Function at 0x40cd40
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
xor eax, eax
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea edi, [ebp - 0x438]
sub esp, 0x718
mov edx, dword [ecx]
mov ebx, dword [ecx + 8]
mov ecx, 0x105
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.ucrtbase.dll_wcsncmp]
mov dword [0x41d4e0], edx
cmp word [ebx], 0
jne 0x40cd83
jmp 0x40cdc3
add ebx, 2
movzx eax, word [ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_iswspace]
test eax, eax
jne 0x40cd80
mov dword [esp], ebx
mov eax, 2
mov dword [esp + 8], eax
mov eax, 0x4169d4
mov dword [esp + 4], eax
call edi
test eax, eax
jne 0x40d730
xor esi, esi
add ebx, 4
mov dword [ebp - 0x438], esi
cmp word [ebx], 0
jne 0x40cd83
mov dword [esp], 0
call sym._OleInitialize_4
sub esp, 4
test eax, eax
js 0x40e059
cmp word [ebp - 0x434], 0
jne 0x40d8e0
mov eax, 8
mov dword [ebp - 0x6d0], eax
mov eax, 0x604
mov dword [ebp - 0x6cc], eax
lea eax, [ebp - 0x6d0]
mov dword [esp], eax
call sym._InitCommonControlsEx_4
sub esp, 4
test eax, eax
je 0x40e043
mov eax, sym._explorer_wnd_proc_16
xor esi, esi
mov dword [ebp - 0x55c], eax
mov eax, dword [0x41d4e0]
mov ecx, 0x30
mov dword [ebp - 0x558], esi
lea esi, [ebp - 0x564]
xor ebx, ebx
mov dword [ebp - 0x564], ecx
mov edx, str.ExplorerWClass
xor ecx, ecx
mov dword [esp], esi
mov edi, 4
mov dword [ebp - 0x550], eax
xor eax, eax
mov dword [ebp - 0x54c], eax
xor eax, eax
mov dword [ebp - 0x548], eax
mov eax, 1
mov dword [ebp - 0x544], eax
xor eax, eax
mov dword [ebp - 0x560], ebx
mov ebx, 0x417ca4
mov dword [ebp - 0x554], edi
mov edi, 4
mov dword [ebp - 0x53c], edx
mov dword [ebp - 0x538], ecx
mov dword [ebp - 0x540], eax
call sym._RegisterClassExW_4
lea eax, [ebp - 0x6e0]
sub esp, 4
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0x417c94
call sym._CoCreateInstance_20
sub esp, 0x14
cmp word [ebp - 0x434], 0
jne 0x40d958
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x668], edx
mov dword [ebp + eax - 0x664], edx
add eax, 8
cmp eax, 0x38
jb 0x40cedf
mov dword [esp + 8], esi
xor edi, edi
mov dword [ebp + eax - 0x668], edi
mov eax, 0x64
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [0x41d4e0]
mov dword [esp], eax
call sym._LoadStringW_16
mov eax, 0x32
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x5c8]
mov dword [esp + 8], eax
mov eax, 2
mov dword [esp + 4], eax
mov eax, dword [0x41d4e0]
mov dword [esp], eax
call sym._LoadStringW_16
sub esp, 0x10
mov dword [esp], 0
call sym._GetDC_4
mov edi, eax
sub esp, 4
mov dword [esp], edi
mov eax, 0x58
mov dword [esp + 4], eax
call sym._GetDeviceCaps_8
mov edx, 0x5a
mov dword [ebp - 0x6f0], eax
sub esp, 8
mov dword [esp + 4], edx
mov dword [esp], edi
call sym._GetDeviceCaps_8
mov dword [ebp - 0x6ec], eax
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], 0
call sym._ReleaseDC_8
mov eax, dword [ebp - 0x6ec]
mov ecx, 0x60
mov edi, dword [sym.imp.kernel32.dll_MulDiv]
sub esp, 8
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], 0x1e
call edi
mov dword [0x41d2ac], eax
sub esp, 0xc
mov eax, 0x60
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6ec]
mov dword [esp], 0x18
mov dword [esp + 4], eax
call edi
mov ecx, dword [ebp - 0x6f0]
mov dword [0x41d2a8], eax
sub esp, 0xc
mov eax, 0x60
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], 0x280
call edi
mov dword [0x41d2a4], eax
sub esp, 0xc
mov eax, 0x60
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6ec]
mov dword [esp], 0x1e0
mov dword [esp + 4], eax
call edi
mov edx, 0x24
mov ecx, 8
mov dword [0x41d2a0], eax
