Function at 0x437b70
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x44
call sym.___main
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
sub esp, 4
mov dword [0x43ac18], eax
mov dword [esp], sym._top_filter_4
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 4
sub esp, 4
mov dword [ebp - 0x10], 4
mov dword [0x43ac40], 0
mov dword [0x43ac44], 0x4440bf
mov dword [0x43ac48], 0
mov dword [0x43ac4c], 0xffffff09
mov dword [0x43ac50], 0
mov dword [0x43ac54], 0x4440d6
mov dword [0x43ac58], 0
mov dword [0x43ac5c], 0xffffff09
mov dword [0x43ac60], 0
mov dword [0x43ac64], 0x4440ed
mov dword [0x43ac68], 0
mov dword [0x43ac6c], 0xffffff09
mov dword [0x43ac70], 0
mov dword [0x43ac74], 0x4440fb
mov dword [0x43ac78], 0
mov dword [0x43ac7c], 0xffffff09
mov dword [0x43ac80], 0
mov dword [0x43ac84], 0x44410e
mov dword [0x43ac88], 0
mov dword [0x43ac8c], 0xffffff09
mov dword [0x43ac90], 0
mov dword [0x43ac94], 0x44411d
mov dword [0x43ac98], 0
mov dword [0x43ac9c], 0xffffff09
mov dword [0x43aca0], 0
mov dword [0x43aca4], 0x444130
mov dword [0x43aca8], 0x43ac10
mov dword [0x43acac], 0xffffff09
mov dword [0x43acb0], 0
mov dword [0x43acb4], 0x444139
mov dword [0x43acb8], 0x43ac04
mov dword [0x43acbc], 0xffffff09
mov dword [0x43acc0], 0
mov dword [0x43acc4], 0x444143
mov dword [0x43acc8], 0
mov dword [0x43accc], 0xffffff09
mov dword [0x43acd0], 0
mov dword [0x43acd4], 0x444154
mov dword [0x43acd8], 0
mov dword [0x43acdc], 0xffffff09
mov dword [0x43ace0], 1
mov dword [0x43ace4], 0x444167
mov dword [0x43ace8], 0
mov dword [0x43acec], 0xffffff09
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineWineDbg
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
mov dword [ebp - 0x2c], eax
sub esp, 0xc
test eax, eax
jne 0x438090
mov esi, 0x43ac40
mov ebx, 0x43acf0
lea edi, [ebp - 0x10]
jmp 0x437daf
add esi, 0x10
cmp ebx, esi
je 0x437e00
mov eax, dword [esi + 8]
test eax, eax
jne 0x437da8
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x437def
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 8], esi
add esi, 0x10
cmp ebx, esi
jne 0x437daf
lea esi, [esi]
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
sub esp, 4
add eax, 4
mov dword [ebp - 0x20], eax
dec esi
je 0x437f66
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov eax, dword [sym.imp.ucrtbase.dll_strcmp]
mov dword [esp + 4], str.__help
mov dword [esp], edi
mov dword [ebp - 0x34], eax
call eax
test eax, eax
je 0x43817c
mov dword [esp + 4], str.__gdb
mov eax, dword [ebp - 0x34]
mov dword [esp], edi
call eax
test eax, eax
je 0x4380fa
call sym._dbg_init_console
call dword [sym.imp.dbghelp.dll_SymGetOptions]
and eax, 0xfffedfe9
or eax, 0x12014
mov dword [esp], eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
mov edi, dword [sym.imp.dbghelp.dll_SymSetExtendedOption]
push eax
mov dword [esp + 4], 1
mov dword [esp], 0x3e9
call edi
push edx
push edx
mov dword [esp + 4], 1
mov dword [esp], 0x3eb
call edi
mov eax, dword [ebp + 0xc]
push ecx
push ecx
mov dword [esp + 4], str.__auto
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x34]
mov dword [esp], edi
call eax
test eax, eax
je 0x4380ce
mov dword [esp + 4], str.__minidump
mov eax, dword [ebp - 0x34]
mov dword [esp], edi
call eax
test eax, eax
je 0x438152
test esi, esi
jle 0x43820c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0
mov edx, esi
mov dword [ebp - 0x24], 0xffffffff
lea ebx, [eax + 0xc]
lea eax, [ebx - 8]
mov esi, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebx - 8]
cmp byte [eax], 0x2d
jne 0x4381bc
mov ecx, 0xa
mov edi, str.__command
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta cl
sbb cl, 0
test cl, cl
jne 0x437fe8
cmp edx, 1
je 0x437fe8
mov dword [esp + 4], 0
mov eax, dword [ebx - 4]
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call sym._parser_generate_command_file
mov edx, dword [ebp - 0x20]
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x4380a9
sub edx, 2
add ebx, 8
test edx, edx
jne 0x437efc
