Function at 0x10006370
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x14]
push ebx
mov ebx, 1
sub esp, 0x30
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineFonts
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
sub esp, 0xc
test eax, eax
je 0x100063b0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.AFMPath
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x10006592
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], 0
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
add eax, 2
mov dword [ebp - 0x10], eax
mov dword [esp + 8], eax
mov eax, dword [0x10025780]
mov dword [esp], eax
call edi
sub esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.AFMPath
mov dword [esp], eax
call ebx
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x10006570
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
call esi
sub esp, 0x20
mov dword [ebp - 0x10], eax
mov dword [esp + 8], eax
mov eax, dword [0x10025780]
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
mov edx, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
sub esp, 0xc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
call esi
sub esp, 0x20
test byte [0x100258d8], 8
jne 0x100065c8
mov edi, dword [ebp - 0x1c]
jmp 0x10006527
mov byte [eax], 0
lea esi, [eax + 1]
mov eax, edi
call sym._ReadAFMDir
test eax, eax
je 0x100065b0
mov edi, esi
test edi, edi
je 0x1000654b
mov dword [esp + 4], 0x3a
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strchr]
test eax, eax
jne 0x10006510
mov eax, edi
call sym._ReadAFMDir
test eax, eax
je 0x100065b0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
mov eax, dword [0x10025780]
mov dword [esp], eax
call ebx
sub esp, 0xc
jmp 0x10006576
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x10025780]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov ebx, 1
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x100063a1
mov eax, dword [ebp - 0x1c]
call sym._wine_dbgstr_an.constprop.0_1
mov dword [esp + 0xc], str.got_AFM_font_path__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.PSDRV_GetType1Metrics
mov dword [esp + 4], 0x100258d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_19
jmp 0x10006505