sub esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x6f0], eax
call eax
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x40dae0
mov dword [esp + 0x10], eax
mov eax, 0x4181f4
xor edx, edx
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x417ff4
call sym._CoCreateInstance_20
sub esp, 0x14
test eax, eax
js 0x40db20
mov dword [edi + 0xc], 0
xor eax, eax
mov ecx, 0xcf0000
mov dword [esp + 0x2c], eax
mov eax, dword [0x41d4e0]
mov edx, 0x80000000
mov dword [esp + 8], esi
mov esi, str.ExplorerWClass
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [0x41d2a0]
mov dword [esp + 4], esi
mov dword [esp], 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x41d2a4]
mov dword [esp + 0x18], eax
mov eax, 0x80000000
mov dword [esp + 0x14], eax
call sym._CreateWindowExW_48
mov ecx, dword [ebp - 0x6e0]
mov dword [edi + 4], eax
sub esp, 0x30
test ecx, ecx
je 0x40d14f
mov esi, dword [ecx]
lea edx, [edi + 0x20]
mov dword [esp + 0x10], edx
xor edx, edx
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [esi + 0x28]
mov eax, dword [ebp - 0x6e0]
mov dword [edi + 0x1c], eax
sub esp, 0x14
xor eax, eax
mov ecx, 4
mov dword [ebp - 0x694], eax
mov eax, dword [0x41d2a4]
mov esi, 1
mov dword [ebp - 0x6c4], esi
lea edx, [ebp - 0x694]
mov dword [ebp - 0x6c8], ecx
lea esi, [ebp - 0x6c8]
mov dword [ebp - 0x68c], eax
xor eax, eax
mov dword [ebp - 0x690], eax
mov eax, dword [0x41d2a0]
mov dword [ebp - 0x688], eax
mov eax, dword [edi]
mov ecx, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov esi, dword [edi + 4]
mov dword [esp], eax
mov dword [esp + 4], esi
xor esi, esi
call dword [ecx + 0xc]
mov eax, dword [edi]
mov edx, 2
mov ecx, dword [eax]
sub esp, 0x10
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [ecx + 0x2c]
xor ecx, ecx
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._SetWindowLongW_12
mov eax, dword [0x41d4e0]
xor ecx, ecx
mov edx, 0x50000241
sub esp, 0xc
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x2c], esi
mov esi, str.ReBarWindow32
mov dword [esp + 0x24], eax
mov eax, dword [edi + 4]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp], pe_nt_image_headers32
call sym._CreateWindowExW_48
mov ecx, 0x50000800
sub esp, 0x30
mov edx, eax
mov dword [ebp - 0x6ec], edx
xor eax, eax
mov dword [esp + 0x2c], eax
mov eax, dword [0x41d4e0]
mov dword [esp + 0x20], edx
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, str.ToolbarWindow32
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 8
call sym._CreateWindowExW_48
lea ecx, [ebp - 0x6c0]
mov esi, eax
mov eax, 0xffffffff
mov dword [ebp - 0x6c0], eax
mov eax, 9
sub esp, 0x30
mov dword [ebp - 0x6bc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0x413
mov dword [esp + 0xc], ecx
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._SendMessageW_16
lea ecx, [ebp - 0x6c0]
mov edx, 5
mov dword [ebp - 0x6bc], edx
mov dword [ebp - 0x6f4], eax
sub esp, 0x10
mov eax, 0x413
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._SendMessageW_16
mov ecx, dword [ebp - 0x6f4]
mov dword [ebp - 0x668], ecx
sub esp, 0x10
add eax, 8
mov dword [ebp - 0x640], eax
mov eax, 0x1004
xor edx, edx
mov word [ebp - 0x638], ax
xor eax, eax
inc ecx
mov dword [esp + 0xc], eax
mov eax, 0x14
mov dword [ebp - 0x664], edx
mov edx, 0x1004
mov dword [ebp - 0x654], ecx
mov ecx, 1
mov dword [esp + 8], eax
mov eax, 0x41e
mov word [ebp - 0x660], dx
mov edx, 0x1004
mov dword [ebp - 0x650], ecx
mov ecx, 2
mov dword [esp], esi
mov dword [esp + 4], eax
mov word [ebp - 0x64c], dx
mov dword [ebp - 0x63c], ecx
call sym._SendMessageW_16
lea ecx, [ebp - 0x668]
mov edx, 0x444
mov eax, 3
