Function at 0x622c18c0
Capabilities:
Check if process is running under wine
Delete registry key
Get session user name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x268
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x24c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x250], eax
test byte [0x622d8018], 8
jne 0x622c1a08
test edx, edx
je 0x622c190a
movzx ecx, byte [edx]
test cl, cl
jne 0x622c1a60
lea edi, [ebp - 0x138]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x254], edx
mov dword [ebp - 0x138], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_GetUserNameA]
sub esp, 8
test eax, eax
je 0x622c19b3
mov eax, ebx
and eax, 0xf0000018
cmp eax, 0x10
je 0x622c1b68
mov edx, dword [ebp - 0x254]
ja 0x622c19c8
test eax, eax
je 0x622c1af0
cmp eax, 8
jne 0x622c19da
mov ecx, dword [ebp - 0x250]
mov edx, ebx
mov eax, esi
call sym._read_key_container
mov edi, dword [ebp - 0x24c]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x622c1bb8
mov dword [esp + 8], 0x26384993
mov dword [esp + 4], eax
mov dword [esp], 0x622d8080
call sym._release_handle
test byte [0x622d8018], 8
jne 0x622c1bd6
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x8009000f
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, ebx
and eax, 0xf0000010
cmp eax, 0xf0000000
je 0x622c1b38
mov eax, dword [ebp - 0x24c]
mov dword [eax], 0xffffffff
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090009
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, edx
mov dword [ebp - 0x254], edx
call sym._wine_dbgstr_an.constprop.0
mov esi, dword [ebp - 0x250]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._phProv_p__pszContainer_s__dwFlags_08lx__pVTable_p__n
mov dword [esp + 8], str.RSAENH_CPAcquireContext
mov dword [esp + 4], 0x622d8018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x254]
jmp 0x622c18fb
lea esi, [ebp - 0x23c]
lea edi, [ebp - 0x139]
mov eax, esi
jmp 0x622c1a77
movzx ecx, byte [edx]
test cl, cl
je 0x622c1a80
inc eax
inc edx
mov byte [eax - 1], cl
cmp eax, edi
jne 0x622c1a70
mov byte [eax], 0
mov eax, ebx
lea edi, [ebp - 0x138]
and eax, 0xf0000018
cmp eax, 0x10
je 0x622c1b68
jbe 0x622c1952
and ebx, 0xf0000010
cmp ebx, 0xf0000000
jne 0x622c19da
test byte [0x622d8018], 8
je 0x622c19e6
mov dword [esp + 0xc], str.pszContainer_should_be_empty_n
mov dword [esp + 8], str.RSAENH_CPAcquireContext
mov dword [esp + 4], 0x622d8018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x622c19e6
mov ecx, dword [ebp - 0x250]
mov edx, ebx
mov eax, esi
call sym._read_key_container
mov edx, eax
mov eax, dword [ebp - 0x24c]
mov dword [eax], edx
xor eax, eax
cmp edx, 0xffffffff
je 0x622c19b3
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
test edx, edx
je 0x622c1b45
cmp byte [edx], 0
jne 0x622c1ab1
mov ecx, dword [ebp - 0x250]
mov edx, ebx
mov eax, 0x622da6ab
call sym._new_key_container
mov edx, eax
mov eax, dword [ebp - 0x24c]
mov dword [eax], edx
jmp 0x622c1b09
mov dword [esp + 8], esi
mov dword [esp + 4], str.SoftwareWineCryptoRSA_s
mov dword [esp], edi
call sym._sprintf.constprop.0
xor eax, eax
and ebx, 0x20
mov dword [esp + 4], edi
setne al
sub eax, 0x7fffffff
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
sub esp, 8
test eax, eax
je 0x622c1b14
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090016
xor eax, eax
jmp 0x622c19b3
mov ecx, dword [ebp - 0x250]
mov edx, ebx
mov eax, esi
call sym._new_key_container
mov edx, eax
mov eax, dword [ebp - 0x24c]
mov dword [eax], edx
jmp 0x622c1b09
mov dword [esp + 0xc], str.Cant_create_new_keyset__already_exists_n
mov dword [esp + 8], str.RSAENH_CPAcquireContext
mov dword [esp + 4], 0x622d8018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x622c19a4