Function at 0x482610
Capabilities:
Check if process is running under wine
Link many functions at runtime

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
je 0x48262e
mov ecx, dword [0x587524]
mov dword [eax], ecx
mov eax, dword [0x587528]
test al, 1
je 0x48263f
and eax, 2
pop edi
add esp, 0x18
ret
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 1
push 0x8000
mov dword [0x587528], eax
call esi
mov dword [esp + 0x1c], eax
or eax, 0x8000
push eax
call esi
push 0x51c084
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
cmp ebx, edi
je 0x482705
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebp
cmp eax, edi
mov dword [esp + 0x24], eax
je 0x482705
push 0x51c0a0
call ebp
mov edi, eax
test edi, edi
je 0x482705
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51c0b0
push edi
call esi
test eax, eax
mov dword [0x587518], eax
je 0x482705
push 0x51c0bc
push edi
call esi
test eax, eax
mov dword [0x58751c], eax
je 0x482705
push 0x51c0d0
push edi
call esi
test eax, eax
mov dword [0x587520], eax
je 0x482705
lea edx, [esp + 0x18]
push edx
push 0x51c0dc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x587518]
test eax, eax
jne 0x482728
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4826fb
push eax
call dword [0x587520]
mov dword [0x587510], 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x482713
mov dword [eax], 0
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x18
ret
call fcn.00481a60
test eax, eax
je 0x482768
push str.ProcessIdToSessionId
push ebx
call esi
mov edi, eax
test edi, edi
je 0x48283f
push 0x587524
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call edi
test eax, eax
je 0x48283f
mov eax, dword [0x587524]
test eax, eax
jne 0x48283f
jmp 0x482705
push str.wtsapi32.dll
call ebp
mov edi, eax
test edi, edi
je 0x4827cb
push str.WTSQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x4827cb
push str.WTSFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x4827cb
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x4827cb
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x587524], edx
cmp dword [eax], 0
je 0x4827c0
mov dword [esp + 0x14], 1
push eax
call edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x48283f
push str.wfapi.dll
call ebp
mov edi, eax
test edi, edi
je 0x482705
push str.WFQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x482705
push str.WFFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x482705
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x482705
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x587524], edx
cmp dword [eax], 0
mov ebx, 1
jne 0x482834
mov ebx, dword [esp + 0x14]
push eax
call edi
test ebx, ebx
je 0x482705
mov eax, dword [esp + 0x24]
push str.GetSystemMetrics
push eax
call esi
test eax, eax
je 0x48285e
push 0x1000
call eax
test eax, eax
je 0x482705
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x48286e
mov ecx, dword [0x587524]
mov dword [eax], ecx
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x587528]
pop esi
pop ebp
or eax, 2
pop ebx
mov dword [0x587528], eax
mov eax, 1
pop edi
add esp, 0x18
ret