Function at 0x41ba40
Capabilities:
Check if process is running under wine
Link many functions at runtime

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
push esi
xor esi, esi
cmp ebx, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 8], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], esi
je 0x41ba66
mov eax, dword [0x4ff338]
mov dword [ebx], eax
mov eax, dword [0x4ff33c]
test al, 1
je 0x41ba78
pop esi
and eax, 2
pop ebx
add esp, 0x24
ret
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 1
push 0x8000
mov dword [0x4ff33c], eax
call edi
mov dword [esp + 0x2c], eax
or eax, 0x8000
push eax
call edi
push 0x497844
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, esi
je 0x41bd2a
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebp
cmp eax, esi
mov dword [esp + 0x20], eax
je 0x41bd2a
push 0x497860
call ebp
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0x14], ebx
je 0x41bcfa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x497870
push ebx
call esi
test eax, eax
mov dword [0x4ff32c], eax
je 0x41bcfa
push 0x49787c
push ebx
call esi
test eax, eax
mov dword [0x4ff330], eax
je 0x41bcfa
push 0x497890
push ebx
call esi
test eax, eax
mov dword [0x4ff334], eax
je 0x41bcfa
lea ecx, [esp + 0x28]
push ecx
push str.SoftwareWineWineConfig
push 0x80000002
call dword [0x4ff32c]
test eax, eax
jne 0x41bb5a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41bb4b
push eax
call dword [0x4ff334]
mov dword [0x4ff324], 1
jmp 0x41bcfa
call fcn.0041acd0
test eax, eax
je 0x41bb9d
push str.ProcessIdToSessionId
push edi
call esi
mov edi, eax
test edi, edi
je 0x41bc80
push 0x4ff338
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call edi
test eax, eax
je 0x41bc80
mov eax, dword [0x4ff338]
test eax, eax
jne 0x41bc80
jmp 0x41bcfa
push str.wtsapi32.dll
call ebp
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x24], ebx
je 0x41bc04
push str.WTSQuerySessionInformationA
push ebx
call esi
mov edi, eax
test edi, edi
je 0x41bc04
push str.WTSFreeMemory
push ebx
call esi
mov ebx, eax
test ebx, ebx
je 0x41bc04
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x1c]
push eax
push 4
push 0xffffffffffffffff
push 0
call edi
test eax, eax
je 0x41bc04
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [0x4ff338], ecx
cmp dword [eax], 0
je 0x41bbf9
mov dword [esp + 0x1c], 1
push eax
call ebx
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x41bc7c
push str.wfapi.dll
call ebp
test eax, eax
mov dword [esp + 0x10], eax
je 0x41bcf6
push str.WFQuerySessionInformationA
mov edx, eax
push edx
call esi
mov edi, eax
test edi, edi
je 0x41bcf6
mov eax, dword [esp + 0x10]
push str.WFFreeMemory
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x41bcf6
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x1c]
push edx
push 4
push 0xffffffffffffffff
push 0
call edi
test eax, eax
je 0x41bcf6
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [0x4ff338], ecx
cmp dword [eax], 0
mov edi, 1
jne 0x41bc75
mov edi, dword [esp + 0x1c]
push eax
call ebx
test edi, edi
je 0x41bcf6
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push str.GetSystemMetrics
push edx
call esi
test eax, eax
je 0x41bc9b
push 0x1000
call eax
test eax, eax
je 0x41bcfa
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41bcb3
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41bcbe
push eax
call esi
push ebx
call esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x41bcd1
mov ecx, dword [0x4ff338]
mov dword [eax], ecx
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x4ff33c]
pop edi
pop ebp
or eax, 2
pop esi
mov dword [0x4ff33c], eax
mov eax, 1
pop ebx
add esp, 0x24
ret
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41bd12
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41bd1d
push eax
call esi
test ebx, ebx
je 0x41bd24
push ebx
call esi
mov ebx, dword [esp + 0x38]
xor esi, esi
cmp ebx, esi
je 0x41bd30
mov dword [ebx], esi
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret