Function at 0x42b190
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
mov edi, str.ThreadId
push esi
mov esi, 0x442220
push ebx
push ecx
sub esp, 0x58
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x2c], eax
call fcn.0042abb0
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
sub esp, 4
mov dword [0x4422d0], eax
mov dword [esp], 0x424470
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
mov ecx, 0x4425b0
movd xmm0, edi
xor edx, edx
movd xmm1, ecx
mov edi, str.ProcessId
mov ecx, 0x4425ac
mov dword [0x442230], edx
mov eax, 0xffffff01
punpckldq xmm0, xmm1
movd xmm2, ecx
movq qword [0x442284], xmm0
movd xmm0, edi
mov dword [0x44222c], eax
sub esp, 4
mov dword [0x44223c], eax
punpckldq xmm0, xmm2
lea edi, [ebp - 0x1c]
mov dword [0x442240], edx
mov dword [0x44224c], eax
mov dword [0x442250], edx
mov dword [0x44225c], eax
mov dword [0x442260], edx
mov dword [0x44226c], eax
mov dword [0x442270], edx
mov dword [0x44227c], eax
mov dword [0x442280], edx
mov dword [0x44228c], eax
mov dword [0x442290], edx
movq qword [0x442294], xmm0
mov dword [0x44229c], eax
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], 4
mov dword [0x442220], 0
mov dword [0x442224], 0x43a186
mov dword [0x442228], 0
mov dword [0x442234], 0x43a19d
mov dword [0x442238], 0
mov dword [0x442244], 0x43a1b4
mov dword [0x442248], 0
mov dword [0x442254], 0x43a1c2
mov dword [0x442258], 0
mov dword [0x442264], 0x43a1d5
mov dword [0x442268], 0
mov dword [0x442274], 0x43a1e4
mov dword [0x442278], 0
mov dword [0x4422a0], edx
mov dword [0x4422ac], eax
mov eax, 0xffffff01
mov dword [0x4422b0], edx
mov edx, 1
mov dword [0x4422bc], eax
lea eax, [ebp - 0x28]
mov dword [0x4422a4], 0x43a1f7
mov dword [0x4422a8], 0
mov dword [0x4422b4], 0x43a208
mov dword [0x4422b8], 0
mov dword [0x4422c0], edx
mov dword [0x4422c4], 0x43a21b
mov dword [0x4422c8], 0
mov dword [0x4422cc], 0xffffff01
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineWineDbg
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegCreateKeyA
sub esp, 0xc
mov dword [ebp - 0x38], eax
test eax, eax
je 0x42b3ab
jmp 0x42b5d4
add esi, 0x10
cmp esi, 0x4422d0
je 0x42b400
mov eax, dword [esi + 8]
test eax, eax
jne 0x42b3a0
lea eax, [ebp - 0x20]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x42b3ea
mov eax, dword [ebp - 0x20]
mov dword [esi], eax
mov dword [esi + 8], esi
add esi, 0x10
cmp esi, 0x4422d0
jne 0x42b3ab
lea esi, [esi]
nop
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x2c]
sub esp, 4
sub eax, 1
mov edi, eax
je 0x42b5ea
mov esi, dword [ebx + 4]
mov dword [esp + 4], str.__help
mov eax, dword [sym.imp.ucrtbase.dll_strcmp]
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call eax
test eax, eax
je 0x42b6a5
lea eax, [ebx + 4]
mov dword [ebp - 0x30], eax
mov dword [esp + 4], str.__gdb
mov dword [esp], esi
mov eax, dword [ebp - 0x2c]
call eax
test eax, eax
je 0x42b62c
call fcn.00424fa0
call sub.dbghelp.dll_SymGetOptions
and eax, 0xfffedfe9
or eax, 0x12014
mov dword [esp], eax
call sub.dbghelp.dll_SymSetOptions
push esi
mov dword [esp + 4], str.__auto
mov eax, dword [ebx + 4]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
call eax
test eax, eax
je 0x42b6b6
mov dword [esp + 4], str.__minidump
mov eax, dword [ebx + 4]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
call eax
test eax, eax
je 0x42b65d
test edi, edi
mov esi, edi
jle 0x42b786
xor edx, edx
add ebx, 0xc
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x3c], edx
lea esi, [esi]
lea esi, [esi]
mov edi, dword [ebx - 8]
lea edx, [ebx - 8]
mov dword [ebp - 0x30], edx
cmp byte [edi], 0x2d
jne 0x42b754
mov dword [esp + 4], str.__command
mov dword [esp], edi
mov eax, dword [ebp - 0x2c]
