Function at 0x4196a0
Capabilities:
Check if process is running under wine
Link many functions at runtime

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
je 0x4196be
mov ecx, dword [0x537928]
mov dword [eax], ecx
mov eax, dword [0x53792c]
test al, 1
je 0x4196cf
and eax, 2
pop edi
add esp, 0x18
ret
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 1
push 0x8000
mov dword [0x53792c], eax
call esi
mov dword [esp + 0x1c], eax
or eax, 0x8000
push eax
call esi
push 0x4ce074
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
cmp ebx, edi
je 0x419795
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebp
cmp eax, edi
mov dword [esp + 0x24], eax
je 0x419795
push 0x4ce090
call ebp
mov edi, eax
test edi, edi
je 0x419795
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ce0a0
push edi
call esi
test eax, eax
mov dword [0x53791c], eax
je 0x419795
push 0x4ce0ac
push edi
call esi
test eax, eax
mov dword [0x537920], eax
je 0x419795
push 0x4ce0c0
push edi
call esi
test eax, eax
mov dword [0x537924], eax
je 0x419795
lea edx, [esp + 0x18]
push edx
push 0x4ce0cc
push 0x80000002
call dword [0x53791c]
test eax, eax
jne 0x4197b8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41978b
push eax
call dword [0x537924]
mov dword [0x537914], 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4197a3
mov dword [eax], 0
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x18
ret
call fcn.00418930
test eax, eax
je 0x4197f8
push str.ProcessIdToSessionId
push ebx
call esi
mov edi, eax
test edi, edi
je 0x4198cf
push 0x537928
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call edi
test eax, eax
je 0x4198cf
mov eax, dword [0x537928]
test eax, eax
jne 0x4198cf
jmp 0x419795
push str.wtsapi32.dll
call ebp
mov edi, eax
test edi, edi
je 0x41985b
push str.WTSQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x41985b
push str.WTSFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x41985b
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x41985b
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x537928], edx
cmp dword [eax], 0
je 0x419850
mov dword [esp + 0x14], 1
push eax
call edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4198cf
push str.wfapi.dll
call ebp
mov edi, eax
test edi, edi
je 0x419795
push str.WFQuerySessionInformationA
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x419795
push str.WFFreeMemory
push edi
call esi
mov edi, eax
test edi, edi
je 0x419795
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffffffffffffffff
push 0
call ebx
test eax, eax
je 0x419795
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [0x537928], edx
cmp dword [eax], 0
mov ebx, 1
jne 0x4198c4
mov ebx, dword [esp + 0x14]
push eax
call edi
test ebx, ebx
je 0x419795
mov eax, dword [esp + 0x24]
push str.GetSystemMetrics
push eax
call esi
test eax, eax
je 0x4198ee
push 0x1000
call eax
test eax, eax
je 0x419795
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4198fe
mov ecx, dword [0x537928]
mov dword [eax], ecx
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x53792c]
pop esi
pop ebp
or eax, 2
pop ebx
mov dword [0x53792c], eax
mov eax, 1
pop edi
add esp, 0x18
ret