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._SendMessageW_16
mov eax, 0x71
mov ecx, 0x64
mov dword [ebp - 0x628], eax
mov eax, 0x84
xor edx, edx
mov dword [ebp - 0x624], eax
mov eax, dword [0x41d2ac]
mov dword [ebp - 0x60c], esi
lea esi, [ebp - 0x62c]
mov dword [ebp - 0x62c], ecx
xor ecx, ecx
mov dword [ebp - 0x600], edx
mov dword [ebp - 0x5f4], eax
sub esp, 0x10
mov dword [ebp - 0x604], eax
mov eax, 0xffffffff
mov dword [esp + 8], eax
mov eax, 0x40a
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6ec]
mov dword [esp + 0xc], esi
mov dword [ebp - 0x608], ecx
mov dword [esp], eax
call sym._SendMessageW_16
xor eax, eax
xor edx, edx
mov ecx, 0x50000002
sub esp, 0x10
mov dword [esp + 0x2c], eax
mov eax, dword [0x41d4e0]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp], 0
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x6ec]
mov dword [esp + 0x20], eax
mov eax, dword [0x41d2a8]
mov dword [esp + 0x1c], eax
mov eax, dword [0x41d2a4]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, 0x4169e2
mov dword [esp + 8], eax
mov eax, str.ComboBoxEx32
mov dword [esp + 4], eax
call sym._CreateWindowExW_48
lea edx, [ebp - 0x694]
mov dword [edi + 8], eax
sub esp, 0x30
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._GetWindowRect_8
mov edx, dword [ebp - 0x690]
xor ecx, ecx
mov dword [ebp - 0x600], ecx
mov eax, dword [ebp - 0x688]
lea ecx, [ebp - 0x5c8]
or dword [ebp - 0x624], 1
or dword [ebp - 0x628], 4
mov dword [ebp - 0x618], ecx
sub eax, edx
mov dword [ebp - 0x5f4], eax
sub esp, 8
mov dword [ebp - 0x604], eax
xor eax, eax
mov dword [ebp - 0x608], eax
mov eax, dword [edi + 8]
mov dword [esp + 0xc], esi
mov dword [ebp - 0x60c], eax
mov eax, 0xffffffff
mov dword [esp + 8], eax
mov eax, 0x40a
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6ec]
mov dword [esp], eax
call sym._SendMessageW_16
mov edx, 0xc
xor ecx, ecx
mov eax, dword fs:[0x18]
sub esp, 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x6f0]
call eax
mov dword [eax], sym._IExplorerBrowserEventsImpl_fnQueryInterface_12
sub esp, 0xc
mov esi, eax
mov dword [eax + 4], edi
mov dword [eax + 8], 1
lea eax, [edi + 0x14]
mov dword [esp + 8], eax
mov eax, 0x416a34
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._SHGetImageList_12
mov eax, dword [esi + 4]
mov dword [ebp - 0x6ec], esi
lea esi, [edi + 0x18]
mov eax, dword [eax + 0x14]
sub esp, 0xc
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0x402
mov dword [esp + 4], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [edi]
mov ecx, dword [eax]
sub esp, 0x10
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x6ec]
mov dword [esp], eax
mov dword [esp + 4], esi
call dword [ecx + 0x24]
lea eax, [ebp - 0x6d8]
sub esp, 0xc
mov dword [esp], eax
call sym._SHGetDesktopFolder_4
sub esp, 4
test ebx, ebx
je 0x40dcc8
mov eax, dword [ebp - 0x6d8]
xor esi, esi
xor edx, edx
mov ecx, dword [eax]
mov dword [esp + 0x18], esi
lea esi, [ebp - 0x684]
mov dword [esp + 0x10], edx
xor edx, edx
mov dword [esp + 0xc], ebx
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [ecx + 0xc]
sub esp, 0x1c
test eax, eax
js 0x40dbd0
mov eax, dword [ebp - 0x6d8]
lea ebx, [ebp - 0x6d4]
xor edx, edx
mov ecx, dword [eax]
mov dword [esp + 0x10], ebx
mov ebx, 0x418554
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x684]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [ecx + 0x14]
mov ebx, eax
mov eax, dword [ebp - 0x684]
sub esp, 0x14
mov dword [esp], eax
call sym._ILFree_4
sub esp, 4
test ebx, ebx
js 0x40dbd0
mov eax, dword [ebp - 0x6d8]
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x6d4]
