Function at 0x14000d705
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x28], edx
mov rax, rsp
mov rbx, rax
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0x33
mov eax, dword [rbp - 0xc]
cdqe
sub rax, 1
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 0xc]
cdqe
mov r10, rax
mov r11d, 0
mov eax, dword [rbp - 0xc]
cdqe
mov r8, rax
mov r9d, 0
mov eax, dword [rbp - 0xc]
cdqe
shl rax, 3
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140011910
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 7
shr rax, 3
shl rax, 3
mov qword [rbp - 0x20], rax
cmp dword [rbp + 0x28], 0
jne 0x14000db01
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIDSDTVBOX__
mov qword [rax], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIFADTVBOX__
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIRSDTVBOX__
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServicesVBox
mov qword [rax + 0x18], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rax + 0x20], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxGuest
mov qword [rax + 0x28], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxMouse
mov qword [rax + 0x30], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxService
mov qword [rax + 0x38], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxSF
mov qword [rax + 0x40], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVBoxVideo
mov qword [rax + 0x48], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREVMware__Inc.
mov qword [rax + 0x50], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumSCSIVMware
mov qword [rax + 0x58], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServicesVMware
mov qword [rax + 0x60], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSoftwareVMware__Inc.
mov qword [rax + 0x68], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSOFTWAREWine
mov qword [rax + 0x70], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREWine
mov qword [rax + 0x78], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVMTools
mov qword [rax + 0x80], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001ServicesVMMEMCTL
mov qword [rax + 0x88], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmware
mov qword [rax + 0x90], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmci
mov qword [rax + 0x98], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmx86
mov qword [rax + 0xa0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDECdRomNECVMWar_VMware_IDE_CD
mov qword [rax + 0xa8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDECdRomNECVMWar_VMware_SATA_CD
mov qword [rax + 0xb0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDEDiskVMware_Virtual_IDE_Hard_Drive
mov qword [rax + 0xb8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDEDiskVMware_Virtual_SATA_Hard_Drive
mov qword [rax + 0xc0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmdebug
mov qword [rax + 0xc8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmmouse
mov qword [rax + 0xd0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREVMware__Inc.VMware_Tools
mov qword [rax + 0xd8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSOFTWAREVMware__Inc.VMware_Tools
mov qword [rax + 0xe0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumPCIVEN_1AB8
mov qword [rax + 0xe8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumPCIVEN_5333s
mov qword [rax + 0xf0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vpcbus
mov qword [rax + 0xf8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vpc_s3
mov qword [rax + 0x100], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vpcuhub
mov qword [rax + 0x108], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Servicesmsvmmouf
mov qword [rax + 0x110], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSoftwareClassesFolder_shell_sandbox
mov qword [rax + 0x118], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmicheartbeat
mov qword [rax + 0x120], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmicvss
mov qword [rax + 0x128], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmicshutdown
mov qword [rax + 0x130], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services_vmicexchange
mov qword [rax + 0x138], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREMicrosoftHyper_V
mov qword [rax + 0x140], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREMicrosoftVirtual_MachineGuestParameters
mov qword [rax + 0x148], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREMicrosoftVirtualMachine
mov qword [rax + 0x150], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIDSDTxen
mov qword [rax + 0x158], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIFADTxen
mov qword [rax + 0x160], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIRSDTxen
mov qword [rax + 0x168], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Servicesxenevtchn
mov qword [rax + 0x170], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Servicesxennet
mov qword [rax + 0x178], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Servicesxennet6
mov qword [rax + 0x180], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Servicesxensvc
mov qword [rax + 0x188], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Servicesxenvdb
mov qword [rax + 0x190], rdx
jmp 0x14000de66
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIDSDT
mov qword [rax], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIFADT
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIRSDT
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServices
mov qword [rax + 0x18], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREOracle
mov qword [rax + 0x20], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x28], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x30], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x38], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x40], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x48], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWARE
mov qword [rax + 0x50], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumSCSI
mov qword [rax + 0x58], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServices
mov qword [rax + 0x60], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSoftware
mov qword [rax + 0x68], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSOFTWARE
mov qword [rax + 0x70], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWARE
mov qword [rax + 0x78], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x80], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x88], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x90], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x98], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0xa0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDE
mov qword [rax + 0xa8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDE
mov qword [rax + 0xb0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDE
mov qword [rax + 0xb8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumIDE
mov qword [rax + 0xc0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0xc8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0xd0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREVMware__Inc.
mov qword [rax + 0xd8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryUserSOFTWAREVMware__Inc.
mov qword [rax + 0xe0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumPCI
mov qword [rax + 0xe8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetEnumPCI
mov qword [rax + 0xf0], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0xf8], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x100], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x108], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x110], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSoftwareClassesFolder_shell
mov qword [rax + 0x118], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x120], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x128], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x130], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x138], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREMicrosoft
mov qword [rax + 0x140], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREMicrosoftVirtual_MachineGuest
mov qword [rax + 0x148], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSOFTWAREMicrosoft
mov qword [rax + 0x150], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIDSDT
mov qword [rax + 0x158], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIFADT
mov qword [rax + 0x160], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineHARDWAREACPIRSDT
mov qword [rax + 0x168], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x170], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x178], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x180], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x188], rdx
mov rax, qword [rbp - 0x20]
lea rdx, str.RegistryMachineSYSTEMControlSet001Services
mov qword [rax + 0x190], rdx
mov dword [rbp - 8], 0
jmp 0x14000debf
mov rax, qword [rbp - 0x20]
mov edx, dword [rbp - 8]
movsxd rdx, edx
mov rax, qword [rax + rdx*8]
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call rdx
test eax, eax
je 0x14000debb
mov eax, dword [rbp - 8]
mov edx, eax
lea rax, str.strs_i_:__d_n
mov rcx, rax
call sym.printf_10
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 4], 1
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0xc]
jl 0x14000de6f
mov eax, dword [rbp - 4]
mov rsp, rbx
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret