Function at 0x10015900
Capabilities:
Check if process is running under wine
Delete registry key
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x250
mov ebx, dword [ebp + 0xc]
test byte [0x1001a028], 8
jne 0x10015aa0
test ebx, ebx
je 0x100159e0
movzx edx, byte [ebx]
test dl, dl
je 0x100159e0
lea esi, [ebp - 0x23c]
lea ecx, [ebp - 0x139]
mov eax, esi
jmp 0x10015947
movzx edx, byte [ebx]
test dl, dl
je 0x10015954
add eax, 1
add ebx, 1
mov byte [eax - 1], dl
cmp eax, ecx
jne 0x10015940
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0x138]
and eax, 0xf0000018
cmp eax, 0x10
je 0x10015be0
ja 0x10015a60
test eax, eax
je 0x10015b70
cmp eax, 8
jne 0x10015a34
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, esi
call sym._read_key_container
mov edi, dword [ebp + 8]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x10015c90
mov dword [esp + 8], 0x26384993
mov dword [esp + 4], eax
mov dword [esp], section..bss
call sym._release_handle
test byte [0x1001a028], 8
jne 0x10015d99
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x8009000f
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea edi, [ebp - 0x138]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x138], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_GetUserNameA]
sub esp, 8
test eax, eax
je 0x100159d4
mov eax, dword [ebp + 0x10]
and eax, 0xf0000018
cmp eax, 0x10
je 0x10015be0
jbe 0x10015974
mov eax, dword [ebp + 0x10]
and eax, 0xf0000010
cmp eax, 0xf0000000
je 0x10015bb0
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090009
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
and eax, 0xf0000010
cmp eax, 0xf0000000
jne 0x10015a34
test byte [0x1001a028], 8
je 0x10015a3d
mov dword [esp + 0xc], str.pszContainer_should_be_empty_n
mov dword [esp + 8], 0x1002a6a8
mov dword [esp + 4], 0x1001a028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10015a3d
test ebx, ebx
je 0x10015d78
mov eax, ebx
shr eax, 0x10
je 0x10015c30
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x10015c45
cmp byte [ebx], 0
je 0x10015d82
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp byte [ebx + edx + 1], 0
jne 0x10015ae0
mov dword [ebp + 0xc], ebx
mov esi, ebx
lea ecx, [ebp - 0x137]
lea edi, [ebp - 0x15]
mov byte [ebp - 0x138], 0x22
jmp 0x10015b3d
cmp al, 9
je 0x10015d18
cmp al, 0xa
jne 0x10015cb5
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
lea eax, [edx - 1]
cmp ecx, edi
ja 0x10015d30
test edx, edx
jle 0x10015d30
mov edx, eax
movzx eax, byte [esi]
add esi, 1
cmp al, 0xd
je 0x10015d00
jle 0x10015b08
cmp al, 0x22
je 0x10015ce8
cmp al, 0x5c
jne 0x10015ca9
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x10015b28
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, esi
call sym._read_key_container
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
xor eax, eax
cmp edx, 0xffffffff
je 0x100159d4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test ebx, ebx
je 0x10015bbd
cmp byte [ebx], 0
jne 0x10015a6f
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, 0x10029a9f
call sym._new_key_container
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
jmp 0x10015b84
mov dword [esp + 8], esi
mov dword [esp + 4], str.SoftwareWineCryptoRSA_s
mov dword [esp], edi
call sym._sprintf.constprop.0
xor eax, eax
test byte [ebp + 0x10], 0x20
mov dword [esp + 4], edi
setne al
sub eax, 0x7fffffff
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
sub esp, 8
test eax, eax
je 0x10015b8f
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090016
xor eax, eax
jmp 0x100159d4
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str._phProv_p__pszContainer_s__dwFlags_08lx__pVTable_p__n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 0x1002a6a8
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x1001a028
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x1001591c
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, esi
call sym._new_key_container
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
jmp 0x10015b84
lea ebx, [eax - 0x20]
cmp bl, 0x5e
jbe 0x10015d68
mov ebx, 0x785c
add ecx, 4
mov word [ecx - 4], bx
mov ebx, eax
and eax, 0xf
shr bl, 4
movzx eax, byte [eax + str.0123456789abcdefRSAENH_CPAcquireContext]
movzx ebx, bl
movzx ebx, byte [ebx + str.0123456789abcdefRSAENH_CPAcquireContext]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x10015b28
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x10015b28
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x10015b28
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x10015b28
mov byte [ecx], 0x22
mov ebx, dword [ebp + 0xc]
test eax, eax
jle 0x10015d94
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
lea edi, [ebp - 0x138]
mov byte [eax], 0
mov dword [esp], edi
call sym.___wine_dbg_strdup
mov edx, eax
jmp 0x10015c45
mov byte [ecx], al
add ecx, 1
jmp 0x10015b28
mov edx, str._null_
jmp 0x10015c45
mov eax, 0x2222
lea ecx, [ebp - 0x137]
mov word [ebp - 0x138], ax
lea eax, [ecx + 1]
jmp 0x10015d4a
mov dword [esp + 0xc], str.Cant_create_new_keyset__already_exists_n
mov dword [esp + 8], 0x1002a6a8
mov dword [esp + 4], 0x1001a028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x100159c5