Function at 0x403620
Capabilities:
Check if process is running under wine
Contain obfuscated stackstrings
Delete file
Delete registry key
Link many functions at runtime
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x4c
mov dword [esp], str.shcore.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x404de0
mov ebx, eax
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp], eax
lea edi, [ebp - 0x30]
mov dword [esp + 4], str.GetProcessReference
call esi
sub esp, 8
mov dword [0x41c27c], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SetProcessReference
call esi
sub esp, 8
mov dword [0x41c278], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHUnicodeToAnsi
call esi
sub esp, 8
mov dword [0x41c274], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHAnsiToUnicode
call esi
sub esp, 8
mov dword [0x41c270], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHAnsiToAnsi
call esi
sub esp, 8
mov dword [0x41c26c], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHUnicodeToUnicode
call esi
sub esp, 8
mov dword [0x41c268], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHRegDuplicateHKey
call esi
sub esp, 8
mov dword [0x41c264], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHDeleteKeyA
call esi
sub esp, 8
mov dword [0x41c260], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHGetValueA
call esi
sub esp, 8
mov dword [0x41c25c], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHRegGetValueA
call esi
sub esp, 8
mov dword [0x41c258], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHQueryValueExA
call esi
sub esp, 8
mov dword [0x41c254], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHRegGetPathA
call esi
sub esp, 8
mov dword [0x41c250], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHCopyKeyA
call esi
sub esp, 8
mov dword [0x41c24c], eax
mov dword [esp], ebx
mov dword [esp + 4], str.SHCreateStreamOnFileA
call esi
sub esp, 8
mov dword [0x41c248], eax
mov dword [esp], ebx
mov dword [esp + 4], str.IStream_Size
call esi
sub esp, 8
mov dword [0x41c244], eax
call fcn.00402110
call fcn.004027c0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x41c270]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xd8
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Unexpected_return_value__d._n
mov dword [esp], eax
call fcn.00401870
mov dword [ebp - 0x30], 0x20001
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [0x41c270]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xdd
xor eax, eax
cmp ebx, 1
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xde
xor eax, eax
cmp word [ebp - 0x30], 0
je 0x404db0
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
call fcn.00401870
mov eax, 1
mov word [ebp - 0x30], ax
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [0x41c270]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xe2
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xe3
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x30], 1
sete al
mov dword [esp], eax
call fcn.00401870
mov eax, 1
mov word [ebp - 0x30], ax
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], 0x409005
call dword [0x41c270]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xe7
xor eax, eax
cmp ebx, 1
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xe8
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x30], 0
sete al
mov dword [esp], eax
call fcn.00401870
mov eax, 1
mov word [ebp - 0x30], ax
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c270]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xec
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xed
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x30], 1
sete al
mov dword [esp], eax
call fcn.00401870
mov edx, 1
mov word [ebp - 0x30], dx
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c270]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xf1
xor eax, eax
cmp ebx, 1
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xf2
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x30], 0
sete al
mov dword [esp], eax
call fcn.00401870
mov dword [esp + 8], 0x10
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c270]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xf5
xor eax, eax
cmp ebx, 5
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov ebx, dword [sym.imp.kernel32.dll_lstrcmpW]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xf6
mov dword [esp + 4], 0x409416
mov dword [esp], edi
call ebx
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], str.Unexpected_buffer_contents._n
movzx eax, al
mov dword [esp], eax
call fcn.00401870
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c270]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xf9
xor eax, eax
cmp esi, 2
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0xfa
xor eax, eax
cmp word [ebp - 0x30], 0x74
jne 0x403b6c
xor eax, eax
cmp word [ebp - 0x2e], 0
sete al
mov dword [esp + 4], str.Unexpected_buffer_contents._n
mov dword [esp], eax
call fcn.00401870
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x41c26c]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x103
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
mov eax, 0x6d
mov dword [ebp - 0x30], 0x64636261
mov dword [ebp - 0x2c], 0x68676665
mov dword [ebp - 0x28], 0x6c6b6a69
mov word [ebp - 0x24], ax
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c26c]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x107
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x108
movzx eax, byte [ebp - 0x30]
sub eax, 0x74
je 0x404d90
test eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x109
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp byte [ebp - 0x2d], 0x64
sete al
mov dword [esp], eax
call fcn.00401870
mov eax, 0x6d
mov dword [ebp - 0x30], 0x64636261
mov dword [ebp - 0x2c], 0x68676665
mov dword [ebp - 0x28], 0x6c6b6a69
mov word [ebp - 0x24], ax
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], 0x409005
call dword [0x41c26c]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x10d
xor eax, eax
cmp esi, 1
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x10e
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp byte [ebp - 0x30], 0
sete al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x10f
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp byte [ebp - 0x2d], 0x64
sete al
mov dword [esp], eax
call fcn.00401870
mov edx, 0x6d
mov dword [ebp - 0x30], 0x64636261
mov word [ebp - 0x24], dx
mov dword [ebp - 0x2c], 0x68676665
mov dword [ebp - 0x28], 0x6c6b6a69
mov dword [esp + 8], 4
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c26c]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x113
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov esi, dword [sym.imp.msvcrt.dll_strcmp]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x114
mov dword [esp + 4], 0x409649
mov dword [esp], edi
call esi
mov dword [esp + 4], str.Unexpected_buffer_contents._n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x115
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp byte [ebp - 0x2c], 0x65
sete al
mov dword [esp], eax
call fcn.00401870
mov ecx, 0x6d
mov dword [ebp - 0x30], 0x64636261
mov word [ebp - 0x24], cx
mov dword [ebp - 0x2c], 0x68676665
mov dword [ebp - 0x28], 0x6c6b6a69
mov dword [esp + 8], 5
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c26c]
sub esp, 0xc
mov dword [ebp - 0x3c], eax
call fcn.00404eb0
mov edx, dword [ebp - 0x3c]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x119
xor eax, eax
cmp edx, 5
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x11a
mov dword [esp + 4], str.test
mov dword [esp], edi
call esi
mov dword [esp + 4], str.Unexpected_buffer_contents._n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x11b
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp byte [ebp - 0x2b], 0x66
sete al
mov dword [esp], eax
call fcn.00401870
mov eax, 0x6d
mov dword [ebp - 0x30], 0x64636261
mov dword [ebp - 0x2c], 0x68676665
mov dword [ebp - 0x28], 0x6c6b6a69
mov word [ebp - 0x24], ax
mov dword [esp + 8], 6
mov dword [esp + 4], edi
mov dword [esp], str.test
call dword [0x41c26c]
sub esp, 0xc
mov dword [ebp - 0x3c], eax
call fcn.00404eb0
mov edx, dword [ebp - 0x3c]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x11f
xor eax, eax
cmp edx, 5
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x120
mov dword [esp + 4], str.test
mov dword [esp], edi
call esi
mov dword [esp + 4], str.Unexpected_buffer_contents._n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x121
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp byte [ebp - 0x2b], 0x66
sete al
mov dword [esp], eax
call fcn.00401870
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x41c268]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x12a
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [eax + str.abcdefghiklm]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x404020
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], 0x409416
call dword [0x41c268]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x12e
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x12f
xor eax, eax
cmp dword [ebp - 0x30], 0x650074
je 0x404d80
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x130
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x2a], 0x64
sete al
mov dword [esp], eax
call fcn.00401870
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + str.abcdefghiklm]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x4040e0
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], 0x409414
call dword [0x41c268]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x134
xor eax, eax
cmp esi, 1
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x135
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x30], 0
sete al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x136
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x2a], 0x64
sete al
mov dword [esp], eax
call fcn.00401870
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + str.abcdefghiklm]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x4041a0
mov dword [esp + 8], 4
mov dword [esp + 4], edi
mov dword [esp], 0x409416
call dword [0x41c268]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x13a
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x13b
cmp dword [ebp - 0x30], 0x650074
je 0x404dc0
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x13c
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x28], 0x65
sete al
mov dword [esp], eax
call fcn.00401870
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + str.abcdefghiklm]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x404260
mov dword [esp + 8], 5
mov dword [esp + 4], edi
mov dword [esp], 0x409416
call dword [0x41c268]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x140
xor eax, eax
cmp esi, 5
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x141
mov dword [esp + 4], 0x409416
mov dword [esp], edi
call ebx
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], str.Unexpected_buffer_contents._n
movzx eax, al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x142
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x26], 0x66
sete al
mov dword [esp], eax
call fcn.00401870
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [eax + str.abcdefghiklm]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x404330
mov dword [esp + 8], 6
mov dword [esp + 4], edi
mov dword [esp], 0x409416
call dword [0x41c268]
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x146
xor eax, eax
cmp esi, 5
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_return_value__d._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x147
mov dword [esp + 4], 0x409416
mov dword [esp], edi
call ebx
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], str.Unexpected_buffer_contents._n
movzx eax, al
mov dword [esp], eax
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x148
xor eax, eax
mov dword [esp + 4], str.Unexpected_buffer_contents._n
cmp word [ebp - 0x26], 0x66
sete al
mov dword [esp], eax
call fcn.00401870
mov dword [esp + 8], edi
mov esi, dword [sym.imp.advapi32.dll_RegCreateKeyA]
mov dword [esp + 4], str.SoftwareWineTest
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x151
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_create_test_key__ret__ld._n
call fcn.00401870
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [0x41c264]
sub esp, 4
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x154
xor eax, eax
test ebx, ebx
je 0x404473
xor eax, eax
cmp dword [ebp - 0x30], ebx
setne al
mov dword [esp + 4], str.Unexpected_duplicate_key._n
mov dword [esp], eax
call fcn.00401870
mov dword [esp], ebx
mov ebx, dword [sym.imp.advapi32.dll_RegCloseKey]
call ebx
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp], eax
call ebx
mov ecx, dword [sym.imp.advapi32.dll_RegDeleteKeyA]
sub esp, 4
mov dword [esp + 4], str.SoftwareWineTest
mov dword [esp], 0x80000001
mov dword [ebp - 0x40], ecx
call ecx
lea eax, [ebp - 0x34]
sub esp, 8
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineTest
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
mov dword [ebp - 0x3c], eax
call fcn.00404eb0
mov edx, dword [ebp - 0x3c]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x162
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_create_test_key___ld._n
call fcn.00401870
mov dword [esp + 8], edi
mov dword [esp + 4], str.delete_key
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [ebp - 0x3c], eax
call fcn.00404eb0
mov edx, dword [ebp - 0x3c]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x165
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_create_test_key___ld._n
call fcn.00401870
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp + 4], str.SoftwareWineTest
mov dword [esp], 0x80000001
mov ecx, dword [ebp - 0x40]
call ecx
sub esp, 8
mov dword [ebp - 0x3c], eax
call fcn.00404eb0
mov edx, dword [ebp - 0x3c]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x169
xor eax, eax
cmp edx, 5
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.Unexpected_return_value__ld._n
mov dword [esp], eax
call fcn.00401870
mov dword [esp + 4], str.SoftwareWineTest
mov dword [esp], 0x80000001
call dword [0x41c260]
sub esp, 8
mov dword [ebp - 0x3c], eax
call fcn.00404eb0
mov edx, dword [ebp - 0x3c]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x16c
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_retval__lu._n
call fcn.00401870
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [ebp - 0x3c], eax
call fcn.00404eb0
mov edx, dword [ebp - 0x3c]
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x16f
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_retval__lu._n
call fcn.00401870
call fcn.00401a90
call fcn.004023c0
call fcn.00402bb0
call fcn.00401ce0
call fcn.00401890
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x40], eax
mov eax, dword [sym.imp.advapi32.dll_RegOpenKeyA]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SoftwareWineTestCopyDestination
mov dword [esp], 0x80000001
mov dword [ebp - 0x3c], eax
call eax
sub esp, 0xc
test eax, eax
jne 0x40469d
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40469d
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [0x41c260]
mov eax, dword [ebp - 0x30]
sub esp, 8
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [ebp - 0x30], 0
mov dword [esp + 8], edi
mov dword [esp + 4], str.SoftwareWineTestCopyDestination
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x288
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_create_a_test_key__ret__ld._n
call fcn.00401870
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionexplorer
mov dword [esp], 0x80000002
mov eax, dword [ebp - 0x3c]
call eax
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x28c
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_open_a_test_key__ret__ld._n
call fcn.00401870
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dword [0x41c24c]
sub esp, 0x10
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x28f
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Copy_failed__ret__lu._n
call fcn.00401870
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp], eax