call eax
test eax, eax
jne 0x42b530
cmp esi, 1
je 0x42b709
mov dword [esp + 4], 0
mov eax, dword [ebx - 4]
mov dword [esp], eax
call fcn.00427d30
mov dword [ebp - 0x34], eax
cmp eax, 0xffffffff
je 0x42b687
sub esi, 2
add ebx, 8
test esi, esi
jne 0x42b4d0
jmp 0x42b613
mov dword [esp + 4], str.__file
mov dword [esp], edi
mov eax, dword [ebp - 0x2c]
call eax
test eax, eax
jne 0x42b709
cmp esi, 1
je 0x42b709
mov eax, dword [ebx - 4]
mov dword [ebp - 0x3c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80010000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x34], eax
cmp eax, 0xffffffff
jne 0x42b51e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
mov dword [esp], str.Couldnt_open_file__s___lu__n
mov dword [esp + 4], eax
call fcn.004242a0
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test byte [0x42c85c], 2
jne 0x42b6e0
mov dword [ebp - 0x38], 0xffffffff
jmp 0x42b5c5
call fcn.00424fa0
xor ebx, ebx
call sub.dbghelp.dll_SymGetOptions
and eax, 0xfffedfe9
or eax, 0x12014
mov dword [esp], eax
call sub.dbghelp.dll_SymSetOptions
push ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0xffffffff
call fcn.00424270
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00424ff0
jmp 0x42b5c5
call fcn.00424270
mov eax, dword [ebp - 0x30]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00414200
mov dword [ebp - 0x38], eax
add eax, 1
jne 0x42b5c5
mov dword [esp], str.Usage:_n_twinedbg_______gdb______prog_name_____prog_args______num____file.mdmp_____help___n
call fcn.004242a0
jmp 0x42b5c5
mov eax, dword [ebp - 0x30]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0041f600
cmp eax, 1
je 0x42b64c
cmp eax, 2
je 0x42b5e1
test eax, eax
jne 0x42b4ad
jmp 0x42b5c5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], str.Couldnt_open_temp_file___lu__n
mov dword [esp + 4], eax
call fcn.004242a0
jmp 0x42b5be
mov dword [esp], str.Usage:_n___winedbg__cmdline________launch_process__cmdline___as_if_you_were_starting_n___________________________it_with_wine__and_run_WineDbg_on_it_n___winedbg__num____________attach_to_running_process_of_wpid__num__and_run_n___________________________WineDbg_on_it_n___winedbg___gdb__cmdline__launch_process__cmdline___as_if_you_were_starting_n___________________________wine__and_run_gdb__proxied__on_it_n___winedbg___gdb__num______attach_to_running_process_of_wpid__num__and_run_n___________________________gdb__proxied__on_it_n___winedbg__file.mdmp______reload_the_minidump__file.mdmp__into_memory_and_run_n___________________________WineDbg_on_it_n___winedbg___help__________prints_advanced_options_n
call fcn.004242a0
jmp 0x42b5c5
mov eax, dword [ebp - 0x30]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0041f2a0
cmp eax, 1
je 0x42b64c
cmp eax, 2
je 0x42b5e1
test eax, eax
jne 0x42b492
jmp 0x42b5c5
mov dword [esp + 0xc], str.Cannot_create_WineDbg_key_in_registry_n
mov dword [esp + 8], str.dbg_load_internal_vars
mov dword [esp + 4], 0x42c85c
mov dword [esp], 1
call fcn.00423d60
jmp 0x42b5e1
mov dword [esp + 4], 0x43a5af
mov dword [esp], edi
mov eax, dword [ebp - 0x2c]
call eax
test eax, eax
jne 0x42b64c
add dword [ebp - 0x30], 4
lea eax, [esi - 1]
mov edi, eax
test edi, edi
je 0x42b613
mov eax, dword [ebp - 0x30]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0041f120
cmp eax, 1
je 0x42b758
cmp eax, 2
je 0x42b5e1
jmp 0x42b613
mov edi, esi
jmp 0x42b72a
mov eax, dword [ebp - 0x30]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00420a30
cmp eax, 1
jne 0x42b746
mov eax, dword [ebp - 0x30]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0041f240
cmp eax, 1
je 0x42b64c
jmp 0x42b746
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x3c], eax
jmp 0x42b732