Function at 0x43c910
Capabilities:
Check if process is running under wine
Link many functions at runtime

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
je 0x43c92e
mov ecx, dword [0x4ceb08]
mov dword [eax], ecx
mov eax, dword [0x4ceb0c]
test al, 1
je 0x43c93f
and eax, 2
pop edi
add esp, 0x18
ret
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 1
push 0x8000
mov dword [0x4ceb0c], eax
call esi
mov dword [esp + 0x1c], eax
or eax, 0x8000
push eax
call esi
push 0x4b4ca4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
cmp ebx, edi
je 0x43ca05
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebp
cmp eax, edi
mov dword [esp + 0x24], eax
je 0x43ca05
push 0x4b4cc0
call ebp
mov edi, eax
test edi, edi
je 0x43ca05
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b4cd0
push edi
call esi
test eax, eax
mov dword [0x4ceafc], eax
je 0x43ca05
push 0x4b4cdc
push edi
call esi
test eax, eax
mov dword [0x4ceb00], eax
je 0x43ca05
push 0x4b4cf0
push edi
call esi
test eax, eax
mov dword [0x4ceb04], eax
je 0x43ca05
lea edx, [esp + 0x18]
push edx
push 0x4b4cfc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x4ceafc]
test eax, eax
jne 0x43ca28
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43c9fb
push eax
call dword [0x4ceb04]
mov dword [0x4ceaf4], 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x43ca13
mov dword [eax], 0
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x18
ret
call fcn.0043bba0
test eax, eax
je 0x43ca68
push str.ProcessIdToSessionId
push ebx
call esi
mov edi, eax
test edi, edi
je 0x43cb3f
push 0x4ceb08
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call edi
test eax, eax
je 0x43cb3f
mov eax, dword [0x4ceb08]
test eax, eax
jne 0x43cb3f
jmp 0x43ca05
push str.wtsapi32.dll
call ebp
mov edi, eax
test edi, edi
je 0x43cacb
push str.WTSQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x43cacb
push str.WTSFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x43cacb
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x43cacb
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x4ceb08], edx
cmp dword [eax], 0
je 0x43cac0
mov dword [esp + 0x14], 1
push eax
call edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x43cb3f
push str.wfapi.dll
call ebp
mov edi, eax
test edi, edi
je 0x43ca05
push str.WFQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x43ca05
push str.WFFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x43ca05
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x43ca05
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x4ceb08], edx
cmp dword [eax], 0
mov ebx, 1
jne 0x43cb34
mov ebx, dword [esp + 0x14]
push eax
call edi
test ebx, ebx
je 0x43ca05
mov eax, dword [esp + 0x24]
push str.GetSystemMetrics
push eax
call esi
test eax, eax
je 0x43cb5e
push 0x1000
call eax
test eax, eax
je 0x43ca05
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x43cb6e
mov ecx, dword [0x4ceb08]
mov dword [eax], ecx
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x4ceb0c]
pop esi
pop ebp
or eax, 2
pop ebx
mov dword [0x4ceb0c], eax
mov eax, 1
pop edi
add esp, 0x18
ret