Function at 0x42b970
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rdi, str.ThreadId
mov rbx, rdx
mov esi, ecx
call sym.__main
mov ecx, 0xfffffff5
call qword [sym.imp.kernel32.dll_GetStdHandle]
lea rcx, [sym.top_filter]
mov qword [0x0044e3c0], rax
call qword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
movq xmm0, rdi
lea rax, str.BreakAllThreadsStartup
lea rdi, str.ProcessId
mov qword [0x0044e268], rax
lea r8, [rsp + 0x68]
lea rax, str.BreakOnCritSectTimeOut
mov rcx, 0xffffffff80000001
mov qword [0x0044e288], rax
lea rax, str.BreakOnAttach
lea rdx, str.SoftwareWineWineDbg
mov qword [0x0044e2a8], rax
lea rax, str.BreakOnFirstChance
mov qword [0x0044e2c8], rax
lea rax, str.BreakOnDllLoad
mov qword [0x0044e2e8], rax
lea rax, str.CanDeferOnBPByAddr
mov qword [0x0044e308], rax
lea rax, [0x0044e8b4]
movq xmm1, rax
lea rax, [0x0044e8b0]
mov dword [rsp + 0x5c], 4
punpcklqdq xmm0, xmm1
movq xmm2, rax
lea rax, str.AlwaysShowThunks
mov dword [rsp + 0x64], 4
movups xmmword [0x0044e328], xmm0
movq xmm0, rdi
mov dword [0x0044e260], 0
punpcklqdq xmm0, xmm2
movups xmmword [0x0044e348], xmm0
mov qword [0x0044e270], 0
mov dword [0x0044e278], 0xffffff09
mov dword [0x0044e280], 0
mov qword [0x0044e290], 0
mov dword [0x0044e298], 0xffffff09
mov dword [0x0044e2a0], 0
mov qword [0x0044e2b0], 0
mov dword [0x0044e2b8], 0xffffff09
mov dword [0x0044e2c0], 0
mov qword [0x0044e2d0], 0
mov dword [0x0044e2d8], 0xffffff09
mov dword [0x0044e2e0], 0
mov qword [0x0044e2f0], 0
mov dword [0x0044e2f8], 0xffffff09
mov dword [0x0044e300], 0
mov qword [0x0044e310], 0
mov dword [0x0044e318], 0xffffff09
mov dword [0x0044e320], 0
mov dword [0x0044e338], 0xffffff09
mov dword [0x0044e340], 0
mov dword [0x0044e358], 0xffffff09
mov dword [0x0044e360], 0
mov qword [0x0044e368], rax
lea rax, str.AlsoDebugProcChild
mov qword [0x0044e388], rax
lea rax, str.ShowCrashDialog
mov qword [0x0044e370], 0
mov dword [0x0044e378], 0xffffff09
mov dword [0x0044e380], 0
mov qword [0x0044e390], 0
mov dword [0x0044e398], 0xffffff09
mov dword [0x0044e3a0], 1
mov qword [0x0044e3a8], rax
mov qword [0x0044e3b0], 0
mov dword [0x0044e3b8], 0xffffff09
call qword [sym.imp.advapi32.dll_RegCreateKeyA]
mov r12d, eax
test eax, eax
jne 0x42be4d
mov rcx, qword [rsp + 0x68]
lea rdi, [rsp + 0x5c]
lea r15, [rsp + 0x64]
mov r14, qword [sym.imp.advapi32.dll_RegQueryValueExA]
lea rbp, [0x0044e260]
lea r13, [rbp + 0x160]
jmp 0x42bc19
add rbp, 0x20
cmp rbp, r13
je 0x42bc60
cmp qword [rbp + 0x10], 0
jne 0x42bc10
lea rax, [rsp + 0x60]
mov rdx, qword [rbp + 8]
xor r8d, r8d
mov r9, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call r14
test eax, eax
jne 0x42bc47
mov eax, dword [rsp + 0x60]
mov dword [rbp], eax
mov qword [rbp + 0x10], rbp
add rbp, 0x20
mov rcx, qword [rsp + 0x68]
cmp rbp, r13
jne 0x42bc19
nop dword [rax]
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea r13, [rbx + 8]
sub esi, 1
je 0x42bd6c
mov r15, qword [rbx + 8]
mov r14, qword [sym.imp.ucrtbase.dll_strcmp]
lea rdx, str.__help
mov rcx, r15
call r14
test eax, eax
je 0x42bf1c
lea rdx, str.__gdb
mov rcx, r15
call r14
test eax, eax
je 0x42bea7
call sym.dbg_init_console
call sym.SymGetOptions
and eax, 0xfffedfe9
mov ecx, eax
or ecx, 0x12014
call sym.SymSetOptions
mov r15, qword [rbx + 8]
lea rdx, str.__auto
mov rcx, r15
call r14
test eax, eax
je 0x42be82
lea rdx, str.__minidump
mov rcx, r15
call r14
test eax, eax
je 0x42bef7
test esi, esi
jle 0x42bfb3
mov ebp, esi
add rbx, 0x18
xor r15d, r15d
or r8, 0xffffffffffffffff
mov r9, qword [rbx - 0x10]
lea r13, [rbx - 0x10]
mov esi, ebp
cmp byte [r9], 0x2d
jne 0x42bf5e
