Function at 0x1400033b0
Capabilities:
Check if process is running under wine

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor r12d, r12d
mov qword [rsp + 0x60], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
lea r8d, [r12 + 0x19]
lea rdx, str.HARDWAREACPIDSDTVBOX__
lea rcx, [rsp + 0x60]
call fcn.1400040e0
nop
mov qword [rbp - 0x80], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
lea r8d, [r12 + 0x19]
lea rdx, str.HARDWAREACPIFADTVBOX__
lea rcx, [rbp - 0x80]
call fcn.1400040e0
nop
mov qword [rbp - 0x60], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
lea r8d, [r12 + 0x19]
lea rdx, str.HARDWAREACPIRSDTVBOX__
lea rcx, [rbp - 0x60]
call fcn.1400040e0
nop
mov qword [rbp - 0x40], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
lea r8d, [r12 + 0x2a]
lea rdx, str.SOFTWAREOracleVirtualBox_Guest_Additions
lea rcx, [rbp - 0x40]
call fcn.1400040e0
nop
mov qword [rbp - 0x20], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r12w
lea r8d, [r12 + 0x22]
lea rdx, str.SOFTWAREOracleVirtualBoxVersion
lea rcx, [rbp - 0x20]
call fcn.1400040e0
nop
mov qword [rbp], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp + 0x10], xmm0
mov word [rbp], r12w
lea r8d, [r12 + 0x27]
lea rdx, str.SYSTEMControlSet001ServicesVBoxGuest
lea rcx, [rbp]
call fcn.1400040e0
nop
mov qword [rbp + 0x20], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r12w
lea r8d, [r12 + 0x27]
lea rdx, str.SYSTEMControlSet001ServicesVBoxMouse
lea rcx, [rbp + 0x20]
call fcn.1400040e0
nop
mov qword [rbp + 0x40], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r12w
lea r8d, [r12 + 0x29]
lea rdx, str.SYSTEMControlSet001ServicesVBoxService
lea rcx, [rbp + 0x40]
call fcn.1400040e0
nop
mov qword [rbp + 0x60], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
lea r8d, [r12 + 0x24]
lea rdx, str.SYSTEMControlSet001ServicesVBoxSF
lea rcx, [rbp + 0x60]
call fcn.1400040e0
nop
mov qword [rbp + 0x80], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], r12w
lea r8d, [r12 + 0x27]
lea rdx, str.SYSTEMControlSet001ServicesVBoxVideo
lea rcx, [rbp + 0x80]
call fcn.1400040e0
nop
mov qword [rbp + 0xa0], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r12w
lea r8d, [r12 + 0x33]
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
lea rcx, [rbp + 0xa0]
call fcn.1400040e0
nop
mov qword [rbp + 0xc0], r12
movdqa xmm0, xmmword [0x14009ae60]
movdqa xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0xc0], r12w
lea r8d, [r12 + 0xd]
lea rdx, str.SOFTWAREWine
lea rcx, [rbp + 0xc0]
call fcn.1400040e0
nop
mov r15d, r12d
lea rdi, [rsp + 0x60]
movabs rax, 0x7fffffffffffffff
movabs r13, 0x7ffffffffffffffe
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov rsi, qword [rdi + 0x10]
mov r14, rdi
cmp qword [rdi + 0x18], 8
jb 0x140003660
mov r14, qword [rdi]
cmp rsi, 8
jae 0x140003676
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x38], xmm0
mov ebx, 7
jmp 0x1400036f3
mov rbx, rsi
or rbx, 7
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000382d
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400036cc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000382d
mov rcx, rax
call fcn.140050f78
mov rcx, rax
test rax, rax
je 0x140003827
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400036db
test rcx, rcx
je 0x1400036d8
call fcn.140050f78
jmp 0x1400036db
mov rax, r12
mov qword [rsp + 0x38], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.1400532f0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
lea rdx, [rsp + 0x38]
cmp rbx, 8
cmovae rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x50]
test ebx, ebx
je 0x14000379f
cmp rdx, 8
jb 0x140003780
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000377b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003827
call fcn.140050f70
inc r15
add rdi, 0x20
cmp r15, 0xc
movabs rax, 0x7fffffffffffffff
jl 0x140003640
xor bl, bl
jmp 0x1400037da
cmp rdx, 8
jb 0x1400037d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003827
call fcn.140050f70
mov bl, 1
lea r9, [fcn.140003ee0]
mov edx, 0x20
lea r8d, [rdx - 0x14]
lea rcx, [rsp + 0x60]
call fcn.140051250
movzx eax, bl
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140050f50
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140057640
nop
call fcn.1400014b0
int3