Function at 0x402270
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], str.sj43OfUjPuszIUJEfpLltBG9nk3qvIcJwtXfqYjCLMNJb1C2VJUjl0vAppi5UoLgHmFXaDwLTII5calIPnJUg6Q7c4yS5ozEiGLAFKXkNzjylM2McVgze8Wd1a8zIFfG0sd5MPbc1mweYSqdIiPlpq5J9l65gJ502Xe6wqJI1P9m8VNQyC6VbfDXL2prPySb0KpS85jBeyKhuV3rkl4G8U4y4oPQgD5C0CEn3oDV3PMxvoBC693A5MUxanWD40FHyDc7UVyeOJvLjlvVmYHgYcMo5HcitcdCG8BjzkWmO8YLIknM751W4umTSPMorhQvOIML5aOBjA8siqotKUgAI4qjwHp23a0Hcs7C81tdOUlRUCuOtzuoEI412H5vV7TIDfSsq7dYRwLXQMax6fsAkvgFijWg5huW12TXjrm9OVJgu6C8Wcy7Y2QUhz0DU8WGCUDSpuhTpeyO2YLxxmogJuHjE8oVVwpXFahtVEMFIaNINftrdPdNnW4FojyuGHXDacGxEc8a97c482yj8P10cpI5P35GQiFhVxtnVj2mp4GXsXLmjJuG5IPTBVJR8lvgCSTMI2FuzHqyj0Rzx12bxC4JFbzrmeqGJ3X5wkG32jMYiuuIwkHiBMwulEKMpMktA0m8q18NtOjo4bjkHskpUJKjeRHkgc5fkOui6RyNXNKYoeRFpkomGULAiX2wV3urVd9JBHVeKwXVssMzYcxosWnFF8K0vz2a9bzFKWlGDKQhFnxlFBBdbwe5r3XOTBTElqAIrJVEwXFLGE1awNx4gIqjWxLxXgwDcOVbqf2OHl1TjF0YzhiAbfKbqLBDmaY8NdOcavhRwPfUm6FCIyeF747X4sLvcQGQs0VqwNDRSwYqTmcuJvtviMhljmYOerXyFGLFwHJiRdfVrjCbmecb4o7SUCS5XYPHCoROi98koSLv4GrwEpJMMhnVrwMnwnK2KSTH1smXcEYGo5BB0mEsYePBkuKeAqEvTzLdXmTURL2xE0vN84FjbncLN7uKqQUnbvAftW9IOBKEFQ0L59Lw1j63V7twRemb4lEHYJvCgJG8OUnofR6geX9RCjQDm3hGkruw0CiGgN6z4mpPj71GAFTozJrJSFoW7KND5ROGIDV9Ugjwjr60XaSymvOX2nTiPTv1T9hdlcPtxAJbLEXNyzoc79a7KxkldAroVUnmF26Alnn7U7hETMnBqotC8lxozugRqd4b30WC0h9RIisWlp5Rh11SkNmEcwc1JXRMp5Ohvxb3xO09q1J4CCd1ocn9tFv3mtGtxXEeESsAlxrK49nbxy4Jjdwcu8uh9Y8ll6UH5whJLtklBgLWhO3lU1WuWgs4nIDlRADzm3b37RdBJNt0c8aIYc4YbFHSIPndkgieTyXsgaGhzbMJNWTj8Py2b9ygcrjx1EVF4BHdMYjaBGLqJnk9SspgyGoOhB7LrY4t4bJPRbHdHFiaOgYQG0OEztxeLlh8cdLL1IFflOulbkWPW9TAOTgxaUphTD3
mov dword [ebp - 0x14], str.NutzRwfl5a9yiyE79HmeKEf64BXhSMRxqQUftcBEXq9AtENeBKwhFrjx1QJDKdHBUnlpbHBINoTml93nf16RvAWnPUWadYylAt6Ee72xWWbC9i5XsgajsVBMKLSbcQw6nKxAgtvV0FhM5ORGfpR66ewK77nBBYXuQY3YiMnAAR1JcTDDhDjHpcE6qjJSc4vuhb0CJ0KXywI1q9UbPgDKJwNultM6Aa0puyMpp1yoSjeIDEt2QS2TPPrpCpSRkRCQ1vQhvGp1EDUwyWjeVeDVQIS9eATpQ9MNXEBjBOKO8CDEN0K9giGDjHcRcecutubwbNvAHbKBG3NWRgltIdlX9hawJdHvoOIC3Y1l8tnYPqiObDVfNmQRFSoTdcPoHtE3EqCPGokqhXxf2rBN
