Function at 0x10005b40
Capabilities:
Check if process is running under wine
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
lea eax, [ebp - 0x21c]
push ebx
lea ebx, [ebp - 0x228]
sub esp, 0x23c
mov edi, dword [0x1001e20c]
mov dword [ebp - 0x228], 0xc
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0x101
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 5
mov dword [esp], esi
call edi
sub esp, 0x10
test eax, eax
je 0x10005d00
mov eax, dword [ebp - 0x218]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov edi, dword [sym.imp.advapi32.dll_CryptGetProvParam]
mov dword [esp + 8], 0
mov dword [esp + 4], 6
mov dword [esp], eax
call edi
sub esp, 0x14
test eax, eax
je 0x10005cf0
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x22c], eax
call eax
mov esi, eax
test eax, eax
je 0x10005cf0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x218]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 6
mov dword [esp], eax
call edi
sub esp, 0x14
test eax, eax
je 0x10005cf0
mov dword [esp + 0x14], 0
mov ebx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [ebp - 0x220], eax
sub esp, 0x18
lea eax, [eax + eax + 0x34]
mov dword [esp], eax
mov eax, dword [ebp - 0x22c]
call eax
mov edi, eax
test eax, eax
je 0x10005ccc
mov dword [esp + 4], str.SoftwareWineCryptoRSA_
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov edx, dword [ebp - 0x220]
mov dword [esp], edi
mov dword [ebp - 0x22c], edx
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edx, dword [ebp - 0x22c]
mov dword [esp + 0xc], 0xffffffff
lea eax, [edi + eax*2]
mov dword [esp + 8], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x18
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
xor edi, edi
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x224]
mov dword [esp + 8], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 2
mov dword [esp], esi
call edi
sub esp, 0x10
test eax, eax
jne 0x10005d90
lea eax, [ebp - 0x220]
lea ebx, [ebp - 0x20e]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_GetUserNameW]
sub esp, 8
test eax, eax
je 0x10005cf0
mov eax, dword [ebp - 0x220]
lea eax, [eax + eax + 0x34]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x10005cf2
mov dword [esp + 4], str.SoftwareWineCryptoRSA_
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscat]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x224]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x230], eax
call eax
test eax, eax
je 0x10005cf0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [ebp - 0x22c], eax
mov dword [esp + 4], 2
mov dword [esp], esi
call edi
mov edx, dword [ebp - 0x22c]
sub esp, 0x10
test eax, eax
je 0x10005ce0
mov eax, dword [edx]
mov dword [ebp - 0x22c], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 0x34]
mov dword [esp], eax
mov eax, dword [ebp - 0x230]
call eax
mov edx, dword [ebp - 0x22c]
test eax, eax
mov edi, eax
je 0x10005e38
mov dword [ebp - 0x22c], edx
mov dword [esp + 4], str.SoftwareWineCryptoRSA_
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov edx, dword [ebp - 0x22c]
mov eax, dword [edx]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov edx, dword [ebp - 0x22c]
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret