http://bugs.winehq.org/show_bug.cgi?id=23578
--- Comment #45 from Henri Verbeet hverbeet@gmail.com 2010-07-14 14:10:48 --- For what it's worth, my current theory is that the "~4cc3.tmp" process you see in the oprofile log is something like Steam DRM or VAC trying to scan the memory of the game's main process. That would be the read_thread_long() and read_process_memory() calls you see. read_thread_long() uses PTRACE_PEEKDATA, which isn't very efficient, and that would account for the high amount of (Linux) kernel time. (Although you don't see the kernel time in the posted oprofile log.)