Function at 0x420b50
Capabilities:
Check if process is running under wine
Link many functions at runtime

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
je 0x420b6e
mov ecx, dword [0x4e69a4]
mov dword [eax], ecx
mov eax, dword [0x4e69a8]
test al, 1
je 0x420b7f
and eax, 2
pop edi
add esp, 0x18
ret
push ebx
push ebp
push esi
mov esi, dword [sym.imp.kernel32.dll_SetErrorMode]
or eax, 1
push 0x8000
mov dword [0x4e69a8], eax
call esi
mov dword [esp + 0x1c], eax
or eax, 0x8000
push eax
call esi
push 0x47fa34
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
cmp ebx, edi
je 0x420c45
mov ebp, dword [sym.imp.kernel32.dll_LoadLibraryA]
push str.user32.dll
call ebp
cmp eax, edi
mov dword [esp + 0x24], eax
je 0x420c45
push 0x47fa50
call ebp
mov edi, eax
test edi, edi
je 0x420c45
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x47fa60
push edi
call esi
test eax, eax
mov dword [0x4e6998], eax
je 0x420c45
push 0x47fa6c
push edi
call esi
test eax, eax
mov dword [0x4e699c], eax
je 0x420c45
push 0x47fa80
push edi
call esi
test eax, eax
mov dword [0x4e69a0], eax
je 0x420c45
lea edx, [esp + 0x18]
push edx
push 0x47fa8c
push 0x80000002
call dword [0x4e6998]
test eax, eax
jne 0x420c68
mov eax, dword [esp + 0x18]
test eax, eax
je 0x420c3b
push eax
call dword [0x4e69a0]
mov dword [0x4e6990], 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x420c53
mov dword [eax], 0
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_SetErrorMode]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x18
ret
call fcn.0041ffa0
test eax, eax
je 0x420ca8
push str.ProcessIdToSessionId
push ebx
call esi
mov edi, eax
test edi, edi
je 0x420d7f
push 0x4e69a4
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
call edi
test eax, eax
je 0x420d7f
mov eax, dword [0x4e69a4]
test eax, eax
jne 0x420d7f
jmp 0x420c45
push str.wtsapi32.dll
call ebp
mov edi, eax
test edi, edi
je 0x420d0b
push str.WTSQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x420d0b
push str.WTSFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x420d0b
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x420d0b
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x4e69a4], edx
cmp dword [eax], 0
je 0x420d00
mov dword [esp + 0x14], 1
push eax
call edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x420d7f
push str.wfapi.dll
call ebp
mov edi, eax
test edi, edi
je 0x420c45
push str.WFQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x420c45
push str.WFFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x420c45
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x420c45
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x4e69a4], edx
cmp dword [eax], 0
mov ebx, 1
jne 0x420d74
mov ebx, dword [esp + 0x14]
push eax
call edi
test ebx, ebx
je 0x420c45
mov eax, dword [esp + 0x24]
push str.GetSystemMetrics
push eax
call esi
test eax, eax
je 0x420d9e
push 0x1000
call eax
test eax, eax
je 0x420c45
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x420dae
mov ecx, dword [0x4e69a4]
mov dword [eax], ecx
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.kernel32.dll_SetErrorMode]
mov eax, dword [0x4e69a8]
pop esi
pop ebp
or eax, 2
pop ebx
mov dword [0x4e69a8], eax
mov eax, 1
pop edi
add esp, 0x18
ret