Function at 0x14000927a
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x28], edx
mov rax, rsp
mov rbx, rax
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0x33
mov eax, dword [rbp - 0xc]
cdqe
sub rax, 1
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 0xc]
cdqe
mov r10, rax
mov r11d, 0
mov eax, dword [rbp - 0xc]
cdqe
mov r8, rax
mov r9d, 0
mov eax, dword [rbp - 0xc]
cdqe
shl rax, 3
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.14000ce90
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 7
shr rax, 3
shl rax, 3
mov qword [rbp - 0x20], rax
cmp dword [rbp + 0x28], 0
jne 0x14000960d
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIDSDTVBOX__
mov qword [rax], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIFADTVBOX__
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIRSDTVBOX__
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServicesVBox
mov qword [rax + 0x18], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rax + 0x20], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxGuest
mov qword [rax + 0x28], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxMouse
mov qword [rax + 0x30], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxService
mov qword [rax + 0x38], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxSF
mov qword [rax + 0x40], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxVideo
mov qword [rax + 0x48], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREVMware__Inc.
mov qword [rax + 0x50], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumSCSIVMware
mov qword [rax + 0x58], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServicesVMware
mov qword [rax + 0x60], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSoftwareVMware__Inc.
mov qword [rax + 0x68], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSOFTWAREWine
mov qword [rax + 0x70], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREWine
mov qword [rax + 0x78], rdx
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x80], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x88], 0x4c
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x90], 0x65
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x98], 0x69
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xa0], 0x36
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xa8], 0x2a
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xb0], 0x2a
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xb8], 0x2a
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xc0], 0x2a
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xc8], 0x67
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xd0], 0x65
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xd8], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xe0], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xe8], 0x2a
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xf0], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xf8], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x100], 0x33
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x108], 0x62
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x110], 0x66
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x118], 0x78
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x120], 0x74
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x128], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x130], 0x6e
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x138], 0x65
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x140], 0x56
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x148], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x150], 0x65
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x158], 0x6e
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x160], 0x6e
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x168], 0x6e
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x170], 0x6e
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x178], 0x74
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x180], 0x36
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x188], 0x63
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x190], 0x62
jmp 0x140009909
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIDSDT
mov qword [rax], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIFADT
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIRSDT
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServices
mov qword [rax + 0x18], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREOracle
mov qword [rax + 0x20], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x28], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x30], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x38], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x40], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x48], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWARE
mov qword [rax + 0x50], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumSCSI
mov qword [rax + 0x58], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServices
mov qword [rax + 0x60], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSoftware
mov qword [rax + 0x68], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSOFTWARE
mov qword [rax + 0x70], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWARE
mov qword [rax + 0x78], rdx
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x80], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x88], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x90], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x98], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xa0], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xa8], 0x45
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xb0], 0x45
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xb8], 0x45
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xc0], 0x45
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xc8], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xd0], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xd8], 0x2e
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xe0], 0x2e
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xe8], 0x49
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xf0], 0x49
mov rax, qword [rbp - 0x20]
mov qword [rax + 0xf8], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x100], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x108], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x110], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x118], 0x6c
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x120], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x128], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x130], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x138], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x140], 0x74
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x148], 0x74
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x150], 0x74
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x158], 0x54
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x160], 0x54
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x168], 0x54
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x170], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x178], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x180], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x188], 0x73
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x190], 0x73
mov dword [rbp - 8], 0
jmp 0x140009938
mov rax, qword [rbp - 0x20]
mov edx, dword [rbp - 8]
movsxd rdx, edx
mov rax, qword [rax + rdx*8]
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call rdx
test eax, eax
je 0x140009934
mov dword [rbp - 4], 1
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0xc]
jl 0x140009912
mov eax, dword [rbp - 4]
mov rsp, rbx
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret