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 4], str.OpenWithIcon
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 0x88], 1
push eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
jmp 0x40cb5d
test byte [section..data], 2
je 0x40c1e1
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40d041
shr eax, 0x10
je 0x40d028
mov edi, dword [ebp - 0x68]
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40ca26
mov eax, edi
call fcn.004012a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.error_writing_file__s_n
mov dword [esp + 8], str.write_freedesktop_mime_type_entry
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40c1e1
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x40d01e
shr eax, 0x10
je 0x40d000
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], 0xffffffff
mov edi, str._invalid_
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x40ca9a
mov eax, dword [ebp - 0x94]
call fcn.004012a0
mov edi, eax
mov eax, ebx
shr eax, 0x10
je 0x40cf70
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x68], str._invalid_
sub esp, 8
test eax, eax
jne 0x40cace
mov eax, ebx
call fcn.004012a0
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x40cef0
shr eax, 0x10
je 0x40d0e4
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40cb0c
mov eax, dword [ebp - 0x64]
call fcn.004012a0
mov ecx, dword [ebp - 0x68]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], str.writing_MIME_type__s__extension_s__comment_s_n
mov dword [esp + 8], str.write_freedesktop_mime_type_entry
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x40c103
mov edi, dword [ebp - 0x68]
test edi, edi
setne byte [ebp - 0xa4]
test byte [section..data], 2
jne 0x40d0fd
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x40bb75
cmp byte [ebp - 0xa4], 0
je 0x40bb75
mov dword [esp], 0
mov ecx, dword [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 0xb4]
call fcn.00406a40
mov dword [ebp - 0x88], 1
jmp 0x40bb75
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.004019b0
jmp 0x40b58f
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.004019b0
jmp 0x40bf8e
mov eax, 2
jmp 0x40ba2a
mov edx, 0x70
mov eax, str.application_x_ms_shortcut
jmp 0x40cbe8
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
jne 0x40cbe4
sub eax, 0x410096
call fcn.00401510
mov edx, 0x61
mov dword [ebp - 0x64], eax
xor eax, eax
jmp 0x40cc0d
movzx edx, word [eax + str.application_x_ms_shortcut]
mov ecx, dword [ebp - 0x64]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x40cc06
jmp 0x40c2f0
mov eax, 0x14
call fcn.00401510
mov ecx, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0xa4], eax
lea edi, [eax + 4]
mov dword [eax], ecx
jmp 0x40c3b5
mov eax, dword [ebp - 0x9c]
jmp 0x40c2c4
mov eax, dword [ebp - 0x6c]
jmp 0x40c86f
mov eax, dword [ebp - 0x84]
jmp 0x40c8be
mov eax, dword [ebp - 0x64]
jmp 0x40c038
mov eax, dword [ebp - 0x68]
jmp 0x40c959
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], str.OpenWithIcon
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteValueW
push eax
push eax
jmp 0x40c98f
mov eax, dword [ebp - 0x6c]
call fcn.00401f40
mov dword [esp + 4], str.Execwine_start__ProgIDOpen__s___f_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call fcn.00401190
jmp 0x40c74a
test byte [section..data], 2
je 0x40c9b4
test edi, edi
je 0x40d1b2
mov eax, edi
shr eax, 0x10
je 0x40d19a
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40d1bc
mov eax, edi
call fcn.004012a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.error_writing_association_file__s_n
mov dword [esp + 8], str.write_freedesktop_association_entry
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40c9b4
test edi, edi
je 0x40d2c1
mov eax, edi
shr eax, 0x10
je 0x40d2a3
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push ecx
push ecx
test eax, eax
jne 0x40d294
mov eax, edi
call fcn.004012a0
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40d285
shr eax, 0x10
je 0x40d266
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40d257
mov eax, dword [ebp - 0x68]
call fcn.004012a0
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x6c]
shr eax, 0x10
je 0x40d238
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push ecx
push ecx
test eax, eax
jne 0x40d229
mov eax, dword [ebp - 0x6c]
call fcn.004012a0
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x40d21a
shr eax, 0x10
je 0x40d1fb
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x40d1ec
mov eax, dword [ebp - 0x64]
call fcn.004012a0
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x84]
shr eax, 0x10
je 0x40d1d0
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push ecx
push ecx
test eax, eax
jne 0x40d1c6
mov eax, dword [ebp - 0x84]
call fcn.004012a0
mov ecx, dword [ebp - 0xac]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.friendlyAppName_s__MIME_type__s__progID_s__icon_s_to_file__s_n
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0xa0]
mov dword [esp + 8], str.write_freedesktop_association_entry
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [esp + 4], 0x40e000
