How does it handle stuff like syscalls without altering the executed code?
Windows apps don't use syscalls directly; they call into kernel32.dll, which is convenient for Wine. (Microsoft enforces this by scrambling the syscall numbers on OS updates [1].)
[1]: https://j00ru.vexillium.org/syscalls/nt/64/
It installs handlers. I don't have the exact name but there's support in the kernel to redirect syscalls to a Userland process
Windows apps don't use syscalls directly; they call into kernel32.dll, which is convenient for Wine. (Microsoft enforces this by scrambling the syscall numbers on OS updates [1].)
[1]: https://j00ru.vexillium.org/syscalls/nt/64/