Function at 0x402140
Capabilities:
Check if process is running under wine
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push edi
mov edi, eax
mov eax, edx
push esi
and eax, 1
mov ecx, edi
push ebx
mov ebx, edi
sub esp, 0x24c
mov byte [esp + 0x2b], al
test edi, edi
jne 0x40216d
jmp 0x402445
test ax, ax
je 0x402186
movzx eax, word [ecx]
add ecx, 2
cmp ax, 0x5c
je 0x40217f
cmp ax, 0x2f
jne 0x402168
mov ebx, ecx
test ax, ax
jne 0x40216d
mov ebp, dword [sym.imp.kernel32.dll_lstrlenW]
mov dword [esp], ebx
call ebp
mov esi, eax
mov eax, dword [sym.imp.kernel32.dll_GetProcessHeap]
sub esp, 4
mov dword [esp + 0x24], eax
call eax
lea edx, [esi + esi + 0x4a]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov dword [esp + 4], str.SoftwareWineAppDefaults_
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcpyW]
mov edx, dword [sym.imp.kernel32.dll_lstrcatW]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x20], edx
call edx
sub esp, 8
mov dword [esp], esi
call ebp
mov ebp, dword [sym.imp.kernel32.dll_lstrcmpW]
lea ecx, [esi + eax*2 - 6]
sub esp, 4
mov dword [esp + 4], 0x408880
mov dword [esp], ecx
mov dword [esp + 0x2c], ecx
call ebp
sub esp, 8
test eax, eax
mov edx, dword [esp + 0x20]
je 0x4022c8
mov dword [esp + 4], str.Explorer
mov dword [esp], esi
call edx
mov edx, esi
mov ecx, str.Desktop
mov eax, 0x80000001
sub esp, 8
call fcn.00401ac0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
call eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov edx, dword [esp + 0x20]
test edx, edx
jne 0x402438
cmp byte [esp + 0x2b], 0
je 0x402430
movzx edx, word [ebx]
test dx, dx
je 0x402293
mov eax, ebx
nop
cmp dx, 0x2e
cmove ebx, eax
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
jne 0x402280
mov dword [esp + 4], str..lnk
mov dword [esp], ebx
call ebp
sub esp, 8
test eax, eax
je 0x4022e0
add esp, 0x24c
mov ecx, str.Desktop
mov edx, str.SoftwareWineExplorer
pop ebx
mov eax, 0x80000001
pop esi
pop edi
pop ebp
jmp fcn.00401ac0
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov word [ecx], ax
jmp 0x40221b
mov dword [esp], str.ole32
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4022a7
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp + 4], str.CoInitialize
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp], 0
call eax
sub esp, 4
mov dword [esp + 4], str.CoCreateInstance
mov dword [esp], ebx
call esi
sub esp, 8
lea edx, [esp + 0x30]
mov dword [esp + 0xc], 0x409260
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x408d90
call eax
sub esp, 0x14
test eax, eax
mov ebp, eax
js 0x40245f
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x40a4b0
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov ebp, eax
js 0x402452
mov eax, dword [esp + 0x34]
mov edx, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x14]
sub esp, 0xc
mov ebp, eax
mov eax, dword [esp + 0x34]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test ebp, ebp
js 0x402452
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x38]
mov edx, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x104
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0x14
mov ebp, eax
test eax, eax
jne 0x40247f
lea ecx, [esp + 0x38]
xor edx, edx
mov eax, ecx
call fcn.00402140
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
sub esp, 4
mov dword [esp + 4], str.CoUninitialize
mov dword [esp], ebx
call esi
sub esp, 8
call eax
mov edx, dword [esp + 0x20]
lea esi, [esi]
test edx, edx
je 0x4022a7
add esp, 0x24c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
je 0x4022a7
jmp 0x405f5c
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push eax
test byte [section..data], 2
jne 0x402498
mov dword [esp], ebx
mov dword [esp + 4], str.CoUninitialize
call esi
sub esp, 8
call eax
jmp 0x4022a7
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test ebp, ebp
jns 0x402468
jmp 0x40245f
mov eax, edi
call fcn.00401600
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_get_target_information_for__s__hr_lx_n
mov dword [esp + 8], str.get_desktop_setting
mov dword [esp + 4], 0x407000
mov dword [esp], 1
call fcn.004018f0
jmp 0x402468
movzx eax, word [pe_dos_header]
ud2