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0xb0]
mov dword [esp], 3
mov dword [esp + 0x14], ecx
call fcn.00401480
jmp 0x40c645
mov eax, dword [ebp - 0x68]
test eax, eax
jne 0x40cf8b
mov eax, dword [ebp - 0xac]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov dword [esp], edi
call sub.advapi32.dll_RegCloseKey
cmp dword [ebp - 0xa0], 0
push ecx
jne 0x40c60a
jmp 0x40bb75
mov eax, str._null_
jmp 0x40cb0c
test byte [section..data], 2
je 0x40c98f
mov dword [esp + 0xc], str.could_not_create_extension_subkey_n
mov dword [esp + 8], str.update_association
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40c98f
mov dword [ebp - 0x88], 0
test byte [section..data], 2
je 0x40c98f
mov dword [esp + 0xc], str.could_not_open_file_associations_key_n
mov dword [esp + 8], str.update_association
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40c98f
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
mov dword [ebp - 0x68], eax
jmp 0x40cace
mov eax, dword [ebp - 0x68]
mov dword [esp], edx
mov dword [ebp - 0xb0], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa8]
call eax
mov edx, dword [ebp - 0xb0]
test eax, eax
jne 0x40c5dc
mov eax, dword [ebp - 0xac]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 0xc
mov dword [esp], edi
call sub.advapi32.dll_RegCloseKey
cmp dword [ebp - 0xa0], 0
push eax
jne 0x40c60a
mov byte [ebp - 0xa4], 1
jmp 0x40cb5d
movzx eax, word [ebp - 0x94]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
mov edi, eax
jmp 0x40ca9a
mov edi, str._null_
jmp 0x40ca9a
movzx eax, word [ebp - 0x68]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x40ca26
mov eax, str._null_
jmp 0x40ca26
mov ecx, dword [eax + 4]
cmp edi, ecx
je 0x40d0a3
mov eax, dword [edi]
and dword [eax + 0xc], 0xfffffffe
mov eax, dword [edi]
mov eax, dword [eax]
or dword [eax + 0xc], 1
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
test ecx, ecx
je 0x40d094
cmp eax, dword [ecx + 4]
je 0x40d08f
mov dword [ecx + 8], edx
mov ecx, dword [edx + 4]
mov dword [eax + 8], ecx
test ecx, ecx
je 0x40d081
mov dword [ecx], eax
mov dword [edx + 4], eax
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [eax], edx
jmp 0x40c420
mov dword [ecx + 4], edx
jmp 0x40d075
mov dword [ebp - 0xb8], edx
mov byte [ebp - 0xa0], 1
jmp 0x40d075
mov dword [edx + 8], ecx
mov edx, dword [ecx + 8]
mov dword [eax + 4], edx
test edx, edx
je 0x40d0b2
mov dword [edx], eax
mov dword [ecx + 8], eax
mov edx, dword [eax]
mov edi, eax
mov dword [ecx], edx
mov dword [eax], ecx
jmp 0x40d052
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x40d126
test byte [ecx + 0xc], 1
je 0x40d126
xor dword [edx + 0xc], 1
xor dword [eax + 0xc], 1
mov eax, dword [edx + 8]
xor dword [eax + 0xc], 1
mov eax, dword [edi]
mov edi, dword [eax]
jmp 0x40c420
movzx eax, word [ebp - 0x64]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x40cb0c
mov dword [esp + 0xc], str.error_opening_associations_registry_key_n
mov dword [esp + 8], str.has_association_changed
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x40cb5d
mov ecx, dword [eax + 8]
cmp edi, ecx
je 0x40d17e
mov eax, dword [edi]
and dword [eax + 0xc], 0xfffffffe
mov eax, dword [edi]
mov eax, dword [eax]
or dword [eax + 0xc], 1
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
test ecx, ecx
je 0x40d16f
cmp eax, dword [ecx + 4]
je 0x40d16a
mov dword [ecx + 8], edx
mov ecx, dword [edx + 8]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x40d15c
mov dword [ecx], eax
mov dword [edx + 8], eax
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [eax], edx
jmp 0x40c420
mov dword [ecx + 4], edx
jmp 0x40d150
mov dword [ebp - 0xb8], edx
mov byte [ebp - 0xa0], 1
jmp 0x40d150
mov dword [edx + 4], ecx
mov edx, dword [ecx + 4]
mov dword [eax + 8], edx
test edx, edx
je 0x40d18d
mov dword [edx], eax
mov dword [ecx + 4], eax
mov edx, dword [eax]
mov edi, eax
mov dword [ecx], edx
mov dword [eax], ecx
jmp 0x40d12d
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x40ccf5
mov eax, str._null_
jmp 0x40ccf5
mov eax, str._invalid_
jmp 0x40ccf5
mov eax, str._invalid_
jmp 0x40ce50
movzx eax, word [ebp - 0x84]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x40ce50
mov dword [ebp - 0xb0], str._invalid_
jmp 0x40ce15
movzx eax, word [ebp - 0x64]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
mov dword [ebp - 0xb0], eax
jmp 0x40ce15
mov dword [ebp - 0xb0], str._null_
jmp 0x40ce15
mov dword [ebp - 0xbc], str._invalid_
jmp 0x40cdd5
movzx eax, word [ebp - 0x6c]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
mov dword [ebp - 0xbc], eax
jmp 0x40cdd5
mov dword [ebp - 0xa0], str._invalid_
jmp 0x40cd9d
movzx eax, word [ebp - 0x68]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
mov dword [ebp - 0xa0], eax
jmp 0x40cd9d
mov dword [ebp - 0xa0], str._null_
jmp 0x40cd9d
mov dword [ebp - 0xac], str._invalid_
jmp 0x40cd5d
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
mov dword [ebp - 0xac], eax
jmp 0x40cd5d
mov dword [ebp - 0xac], str._null_
jmp 0x40cd5d
movzx eax, word [pe_dos_header]
ud2