Function at 0x437110
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x44
call fcn.004368c0
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [0x4ab2f0], eax
push edx
mov dword [esp], 0x421a80
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x10], 4
push ecx
mov dword [0x4ab240], 0
mov dword [0x4ab244], 0x440dc3
mov dword [0x4ab248], 0
mov dword [0x4ab24c], 0xffffff09
mov dword [0x4ab250], 0
mov dword [0x4ab254], 0x440dda
mov dword [0x4ab258], 0
mov dword [0x4ab25c], 0xffffff09
mov dword [0x4ab260], 0
mov dword [0x4ab264], 0x440df1
mov dword [0x4ab268], 0
mov dword [0x4ab26c], 0xffffff09
mov dword [0x4ab270], 0
mov dword [0x4ab274], 0x440dff
mov dword [0x4ab278], 0
mov dword [0x4ab27c], 0xffffff09
mov dword [0x4ab280], 0
mov dword [0x4ab284], 0x440e12
mov dword [0x4ab288], 0
mov dword [0x4ab28c], 0xffffff09
mov dword [0x4ab290], 0
mov dword [0x4ab294], 0x440e21
mov dword [0x4ab298], 0
mov dword [0x4ab29c], 0xffffff09
mov dword [0x4ab2a0], 0
mov dword [0x4ab2a4], 0x440e34
mov dword [0x4ab2a8], 0x4ab5d0
mov dword [0x4ab2ac], 0xffffff09
mov dword [0x4ab2b0], 0
mov dword [0x4ab2b4], 0x440e3d
mov dword [0x4ab2b8], 0x4ab5cc
mov dword [0x4ab2bc], 0xffffff09
mov dword [0x4ab2c0], 0
mov dword [0x4ab2c4], 0x440e47
mov dword [0x4ab2c8], 0
mov dword [0x4ab2cc], 0xffffff09
mov dword [0x4ab2d0], 0
mov dword [0x4ab2d4], 0x440e58
mov dword [0x4ab2d8], 0
mov dword [0x4ab2dc], 0xffffff09
mov dword [0x4ab2e0], 1
mov dword [0x4ab2e4], 0x440e6b
mov dword [0x4ab2e8], 0
mov dword [0x4ab2ec], 0xffffff09
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineWineDbg
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
sub esp, 0xc
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x437646
mov ebx, 0x4ab240
mov esi, 0x4ab2f0
lea edi, [ebp - 0x10]
jmp 0x437347
add ebx, 0x10
cmp esi, ebx
je 0x437398
mov eax, dword [ebx + 8]
test eax, eax
jne 0x437340
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x437387
mov eax, dword [ebp - 0x14]
mov dword [ebx], eax
mov dword [ebx + 8], ebx
add ebx, 0x10
cmp esi, ebx
jne 0x437347
lea esi, [esi]
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
add eax, 4
dec edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x43750d
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov eax, dword [sym.imp.ucrtbase.dll_strcmp]
mov dword [esp + 4], str.__help
mov dword [esp], ebx
mov dword [ebp - 0x20], eax
call eax
mov edx, dword [ebp - 0x28]
test eax, eax
je 0x437786
mov dword [esp + 4], str.__gdb
mov dword [esp], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
call eax
mov edx, dword [ebp - 0x28]
test eax, eax
je 0x43770a
mov dword [ebp - 0x28], edx
call fcn.004228f0
call dword [sym.imp.dbghelp.dll_SymGetOptions]
and eax, 0xfffedfe9
or eax, 0x12014
mov dword [esp], eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
mov ebx, dword [sym.imp.dbghelp.dll_SymSetExtendedOption]
push eax
mov dword [esp + 4], 1
mov dword [esp], 0x3e9
call ebx
push edx
push edx
mov dword [esp + 4], 1
mov dword [esp], 0x3eb
call ebx
mov eax, dword [ebp + 0xc]
push ecx
push ecx
mov dword [esp + 4], str.__auto
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
mov dword [esp], ebx
call eax
mov edx, dword [ebp - 0x28]
test eax, eax
je 0x437694
mov dword [esp + 4], str.__minidump
mov dword [esp], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
call eax
mov edx, dword [ebp - 0x28]
test eax, eax
je 0x437759
test edx, edx
jle 0x4377ef
mov eax, dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x28], 0xffffffff
lea esi, [eax + 0xc]
mov edi, dword [esi - 8]
lea eax, [esi - 8]
mov dword [ebp - 0x24], eax
mov edx, ebx
cmp byte [edi], 0x2d
jne 0x4377c3
mov dword [esp + 4], str.__command
mov dword [esp], edi
mov eax, dword [ebp - 0x20]
call eax
cmp ebx, 1
setne dl
test eax, eax
jne 0x437588
test dl, dl
je 0x437588
mov dword [esp + 4], 0
mov eax, dword [esi - 4]
mov dword [esp], eax
call fcn.004251c0
mov dword [ebp - 0x28], eax
inc eax
je 0x43766f
sub ebx, 2
add esi, 8
test ebx, ebx
jne 0x4374aa
jmp 0x437566
call fcn.004228f0
call dword [sym.imp.dbghelp.dll_SymGetOptions]
