Function at 0x79d92640
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x15c
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov word [ebp - 0x132], ax
mov byte [ebp - 0x133], bl
test byte [0x79d9e040], 4
jne 0x79d92970
lea eax, [ebp - 0x12c]
mov dword [esp + 4], str.SoftwareWineWineMpr_
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call sym._RegCreateKeyA_12
mov edx, 5
sub esp, 0xc
test eax, eax
jne 0x79d9276f
lea eax, [ebp - 0x116]
movzx ebx, bl
mov dword [esp + 4], str.X__02X_
xor edi, edi
mov dword [esp + 8], ebx
lea esi, [ebp - 0x110]
mov dword [esp], eax
call sym._sprintf
jmp 0x79d926e8
cmp dword [ebp - 0x128], 3
jne 0x79d926e5
mov eax, dword [ebp - 0x124]
mov ebx, eax
cmp eax, 5
jbe 0x79d926e5
mov eax, dword [esi]
cmp dword [ebp - 0x116], eax
je 0x79d92780
add edi, 1
lea eax, [ebp - 0x120]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x124]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0x124], 0x100
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x110], 0
call sym._RegEnumValueA_32
sub esp, 0x20
test eax, eax
je 0x79d926c1
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sym._RegCloseKey_4
xor edx, edx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
movzx eax, byte [esi + 4]
cmp byte [ebp - 0x112], al
jne 0x79d926e5
mov dword [ebp - 0x138], edi
mov edx, 5
mov edi, ebx
jmp 0x79d927f3
lea eax, [ecx - 0x61]
cmp al, 5
ja 0x79d929f0
lea eax, [ecx - 0x57]
movzx ebx, byte [ebp + edx - 0x10f]
lea ecx, [ebx - 0x30]
cmp cl, 9
jbe 0x79d927d5
lea ecx, [ebx - 0x41]
cmp cl, 5
jbe 0x79d92810
lea ecx, [ebx - 0x61]
cmp cl, 5
ja 0x79d929e0
lea ecx, [ebx - 0x57]
lea ebx, [edx - 5]
shr ebx, 1
test al, al
js 0x79d9281c
shl eax, 4
or eax, ecx
mov byte [ebp + ebx - 0x110], al
lea eax, [edx + 2]
cmp edi, eax
jbe 0x79d92824
mov edx, eax
movzx ecx, byte [esi + edx]
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x79d927ae
lea eax, [ecx - 0x41]
cmp al, 5
ja 0x79d927a0
lea eax, [ecx - 0x37]
jmp 0x79d927ae
lea ecx, [ebx - 0x37]
lea ebx, [edx - 5]
shr ebx, 1
test al, al
jns 0x79d927de
mov edi, dword [ebp - 0x138]
jmp 0x79d9282f
lea ebx, [edx - 3]
mov edi, dword [ebp - 0x138]
shr ebx, 1
movzx eax, word [ebp - 0x132]
mov dword [ebp - 0x124], ebx
mov byte [ebp + ebx - 0x110], 0
cmp eax, ebx
ja 0x79d926e5
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._memcmp
test eax, eax
jne 0x79d926e5
mov eax, dword [ebp - 0x120]
lea ebx, [ebx + eax + 8]
mov dword [ebp - 0x11c], ebx
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapAlloc_12
mov ebx, eax
mov eax, dword [ebp - 0x124]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebx + 8]
mov dword [esp], eax
call sym._memmove
mov eax, dword [ebp - 0x11c]
mov word [ebx], ax
mov eax, dword [ebp - 0x124]
mov word [ebx + 2], ax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], 0x100
mov word [ebx + 4], ax
mov eax, edi
mov byte [ebx + 6], al
movzx eax, byte [ebp - 0x133]
mov byte [ebx + 7], al
lea eax, [ebp - 0x120]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x124]
mov dword [esp + 0x10], 0
lea eax, [ebx + eax + 8]
mov dword [esp + 8], esi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._RegEnumValueA_32
sub esp, 0x20
test eax, eax
jne 0x79d92945
mov eax, dword [ebp + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [ebp + 0x14]
sub esp, 8
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
jmp 0x79d926e5
movzx esi, ax
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._wine_dbgstr_an
mov edi, dword [ebp + 0x18]
movzx edx, bl
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], str.__s___d___d___p__0x_08x__totally_insecure_n
mov dword [esp + 0x10], 0xfc
mov dword [esp + 0xc], str.WNetEnumCachedPasswords
mov dword [esp + 8], 0x79d9f571
mov dword [esp + 4], 0x79d9e040
mov dword [esp], 2
call sym._ros_dbg_log
jmp 0x79d9266c
lea ebx, [edx - 5]
mov edi, dword [ebp - 0x138]
shr ebx, 1
jmp 0x79d9282f
mov eax, 0xffffffff
jmp 0x79d927ae