call ebx
mov dword [ebp - 0x30], 0
sub esp, 4
mov dword [esp + 8], edi
mov dword [esp + 4], str.SoftwareWineTestCopyDestinationShell_Folders
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x3c]
call eax
sub esp, 0xc
mov esi, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x297
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
lea esi, [ebp - 0x38]
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_open_a_test_key__ret__ld._n
call fcn.00401870
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x29a
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Common_AppData
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [0x41c254]
sub esp, 0x18
test eax, eax
sete al
mov dword [esp + 4], str.SHQueryValueExA_failed_n
movzx eax, al
mov dword [esp], eax
call fcn.00401870
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x40]
sub esp, 4
call fcn.00401230
mov dword [ebp - 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], str.test_file
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2d5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.File_creation_failed:__lu._n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp], eax
call fcn.00401870
mov dword [esp + 0xc], edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 0x409848
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2d7
xor eax, eax
mov dword [esp + 4], str.Failed_to_write_data_into_file._n
cmp dword [ebp - 0x30], 6
sete al
mov dword [esp], eax
call fcn.00401870
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], str.test_file
call dword [0x41c248]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2dc
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
mov eax, dword [ebp - 0x38]
mov ecx, 0x2dd
mov edx, 6
call fcn.00401dc0
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2e0
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
mov eax, dword [ebp - 0x38]
mov ecx, 0x2e1
mov edx, 6
call fcn.00401dc0
mov eax, dword [ebp - 0x38]
mov ecx, 0x2e2
xor edx, edx
call fcn.00401f60
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov dword [esp + 4], 0x64
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2e5
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
mov eax, dword [ebp - 0x38]
mov ecx, 0x2e6
mov edx, 6
call fcn.00401dc0
mov eax, dword [ebp - 0x38]
mov ecx, 0x2e7
mov edx, 0x64
call fcn.00401f60
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov edx, 0x2e9
mov eax, 6
sub esp, 4
call fcn.00402060
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], str.test_file
call dword [0x41c248]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2ec
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
lea eax, [ebp - 0x34]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], str.test_file
call dword [0x41c248]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2ee
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
mov eax, dword [ebp - 0x38]
mov ecx, 0x2ef
mov edx, 6
call fcn.00401dc0
mov eax, dword [ebp - 0x34]
mov ecx, 0x2f0
mov edx, 6
call fcn.00401dc0
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, 0x2f1
call fcn.00401f60
mov eax, dword [ebp - 0x34]
mov ecx, 0x2f2
xor edx, edx
call fcn.00401f60
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2f6
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, 0x2f7
call fcn.00401dc0
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, 0x2f8
call fcn.00401dc0
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, 0x2f9
call fcn.00401f60
mov eax, dword [ebp - 0x34]
mov ecx, 0x2fa
xor edx, edx
call fcn.00401f60
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov dword [esp + 4], 0x64
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x2fe
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
mov eax, dword [ebp - 0x38]
mov ecx, 0x2ff
mov edx, 0x64
call fcn.00401dc0
mov eax, dword [ebp - 0x34]
mov ecx, 0x300
mov edx, 0x64
call fcn.00401dc0
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, 0x301
call fcn.00401f60
mov eax, dword [ebp - 0x34]
mov ecx, 0x302
xor edx, edx
call fcn.00401f60
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov dword [esp + 4], 0x5a
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x306
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.00401870
mov eax, dword [ebp - 0x38]
mov ecx, 0x307
mov edx, 0x64
call fcn.00401dc0
mov eax, dword [ebp - 0x34]
mov ecx, 0x308
mov edx, 0x64
call fcn.00401dc0
mov eax, dword [ebp - 0x38]
mov ecx, 0x309
xor edx, edx
call fcn.00401f60
mov eax, dword [ebp - 0x34]
mov ecx, 0x30a
mov edx, 0x5a
call fcn.00401f60
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x34]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov edx, 0x30d
mov eax, 0x64
sub esp, 4
call fcn.00402060
mov dword [esp], str.test_file
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
xor eax, eax
cmp word [ebp - 0x2c], 0
sete al
jmp 0x40409f
movzx eax, byte [ebp - 0x2f]
sub eax, 0x65
jne 0x403c53
movzx eax, byte [ebp - 0x2e]
jmp 0x403c53
xor eax, eax
cmp word [ebp - 0x2e], 2
sete al
jmp 0x40385d
cmp word [ebp - 0x2c], 0x73
jne 0x40421d
xor eax, eax
cmp word [ebp - 0x2a], 0
sete al
jmp 0x40421f
call fcn.00404eb0
mov dword [eax], 0x40917b
mov dword [eax + 4], 0x318
mov dword [esp], str.Shcore.dll_is_not_available._n
call fcn.00401730
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret