Function at 0x4070a0
Capabilities:
Get process heap flags
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x21a8
call fcn.0040def8
sub esp, eax
mov eax, dword [esp + eax]
mov dword [ebp - 0x2184], edx
mov dword [ebp - 0x217c], ecx
mov ebx, eax
lea ecx, [ebp - 0x2178]
mov eax, edx
mov dword [ebp - 0x2174], 0
lea edx, [ebp - 0x2170]
mov dword [ebp - 0x2170], 0xffffffff
mov dword [ebp - 0x216c], 0
call fcn.00402b90
test eax, eax
je 0x4074e0
mov eax, dword [ebp - 0x2170]
cmp eax, 0x19
mov dword [ebp - 0x2190], eax
movzx eax, byte [section..data]
ja 0x4075e0
mov esi, dword [ebp - 0x2190]
mov edx, 0xfdbef7ff
bt edx, esi
jb 0x4075e0
mov edi, dword [ebp - 0x2178]
lea esi, [ebp - 0x818]
mov dword [ebp - 0x218c], esi
mov dword [ebp - 0x2188], edi
test al, 8
jne 0x407e10
xor eax, eax
lea edi, [ebp - 0x1818]
mov word [ebp - 0x1818], ax
mov eax, dword [ebx]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x20]
lea eax, [ebp - 0x1e30]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0x104
mov dword [esp], edi
mov dword [ebp - 0x2180], eax
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x407cb0
xor eax, eax
lea esi, [ebp - 0x1818]
mov word [ebp - 0x1818], ax
mov eax, dword [ebx]
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x18]
lea eax, [ebp - 0x1018]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2180]
mov dword [esp + 8], 0x400
mov dword [esp], esi
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x407b50
mov ecx, dword [ebp - 0x218c]
lea edx, [ebp - 0x1818]
mov eax, ebx
call fcn.00404f00
lea eax, [ebp - 0x2038]
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
lea eax, [ebp - 0x1818]
mov dword [esp], eax
mov eax, dword [ebp - 0x2180]
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x407898
mov eax, dword [ebx]
xor edx, edx
lea edi, [ebp - 0x1818]
mov dword [esp], ebx
mov word [ebp - 0x1818], dx
lea edx, [ebp - 0x2174]
lea esi, [ebp - 0x1c28]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
call dword [eax + 0x40]
mov eax, dword [ebp - 0x2180]
sub esp, 0x10
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], edi
call eax
sub esp, 0xc
test byte [section..data], 8
jne 0x407740
xor edx, edx
cmp word [ebp - 0x2038], 0
mov word [ebp - 0x1a20], dx
jne 0x407300
mov eax, dword [ebx]
lea edx, [ebp - 0x2168]
mov dword [esp], ebx
mov dword [ebp - 0x2168], 0
mov dword [esp + 4], edx
call dword [eax + 0x10]
mov eax, dword [ebp - 0x2168]
sub esp, 8
test eax, eax
je 0x407300
lea ebx, [ebp - 0x2038]
mov dword [esp], eax
mov dword [esp + 4], ebx
call sub.shell32.dll_SHGetPathFromIDListW
sub esp, 8
test eax, eax
je 0x407300
test byte [section..data], 8
jne 0x408100
lea esi, [esi]
mov eax, dword [ebp - 0x217c]
mov edx, dword [ebp - 0x2174]
mov ecx, 0
cmp word [ebp - 0x1c28], 0
mov dword [esp], eax
je 0x407620
mov eax, esi
call fcn.00406a40
mov ebx, eax
test ebx, ebx
je 0x407635
cmp word [ebp - 0x2038], 0
jne 0x407fb0
mov dword [esp + 0xc], str.winemenubuilder_semaphore
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
sub esp, 0x10
mov dword [ebp - 0x216c], eax
lea eax, [ebp - 0x216c]
mov dword [esp + 0x10], 0x4ff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.user32.dll_MsgWaitForMultipleObjects
sub esp, 0x14
test eax, eax
jne 0x407f70
mov eax, dword [ebp - 0x2190]
cmp eax, 0x10
je 0x408000
cmp eax, 0x19
je 0x408013
lea eax, [ebp - 0x1a20]
mov dword [esp + 0xc], ebx
mov edx, dword [ebp - 0x2188]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e30]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2184]
mov dword [esp], 0
mov ecx, eax
call fcn.004048b0
test eax, eax
mov dword [esp + 8], 0
sete al
sete byte [ebp - 0x2180]
movzx eax, al
mov dword [esp + 4], 1
mov esi, eax
mov eax, dword [ebp - 0x216c]
xor esi, 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseSemaphore]
sub esp, 0xc
mov eax, dword [ebp - 0x216c]
test eax, eax
je 0x407448
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x2188]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x217c]