sub esp, 4
mov eax, dword [edi]
xor edx, edx
mov ecx, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [ecx + 0x38]
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
call dword [eax + 8]
mov ecx, 0xa
sub esp, 4
mov dword [esp + 4], ecx
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._ShowWindow_8
mov eax, dword [edi + 4]
sub esp, 8
mov dword [esp], eax
call sym._UpdateWindow_4
mov edi, dword [ebp - 0x6ec]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
jmp 0x40d6f6
mov dword [esp], esi
call sym._TranslateMessage_4
sub esp, 4
mov dword [esp], esi
call sym._DispatchMessageW_4
sub esp, 4
mov dword [esp], esi
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call sym._GetMessageW_16
sub esp, 0x10
test eax, eax
jne 0x40d6e0
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], ebx
mov edx, 3
mov ecx, 0x4169cc
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call edi
test eax, eax
jne 0x40d760
mov eax, 1
add ebx, 6
mov dword [ebp - 0x438], eax
jmp 0x40cdbd
mov dword [esp], ebx
mov eax, 4
mov dword [esp + 8], eax
mov eax, 0x4169c4
mov dword [esp + 4], eax
call edi
test eax, eax
jne 0x40d790
lea edx, [ebx + 8]
lea eax, [ebp - 0x434]
call sym._copy_path_string
mov ebx, eax
jmp 0x40cdbd
mov dword [esp], ebx
mov eax, 6
mov dword [esp + 8], eax
mov eax, 0x4169b8
mov dword [esp + 4], eax
call edi
test eax, eax
je 0x40d940
mov dword [esp], ebx
mov ecx, 8
mov esi, 0x4169a8
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call edi
test eax, eax
mov esi, eax
jne 0x40da90
lea edx, [ebx + 0x10]
lea eax, [ebp - 0x22c]
call sym._copy_path_string
cmp word [ebp - 0x434], 0
mov ebx, eax
jne 0x40cdbd
cmp word [ebp - 0x22c], 0
je 0x40cdbd
lea eax, [ebp - 0x22c]
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x40d810
lea esi, [esi]
lea edx, [ebp - 0x22c]
cmp eax, edx
jbe 0x40d833
sub eax, 2
cmp word [eax], 0x5c
jne 0x40d820
lea edx, [ebp - 0x22c]
cmp eax, edx
je 0x40cdbd
lea ecx, [ebp - 0x22c]
mov edx, 0xfffffffe
sub edx, ecx
add edx, eax
mov dword [ebp - 0x6ec], edx
mov ecx, edx
shr ecx, 1
inc ecx
cmp edx, 0xc
jbe 0x40e038
lea edx, [ebp - 0x438]
mov esi, ecx
mov dword [ebp - 0x6f0], edx
shr esi, 3
shl esi, 4
add esi, edx
lea esi, [esi]
movdqu xmm0, xmmword [edx + 0x20c]
add edx, 0x10
movdqu xmmword [edx - 0xc], xmm0
cmp esi, edx
jne 0x40d880
mov esi, ecx
and esi, 0xfffffff8
lea edx, [ebp + esi*2 - 0x22c]
cmp esi, ecx
je 0x40d8c1
lea ecx, [ebp + esi*2 - 0x438]
nop
lea esi, [esi]
movzx esi, word [edx]
add edx, 2
add ecx, 2
mov word [ecx + 2], si
cmp edx, eax
jne 0x40d8b0
mov eax, dword [ebp - 0x6ec]
xor edx, edx
mov word [ebp + eax - 0x432], dx
jmp 0x40cdbd
lea ebx, [ebp - 0x434]
mov dword [esp], ebx
call sym._PathIsDirectoryW_4
sub esp, 4
test eax, eax
jne 0x40cde8
mov eax, 0xa
xor edx, edx
mov dword [esp + 0x14], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], 0
call sym._ShellExecuteW_24
sub esp, 0x18
cmp eax, 0x20
jbe 0x40cde8
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_ExitProcess]
lea edx, [ebx + 0xc]
lea eax, [ebp - 0x434]
call sym._copy_path_string
mov ebx, eax
jmp 0x40cdbd
mov edx, dword [sym.imp.kernel32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x434]
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [ebp - 0x6ec], edx
call edx
sub esp, 0x10
mov edi, eax
lea eax, [eax + eax]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
lea ecx, [ebp - 0x434]
mov edx, dword [ebp - 0x6ec]
mov dword [esp + 4], edi
mov dword [esp], ecx
mov ebx, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
call edx
mov edx, dword [ebp - 0x6e0]