jmp 0x437fbf
call sym._dbg_init_console
call dword [sym.imp.dbghelp.dll_SymGetOptions]
and eax, 0xfffedfe9
or eax, 0x12014
mov dword [esp], eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push ebx
mov ebx, dword [sym.imp.dbghelp.dll_SymSetExtendedOption]
mov dword [esp + 4], 1
mov dword [esp], 0x3e9
call ebx
push esi
push esi
mov dword [esp + 4], 1
mov dword [esp], 0x3eb
call ebx
mov dword [ebp - 0x30], 0
push edi
mov dword [ebp - 0x24], 0xffffffff
push edi
call sym._restart_if_wow64
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._dbg_start_interactive
mov eax, dword [ebp - 0x2c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 7
mov edi, str.__file
mov esi, eax
mov dword [ebp - 0x28], edx
repe cmpsb byte [esi], byte es:[edi]
seta cl
sbb cl, 0
test cl, cl
jne 0x438194
cmp edx, 1
je 0x438194
mov eax, dword [ebx - 4]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [ebp - 0x30], eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80010000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edx, dword [ebp - 0x28]
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
jne 0x437f5a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 4]
mov dword [esp], str.Couldnt_open_file__s___lu__n
mov dword [esp + 4], eax
call sym._dbg_printf
mov dword [ebp - 0x2c], 1
jmp 0x437fd6
test byte [0x4391a8], 2
jne 0x438129
mov dword [ebp - 0x2c], 0xffffffff
jmp 0x437fd6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], str.Couldnt_open_temp_file___lu__n
mov dword [esp + 4], eax
call sym._dbg_printf
mov dword [ebp - 0x2c], 1
jmp 0x437fd6
mov eax, dword [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._dbg_active_auto
cmp eax, 1
je 0x438118
cmp eax, 2
je 0x43809d
test eax, eax
je 0x437fd6
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 4]
jmp 0x437ec6
call sym._restart_if_wow64
mov eax, dword [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._gdb_main
mov dword [ebp - 0x2c], eax
inc eax
jne 0x437fd6
mov dword [esp], str.Usage:_n_twinedbg_______gdb______prog_name_____prog_args______num____file.mdmp_____help___n
call sym._dbg_printf
jmp 0x437fd6
mov dword [esp + 0xc], str.Cannot_create_WineDbg_key_in_registry_n
mov dword [esp + 8], str.dbg_load_internal_vars
mov dword [esp + 4], 0x4391a8
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_10
jmp 0x43809d
mov eax, dword [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._dbg_active_minidump
cmp eax, 1
je 0x438118
cmp eax, 2
je 0x43809d
test eax, eax
jne 0x437ede
jmp 0x437fd6
mov dword [esp], str.Usage:_n___winedbg__cmdline________launch_process__cmdline___as_if_you_were_starting_n___________________________it_with_wine__and_run_WineDbg_on_it_n___winedbg__num____________attach_to_running_process_of_wpid__num__and_run_n___________________________WineDbg_on_it_n___winedbg___gdb__cmdline__launch_process__cmdline___as_if_you_were_starting_n___________________________wine__and_run_gdb__proxied__on_it_n___winedbg___gdb__num______attach_to_running_process_of_wpid__num__and_run_n___________________________gdb__proxied__on_it_n___winedbg__file.mdmp______reload_the_minidump__file.mdmp__into_memory_and_run_n___________________________WineDbg_on_it_n___winedbg___help__________prints_advanced_options_n
call sym._dbg_printf
mov dword [ebp - 0x2c], 0
jmp 0x437fd6
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], 0x4444f7
call eax
test eax, eax
jne 0x438118
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x20], 4
dec edx
mov esi, edx
je 0x437fbf
mov eax, dword [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._dbg_active_attach
cmp eax, 1
je 0x4381de
cmp eax, 2
je 0x43809d
jmp 0x437fbf
mov eax, dword [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._minidump_reload
cmp eax, 1
jne 0x4381d0
mov eax, dword [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._dbg_active_launch
cmp eax, 1
je 0x438118
jmp 0x4381d0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 0xffffffff
jmp 0x4381bc