sub esp, 0xc
test eax, eax
jne 0x4074cf
cmp byte [ebp - 0x2180], 0
je 0x4074cf
test byte [section..data], 2
je 0x4074cf
mov dword [esp + 0xc], str.failed_to_build_the_menu_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 1
test byte [section..data], 4
je 0x4074cf
mov eax, dword [ebp - 0x2184]
shr eax, 0x10
je 0x4080b0
mov edi, dword [ebp - 0x2184]
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ebx, eax
sub esp, 8
mov eax, str._invalid_
test ebx, ebx
jne 0x4080c7
movzx edx, word [edi]
mov eax, edi
test dx, dx
je 0x408b11
lea esi, [esi]
mov ecx, ebx
lea ebx, [ebx + 1]
cmp word [eax + ecx*2 + 2], 0
jne 0x407538
mov eax, 0x224c
mov edi, dword [ebp - 0x2184]
lea ebx, [ebp - 0x816]
lea esi, [ebp - 0x6f6]
mov word [ebp - 0x818], ax
jmp 0x4075a8
cmp dx, 9
je 0x408828
cmp dx, 0xa
jne 0x4087b6
mov eax, 0x6e5c
add ebx, 2
mov word [ebx - 2], ax
lea esi, [esi]
nop
lea eax, [ecx - 1]
test ecx, ecx
jle 0x408920
cmp ebx, esi
ja 0x408920
movzx edx, word [edi]
mov ecx, eax
add edi, 2
cmp dx, 0xd
je 0x408798
jbe 0x407568
cmp dx, 0x22
je 0x408810
cmp dx, 0x5c
jne 0x4087a9
mov eax, 0x5c5c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x407590
mov esi, 1
test al, 4
je 0x4074cf
mov dword [esp + 0xc], str.Not_under_desktop_or_start_menu._Ignoring._n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 2
call fcn.00401480
jmp 0x4074cf
lea eax, [ebp - 0x2038]
call fcn.00406a40
mov ebx, eax
test ebx, ebx
jne 0x407333
mov edx, dword [ebp - 0x217c]
movzx eax, byte [section..data]
test edx, edx
jne 0x408770
test al, 2
je 0x407333
cmp word [ebp - 0x1c28], 0
lea eax, [ebp - 0x2038]
cmove esi, eax
mov eax, esi
shr eax, 0x10
je 0x408b38
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x4088c2
movzx eax, word [esi]
test ax, ax
je 0x408c1d
lea esi, [esi]
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x4076a0
mov edi, 0x224c
mov dword [ebp - 0x2180], ebx
lea ecx, [ebp - 0x2162]
mov word [ebp - 0x2164], di
jmp 0x40770e
cmp ax, 9
je 0x408a00
cmp ax, 0xa
jne 0x40897f
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea edi, [edx - 1]
test edx, edx
jle 0x408890
lea eax, [ebp - 0x2042]
cmp ecx, eax
ja 0x408890
movzx eax, word [esi]
mov edx, edi
add esi, 2
cmp ax, 0xd
je 0x4089e8
jbe 0x4076d0
cmp ax, 0x22
je 0x4089d0
cmp ax, 0x5c
jne 0x408972
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x4076f0
mov eax, esi
shr eax, 0x10
je 0x408750
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x407864
movzx eax, word [ebp - 0x1c28]
test ax, ax
je 0x407837
nop
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x407780
mov ecx, 0x224c
lea edi, [ebp - 0x18fe]
mov dword [ebp - 0x2180], esi
mov word [ebp - 0x1a20], cx
lea ecx, [ebp - 0x1a1e]
mov dword [ebp - 0x2194], edi
mov dword [ebp - 0x2198], ebx
jmp 0x407802
cmp ax, 9
je 0x408208
cmp ax, 0xa
jne 0x4082ae
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea edi, [edx - 1]
cmp ecx, dword [ebp - 0x2194]
ja 0x408670
test edx, edx
jle 0x408670
mov eax, dword [ebp - 0x2180]
mov edx, edi
movzx eax, word [eax]
add dword [ebp - 0x2180], 2
cmp ax, 0xd
je 0x408220
jbe 0x4077c0
cmp ax, 0x22
je 0x408300
cmp ax, 0x5c
jne 0x4082a1
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4077e0
mov edi, 0x224c
mov byte [ebp - 0x1a1e], 0x22
lea ecx, [ebp - 0x1a1e]
mov word [ebp - 0x1a20], di
lea eax, [ecx + 1]
lea ecx, [ebp - 0x1a20]
mov byte [eax], 0
mov dword [esp], ecx
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.icon_file__:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x40729b
lea eax, [ebp - 0x2038]
shr eax, 0x10
je 0x4086c0
lea eax, [ebp - 0x2038]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x4079ba
movzx eax, word [ebp - 0x2038]
test ax, ax
je 0x40798d
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [ebp + edx*2 - 0x2036], 0
jne 0x4078e0
mov edi, 0x224c
mov dword [ebp - 0x2198], ebx
lea ecx, [ebp - 0x1a1e]
lea esi, [ebp - 0x2038]
mov word [ebp - 0x1a20], di