sub esp, 0x10
test edx, edx
je 0x40cedb
test ebx, ebx
je 0x40ced9
mov dword [esp], ebx
call sym._ILCreateFromPathW_4
sub esp, 4
test eax, eax
mov edi, eax
je 0x40dbe0
lea edx, [ebp - 0x6b0]
mov ecx, eax
lea eax, [ebp - 0x6b8]
call sym._variant_from_pidl.isra.0
lea ecx, [ebp - 0x6e4]
xor eax, eax
mov word [ebp - 0x6a8], ax
mov eax, dword [ebp - 0x6e0]
mov edx, dword [eax]
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x6dc]
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x6a8]
mov dword [esp + 8], ecx
lea ecx, [ebp - 0x6b8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x3c]
sub esp, 0x1c
test eax, eax
jne 0x40db60
test byte [0x41304c], 8
jne 0x40dce0
mov eax, dword [ebp - 0x6dc]
mov dword [esp], eax
call sym._SetForegroundWindow_4
sub esp, 4
mov eax, dword [ebp - 0x6e0]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], ebx
mov eax, 8
mov dword [esp + 8], eax
mov eax, str._desktop_select__root__cd__e_
mov dword [esp + 4], eax
call edi
test eax, eax
je 0x40db88
mov dword [esp], ebx
mov eax, str.__desktop
mov esi, 9
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call edi
test eax, eax
jne 0x40e026
add ebx, 0x12
mov dword [esp], ebx
call sym._manage_desktop
jmp 0x40cdbd
test byte [0x41304c], 2
je 0x40d717
mov ecx, str.Could_not_allocate_an_explorer_info_struct_n
mov ebx, 0x416904
mov dword [esp + 0xc], ecx
mov esi, 0x41304c
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x40d717
test byte [0x41304c], 2
jne 0x40dba0
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 4], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], edi
call sym._ILFree_4
lea eax, [ebp - 0x6b8]
sub esp, 4
mov dword [esp], eax
call sym._VariantClear_4
sub esp, 4
jmp 0x40cedb
add ebx, 0x10
mov dword [esp], ebx
call sym._manage_desktop
jmp 0x40cdbd
mov dword [esp], 1
mov eax, str.Could_not_obtain_an_instance_of_IExplorerBrowser_n
mov dword [esp + 0xc], eax
mov eax, 0x416904
mov dword [esp + 8], eax
mov eax, 0x41304c
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0_2
jmp 0x40db29
mov ebx, dword [ebp - 0x6d8]
jmp 0x40d680
test byte [0x41304c], 2
je 0x40da68
mov eax, ebx
shr eax, 0x10
je 0x40dfb0
mov dword [esp], ebx
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x40dfda
cmp word [ebx], 0
je 0x40e005
nop
mov edx, eax
cmp word [ebx + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x40dc20
mov dword [ebp - 0x6ec], ebx
lea ecx, [ebp - 0x562]
mov edi, 0x224c
mov word [ebp - 0x564], di
jmp 0x40dc8b
cmp eax, 9
je 0x40de48
cmp eax, 0xa
jne 0x40de72
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea edi, [ebp - 0x442]
lea eax, [edx - 1]
cmp ecx, edi
ja 0x40df30
test edx, edx
jle 0x40df30
mov edx, eax
add dword [ebp - 0x6ec], 2
mov eax, dword [ebp - 0x6ec]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x40de58
jbe 0x40dc50
cmp eax, 0x22
je 0x40dec0
cmp eax, 0x5c
jne 0x40de65
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x40dc70
mov ebx, dword [ebp - 0x6d8]
lea esi, [ebp - 0x684]
jmp 0x40d680
mov eax, ebx
shr eax, 0x10
je 0x40df88
mov dword [esp], ebx
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x40dfd0
cmp word [ebx], 0
je 0x40dfe4
lea esi, [esi]
lea edi, [edi]
mov edx, eax
cmp word [ebx + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x40dd20
mov dword [ebp - 0x6ec], ebx
lea ecx, [ebp - 0x562]
mov eax, 0x224c
mov word [ebp - 0x564], ax
jmp 0x40dd8b
cmp eax, 9
je 0x40ddd0
cmp eax, 0xa
jne 0x40dde7
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea edi, [edi]
lea eax, [edx - 1]
test edx, edx
jle 0x40ded0
lea edi, [ebp - 0x442]
cmp ecx, edi
ja 0x40ded0