mov ecx, 0xa
mov rsi, r9
lea rdi, str.__command
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x42bdc0
cmp ebp, 1
je 0x42bdc0
mov rcx, qword [rbx - 8]
xor edx, edx
call sym.parser_generate_command_file
mov r8, rax
cmp rax, 0xffffffffffffffff
je 0x42be5f
lea r10d, [rbp - 2]
add rbx, 0x10
mov ebp, r10d
test r10d, r10d
jne 0x42bd07
jmp 0x42bd8f
call sym.dbg_init_console
xor r15d, r15d
call sym.SymGetOptions
and eax, 0xfffedfe9
mov ecx, eax
or ecx, 0x12014
call sym.SymSetOptions
or r8, 0xffffffffffffffff
mov qword [rsp + 0x48], r8
call sym.restart_if_wow64
mov r8, qword [rsp + 0x48]
mov rcx, r15
mov rdx, r8
call sym.dbg_start_interactive
mov eax, r12d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 7
mov rsi, r9
lea rdi, str.__file
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x42bf30
cmp ebp, 1
je 0x42bf30
mov r15, qword [rbx - 8]
xor r8d, r8d
xor r9d, r9d
mov edx, 0x80010000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rcx, r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.kernel32.dll_CreateFileA]
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x42bd5a
mov rax, qword gs:[0x30]
mov rdx, qword [r13 + 8]
mov r8d, dword [rax + 0x68]
lea rcx, str.Couldnt_open_file__s___lu__n
mov r12d, 1
call sym.dbg_printf
jmp 0x42bda9
test byte [0x0042e340], 2
jne 0x42bed3
or r12d, 0xffffffff
jmp 0x42bda9
mov rax, qword gs:[0x30]
mov edx, dword [rax + 0x68]
lea rcx, str.Couldnt_open_temp_file___lu__n
mov r12d, 1
call sym.dbg_printf
jmp 0x42bda9
mov rdx, r13
mov ecx, esi
call sym.dbg_active_auto
cmp eax, 1
je 0x42bec2
cmp eax, 2
je 0x42be56
test eax, eax
je 0x42bda9
mov r15, qword [rbx + 8]
jmp 0x42bcdd
call sym.restart_if_wow64
mov rdx, r13
mov ecx, esi
call sym.gdb_main
mov r12d, eax
cmp eax, 0xffffffff
jne 0x42bda9
lea rcx, str.Usage:_n_twinedbg_______gdb______prog_name_____prog_args______num____file.mdmp_____help___n
call sym.dbg_printf
jmp 0x42bda9
lea r9, str.Cannot_create_WineDbg_key_in_registry_n
lea r8, str.dbg_load_internal_vars
mov ecx, 1
lea rdx, [0x0042e340]
call sym.wine_dbg_log.constprop.0_11
jmp 0x42be56
mov rdx, r13
mov ecx, esi
call sym.dbg_active_minidump
cmp eax, 1
je 0x42bec2
cmp eax, 2
je 0x42be56
test eax, eax
jne 0x42bcf2
jmp 0x42bda9
lea rcx, str.Usage:_n___winedbg__cmdline________launch_process__cmdline___as_if_you_were_starting_n___________________________it_with_wine__and_run_WineDbg_on_it_n___winedbg__num____________attach_to_running_process_of_wpid__num__and_run_n___________________________WineDbg_on_it_n___winedbg___gdb__cmdline__launch_process__cmdline___as_if_you_were_starting_n___________________________wine__and_run_gdb__proxied__on_it_n___winedbg___gdb__num______attach_to_running_process_of_wpid__num__and_run_n___________________________gdb__proxied__on_it_n___winedbg__file.mdmp______reload_the_minidump__file.mdmp__into_memory_and_run_n___________________________WineDbg_on_it_n___winedbg___help__________prints_advanced_options_n
xor r12d, r12d
call sym.dbg_printf
jmp 0x42bda9
mov qword [rsp + 0x48], r8
lea rdx, [0x0044028b]
mov rcx, r9
call r14
test eax, eax
jne 0x42bec2
mov esi, ebp
add r13, 8
mov r8, qword [rsp + 0x48]
sub esi, 1
je 0x42bd8f
mov rdx, r13
mov ecx, esi
mov qword [rsp + 0x48], r8
call sym.dbg_active_attach
mov r8, qword [rsp + 0x48]
cmp eax, 1
je 0x42bf85
cmp eax, 2
je 0x42be56
jmp 0x42bd8f
mov rdx, r13
mov ecx, esi
call sym.minidump_reload
mov r8, qword [rsp + 0x48]
cmp eax, 1
jne 0x42bf77
mov rdx, r13
mov ecx, esi
call sym.dbg_active_launch
mov r8, qword [rsp + 0x48]
cmp eax, 1
je 0x42bec2
jmp 0x42bf77
xor r15d, r15d
or r8, 0xffffffffffffffff
jmp 0x42bf5e