lea edi, [ebp - 0x18fe]
mov dword [ebp - 0x2194], edi
jmp 0x40795c
cmp ax, 9
je 0x4084e0
cmp ax, 0xa
jne 0x4083ee
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea edi, [edx - 1]
cmp ecx, dword [ebp - 0x2194]
ja 0x408610
test edx, edx
jle 0x408610
movzx eax, word [esi]
mov edx, edi
add esi, 2
cmp ax, 0xd
je 0x4083d0
jbe 0x407920
cmp ax, 0x22
je 0x408440
cmp ax, 0x5c
jne 0x4083e1
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x407940
mov esi, 0x224c
mov byte [ebp - 0x1a1e], 0x22
lea ecx, [ebp - 0x1a1e]
mov word [ebp - 0x1a20], si
lea eax, [ecx + 1]
lea ecx, [ebp - 0x1a20]
mov byte [eax], 0
mov dword [esp], ecx
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.path_______:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
test byte [section..data], 8
je 0x40723e
mov eax, dword [ebp - 0x218c]
shr eax, 0x10
je 0x4086a0
mov esi, dword [ebp - 0x218c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x407b1a
movzx eax, word [ebp - 0x818]
test ax, ax
je 0x407aed
lea esi, [esi]
nop
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x407a40
mov ecx, 0x224c
lea edi, [ebp - 0x18fe]
mov dword [ebp - 0x2198], ebx
mov esi, dword [ebp - 0x218c]
mov word [ebp - 0x1a20], cx
lea ecx, [ebp - 0x1a1e]
mov dword [ebp - 0x2194], edi
jmp 0x407abc
cmp ax, 9
je 0x4084f8
cmp ax, 0xa
jne 0x40831e
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea edi, [edx - 1]
cmp ecx, dword [ebp - 0x2194]
ja 0x4085e0
test edx, edx
jle 0x4085e0
movzx eax, word [esi]
mov edx, edi
add esi, 2
cmp ax, 0xd
je 0x4084c8
jbe 0x407a80
cmp ax, 0x22
je 0x408370
cmp ax, 0x5c
jne 0x408311
mov edi, 0x5c5c
add ecx, 2
mov word [ecx - 2], di
jmp 0x407aa0
mov eax, 0x224c
mov byte [ebp - 0x1a1e], 0x22
lea ecx, [ebp - 0x1a1e]
mov word [ebp - 0x1a20], ax
lea eax, [ecx + 1]
lea ecx, [ebp - 0x1a20]
mov byte [eax], 0
mov dword [esp], ecx
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.args_______:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x40723e
lea eax, [ebp - 0x1018]
shr eax, 0x10
je 0x4086f0
lea eax, [ebp - 0x1018]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x407c7a
movzx eax, word [ebp - 0x1018]
test ax, ax
je 0x407c4d
lea esi, [esi]
nop
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [ebp + edx*2 - 0x1016], 0
jne 0x407ba0
mov ecx, 0x224c
lea edi, [ebp - 0x6f6]
mov dword [ebp - 0x2198], ebx
lea esi, [ebp - 0x1018]
mov word [ebp - 0x818], cx
lea ecx, [ebp - 0x816]
mov dword [ebp - 0x2194], edi
jmp 0x407c1c
cmp ax, 9
je 0x4083b8
cmp ax, 0xa
jne 0x40845e
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea edi, [edx - 1]
cmp ecx, dword [ebp - 0x2194]
ja 0x408640
test edx, edx
jle 0x408640
movzx eax, word [esi]
mov edx, edi
add esi, 2
cmp ax, 0xd
je 0x4081f0
jbe 0x407be0
cmp ax, 0x22
je 0x4084b0
cmp ax, 0x5c
jne 0x408451
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x407c00
mov eax, 0x224c
mov byte [ebp - 0x816], 0x22
lea ecx, [ebp - 0x816]
mov word [ebp - 0x818], ax
lea eax, [ecx + 1]
mov byte [eax], 0
mov eax, dword [ebp - 0x218c]
mov dword [esp], eax
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.description:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x4071f8
lea eax, [ebp - 0x1e30]
shr eax, 0x10
je 0x408720
lea eax, [ebp - 0x1e30]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x407dda
movzx eax, word [ebp - 0x1e30]
test ax, ax
je 0x407dad
lea esi, [esi]
nop
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [ebp + edx*2 - 0x1e2e], 0
jne 0x407d00
mov edi, 0x224c
mov dword [ebp - 0x2198], ebx
lea ecx, [ebp - 0x816]
lea esi, [ebp - 0x1e30]
mov word [ebp - 0x818], di
lea edi, [ebp - 0x6f6]
mov dword [ebp - 0x2194], edi
jmp 0x407d7c
cmp ax, 9
je 0x4083a0
cmp ax, 0xa
jne 0x40823e
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea edi, [edx - 1]
cmp ecx, dword [ebp - 0x2194]
ja 0x4085b8
test edx, edx
jle 0x4085b8
movzx eax, word [esi]
mov edx, edi
add esi, 2
cmp ax, 0xd
je 0x408388
jbe 0x407d40
cmp ax, 0x22
