https://bugs.winehq.org/show_bug.cgi?id=45327
--- Comment #5 from Zebediah Figura z.figura12@gmail.com --- The game links to 'stub.dll' which I'm guessing is supposed to decrypt the actual binary's contents somehow while loading. But it runs into this instead:
1231.028:0031:0032:Call ntdll.NtCreateFile(0034d7a4,00120089,0034d7b0,0034dbdc,00000000,00000080,00000001,00000003,00000060,00000000,00000000) ret=10017310 1231.028:0031:0032:trace:ntdll:FILE_CreateFile handle=0x34d7a4 access=00120089 name=L"\??\C:\windows\system32\ntdll.dll" objattr=00000040 root=(nil) sec=(nil) io=0x34dbdc alloc_size=(nil) attr=00000080 sharing=00000001 disp=3 options=00000060 ea=(nil).0x00000000 1231.030:0031:0032:Ret ntdll.NtCreateFile() retval=00000000 ret=10017310 1231.030:0031:0032:Call ntdll.NtQueryInformationFile(00000040,0034d7b0,0034d7d0,00000018,00000005) ret=10017469 1231.030:0031:0032:trace:ntdll:NtQueryInformationFile (0x40,0x34d7b0,0x34d7d0,0x00000018,0x00000005) 1231.030:0031:0032:Ret ntdll.NtQueryInformationFile() retval=00000000 ret=10017469 1231.030:0031:0032:Call ntdll.NtAllocateVirtualMemory(ffffffff,0034d7a0,00000000,0034d7cc,00003000,00000004) ret=1001776d 1231.030:0031:0032:trace:virtual:NtAllocateVirtualMemory 0xffffffff (nil) 000009ac 3000 00000004 1231.030:0031:0032:trace:virtual:map_view got mem in reserved area 0x360000-0x361000 1231.030:0031:0032:trace:virtual:create_view forcing exec permission on 0x360000-0x360fff 1231.030:0031:0032:trace:virtual:VIRTUAL_DumpView View: 0x360000 - 0x360fff (valloc) 1231.030:0031:0032:trace:virtual:VIRTUAL_DumpView 0x360000 - 0x360fff c-rw- 1231.030:0031:0032:Ret ntdll.NtAllocateVirtualMemory() retval=00000000 ret=1001776d 1231.030:0031:0032:Call ntdll.NtReadFile(00000040,00000000,00000000,00000000,0034d7d0,00360000,000009ac,0034d7b0,00000000) ret=10017c9a 1231.030:0031:0032:trace:ntdll:NtReadFile (0x40,(nil),(nil),(nil),0x34d7d0,0x360000,0x000009ac,0x34d7b0,(nil)),partial stub! 1231.030:0031:0032:trace:ntdll:NtReadFile = SUCCESS (2476) 1231.030:0031:0032:Ret ntdll.NtReadFile() retval=00000000 ret=10017c9a 1231.030:0031:0032:trace:seh:raise_exception code=c0000005 flags=0 addr=0x1016d230 ip=1016d230 tid=0032 1231.030:0031:0032:trace:seh:raise_exception info[0]=00000001 1231.030:0031:0032:trace:seh:raise_exception info[1]=00361000
The Staging fake DLL patches get it farther, but then it crashes with STATUS_BREAKPOINT somewhere in its own code.