Function at 0x622c4c80
Capabilities:
Check if process is running under wine
Query or enumerate registry key

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x188
mov eax, dword [ecx + 8]
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14c], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x150], eax
test byte [0x622d8018], 8
jne 0x622c4d20
test edx, edx
je 0x622c4d72
lea esi, [ebp - 0x138]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x26384993
mov dword [esp], 0x622d8080
mov dword [ebp - 0x154], edx
call sym._lookup_handle
mov edx, dword [ebp - 0x154]
test eax, eax
mov ebx, eax
je 0x622c4e10
mov ecx, dword [ebp - 0x138]
test ecx, ecx
je 0x622c5240
cmp edi, 0x29
ja case.0x622c4d11.0
jmp dword [edi*4 + str.0N_bHN_b]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._hProv_08Ix__dwParam_08lx__pbData_p__pdwDataLen_p__dwFlags_08lx__n
mov dword [esp + 8], str.RSAENH_CPGetProvParam
mov dword [esp + 4], 0x622d8018
mov dword [esp], 3
mov dword [ebp - 0x154], edx
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x154]
test edx, edx
jne 0x622c4cc2
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor ebx, ebx
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [ebp - 0x138], 1
mov ecx, dword [ebp - 0x14c]
test ecx, ecx
je 0x622c4dec
cmp dword [edx], 3
ja 0x622c4de0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xea
xor ebx, ebx
mov dword [edx], 4
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, dword [ebp - 0x14c]
mov dword [eax], 1
mov dword [edx], 4
lea esp, [ebp - 0x10]
mov ebx, 1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090001
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, dword fs:[0x18]
xor ebx, ebx
mov dword [eax + 0x34], 0x8009000a
jmp 0x622c4d81
mov esi, dword [ecx + 0x14]
cmp esi, 0x16
ja 0x622c4e68
imul ebx, dword [ecx + 0x10], 0x898
lea eax, [esi + 1]
imul eax, eax, 0x58
mov eax, dword [eax + ebx + 0x622e0420]
test eax, eax
jne 0x622c4e75
test byte [ebp - 0x150], 1
je 0x622c5278
cmp edi, 1
je 0x622c5370
mov ebx, dword [ebp - 0x14c]
test ebx, ebx
je 0x622c5346
cmp dword [edx], 0x57
ja 0x622c530e
mov eax, dword fs:[0x18]
xor ebx, ebx
mov dword [eax + 0x34], 0xea
mov dword [edx], 0x58
jmp 0x622c4d81
mov dword [ebp - 0x150], edx
lea esi, [ecx + 0x1c]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov edi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x150]
lea ebx, [eax + 1]
test edi, edi
je 0x622c5232
cmp ebx, dword [edx]
jbe 0x622c5210
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xea
mov dword [edx], ebx
xor ebx, ebx
jmp 0x622c4d81
mov dword [ebp - 0x138], 8
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x622c4dec
cmp dword [edx], 3
jbe 0x622c4db1
mov eax, dword [ebp - 0x14c]
mov dword [eax], 8
jmp 0x622c4dec
mov dword [ebp - 0x138], 2
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x622c4dec
cmp dword [edx], 3
jbe 0x622c4db1
mov eax, dword [ebp - 0x14c]
mov dword [eax], 2
jmp 0x622c4dec
mov dword [ebp - 0x150], edx
lea esi, [ecx + 0x120]
jmp 0x622c4eb9
mov dword [ebp - 0x138], 0x200
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x622c4dec
cmp dword [edx], 3
jbe 0x622c4db1
mov eax, dword [ebp - 0x14c]
mov dword [eax], 0x200
jmp 0x622c4dec
mov dword [ebp - 0x138], 3
mov esi, dword [ebp - 0x14c]
test esi, esi
je 0x622c4dec
cmp dword [edx], 3
jbe 0x622c4db1
mov eax, dword [ebp - 0x14c]
mov dword [eax], 3
jmp 0x622c4dec
mov ebx, dword [ecx + 0xc]
add ecx, 0x1c
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], str.SoftwareWineCryptoRSA_s
and ebx, 0x20
mov dword [ebp - 0x154], edx
call sym._sprintf.constprop.0
cmp ebx, 1
mov eax, 0x80000001
lea ecx, [ebp - 0x13c]
sbb eax, 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x154]
sub esp, 0x14
test eax, eax
mov ebx, eax
je 0x622c5290
mov eax, dword fs:[0x18]
xor ebx, ebx
mov dword [eax + 0x34], 0x80090016
jmp 0x622c4d81
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x622c5262
cmp dword [edx], 0x5f
ja 0x622c5250
mov eax, dword fs:[0x18]
xor ebx, ebx
mov dword [eax + 0x34], 0xea
mov dword [edx], 0x60
jmp 0x622c4d81
mov eax, dword [ecx + 0xc]
mov ebx, dword [ebp - 0x14c]
and eax, 0x20
mov dword [ebp - 0x138], eax
test ebx, ebx
je 0x622c4dec
cmp dword [edx], 3
jbe 0x622c4db1
mov esi, dword [ebp - 0x14c]
mov dword [esi], eax
jmp 0x622c4dec
test byte [ebp - 0x150], 1
je 0x622c50f0
mov dword [ecx + 0x18], 0
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x622c5360
mov dword [esp + 8], 0x622da6ab
lea ebx, [ebp - 0x13c]
mov dword [esp + 4], str.SoftwareWineCryptoRSA_s
mov dword [esp], esi
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], ecx
call sym._sprintf.constprop.0
xor eax, eax
test byte [ebp - 0x150], 0x20
mov dword [esp + 0x10], ebx
setne al
mov dword [esp + 0xc], 0x20019
sub eax, 0x7fffffff
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 0x158]
sub esp, 0x14
test eax, eax
mov ebx, eax
jne 0x622c5278
mov eax, dword [edx]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x14c], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x150], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
mov ecx, dword [ebp - 0x14c]
sub esp, 0x20
test eax, eax
je 0x622c51ef
cmp eax, 0xea
jne 0x622c5484
mov edx, dword [ebp - 0x150]
mov dword [edx], 0x105
mov eax, dword [ebp - 0x13c]
inc dword [ecx + 0x18]
mov ebx, 1
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x622c4d81
mov eax, dword [ebp - 0x14c]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [ebp - 0x150], edx
call sym._memcpy
mov edx, dword [ebp - 0x150]
mov dword [edx], ebx
mov ebx, 1
jmp 0x622c4d81
xor ebx, ebx
jmp 0x622c4d81
mov edi, dword [ebp - 0x14c]
mov esi, 0x622da6ac
mov ecx, 0x18
rep movsd dword es:[edi], dword [esi]
mov dword [edx], 0x60
mov ebx, 1
jmp 0x622c4d81
mov eax, dword fs:[0x18]
xor ebx, ebx
mov dword [eax + 0x34], 0x103
jmp 0x622c4d81
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x154], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetSecurityInfo]
mov esi, eax
mov eax, dword [ebp - 0x13c]
sub esp, 0x20
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [ebp - 0x154]
sub esp, 4
test esi, esi
je 0x622c5435
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], esi
jmp 0x622c4d81
test byte [ebp - 0x150], 1
jne 0x622c54c2
inc esi
imul ebx, esi, 0x58
imul eax, dword [ecx + 0x10], 0x898
mov dword [ecx + 0x14], esi
cmp dword [edx], 0x57
lea esi, [ebx + eax + 0x622e0420]
jbe 0x622c4e95
mov edi, dword [ebp - 0x14c]
mov ecx, 0x16
rep movsd dword es:[edi], dword [esi]
mov dword [edx], 0x58
mov ebx, 1
jmp 0x622c4d81
mov dword [edx], 0x105
mov ebx, 1
jmp 0x622c4d81
mov edi, dword [ebp - 0x14c]
test edi, edi
je 0x622c5425
cmp dword [edx], 0x1f
jbe 0x622c54a8
test byte [ebp - 0x150], 1
jne 0x622c54f2
inc esi
imul ebx, esi, 0x58
mov dword [ecx + 0x14], esi
imul eax, dword [ecx + 0x10], 0x898
imul esi, esi, 0x58
cmp dword [edx], 0x1f
lea ecx, [esi + eax]
lea eax, [ebx + eax + 0x622e0438]
lea edi, [ecx + 0x622e0420]
mov ebx, dword [eax]
mov ecx, dword [ecx + 0x622e0420]
mov esi, dword [edi + 4]
mov dword [ebp - 0x150], esi
mov esi, dword [edi + 0x14]
mov edi, dword [eax + 4]
mov dword [ebp - 0x154], esi
mov esi, dword [eax + 8]
mov dword [ebp - 0x158], esi
mov esi, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x15c], esi
jbe 0x622c54a8
mov esi, dword [ebp - 0x14c]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x150]
mov dword [esi + 0x10], edi
mov edi, dword [ebp - 0x158]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x154]
mov dword [esi + 0x14], edi
mov edi, dword [ebp - 0x15c]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], eax
mov dword [edx], 0x20
mov ebx, 1
jmp 0x622c4d81
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x150], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetSecurityDescriptorLength]
mov edx, dword [ebp - 0x150]
sub esp, 4
mov ebx, eax
cmp dword [edx], eax
jae 0x622c54cb
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7a
mov esi, dword [ebp - 0x138]
mov dword [edx], ebx
mov ebx, 1
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
jmp 0x622c4d81
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x103
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x622c4d81
mov eax, dword fs:[0x18]
xor ebx, ebx
mov dword [eax + 0x34], 0xea
mov dword [edx], 0x20
jmp 0x622c4d81
xor ebx, ebx
xor esi, esi
jmp 0x622c531f
mov dword [esp + 8], eax
mov esi, dword [ebp - 0x138]
mov eax, dword [ebp - 0x14c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._memcpy
mov edx, dword [ebp - 0x150]
jmp 0x622c546c
xor ebx, ebx
xor esi, esi
jmp 0x622c5398