je 0x408290
cmp ax, 0x5c
jne 0x408231
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x407d60
mov esi, 0x224c
mov byte [ebp - 0x816], 0x22
lea ecx, [ebp - 0x816]
mov word [ebp - 0x818], si
lea eax, [ecx + 1]
mov byte [eax], 0
mov eax, dword [ebp - 0x218c]
mov dword [esp], eax
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.workdir____:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x4071a5
mov eax, edi
test edi, edi
je 0x408958
shr eax, 0x10
je 0x4088f0
mov esi, dword [ebp - 0x2188]
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x407f40
cmp word [esi], 0
je 0x408a11
mov eax, esi
lea esi, [esi]
nop
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [eax + edx*2 + 2], 0
jne 0x407e60
mov ecx, 0x224c
lea eax, [ebp - 0x6f6]
mov dword [ebp - 0x218c], ebx
mov esi, dword [ebp - 0x2188]
mov word [ebp - 0x818], cx
lea ecx, [ebp - 0x816]
mov dword [ebp - 0x2180], eax
jmp 0x407ed1
cmp ax, 9
je 0x408588
cmp ax, 0xa
jne 0x408516
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea eax, [edx - 1]
cmp ecx, dword [ebp - 0x2180]
ja 0x407f08
test edx, edx
jle 0x407f08
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x4085a0
jbe 0x407ea0
cmp ax, 0x22
je 0x408570
cmp ax, 0x5c
jne 0x408509
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x407ec0
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x218c]
test eax, eax
jle 0x408a2a
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
mov byte [eax], 0
lea eax, [ebp - 0x818]
mov dword [esp], eax
mov dword [ebp - 0x218c], eax
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Link_______:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x40714d
mov byte [ebp - 0x2180], 1
xor esi, esi
test byte [section..data], 2
je 0x407432
mov dword [esp + 0xc], str.failed_wait_for_semaphore_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x407432
lea eax, [ebp - 0x2038]
mov dword [esp], eax
call sub.shlwapi.dll_PathFindFileNameW
sub esp, 4
mov esi, eax
test eax, eax
je 0x407341
xor eax, eax
lea ecx, [ebp - 0x1a20]
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x407fd8
mov dword [esp], ecx
call sub.user32.dll_CharLowerW
sub esp, 4
jmp 0x407341
cmp dword [ebp - 0x2190], 0x19
je 0x408013
cmp word [ebp - 0x2038], 0
jne 0x408060
lea eax, [ebp - 0x1a20]
mov dword [esp + 0x10], ebx
mov ecx, dword [ebp - 0x2188]
xor edx, edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1e30]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2184]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403460
jmp 0x4073fc
lea eax, [ebp - 0x1a20]
mov dword [esp + 0x10], ebx
mov ecx, dword [ebp - 0x2188]
xor edx, edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1e30]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x218c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2038]
mov dword [esp], eax
xor eax, eax
call fcn.00403460
jmp 0x4073fc
movzx eax, word [ebp - 0x2184]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
mov dword [esp + 0x10], eax
mov esi, 1
mov dword [esp + 0xc], str.Unknown_link_location__s._Ignoring._n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 2
call fcn.00401480
jmp 0x4074cf
mov eax, ebx
shr eax, 0x10
je 0x408bfb
lea eax, [ebp - 0x2038]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x408ab6
movzx eax, word [ebp - 0x2038]
test ax, ax
je 0x408c48
lea esi, [esi]
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [ebp + edx*2 - 0x2036], 0
jne 0x408148
mov ebx, 0x224c
lea ecx, [ebp - 0x2162]
lea edi, [ebp - 0x2038]
mov word [ebp - 0x2164], bx
jmp 0x4081be
cmp ax, 9
je 0x408b50
cmp ax, 0xa
jne 0x408b86
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
nop
lea eax, [ebp - 0x2042]
lea ebx, [edx - 1]
cmp ecx, eax
ja 0x408a8a
test edx, edx
jle 0x408a8a
movzx eax, word [edi]
mov edx, ebx
add edi, 2
cmp ax, 0xd
je 0x408b68
jbe 0x408178
cmp ax, 0x22
je 0x408be0
cmp ax, 0x5c
jne 0x408b79
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4081a0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407c00