mov dword [ebp - 0x18], str.5wD88kOTcrPQEljQ76qPqlD57E39zj4Yr1GuRbzxCKEpuz7R80JHna65N1ifY5ItDFu3LUs0lHCCbGL6fKpK9zvMWinthpN8sioqo3FSQGasTyTFxLNFv7Sf9ivAATBgPnhQ9DAaikHXfXVyh9MH3KxOAWQqu5d1O9v6n6T7trHhcG5zPFL
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], str.qzH6Uk9Fh1B8By2UIfuGkSIAtRKzDLxgExjd5Rn42udwkA4fwoYsnNajwvBzFYphpfRctwFsbSrvbyAiYJprFRxLRBrmQiqUuruyanQPXr2D7eUIIsVw2WBGpANxH5FkUcV3bz87tiR7D0kDH2rNg0wHQGorce341WDBCo6bumXRMNVD5hnyd4OsB337SeqdloDly8KSAnrx3aMGlmTiHftuUxIhM9vdJCDE7du28WCsweMicKJICJLkJVxntET3j2X4o65mctUEIDJmBfkHPOtsONJw1X86qjAjxmGyGcUSKHnhQYGnfPEiEyJAYSAeIx9nHDQhdbkAdefQrrw2KcOdvpDQk1Rr5lQYn67ShtWL2TlTh5wTkepUGPpEEpnRBYwflCP2yXbzowTBvt78h2A8UFWsJFUFOUkBJXyX7ztiomT7HkrT1lTnQKTidThzz5ov2gqq2ui6a3OA4xdtgA0CIW1VeJ6GVLsxGK168NePoKXE2gHkKkQMtXeOtqVCfzUwdLhD1k14eiCmm2T8d8SKQmA78Mdp7qMv6GyD2Ow4oYSg2HpKqGSlltjHTcgzqAKIR0AElLNM6KMkjpriaL1kevH8YCh3jE8z4evbOxXT38fYHHU1edRqvugG8CofcwQHd1OG8lmNuc461nkqoWpl0fClBjB2KrwXT5rAIaoxcAT2jAQdwVXHfuvM9oMIT0noHbEeKPETrzoyTQhfrhi6AGQm39H3Q4hdedaVd4SoYYXUnW5D08w57dGc7r4h6TLT452XNjUaab1OA3jG4Hb9Gcd3EHo3l2X6RPKy2VK8MaLpEBITxjcIUDHqtWavBmGEhyaT94zSctphXqEYjlQfclFwWLGda6nDVqv5aGCGdfVvbC8OjgQ3GYHeUleexM5iwGseSBlAfdizcEMysBiri1x8KqT0why5KF2lQtifaDirckVuI0DGIK4ymjGtbM8GjNErnKc5loExDIt839K1pjku8Wx4QPOXVy8ryJSdIVWJeh0epOUzsD5xcnVF0psHvokIP8BizkcMqmCwklid6FrXr0nvrWHYWnR9ENSCDj73D8PVmFAxPFyb6IJT6ymeLtWt65bO2cUjHpudIUdsbocqb3lH9p48n2WWlorYS0r8gJbBDDPHwnV4pY3GaVQ2lkjgyUrh2d6XpUM2woeniVdCe1jteO1TtIzrRzJ2XQS7F1z23MbWOaiJLcbAQ0enLxmVk6LJWtnP4n6P3pCknSfcQ4es1IrIoamxWWMYU8Hd0AfezTwMeH0W1GGn8sYPMXkwInQwvoCgpyfJSSVXy0h4vDhz4Wthwk7szmSh3loSCoCrp1YWxUEJg1n7afReqFEnnIBfAzVRstPMxecQCPqJW7peAvcqCkbxlMPxDliI2WOw13e5XKFn7hg2tFwTqlIfo3t85ed3WWidRI22oXUqMdwd2HeHatyfV5Khq729dDtOiUxeGkJLCWVlqtaXQw7xsfCJRWKSq7l8y6bGy81xTMf5gQVDB0lKkhlCfOncFuEL8lS5x7Qiyde8wCVvG8H3Ppql46V5lLTaBtaC9uDP7SEhByiavOab8lDEtitDiVoBH3X7GU4lOGlrglV3DHevhd2Eda33IU9aifOTrv2jtJ6yEExqJ7TUczTHHCIweCYMp1IXwOJyA
cmp dword [ebp - 4], 0
je 0x4022d1
push str.wine_get_unix_file_name
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4022c5
mov dword [ebp - 8], 1
jmp 0x4022cc
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
jmp 0x4022d3
xor al, al
mov esp, ebp
pop ebp
ret