Function at 0x403380
Capabilities:
Check for time delay via gettickcount
Check os version
Compare security identifiers
Create directory
Delete file
Get common file path
Get file size
Get geographical location
Get keyboard layout
Link many functions at runtime
Query environment variable
Set environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x430
mov edx, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.PATH
mov dword [ebp - 0x3ec], edx
call edx
sub esp, 0xc
mov ebx, eax
mov dword [esp], eax
call sym._xalloc
mov dword [0x40d2a4], eax
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x334]
mov dword [esp + 4], eax
mov dword [esp], str.PATH
mov edx, dword [ebp - 0x3ec]
call edx
sub esp, 0xc
mov dword [esp], 3
call dword [sym.imp.kernel32.dll_SetErrorMode]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
sub esp, 8
test eax, eax
je 0x404645
test edi, edi
je 0x404839
cmp byte [edi], 0x2d
jne 0x403607
cmp byte [edi + 1], 0
jne 0x403607
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
push ecx
mov dword [ebp - 0x40c], edi
mov dword [0x40d340], eax
mov eax, dword [ebp - 0x40c]
mov dword [esp + 4], 0x40a9f3
mov dword [esp + 8], eax
mov dword [esp], 6
call dbg.report
cmp dword [0x40d340], 0xffffffff
je 0x404852
test esi, esi
je 0x40465e
lea eax, [ebp - 0x230]
mov dword [esp + 0xc], 0
mov edi, eax
mov dword [ebp - 0x400], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x108
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
sub esp, 0x10
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov dword [ebp - 0x410], eax
sub esp, 8
test eax, eax
jne 0x403508
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
je 0x403500
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x400]
mov dword [esp + 4], str.Could_not_create_directory__s___d_
mov dword [esp + 8], eax
mov dword [esp], 9
call dbg.report
xor eax, eax
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x400]
mov dword [esp + 4], 0x40a9f3
mov dword [esp], 5
mov dword [esp + 8], eax
call dbg.report
mov dword [esp], str.Version_4_n
call dbg.xprintf
mov edx, 0x40d2e0
mov eax, 0x40a990
cmp byte [0x40d2e0], 0
cmovne eax, edx
mov dword [esp], str.Tests_from_build__s_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], str.Archive:___n
call dbg.xprintf
mov eax, dword [0x40d050]
mov dword [esp], str.Tag:__s_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], str.Build_info:_n
call dbg.xprintf
lea ecx, [ebp - 0x3e8]
mov edx, str.STRINGRES
mov eax, str.BUILD_INFO
call dbg.extract_rcdata
mov edi, eax
test eax, eax
je 0x40364b
mov ebx, dword [ebp - 0x3e8]
mov esi, dword [sym.imp.msvcrt.dll_memchr]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xa
mov dword [esp], edi
call esi
test eax, eax
je 0x4041f8
mov edx, eax
sub edx, edi
sub ebx, edx
sub ebx, 1
mov dword [ebp - 0x3e8], ebx
je 0x403620
lea ecx, [eax + 1]
cmp edi, eax
jb 0x404878
mov dword [ebp - 0x3ec], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], str._____.s_n
call dbg.xprintf
mov ecx, dword [ebp - 0x3ec]
mov edi, ecx
jmp 0x4035ae
mov eax, edi
call dbg.create_output_file
mov dword [ebp - 0x40c], edi
jmp 0x403442
cmp edi, eax
jae 0x4048ae
cmp byte [eax - 1], 0xd
jne 0x4048ae
sub eax, 1
mov dword [esp + 8], edi
sub eax, edi
mov dword [esp], str._____.s_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], str.Operating_system_version:_n
call dbg.xprintf
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [esp], str.ntdll.dll
mov dword [ebp - 0x3ec], eax
call eax
mov ebx, dword [sym.imp.kernel32.dll_GetVersionExA]
mov dword [ebp - 0x3d0], 0x9c
mov dword [ebp - 0x3f0], eax
sub esp, 4
lea eax, [ebp - 0x3d0]
mov dword [esp], eax
call ebx
mov dword [ebp - 0x3f4], eax
sub esp, 4
test eax, eax
je 0x4045d3
cmp dword [ebp - 0x3cc], 6
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
je 0x4044e2
mov eax, dword [0x40d2d8]
mov edx, str.__WOW64_
mov dword [esp + 4], str.i386
mov dword [esp], str.____Platform_s_s_n
test eax, eax
mov eax, 0x40a99b
cmovne eax, edx
mov dword [esp + 8], eax
call dbg.xprintf
call sym._running_under_wine
mov dword [esp], str.____bRunningUnderWine_d_n
mov dword [esp + 4], eax
call dbg.xprintf
call dbg.running_on_visible_desktop
mov dword [esp], str.____bRunningOnVisibleDesktop_d_n
mov dword [esp + 4], eax
call dbg.xprintf
mov eax, 0x500
mov dword [ebp - 0x3e4], 0
mov word [ebp - 0x3d4], ax
lea eax, [ebp - 0x3e4]
mov dword [ebp - 0x3d8], 0
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x3d8]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
test eax, eax
je 0x403973
lea eax, [ebp - 0x3e0]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov eax, dword [sym.imp.advapi32.dll_OpenProcessToken]
mov dword [esp], 0xffffffff
mov dword [ebp - 0x3f8], eax
call eax
sub esp, 0xc
test eax, eax
je 0x40471a
xor eax, eax
mov esi, dword [sym.imp.advapi32.dll_GetTokenInformation]
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x3dc]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x3e0]
mov dword [esp], eax
mov dword [ebp - 0x3fc], esi
call esi
mov eax, dword [ebp - 0x3dc]
sub esp, 0x14
mov dword [esp], eax
call sym._xalloc
mov ebx, eax
lea eax, [ebp - 0x3dc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3dc]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x3e0]
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
je 0x404701
mov eax, dword [ebp - 0x3e0]
xor esi, esi
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x404], eax
call eax
push ecx
cmp dword [ebx], 0
jne 0x40387b
jmp 0x404904
add esi, 1
cmp esi, dword [ebx]
jae 0x404904
mov eax, dword [ebp - 0x3e4]
mov dword [esp + 4], eax
mov eax, dword [ebx + esi*8 + 4]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_EqualSid]
sub esp, 8
test eax, eax
je 0x403870
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x3e4]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_FreeSid]
push eax
mov eax, str.admin
mov dword [esp + 4], eax
mov dword [esp], str.____Account_s
call dbg.xprintf
lea eax, [ebp - 0x3e0]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
mov eax, dword [ebp - 0x3f8]
call eax
sub esp, 0xc
test eax, eax
je 0x403967
lea eax, [ebp - 0x3d8]
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x3dc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x14
mov eax, dword [ebp - 0x3e0]
mov dword [esp], eax
mov eax, dword [ebp - 0x3fc]
call eax
sub esp, 0x14
test eax, eax
mov eax, dword [ebp - 0x3e0]
mov dword [esp], eax
mov eax, dword [ebp - 0x404]
je 0x404940
call eax
push eax
cmp dword [ebp - 0x3dc], 0
js 0x403967
mov eax, str.not_elevated
mov edx, str.elevated
mov dword [esp], str.___s
cmovne eax, edx
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], 0x40ab3d
call dbg.xprintf
mov eax, dword [0x40d044]
test eax, eax
je 0x40398c
mov dword [esp + 4], eax
mov dword [esp], str.____Submitter_s_n
call dbg.xprintf
mov eax, dword [0x40d04c]
test eax, eax
je 0x4039a5
mov dword [esp + 4], eax
mov dword [esp], str.____Description_s_n
call dbg.xprintf
mov eax, dword [0x40d048]
test eax, eax
je 0x4039be
mov dword [esp + 4], eax
mov dword [esp], str.____URL_s_n
call dbg.xprintf
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x3c0]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3c4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3cc]
mov dword [esp], str.____dwMajorVersion_u_n____dwMinorVersion_u_n____dwBuildNumber_u_n____PlatformId_u_n____szCSDVersion_s_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp + 4], str.wine_get_build_id
mov ebx, dword [ebp - 0x3f0]
mov dword [esp], ebx
call edi
sub esp, 8
mov esi, eax
mov dword [esp], ebx
mov dword [esp + 4], str.wine_get_host_version
call edi
sub esp, 8
mov ebx, eax
test esi, esi
je 0x403a3c
call esi
mov dword [esp], str.____WineBuild_s_n
mov dword [esp + 4], eax
call dbg.xprintf
test ebx, ebx
je 0x403a75
lea eax, [ebp - 0x3d8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3dc]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x3d8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3dc]
mov dword [esp], str.____Host_system_s_n____Host_version_s_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], 0x59
call dword [sym.imp.user32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
jne 0x404630
mov eax, dword [ebp - 0x3f4]
test eax, eax
je 0x403b10
movzx eax, byte [ebp - 0x335]
mov dword [esp + 0x14], eax
movzx eax, byte [ebp - 0x336]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x338]
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0x33a]
mov dword [esp + 8], eax
movzx eax, word [ebp - 0x33c]
mov dword [esp], str.____wServicePackMajor_d_n____wServicePackMinor_d_n____wSuiteMask_d_n____wProductType_d_n____wReserved_d_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], str.kernel32.dll
mov eax, dword [ebp - 0x3ec]
call eax
push edx
mov dword [esp + 4], str.GetProductInfo
mov dword [esp], eax
call edi
mov ebx, eax
push ecx
push ecx
test eax, eax
je 0x403b10
call sym._running_under_wine
test eax, eax
je 0x40472f
lea esi, [esi]
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
mov dword [esp], str.____SystemDefaultLCID_04x_n
mov dword [esp + 4], eax
call dbg.xprintf
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
mov dword [esp], str.____UserDefaultLCID_04x_n
mov dword [esp + 4], eax
call dbg.xprintf
call dword [sym.imp.kernel32.dll_GetThreadLocale]
mov dword [esp], str.____ThreadLocale_04x_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], str.kernel32.dll
mov eax, dword [ebp - 0x3ec]
call eax
sub esp, 4
mov ebx, eax
mov dword [esp + 4], str.GetSystemPreferredUILanguages
mov dword [esp], eax
call edi
sub esp, 8
mov dword [ebp - 0x3f0], eax
mov dword [esp], ebx
mov dword [esp + 4], str.GetUserDefaultUILanguage
call edi
sub esp, 8
mov esi, eax
mov dword [esp], ebx
mov dword [esp + 4], str.GetThreadUILanguage
call edi
mov ebx, eax
mov eax, dword [ebp - 0x3f0]
sub esp, 8
test eax, eax
je 0x403c00
call sym._running_under_wine
test eax, eax
jne 0x403c00
lea eax, [ebp - 0x3d8]
lea edx, [ebp - 0x128]
mov dword [ebp - 0x3d8], 0x20
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3dc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 4
mov eax, dword [ebp - 0x3f0]
call eax
lea edx, [ebp - 0x128]
sub esp, 0x10
test eax, eax
jne 0x40478a
lea esi, [esi]
nop
test esi, esi
je 0x403c19
call esi
mov dword [esp], str.____UserDefaultUILanguage_04x_n
movzx eax, ax
mov dword [esp + 4], eax
call dbg.xprintf
test ebx, ebx
je 0x403c32
call ebx
mov dword [esp], str.____ThreadUILanguage_04x_n
movzx eax, ax
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], 0
call dword [sym.imp.user32.dll_GetKeyboardLayout]
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], str.____KeyboardLayout_p_n
call dbg.xprintf
mov dword [esp], 0x10
call dword [sym.imp.kernel32.dll_GetUserGeoID]
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], str.____Country_d_n
call dbg.xprintf
call dword [sym.imp.kernel32.dll_GetACP]
mov dword [esp], str.____ACP_d_n
mov dword [esp + 4], eax
call dbg.xprintf
mov dword [esp], str.Dll_info:_n
call dbg.xprintf
mov dword [esp + 4], str.Counting_tests
mov dword [esp], 0
call dbg.report
mov dword [esp + 0xc], 0x40d32c
mov esi, dword [sym.imp.kernel32.dll_EnumResourceNamesA]
mov dword [esp + 8], dbg.EnumTestFileProc
mov dword [esp + 4], str.TESTRES
mov dword [esp], 0
call esi
sub esp, 0x10
test eax, eax
je 0x40460a
mov eax, dword [0x40d32c]
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp], eax
call sym._xalloc
mov dword [0x40d330], eax
mov dword [esp], str.mscoree.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x40d2b8], 0
mov dword [0x40d2bc], eax
sub esp, 4
test eax, eax
je 0x403d29
mov dword [esp + 4], str.LoadLibraryShim
mov dword [esp], eax
call edi
push edx
push edx
mov dword [0x40d2b8], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [ebp - 0x3ec]
call eax
sub esp, 4
mov ebx, eax
mov dword [esp + 4], str.CreateActCtxA
mov dword [esp], eax
call edi
sub esp, 8
mov dword [0x40d2b4], eax
mov dword [esp + 4], str.ActivateActCtx
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [0x40d2b0], eax
mov dword [esp + 4], str.DeactivateActCtx
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [0x40d2ac], eax
mov dword [esp + 4], str.ReleaseActCtx
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [0x40d2a8], eax
mov dword [esp + 4], str.Extracting_tests
mov dword [esp], 0
call dbg.report
mov eax, dword [0x40d32c]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 8], eax
call dbg.report
mov eax, dword [ebp - 0x400]
mov dword [0x40d32c], 0
mov dword [0x40d328], 0
mov dword [0x40d324], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], dbg.extract_test_proc
mov dword [esp + 4], str.TESTRES
mov dword [esp], 0
call esi
sub esp, 0x10
test eax, eax
je 0x4045ad
mov eax, dword [0x40d2bc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov esi, dword [0x40d040]
sub esp, 4
test esi, esi
jne 0x40448a
mov dword [esp], str.Test_output:_n
call dbg.xprintf
xor eax, eax
mov dword [esp + 8], str.Extracting:_Done
mov dword [esp + 4], eax
mov dword [esp], 3
call dbg.report
cmp dword [0x40d320], 0
jne 0x4048c7
xor eax, eax
mov dword [esp + 4], str.Running_tests
mov ebx, esi
mov dword [esp], eax
call dbg.report
mov eax, dword [0x40d328]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
call dbg.report
cmp dword [0x40d32c], 0
jle 0x404405
nop
mov edx, dword [0x40d330]
mov ecx, dword [0x40d040]
lea eax, [ebx + ebx*4]
lea edi, [edx + eax*4]
test ecx, ecx
jne 0x404405
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4044d0
mov dword [ebp - 0x3ec], ecx
mov dword [esp + 0xc], eax
mov eax, dword [0x40d2a4]
mov dword [esp + 4], 0x40af63
mov dword [esp + 8], eax
mov dword [esp], 0
call dbg.strmake
mov dword [esp], str.PATH
mov esi, eax
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sub esp, 8
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [edi + 4]
test eax, eax
jle 0x4043d6
mov eax, dword [0x40d040]
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x3ec], ecx
mov dword [ebp - 0x408], ebx
jmp 0x403f9b
mov dword [esp + 0xc], esi
mov eax, dword [edi]
mov dword [esp + 4], str.Skipping:__s:_s
mov dword [esp + 8], eax
mov dword [esp], 2
call dbg.report
mov dword [esp + 0xc], 0x40d060
mov dword [esp + 8], esi
mov eax, dword [edi]
mov dword [esp], str._s:_s_skipped__s_n
mov dword [esp + 4], eax
call dbg.xprintf
add dword [0x40d324], 1
mov eax, dword [0x40d2d4]
test eax, eax
jne 0x4041d8
add dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x3ec]
cmp dword [edi + 4], eax
jle 0x4043d0
mov eax, dword [0x40d040]
test eax, eax
jne 0x4043d0
mov eax, dword [0x40d340]
mov ecx, dword [ebp - 0x3ec]
mov ebx, dword [edi]
mov dword [ebp - 0x3f0], eax
mov eax, dword [edi + 8]
mov esi, dword [eax + ecx*4]
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strlen]
cmp eax, 4
jbe 0x403ffc
lea eax, [ebx + eax - 4]
mov dword [esp + 4], str..exe
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strcmp]
test eax, eax
jne 0x403ffc
mov dword [esp + 4], str.ntoskrnl.exe
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strcmp]
test eax, eax
jne 0x4044a0
mov dword [esp + 8], ebx
mov dword [esp + 4], str.dlls__s
mov dword [esp], 0x40d060
call dbg.sprintf
add eax, 0x40d060
mov dword [esp + 8], esi
mov dword [esp + 4], str._tests__s.c
mov dword [esp], eax
call dbg.sprintf
mov eax, dword [edi]
mov edx, esi
call dbg.test_filtered_out
test eax, eax
jne 0x403f30
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x3f8], eax
mov dword [esp + 0xc], esi
mov eax, dword [edi + 0xc]
mov dword [esp + 4], str._s__s
mov dword [esp + 8], eax
mov dword [esp], 0
call dbg.strmake
mov dword [ebp - 0x3f4], eax
mov ebx, eax
mov dword [esp + 0xc], esi
mov eax, dword [edi]
mov dword [esp + 4], str.Running:__s:_s
mov dword [esp + 8], eax
mov dword [esp], 2
call dbg.report
mov dword [esp + 0xc], 0x40d060
mov dword [esp + 8], esi
mov eax, dword [edi]
mov dword [esp], str._s:_s_start__s_n
mov dword [esp + 4], eax
call dbg.xprintf
mov edx, dword [ebp - 0x3f0]
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FlushFileBuffers]
sub esp, 4
cmp dword [0x40d2d0], 1
jle 0x404218
lea edx, [ebp - 0x128]
mov eax, edx
call dbg.create_temp_file
lea ecx, [ebp - 0x3d8]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov edx, eax
mov dword [esp], 0x1d4c0
mov ecx, dword [ebp - 0x400]
mov dword [ebp - 0x3fc], eax
mov eax, ebx
mov dword [ebp - 0x3f4], ebx
call dbg.run_ex
mov edx, dword [ebp - 0x3fc]
lea ecx, [ebp - 0x3d0]
mov ebx, eax
lea eax, [ebp - 0x128]
call dbg.flush_temp_file
mov edx, eax
mov eax, dword [ebp - 0x3d0]
test ebx, ebx
jne 0x404340
cmp eax, 0x8000
ja 0x404340
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp - 0x3fc], ecx
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_free]
mov ebx, dword [ebp - 0x3f4]
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_free]
mov ebx, dword [ebp - 0x3d0]
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov dword [esp + 0x18], ebx
mov ecx, dword [ebp - 0x3f8]
mov dword [esp + 0x10], 0
sub eax, ecx
mul edx
shr edx, 6
mov dword [esp + 0x14], edx
mov ecx, dword [ebp - 0x3fc]
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov eax, dword [edi]
mov dword [esp], str._s:_s:_04x_done___d__in__ds__uB_n
mov dword [esp + 4], eax
call dbg.xprintf
mov eax, dword [ebp - 0x3d0]
cmp eax, 0x8000
ja 0x404390
mov eax, dword [0x40d2d4]
test eax, eax
je 0x403f80
lea esi, [esi]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Running_tests____u_failures
mov dword [esp], 0
call dbg.report
jmp 0x403f80
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], str._____.s_n
call dbg.xprintf
jmp 0x40364b
mov dword [esp + 4], 0
mov eax, dword [sym.imp.kernel32.dll_GetFileSize]
mov ebx, dword [ebp - 0x3f0]
mov dword [esp], ebx
mov dword [ebp - 0x404], eax
call eax
lea edx, [ebp - 0x3d8]
sub esp, 8
mov dword [ebp - 0x3fc], eax
mov dword [esp + 8], edx
mov edx, ebx
mov dword [esp + 4], 0
mov dword [esp], 0x1d4c0
mov ecx, dword [ebp - 0x400]
mov dword [ebp - 0x3f0], ebx
mov eax, dword [ebp - 0x3f4]
call dbg.run_ex
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x3f0]
mov ebx, eax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x404]
call ecx
mov ecx, dword [ebp - 0x3fc]
sub esp, 8
sub eax, ecx
mov dword [ebp - 0x3d0], eax
cmp ebx, 0xfffffffe
jne 0x4042ad
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
neg ebx
mov eax, dword [ebp - 0x3f4]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_free]
mov edx, dword [ebp - 0x3d0]
mov dword [ebp - 0x3f0], edx
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [ebp - 0x3d8]
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x3fc], ecx
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x3f8]
mov dword [esp + 0x10], ebx
sub eax, edx
mov edx, 0x10624dd3
mov dword [esp + 0xc], ecx
mul edx
mov dword [esp + 8], esi
shr edx, 6
mov dword [esp + 0x14], edx
mov eax, dword [edi]
mov dword [esp], str._s:_s:_04x_done___d__in__ds__uB_n
mov dword [esp + 4], eax
call dbg.xprintf
mov eax, dword [ebp - 0x3d0]
cmp eax, 0x8000
ja 0x404390
mov eax, dword [0x40d2d4]
test ebx, ebx
je 0x403f78
add eax, 1
mov dword [0x40d2d4], eax
jmp 0x403f78
lea ecx, [ebp - 0x3d0]
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x3fc], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x3fc]
sub esp, 0x14
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_free]
jmp 0x40429d
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3fc]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [edi]
mov dword [esp], str._s:_s:_04x_The_test_prints_too_much_data___u_bytes__n
mov dword [esp + 4], eax
call dbg.xprintf
mov eax, dword [0x40d2d4]
add eax, 1
mov dword [0x40d2d4], eax
jmp 0x403f78
mov ebx, dword [ebp - 0x408]
mov esi, dword [edi + 0x10]
test esi, esi
je 0x4043f6
mov eax, dword [0x40d2a4]
mov dword [esp], str.PATH
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sub esp, 8
add ebx, 1
cmp dword [0x40d32c], ebx
jg 0x403ea0
xor eax, eax
mov dword [esp + 8], str.Running:_Done
mov dword [esp + 4], eax
mov dword [esp], 3
call dbg.report
mov eax, dword [0x40d2d4]
mov dword [esp + 4], str.Cleaning_up____u_failures
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], eax
call dbg.report
mov dword [esp + 4], 0x40a990
mov eax, dword [ebp - 0x40c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strcmp]
test eax, eax
jne 0x4048f0
xor ecx, ecx
cmp dword [ebp - 0x410], 0
mov dword [0x40d340], ecx
jne 0x4048e0
mov eax, dword [0x40d330]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [0x40d2a4]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x40c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], str.programs__s
mov dword [esp], 0x40d060
call dbg.sprintf
sub eax, 4
mov byte [eax + 0x40d060], 0
jmp 0x404014
mov edx, dword [edi + 4]
xor eax, eax
test edx, edx
jg 0x403f21
jmp 0x4043f6
cmp dword [ebp - 0x3c8], 2
jne 0x4036b3
mov dword [ebp - 0x128], 0x11c
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], str.RtlGetVersion
mov eax, dword [ebp - 0x3f0]
mov dword [esp], eax
call edi
push edx
push edx
lea edx, [ebp - 0x128]
mov dword [esp], edx
call eax
push ecx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x33c], eax
movzx eax, word [ebp - 0x10]
mov word [ebp - 0x338], ax
movzx eax, byte [ebp - 0xe]
mov byte [ebp - 0x336], al
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x114]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
jmp 0x4036b3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.Cant_enumerate_test_files:__d
mov dword [esp], 9
mov dword [esp + 8], eax
call dbg.report
jmp 0x403e0e
mov dword [ebp - 0x3d0], 0x94
lea eax, [ebp - 0x3d0]
mov dword [esp], eax
call ebx
push edi
test eax, eax
jne 0x4036a0
mov dword [esp + 4], str.Cant_get_OS_version.
mov dword [esp], 9
call dbg.report
jmp 0x4036a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.Cant_enumerate_test_files:__d
mov dword [esp], 9
mov dword [esp + 8], eax
call dbg.report
jmp 0x403cda
mov dword [esp + 4], eax
mov dword [esp], str.____R2_build_number_d_n
call dbg.xprintf
jmp 0x403a8d
mov dword [esp + 4], str.Cant_name_temporary_dir__check___TEMP___.
mov dword [esp], 9
call dbg.report
jmp 0x403413
lea edi, [ebp - 0x230]
mov dword [esp + 4], ebx
xor esi, esi
mov dword [ebp - 0x400], edi
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_strcpy]
mov dword [esp], edi
call sym._strlen
mov dword [ebp + eax - 0x230], 0x746377
mov dword [esp + 4], esi
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov dword [esp], edi
call esi
push edx
push edx
mov dword [ebp - 0x410], eax
test eax, eax
jne 0x403508
xor ecx, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x40aa11
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x404927
mov edi, dword [ebp - 0x400]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
push eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
push edx
push edx
mov dword [ebp - 0x410], eax
test eax, eax
jne 0x403508
jmp 0x4034d5
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x3e0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push esi
mov eax, dword [ebp - 0x3e4]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_FreeSid]
push ebx
jmp 0x403973
xor eax, eax
mov dword [ebp - 0x3d8], eax
lea eax, [ebp - 0x3d8]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x33a]
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0x33c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3cc]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x3d8]
sub esp, 0x14
mov dword [esp + 4], eax
mov dword [esp], str.____dwProductInfo_u_n
call dbg.xprintf
jmp 0x403b10
xor ecx, ecx
lea eax, [ebp - 0x3d0]
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3d8]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x3d0]
sub esp, 0x20
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_strlen]
mov dword [ebp - 0x3f0], eax
call eax
lea edx, [ebp + eax - 0x3cf]
cmp byte [edx], 0
je 0x40481e
mov dword [ebp - 0x3f4], esi
mov esi, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f8], ebx
mov ebx, edx
lea esi, [esi]
mov byte [ebx - 1], 0x2c
mov dword [esp], ebx
call esi
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x404800
mov esi, dword [ebp - 0x3f4]
mov ebx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x3d0]
mov dword [esp], str.____SystemPreferredUILanguages_s_n
mov dword [esp + 4], eax
call dbg.xprintf
jmp 0x403c00
mov eax, 0x40d1a0
call dbg.create_temp_file
mov dword [ebp - 0x40c], 0x40d1a0
jmp 0x403442
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.Could_not_open_logfile:__u
mov dword [esp], 9
mov dword [esp + 8], eax
call dbg.report
jmp 0x403472
cmp byte [eax - 1], 0xd
jne 0x4035e3
sub eax, 1
mov dword [ebp - 0x3ec], ecx
sub eax, edi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], str._____.s_n
call dbg.xprintf
mov ecx, dword [ebp - 0x3ec]
mov edi, ecx
jmp 0x4035ae
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], str._____.s_n
call dbg.xprintf
jmp 0x40364b
mov dword [esp + 4], str.Some_dlls_are_configured_as_native__you_wont_be_able_to_submit_results.
mov dword [esp], 7
call dbg.report
jmp 0x403e60
mov eax, dword [ebp - 0x400]
call dbg.remove_dir
jmp 0x40446e
mov eax, dword [0x40d340]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
jmp 0x404459
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x3e4]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_FreeSid]
mov eax, str.non_admin
push edx
jmp 0x4038b7
mov dword [esp + 4], str.Cant_name_temporary_dir__check___TEMP___.
mov dword [esp], 9
call dbg.report
jmp 0x4046d1
call eax
push eax
jmp 0x403967