Function at 0x14001ff10
Capabilities:
Check if process is running under wine

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rbp + 0x190], rax
movzx r15d, dl
mov rsi, rcx
lea rcx, [0x14009ca38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001ff74
lea rdx, str.wine_get_version
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001ff74
mov al, 1
jmp 0x14001ffa1
lea rcx, [0x14009c5d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001ff9f
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001ff9f
mov al, 1
jmp 0x14001ffa1
xor al, al
lea rcx, str.Wine:_Windows
lea rdx, str.Windows
test al, al
cmovne rdx, rcx
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14001ffc0
mov rcx, rsi
call fcn.1400155b0
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x20]
call fcn.14006a130
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetVersionExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140020053
mov dword [rsp + 0x20], 0x11c
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x140020053
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x24]
call fcn.14006a130
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x140020053
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x20]
call fcn.14006a130
xor r12d, r12d
cmp dword [rsp + 0x20], r12d
je 0x140020148
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14002011c
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x74]
call fcn.14006a130
mov dword [rbp + 0x70], 0x11c
lea rcx, [rbp + 0x70]
call rbx
test eax, eax
je 0x1400200df
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x74]
call fcn.14006a130
mov dword [rbp + 0x70], 0x114
lea rcx, [rbp + 0x70]
call rbx
test eax, eax
je 0x1400200df
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp + 0x70]
call fcn.14006a130
cmp dword [rbp + 0x70], r12d
je 0x14002011c
mov eax, dword [rbp + 0x74]
mov dword [rsp + 0x24], eax
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x7c]
mov dword [rsp + 0x2c], eax
mov ecx, dword [rbp + 0x80]
mov dword [rsp + 0x30], ecx
movzx eax, word [rbp + 0x184]
mov word [rbp + 0x34], ax
movzx eax, word [rbp + 0x186]
mov word [rbp + 0x36], ax
jmp 0x140020120
mov ecx, dword [rsp + 0x30]
cmp dword [rsp + 0x20], r12d
je 0x140020148
cmp ecx, 2
je 0x140020135
movzx eax, word [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
movzx edx, byte [rbp + 0x3a]
cmp dl, 2
jne 0x140020142
mov dl, 3
jmp 0x1400201a5
test dl, dl
jne 0x1400201a8
jmp 0x1400201a3
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, eax
shr edx, 0x10
movzx r8d, al
mov dword [rsp + 0x24], r8d
movzx eax, ax
shr eax, 8
mov dword [rsp + 0x28], eax
test dx, dx
js 0x140020181
mov ecx, 2
mov dword [rsp + 0x30], ecx
mov eax, edx
and eax, 0x7fff
mov dword [rsp + 0x2c], eax
jmp 0x1400201a3
mov ecx, r12d
cmp r8b, 4
setae cl
mov dword [rsp + 0x30], ecx
jae 0x14002019e
mov eax, edx
and eax, 0x7fff
mov dword [rsp + 0x2c], eax
jmp 0x1400201a3
mov dword [rsp + 0x2c], r12d
mov dl, 1
mov byte [rbp + 0x3a], dl
xor r8b, r8b
lea rbx, [0x14009c748]
mov r14, r12
cmp ecx, dword [rbx - 8]
jne 0x140020231
mov eax, dword [rbx - 4]
cmp dword [rsp + 0x24], eax
jne 0x140020231
mov eax, dword [rbx]
cmp dword [rsp + 0x28], eax
jne 0x140020231
test r15b, r15b
je 0x1400201dc
movzx eax, byte [rbx + 4]
test al, al
je 0x1400201dc
cmp dl, al
jne 0x140020231
test r8b, r8b
je 0x1400201f6
mov r8d, 1
lea rdx, [0x140099044]
mov rcx, rsi
call fcn.1400152b0
mov rax, qword [rbx + 8]
lea rdx, [0x140098b90]
test rax, rax
cmovne rdx, rax
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x140020210
mov rcx, rsi
call fcn.1400152b0
mov r8b, 1
mov ecx, dword [rsp + 0x30]
test r15b, r15b
jne 0x140020246
movzx edx, byte [rbp + 0x3a]
add r14, 0x18
add rbx, 0x18
cmp r14, 0x228
jb 0x1400201b5
test ecx, ecx
jne 0x140020262
lea r8d, [rcx + 6]
lea rdx, str.Win32s
mov rcx, rsi
call fcn.1400152b0
jmp 0x14002039c
mov qword [rbp + 0x40], reloc.WS2_32.dll_recv
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
test r8b, r8b
jne 0x1400202e8
mov r9d, dword [rsp + 0x28]
mov r8d, dword [rsp + 0x24]
lea rdx, str.v_u._u
lea rcx, [rbp + 0x40]
call fcn.140015480
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x48], 0
cmovne rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rcx, rsi
call fcn.1400152b0
test r15b, r15b
je 0x140020392
movzx eax, byte [rbp + 0x3a]
test al, al
je 0x1400202e8
lea rcx, str._workstation
lea rdx, str._server
cmp al, 1
cmove rdx, rcx
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1400202d4
mov r8, rdi
mov rcx, rsi
call fcn.1400152b0
test r15b, r15b
je 0x140020392
movzx ecx, word [rbp + 0x36]
movzx eax, cx
movzx edx, word [rbp + 0x34]
or ax, dx
je 0x140020348
mov r8d, edx
test cx, cx
je 0x14002031e
mov r9d, ecx
lea rdx, str._SP_u._u
lea rcx, [rbp + 0x40]
call fcn.140015480
jmp 0x14002032e
lea rdx, str._SP_u
lea rcx, [rbp + 0x40]
call fcn.140015480
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x48], 0
cmovne rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rcx, rsi
call fcn.1400152b0
mov r8d, dword [rsp + 0x2c]
test r8d, r8d
je 0x14002037c
lea rdx, str.___u_
lea rcx, [rbp + 0x40]
call fcn.140015480
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x48], 0
cmovne rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rcx, rsi
call fcn.1400152b0
mov r8d, 7
lea rdx, str._64_bit
mov rcx, rsi
call fcn.1400152b0
nop
lea rcx, [rbp + 0x40]
call fcn.140015390
nop
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140067810
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret