https://bugs.winehq.org/show_bug.cgi?id=32515
--- Comment #49 from Christian Inci chris.pcguy.inci@gmail.com --- I've got some informations.
Steps used by CEG (more or less): various checksum runs creating a custom TEB (FS with ESP as base) int3 (creating all debug register entries, this doesn't seem to work on wine with the custom TEB) breakpoint triggered by data address (modifying all debug register entries, lower code address breakpoint is now in DR0) CreateFile, GetFileInformationByHandle breakpoint triggered by code address (modifying all debug register entries and data returned by GetFileInformationByHandle) two(?) checksum runs ... calling method at 0x737290 (0x7372ea crashing on wine)
I embedded a very dirty hack inside GetFileInformationByHandle in order to modify four dwords without needing to start a debugger, which allowed me to see the intro movie (it crashed between skipping the movie and showing the main menu. 0x7372ea again), but the actual bug seems to be the int3 with the custom TEB.
By the way, debugging works great with x64dbg when you're starting the game using steam (starting it using the debugger will lead into a "late" crash) and attach to it afterwards. (e.g. when a "safe mode" dialog like the one from iw5sp.exe is showing)