mov edx, eax
add dword [ebp - 0x6ec], 2
mov eax, dword [ebp - 0x6ec]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x40ddc0
jbe 0x40dd50
cmp eax, 0x22
je 0x40de38
cmp eax, 0x5c
nop
jne 0x40ddda
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x40dd70
mov word [ecx], 0x725c
add ecx, 2
jmp 0x40dd70
mov word [ecx], 0x745c
add ecx, 2
jmp 0x40dd70
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x40dfa0
mov byte [ecx], 0x5c
mov edi, eax
add ecx, 5
shr edi, 0xc
movzx ebx, byte [edi + str.0123456789abcdefmake_explorer_window]
mov edi, eax
shr edi, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefmake_explorer_window]
mov edi, eax
shr edi, 4
and eax, 0xf
and edi, 0xf
movzx eax, byte [eax + str.0123456789abcdefmake_explorer_window]
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefmake_explorer_window]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x40dd70
mov word [ecx], 0x225c
add ecx, 2
jmp 0x40dd70
mov word [ecx], 0x745c
add ecx, 2
jmp 0x40dc70
mov word [ecx], 0x725c
add ecx, 2
jmp 0x40dc70
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x40dfc8
mov byte [ecx], 0x5c
mov edi, eax
add ecx, 5
shr edi, 0xc
movzx ebx, byte [edi + str.0123456789abcdefmake_explorer_window]
mov edi, eax
shr edi, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefmake_explorer_window]
mov edi, eax
shr edi, 4
and eax, 0xf
and edi, 0xf
movzx eax, byte [eax + str.0123456789abcdefmake_explorer_window]
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefmake_explorer_window]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x40dc70
mov word [ecx], 0x225c
add ecx, 2
jmp 0x40dc70
mov byte [ecx], 0x22
test eax, eax
jle 0x40dffd
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
mov dword [esp], esi
call sym.___wine_dbg_strdup
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x6dc]
mov ebx, str.Found_window__lx_already_browsing_path__s._n
mov dword [esp + 0xc], ebx
mov esi, 0x416904
mov edi, 0x41304c
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x40da57
mov byte [ecx], 0x22
test eax, eax
jle 0x40e01e
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
mov dword [esp], esi
call sym.___wine_dbg_strdup
mov ebx, str.Failed_to_create_PIDL_for__s._n
mov esi, 0x416904
mov dword [esp + 0x10], eax
mov edi, 0x41304c
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x40da68
mov dword [esp], str._04x
movzx ebx, bx
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
jmp 0x40def3
mov byte [ecx], al
inc ecx
jmp 0x40dd70
mov dword [esp], str._04x
movzx ebx, bx
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
jmp 0x40df53
mov byte [ecx], al
inc ecx
jmp 0x40dc70
mov eax, str._invalid_
jmp 0x40def3
mov eax, str._invalid_
jmp 0x40df53
mov byte [ebp - 0x562], 0x22
lea ecx, [ebp - 0x562]
mov edx, 0x224c
mov word [ebp - 0x564], dx
lea eax, [ecx + 1]
jmp 0x40dee8
mov byte [ebp - 0x562], 0x22
mov ecx, 0x224c
mov word [ebp - 0x564], cx
lea ecx, [ebp - 0x562]
lea eax, [ecx + 1]
jmp 0x40df48
lea eax, [ebp - 0x434]
mov edx, ebx
call sym._copy_path_string
jmp 0x40cdc3
lea edx, [ebp - 0x22c]
jmp 0x40d8a4
test byte [0x41304c], 2
jne 0x40e088
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_ExitProcess]
test byte [0x41304c], 2
je 0x40e04c
mov dword [esp + 0xc], str.Could_not_initialize_COM_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x41304c
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x40e04c
mov dword [esp + 0xc], str.Could_not_initialize_Comctl_n
mov dword [esp + 8], str.wWinMain
mov dword [esp + 4], 0x41304c
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x40e04c