Function at 0x4492a0
Capabilities:
Access peb ldr_data
Check if file exists
Check if process is running under wine
Create process on windows
Create process suspended
Delete registry key
Get file attributes
Get process heap flags
Get process heap force flags
Persist via aedebug registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x110]
sub esp, 0x1cc
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesA]
sub esp, 0xc
mov dword [esp], ebx
call esi
sub esp, 4
cmp eax, 0xffffffff
je 0x449958
mov dword [esp], ebx
call esi
sub esp, 4
cmp eax, 0xffffffff
je 0x449920
lea eax, [ebp - 0x1a0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1a4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionAeDebug
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
sub esp, 0x24
mov esi, eax
test eax, eax
je 0x449498
cmp eax, 5
je 0x449970
cmp eax, 2
jne 0x4499d0
mov dword [ebp - 0x18c], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x17c], 0
mov eax, dword [0x8f0774]
test eax, eax
je 0x4498f8
mov eax, dword [ebp - 0x1a4]
mov ecx, str.dbg_none
mov edx, ebx
call fcn.00447240
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x345
mov eax, dword [ebp - 0x1a0]
mov dword [esp + 4], str.expected_REG_OPENED_EXISTING_KEY__got__ld_n
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [ebp - 0x1a4]
mov ecx, str.dbg_event_order
mov edx, ebx
call fcn.00447240
mov eax, dword [ebp - 0x1a4]
mov ecx, str.dbg_attach_event_code2
mov edx, ebx
call fcn.00447240
mov eax, dword [ebp - 0x1a4]
mov ecx, str.dbg_attach_event_nokill
mov edx, ebx
call fcn.00447240
mov eax, dword [ebp - 0x1a4]
mov ecx, str.dbg_attach_event_detach
mov edx, ebx
call fcn.00447240
mov eax, dword [ebp - 0x1a4]
mov ecx, str.dbg_attach_detach_late
mov edx, ebx
call fcn.00447240
mov eax, dword [ebp - 0x1a4]
mov ecx, str.dbg_attach_process_event_detach
mov edx, ebx
call fcn.00447240
cmp dword [ebp - 0x1a0], 1
je 0x449998
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x194]
call fcn.00443d10
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x184]
call fcn.00443d10
mov eax, dword [ebp - 0x1a4]
mov dword [esp], eax
call esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1a4]
lea ecx, [ebp - 0x194]
mov edx, 0x593c3e
call fcn.00444080
mov eax, dword [ebp - 0x1a4]
lea ecx, [ebp - 0x184]
mov edx, 0x593caf
call fcn.00444080
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x317
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionAeDebug
mov dword [esp + 8], eax
mov dword [esp], str.HKLM_sdebugger_is_set_to__s_n
call fcn.00444260
mov eax, dword [ebp - 0x17c]
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
je 0x44938c
cmp dword [ebp - 0x180], 1
jne 0x44938c
mov dword [esp + 4], str.winedbg___auto
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strstr]
test eax, eax
je 0x44938c
lea eax, [ebp - 0x19c]
mov dword [esp + 4], str.SoftwareWineWineDbg
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
mov dword [ebp - 0x1a8], eax
sub esp, 0xc
test eax, eax
jne 0x449a08
mov eax, dword [ebp - 0x19c]
lea ecx, [ebp - 0x174]
mov edx, str.ShowCrashDialog
call fcn.00444080
mov dword [esp + 0x14], 4
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [esp + 0x10], 0x707be4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.ShowCrashDialog
mov eax, dword [ebp - 0x19c]
mov dword [esp], eax
call edi
sub esp, 0x18
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x334
call fcn.0057d240
mov dword [esp + 4], 1
mov dword [esp], str.IgnoreExceptions_d_n
call fcn.00443b60
call fcn.0057d910
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0x593c3c
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x593c3e
mov eax, dword [ebp - 0x1a4]
mov dword [esp], eax
call edi
sub esp, 0x18
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2e8
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
lea edi, [ebp - 0x150]
mov dword [esp], eax
mov dword [esp + 4], str.unable_to_set_AeDebug_auto:_ret_ld_n
call fcn.00444b30
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp + 4], 0
add eax, 0x10
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1b0], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s_debugger_crash
mov dword [ebp - 0x1ac], eax
mov dword [esp], eax
call fcn.00443b30
mov eax, dword [ebp - 0x1a8]
mov ecx, 0x10
mov edx, 1
mov dword [ebp - 0x154], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x164]
mov word [ebp - 0x124], dx
mov dword [ebp - 0x128], 1
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x154]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edi, dword [ebp - 0x1ac]
mov dword [esp], 0
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov edi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x1b0]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2f2
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x1a8], edx
mov dword [esp + 8], eax
mov dword [esp], edi
mov dword [esp + 4], str.CreateProcess:_err_ld_n
call fcn.00444b30
mov edi, dword [ebp - 0x1ac]
mov dword [esp + 4], 0
mov dword [esp + 8], edi
mov edx, dword [ebp - 0x1a8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1ac], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x160]
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 0xc
mov dword [esp], eax
call edi
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2f6
mov dword [esp], str.waiting_for_child_exit..._n
call fcn.00444260
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2f7
mov dword [esp + 4], 0xea60
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], str.Timed_out_waiting_for_the_child_to_crash_n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
sub esp, 8
mov dword [ebp - 0x1a8], eax
call fcn.0057d110
mov edx, dword [ebp - 0x1ac]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2f9
mov eax, dword [edx + 0x34]
mov dword [esp + 4], str.GetExitCodeProcess_failed:_err_ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x1a8]
mov dword [esp], ecx
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2fa
mov eax, dword [ebp - 0x198]
mov dword [esp + 4], str.exit_code___08lx_n
cmp eax, 0xc0000005
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call edi
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x336
call fcn.0057d240
mov dword [esp + 4], 0
mov dword [esp], str.IgnoreExceptions_d_n
call fcn.00443b60
call fcn.0057d910
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x174]
call fcn.00443d10
mov eax, dword [ebp - 0x19c]
mov dword [esp], eax
call esi
sub esp, 4
jmp 0x44938c
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x344
mov dword [esp], str._none__debugger_test_needs_user_interaction_n
call fcn.00444250
jmp 0x4493ab
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x30e
mov dword [esp + 8], ebx
mov dword [esp + 4], str.could_not_find_the_test_executable__s_n
mov dword [esp], 0
call fcn.00444b30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [ebx + eax], 0x6f732e
jmp 0x4492f1
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x31b
mov dword [esp], str.not_enough_privileges_to_change_the_debugger_n
call fcn.00444250
jmp 0x449489
mov eax, dword [ebp - 0x1a4]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionAeDebug
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x320
mov dword [esp + 8], esi
mov dword [esp + 4], str.could_not_open_the_AeDebug_key:__ld_n
mov dword [esp], 0
call fcn.00444b30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x33b
mov eax, dword [ebp - 0x1a8]
mov dword [esp + 4], str.Couldnt_access_WineDbg_Key___error__lu_n
mov dword [esp + 8], eax
mov dword [esp], 0
call fcn.00444b30
jmp 0x44938c