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4077e0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4077e0
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408860
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdef]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407d60
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x407d60
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408850
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdef]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x4077e0
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4077e0
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408840
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdef]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407aa0
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407aa0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407d60
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407d60
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407c00
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407940
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408880
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdef]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407940
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x407940
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408870
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdef]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407c00
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x407c00
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407aa0
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407940
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407aa0
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408910
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdef]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x407ec0
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x407ec0
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407ec0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x407ec0
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2198]
test edi, edi
jle 0x407dc6
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
jmp 0x407dc9
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2198]
test edi, edi
jle 0x407b06
mov esi, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], si
jmp 0x407b09
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2198]
test edi, edi
jle 0x4079a6
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
jmp 0x4079a9
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2198]
test edi, edi
jle 0x407c66
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
jmp 0x407c69
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2198]
test edi, edi
jle 0x407850
mov edi, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], di
jmp 0x407853
movzx eax, word [ebp - 0x218c]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x407b1a
lea eax, [ebp - 0x2038]
mov dword [esp], str._04x
mov dword [ebp - 0x2194], eax
movzx eax, word [ebp - 0x2194]
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x4079ba
lea eax, [ebp - 0x1018]
mov dword [esp], str._04x
mov dword [ebp - 0x2194], eax
movzx eax, word [ebp - 0x2194]
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x407c7a
lea eax, [ebp - 0x1e30]
mov dword [esp], str._04x
mov dword [ebp - 0x2194], eax
movzx eax, word [ebp - 0x2194]
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x407dda
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x407864
test al, 4
jne 0x408ae8
mov eax, dword [ebp - 0x216c]
test eax, eax
je 0x408a38
mov byte [ebp - 0x2180], 1
xor esi, esi
jmp 0x40743c
mov eax, 0x725c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x407590
lea eax, [edx - 0x20]
cmp ax, 0x5e
jbe 0x408968
mov eax, edx
mov byte [ebx], 0x5c
add ebx, 5
shr ax, 0xc
movzx eax, ax
movzx eax, byte [eax + str.0123456789abcdef]
mov byte [ebx - 4], al
mov eax, edx
shr ax, 8
and eax, 0xf
movzx eax, byte [eax + str.0123456789abcdef]
mov byte [ebx - 3], al
mov eax, edx
and edx, 0xf
shr ax, 4
and eax, 0xf
movzx eax, byte [eax + str.0123456789abcdef]
mov byte [ebx - 2], al
movzx eax, byte [edx + str.0123456789abcdef]
mov byte [ebx - 1], al
jmp 0x407590
mov eax, 0x225c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x407590
mov eax, 0x745c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x407590
mov byte [ecx], al
add ecx, 1
jmp 0x407aa0
mov byte [ecx], al
add ecx, 1
jmp 0x4077e0
mov byte [ecx], al
add ecx, 1
jmp 0x407d60
mov byte [ecx], al
add ecx, 1
jmp 0x407c00
mov byte [ecx], al
add ecx, 1
jmp 0x407940
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x2180]
test edi, edi
jle 0x408c36
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
mov byte [eax], 0
lea eax, [ebp - 0x2164]
mov dword [esp], eax
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_extract_icon_from__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 1
call fcn.00401480
jmp 0x407333
movzx eax, word [ebp - 0x2188]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x407f40
mov byte [ecx], al
add ecx, 1
jmp 0x407ec0
mov byte [ebx], 0x22
test eax, eax
jle 0x408b2a
mov edx, 0x2e2e
mov byte [ebx + 3], 0x2e
lea eax, [ebx + 4]
mov word [ebx + 1], dx
mov byte [eax], 0
lea eax, [ebp - 0x818]
mov dword [esp], eax
call fcn.0040dba0
jmp 0x4080c7
mov eax, str._null_
jmp 0x407f40
mov byte [ebx], dl
add ebx, 1
jmp 0x407590
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408bf1
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdef]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x4076f0
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x4076f0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4076f0
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4076f0
mov eax, 0x224c
mov byte [ebp - 0x816], 0x22
lea ecx, [ebp - 0x816]
mov word [ebp - 0x818], ax
lea eax, [ecx + 1]
jmp 0x407f29
mov dword [esp + 8], 0
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x2188]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
xor esi, esi
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
jmp 0x4074cf
mov byte [ecx], 0x22
test ebx, ebx
jle 0x408c5e
mov ebx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], bx
mov byte [eax], 0
lea eax, [ebp - 0x2164]
mov dword [esp], eax
call fcn.0040dba0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.pidl_path__:__s_n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 3
call fcn.00401480
jmp 0x407300
mov dword [esp + 0xc], str.Unable_to_extract_icon__deferring._n
mov dword [esp + 8], str.InvokeShellLinker
mov dword [esp + 4], 0x40e000
mov dword [esp], 2
call fcn.00401480
jmp 0x408778
mov eax, 0x224c
mov byte [ebp - 0x816], 0x22
lea ebx, [ebp - 0x816]
mov word [ebp - 0x818], ax
lea eax, [ebx + 1]
jmp 0x40893b
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.004019b0
jmp 0x4088c2
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4081a0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4081a0
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x408c3e
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdef]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdef]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdef]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x4081a0
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x4081a0
mov byte [ecx], al
add ecx, 1
jmp 0x4076f0
mov dword [ebp - 0x2180], ebx
movzx eax, word [ebp - 0x2180]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.004019b0
jmp 0x408ab6
mov eax, 0x224c
mov byte [ebp - 0x2162], 0x22
lea ecx, [ebp - 0x2162]
mov word [ebp - 0x2164], ax
lea eax, [ecx + 1]
jmp 0x4088b1
mov byte [ecx], al
add ecx, 1
jmp 0x4081a0
mov word [ebp - 0x2164], 0x224c
lea ecx, [ebp - 0x2162]
mov byte [ebp - 0x2162], 0x22
lea eax, [ecx + 1]
jmp 0x408aa5