Function at 0x1400019b0
Capabilities:
Accept command line arguments
Check if process is running under wine
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, rcx
mov rcx, rdx
mov qword [rsp + 0xa8], rdx
call fcn.140001050
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140001b82
cmp word [rbp], 0
je 0x140001cac
lea rax, [rsp + 0x4c]
mov rsi, qword [sym.imp.ucrtbase.dll_free]
lea rdi, section..data
mov qword [rsp + 0x38], rax
lea r13, [0x140005124]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
mov r14d, dword [rsp + 0x4c]
mov rbx, rax
lea ecx, [r14 + 2]
movsxd rcx, ecx
shl rcx, 3
call qword [sym.imp.ucrtbase.dll_malloc]
mov r12, rax
test rax, rax
je 0x140001cac
test r14d, r14d
jle 0x140001a6b
xor r15d, r15d
nop dword [rax + rax]
mov rcx, qword [rbx + r15*8]
call fcn.140001050
mov r14d, dword [rsp + 0x4c]
mov qword [r12 + r15*8], rax
add r15, 1
cmp r14d, r15d
jg 0x140001a50
mov rax, qword [rsp + 0x30]
movsxd r8, r14d
mov qword [r12 + r8*8 + 8], 0
mov qword [r12 + r8*8], rax
movzx eax, byte [rdi]
test al, 8
jne 0x140001bc0
mov r8d, dword [rsp + 0x4c]
test r8d, r8d
js 0x140001af6
xor r14d, r14d
lea rbx, [0x140005450]
jmp 0x140001ab3
add r14, 1
cmp dword [rsp + 0x4c], r14d
jl 0x140001aee
mov edx, eax
and edx, 8
je 0x140001aa8
mov rcx, qword [r12 + r14*8]
add r14, 1
call fcn.1400017b0
mov rdx, rdi
mov r9, r13
mov r8, rbx
mov qword [rsp + 0x20], rax
mov ecx, 3
call fcn.140001380
movzx eax, byte [rdi]
mov edx, eax
and edx, 8
cmp dword [rsp + 0x4c], r14d
jge 0x140001ab3
test dl, dl
jne 0x140001ba0
xor edx, edx
mov rcx, r12
call sub.ntdll.dll___wine_unix_spawnvp
test eax, eax
je 0x140001cb8
mov eax, dword [rsp + 0x4c]
xor r14d, r14d
mov rbx, rsi
test eax, eax
jle 0x140001c10
nop word [rax + rax]
mov rcx, qword [r12 + r14*8]
add r14, 1
call rsi
cmp dword [rsp + 0x4c], r14d
jg 0x140001b20
mov rcx, r12
call rbx
cmp word [rbp], 0
mov rax, rbp
je 0x140001c00
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140001b48
sub rax, rbp
sar rax, 1
add eax, 1
cdqe
add rax, rax
add rbp, rax
cmp word [rbp], 0
jne 0x140001a10
test byte [section..data], 2
jne 0x140001c1c
mov rcx, qword [rsp + 0x30]
call rbx
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r9, [0x140005128]
lea r8, [0x140005450]
mov rdx, rdi
mov ecx, 3
call fcn.140001380
jmp 0x140001af6
mov rdx, rdi
mov ecx, 3
lea r9, str.Trying
lea r8, [0x140005450]
call fcn.140001380
movzx eax, byte [rdi]
mov ecx, dword [rsp + 0x4c]
mov edx, eax
and edx, 8
test ecx, ecx
jns 0x140001a95
test dl, dl
je 0x140001af6
jmp 0x140001ba0
mov eax, 2
jmp 0x140001b60
mov rbx, qword [sym.imp.ucrtbase.dll_free]
jmp 0x140001b31
cmp qword [rsp + 0xa8], 0
lea rax, str._null_
je 0x140001c6d
mov rax, qword [rsp + 0xa8]
shr rax, 0x10
je 0x140001c96
mov rcx, qword [rsp + 0xa8]
mov rdx, 0xffffffffffffffff
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x140001c6d
mov rcx, qword [rsp + 0xa8]
call fcn.1400011b0
mov qword [rsp + 0x20], rax
lea r9, str.could_not_find_a_suitable_app_to_open__s_n
lea r8, [0x140005450]
mov ecx, 1
lea rdx, section..data
call fcn.140001380
jmp 0x140001b7b
movzx edx, word [rsp + 0xa8]
lea rcx, str._04x
call fcn.140001740
jmp 0x140001c6d
mov rbx, qword [sym.imp.ucrtbase.dll_free]
jmp 0x140001b6e
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]