and eax, 0xfffedfe9
or eax, 0x12014
mov dword [esp], eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push ebx
mov ebx, dword [sym.imp.dbghelp.dll_SymSetExtendedOption]
mov dword [esp + 4], 1
mov dword [esp], 0x3e9
call ebx
push esi
push esi
mov dword [esp + 4], 1
mov dword [esp], 0x3eb
call ebx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x28], 0xffffffff
push edi
push edi
call fcn.004218a0
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.00422940
mov eax, dword [ebp - 0x2c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.__exec
mov dword [esp], edi
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x2d], dl
call eax
test eax, eax
jne 0x4375aa
mov dl, byte [ebp - 0x2d]
test dl, dl
jne 0x43765f
mov dword [esp + 4], str.__file
mov dword [esp], edi
mov eax, dword [ebp - 0x20]
call eax
test eax, eax
jne 0x43779e
cmp ebx, 1
je 0x43779e
mov eax, dword [esi - 4]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 5
mov dword [esp + 4], 0x80010000
mov dword [esp], eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x28], eax
inc eax
jne 0x437501
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [esp], str.Couldnt_open_file__s___lu__n
mov dword [esp + 4], eax
call fcn.004218d0
mov dword [ebp - 0x2c], 1
jmp 0x43757d
test byte [0x4387dc], 2
jne 0x437730
mov dword [ebp - 0x2c], 0xffffffff
jmp 0x43757d
mov eax, dword [esi - 4]
mov dword [esp], eax
call fcn.0041b520
jmp 0x437501
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], str.Couldnt_open_temp_file___lu__n
mov dword [esp + 4], eax
call fcn.004218d0
mov dword [ebp - 0x2c], 1
jmp 0x43757d
mov eax, dword [ebp - 0x24]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0x28], edx
call fcn.0041b7f0
cmp eax, 1
je 0x4376f9
cmp eax, 2
je 0x437653
test eax, eax
je 0x43757d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x28]
mov ebx, dword [eax + 4]
jmp 0x43746e
mov eax, dword [ebp - 0x24]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0041d750
mov edx, dword [ebp - 0x20]
cmp eax, 1
jne 0x4377e1
mov eax, dword [ebp - 0x24]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0041b790
cmp eax, 1
jne 0x4377e1
mov dword [esp], str.Usage:_n_twinedbg_______gdb______prog_name_____prog_args______num____file.mdmp_____help___n
call fcn.004218d0
jmp 0x43757d
mov dword [ebp - 0x20], edx
call fcn.004218a0
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0040f900
mov dword [ebp - 0x2c], eax
inc eax
jne 0x43757d
jmp 0x4376f9
mov dword [esp + 0xc], str.Cannot_create_WineDbg_key_in_registry_n
mov dword [esp + 8], str.dbg_load_internal_vars
mov dword [esp + 4], 0x4387dc
mov dword [esp], 1
call fcn.00421670
jmp 0x437653
mov eax, dword [ebp - 0x24]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0041bb10
cmp eax, 1
je 0x4376f9
cmp eax, 2
je 0x437653
test eax, eax
mov edx, dword [ebp - 0x28]
jne 0x43748c
jmp 0x43757d
mov dword [esp], str.Usage:_n___winedbg__cmdline________launch_process__cmdline___as_if_you_were_starting_n___________________________it_with_wine__and_run_WineDbg_on_it_n___winedbg__num____________attach_to_running_process_of_wpid__num__and_run_n___________________________WineDbg_on_it_n___winedbg___gdb__cmdline__launch_process__cmdline___as_if_you_were_starting_n___________________________wine__and_run_gdb__proxied__on_it_n___winedbg___gdb__num______attach_to_running_process_of_wpid__num__and_run_n___________________________gdb__proxied__on_it_n___winedbg__file.mdmp______reload_the_minidump__file.mdmp__into_memory_and_run_n___________________________WineDbg_on_it_n___winedbg___help__________prints_advanced_options_n
call fcn.004218d0
mov dword [ebp - 0x2c], 0
jmp 0x43757d
mov dword [esp + 4], 0x441202
mov dword [esp], edi
mov eax, dword [ebp - 0x20]
call eax
test eax, eax
jne 0x4376f9
mov edx, ebx
add dword [ebp - 0x24], 4
dec edx
je 0x437566
mov eax, dword [ebp - 0x24]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0x20], edx
call fcn.0041b670
mov edx, dword [ebp - 0x20]
cmp eax, 1
je 0x4376c6
cmp eax, 2
je 0x437653
jmp 0x437566
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x28], 0xffffffff
jmp 0x4377c3