Function at 0x140021180
Capabilities:
Check if process is running under wine

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rbp + 0x190], rax
movzx r15d, dl
mov rsi, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400211e4
lea rdx, str.wine_get_version
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400211e4
mov al, 1
jmp 0x140021211
lea rcx, [0x1400a0928]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002120f
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002120f
mov al, 1
jmp 0x140021211
xor al, al
lea rcx, str.Wine:_Windows
lea rdx, str.Windows
test al, al
cmovne rdx, rcx
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140021230
mov rcx, rsi
call fcn.140016780
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x20]
call fcn.14006daf0
lea rcx, [0x1400a0928]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetVersionExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400212c3
mov dword [rsp + 0x20], 0x11c
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x1400212c3
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x24]
call fcn.14006daf0
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x1400212c3
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x20]
call fcn.14006daf0
xor r12d, r12d
cmp dword [rsp + 0x20], r12d
je 0x1400213b8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14002138c
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x74]
call fcn.14006daf0
mov dword [rbp + 0x70], 0x11c
lea rcx, [rbp + 0x70]
call rbx
test eax, eax
je 0x14002134f
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x74]
call fcn.14006daf0
mov dword [rbp + 0x70], 0x114
lea rcx, [rbp + 0x70]
call rbx
test eax, eax
je 0x14002134f
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp + 0x70]
call fcn.14006daf0
cmp dword [rbp + 0x70], r12d
je 0x14002138c
mov eax, dword [rbp + 0x74]
mov dword [rsp + 0x24], eax
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x7c]
mov dword [rsp + 0x2c], eax
mov ecx, dword [rbp + 0x80]
mov dword [rsp + 0x30], ecx
movzx eax, word [rbp + 0x184]
mov word [rbp + 0x34], ax
movzx eax, word [rbp + 0x186]
mov word [rbp + 0x36], ax
jmp 0x140021390
mov ecx, dword [rsp + 0x30]
cmp dword [rsp + 0x20], r12d
je 0x1400213b8
cmp ecx, 2
je 0x1400213a5
movzx eax, word [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
movzx edx, byte [rbp + 0x3a]
cmp dl, 2
jne 0x1400213b2
mov dl, 3
jmp 0x140021415
test dl, dl
jne 0x140021418
jmp 0x140021413
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, eax
shr edx, 0x10
movzx r8d, al
mov dword [rsp + 0x24], r8d
movzx eax, ax
shr eax, 8
mov dword [rsp + 0x28], eax
test dx, dx
js 0x1400213f1
mov ecx, 2
mov dword [rsp + 0x30], ecx
mov eax, edx
and eax, 0x7fff
mov dword [rsp + 0x2c], eax
jmp 0x140021413
mov ecx, r12d
cmp r8b, 4
setae cl
mov dword [rsp + 0x30], ecx
jae 0x14002140e
mov eax, edx
and eax, 0x7fff
mov dword [rsp + 0x2c], eax
jmp 0x140021413
mov dword [rsp + 0x2c], r12d
mov dl, 1
mov byte [rbp + 0x3a], dl
xor r8b, r8b
lea rbx, [0x1400a0b68]
mov r14, r12
cmp ecx, dword [rbx - 8]
jne 0x1400214a1
mov eax, dword [rbx - 4]
cmp dword [rsp + 0x24], eax
jne 0x1400214a1
mov eax, dword [rbx]
cmp dword [rsp + 0x28], eax
jne 0x1400214a1
test r15b, r15b
je 0x14002144c
movzx eax, byte [rbx + 4]
test al, al
je 0x14002144c
cmp dl, al
jne 0x1400214a1
test r8b, r8b
je 0x140021466
mov r8d, 1
lea rdx, [0x14009d124]
mov rcx, rsi
call fcn.140016480
mov rax, qword [rbx + 8]
lea rdx, [0x14009cc01]
test rax, rax
cmovne rdx, rax
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x140021480
mov rcx, rsi
call fcn.140016480
mov r8b, 1
mov ecx, dword [rsp + 0x30]
test r15b, r15b
jne 0x1400214b6
movzx edx, byte [rbp + 0x3a]
add r14, 0x18
add rbx, 0x18
cmp r14, 0x228
jb 0x140021425
test ecx, ecx
jne 0x1400214d2
lea r8d, [rcx + 6]
lea rdx, str.Win32s
mov rcx, rsi
call fcn.140016480
jmp 0x14002160e
mov qword [rbp + 0x40], reloc.WS2_32.dll_recv
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
test r8b, r8b
jne 0x14002155a
mov r9d, dword [rsp + 0x28]
mov r8d, dword [rsp + 0x24]
lea rdx, str.v_u._u
lea rcx, [rbp + 0x40]
call fcn.140016650
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x48], 0
cmovne rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rcx, rsi
call fcn.140016480
test r15b, r15b
je 0x140021604
movzx eax, byte [rbp + 0x3a]
test al, al
je 0x140021563
lea rcx, str._workstation
lea rdx, str._server
cmp al, 1
cmove rdx, rcx
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140021544
mov r8, rdi
mov rcx, rsi
call fcn.140016480
jmp 0x140021563
test r15b, r15b
je 0x140021604
movzx ecx, word [rbp + 0x36]
movzx eax, cx
movzx edx, word [rbp + 0x34]
or ax, dx
je 0x1400215ba
mov r8d, edx
test cx, cx
je 0x140021590
mov r9d, ecx
lea rdx, str._SP_u._u
lea rcx, [rbp + 0x40]
call fcn.140016650
jmp 0x1400215a0
lea rdx, str._SP_u
lea rcx, [rbp + 0x40]
call fcn.140016650
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x48], 0
cmovne rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rcx, rsi
call fcn.140016480
mov r8d, dword [rsp + 0x2c]
test r8d, r8d
je 0x1400215ee
lea rdx, str.___u_
lea rcx, [rbp + 0x40]
call fcn.140016650
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x48], 0
cmovne rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rcx, rsi
call fcn.140016480
mov r8d, 7
lea rdx, str._64_bit
mov rcx, rsi
call fcn.140016480
nop
lea rcx, [rbp + 0x40]
call fcn.140016560
nop
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14006b1a0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret