Function at 0x67c0ead0
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x140]
push ebx
sub esp, 0x16c
mov byte [ebp - 0x28], 0
mov ebx, dword [sym.imp.advapi32.dll_RegOpenKeyA]
mov dword [ebp - 0x13c], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineDirectSound
mov dword [esp], 0x80000001
call ebx
sub esp, 0xc
test eax, eax
je 0x67c0eb1c
mov dword [ebp - 0x140], 0
lea esi, [ebp - 0x12c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
sub eax, 1
sub esp, 0xc
cmp eax, 0x102
jbe 0x67c0ee80
mov eax, dword [ebp - 0x13c]
mov ebx, dword [ebp - 0x140]
mov dword [ebp - 0x138], 0x104
lea edx, [ebp - 0x138]
test eax, eax
je 0x67c0ee38
mov dword [esp + 0x14], edx
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x14c], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.HelBuflen
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x14c]
sub esp, 0x18
test eax, eax
je 0x67c0ebde
test ebx, ebx
je 0x67c0ebec
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.HelBuflen
mov dword [esp], ebx
call edi
sub esp, 0x18
test eax, eax
jne 0x67c0ebec
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_atoi]
mov dword [0x67c2131c], eax
mov eax, dword [ebp - 0x13c]
mov ebx, dword [ebp - 0x140]
mov dword [ebp - 0x134], 0x104
test eax, eax
je 0x67c0ec3c
lea edx, [ebp - 0x134]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.HQBuffersMax
mov dword [esp], eax
call edi
sub esp, 0x18
test eax, eax
je 0x67c0ee58
test ebx, ebx
je 0x67c0ec76
lea eax, [ebp - 0x134]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.HQBuffersMax
mov dword [esp], ebx
call edi
sub esp, 0x18
test eax, eax
je 0x67c0ee58
mov eax, dword [ebp - 0x13c]
mov ebx, dword [ebp - 0x140]
mov dword [ebp - 0x130], 0x104
lea edx, [ebp - 0x130]
test eax, eax
je 0x67c0ed70
mov dword [esp + 0x14], edx
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x14c], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.EAXEnabled
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x14c]
sub esp, 0x18
test eax, eax
je 0x67c0ed08
test ebx, ebx
je 0x67c0ed32
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.EAXEnabled
mov dword [esp], ebx
call edi
sub esp, 0x18
test eax, eax
jne 0x67c0ed32
movzx edx, byte [ebp - 0x12c]
mov ecx, edx
and ecx, 0xffffffdf
cmp cl, 0x54
sete al
cmp cl, 0x59
sete cl
or eax, ecx
cmp dl, 0x31
sete dl
or eax, edx
movzx eax, al
mov dword [0x67c21314], eax
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x67c0ed48
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov eax, dword [ebp - 0x140]
test eax, eax
je 0x67c0ed5e
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x67c21360], 8
jne 0x67c0ed90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
test ebx, ebx
jne 0x67c0ecdc
test byte [0x67c21360], 8
je 0x67c0ed67
lea esi, [esi]
nop
mov eax, dword [0x67c2131c]
mov dword [esp + 0xc], str.ds_hel_buflen___d_n
mov dword [esp + 8], str.setup_dsound_options
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x67c21360
mov dword [esp], 3
call fcn.67c0e2a0
test byte [0x67c21360], 8
je 0x67c0ed67
mov eax, dword [0x67c21318]
mov dword [esp + 0xc], str.ds_hq_buffers_max___d_n
mov dword [esp + 8], str.setup_dsound_options
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x67c21360
mov dword [esp], 3
call fcn.67c0e2a0
test byte [0x67c21360], 8
je 0x67c0ed67
mov eax, dword [0x67c21314]
mov dword [esp + 0xc], str.ds_eax_enabled___u_n
mov dword [esp + 8], str.setup_dsound_options
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x67c21360
mov dword [esp], 3
call fcn.67c0e2a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
test ebx, ebx
jne 0x67c0ebb2
mov dword [ebp - 0x134], 0x104
jmp 0x67c0ec82
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_atoi]
mov ebx, dword [ebp - 0x140]
mov dword [0x67c21318], eax
mov eax, dword [ebp - 0x13c]
jmp 0x67c0ec82
lea edx, [ebp - 0x130]
mov dword [esp + 4], str.SoftwareWineAppDefaults
mov dword [esp + 8], edx
mov dword [esp], 0x80000001
call ebx
sub esp, 0xc
test eax, eax
jne 0x67c0eb4c
mov edx, dword [sym.imp.ucrtbase.dll_strrchr]
mov dword [esp + 4], 0x2f
mov dword [esp], esi
mov dword [ebp - 0x14c], edx
call edx
mov edx, dword [ebp - 0x14c]
mov dword [esp + 4], 0x5c
test eax, eax
lea edi, [eax + 1]
cmove edi, esi
mov dword [esp], edi
call edx
test eax, eax
lea edx, [eax + 1]
cmovne edi, edx
mov dword [esp], edi
call sub.ucrtbase.dll_strlen
add eax, edi
mov dword [eax], 0x7269445c
mov dword [eax + 4], 0x53746365
mov dword [eax + 8], 0x646e756f
mov byte [eax + 0xc], 0
test byte [0x67c21360], 8
jne 0x67c0ef50
lea eax, [ebp - 0x13c]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x67c0ef37
mov dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x67c0eb4c
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.appname____s__n
mov dword [esp + 8], str.setup_dsound_options
mov dword [esp + 4], 0x67c21360
mov dword [esp], 3
call fcn.67c0e2a0
jmp 0x67c0ef0d