Function at 0x140011520
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
lea rdx, str.wWinMain
lea rcx, [0x14001c488]
call fcn.140011000
xor ebp, ebp
mov dword [rsp + 0x24], ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor dil, dil
xor r13b, r13b
mov r15d, eax
mov dword [rsp + 0x28], eax
lea eax, [rbp + 1]
mov r14d, ebp
mov r12d, ebp
mov byte [rsp + 0x20], dil
mov esi, ebp
cmp dword [rsp + 0x24], ebp
jle 0x140011689
mov edi, eax
mov rcx, qword [rbx]
lea rdx, str.__install
mov r15d, edi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400115c1
cmp edi, dword [rsp + 0x24]
jge 0x1400115c1
mov rbp, qword [rbx + 8]
mov rcx, qword [rbx]
lea rdx, str.__site
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400115df
cmp edi, dword [rsp + 0x24]
jge 0x1400115df
mov r14, qword [rbx + 8]
mov rcx, qword [rbx]
lea rdx, str.__kill
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140011602
mov byte [rsp + 0x20], 1
cmp edi, dword [rsp + 0x24]
jge 0x140011602
mov rbp, qword [rbx + 8]
mov rcx, qword [rbx]
lea rdx, str.__all_users
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, qword [rbx]
lea rdx, str.__start
test eax, eax
mov eax, 1
cmove r12d, eax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [rsp + 0x24]
test eax, eax
jne 0x140011640
cmp edi, ecx
jge 0x140011662
mov r14, qword [rbx + 8]
mov r13b, 1
inc edi
add rbx, 8
cmp r15d, ecx
jl 0x1400115a0
test r13b, r13b
je 0x14001167f
test r14, r14
jne 0x14001166c
lea esi, [r14 + 9]
jmp 0x1400117ef
mov esi, 8
jmp 0x1400117ef
test r12d, r12d
mov rcx, r14
setne dl
call fcn.140011350
jmp 0x1400117ef
movzx edi, byte [rsp + 0x20]
mov r15d, dword [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1400117de
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x1400117de
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400116ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rbx + 2]
jmp 0x1400117ef
mov rcx, rbx
test dil, dil
je 0x140011709
lea rdx, str.Kill
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400116f5
mov rcx, rbx
lea esi, [rax + 7]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400117ef
call qword [0x14001c2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400117ef
lea rdx, str.InstallMessageHook
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14001172f
mov rcx, rbx
lea esi, [rax + 3]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400117ef
lea rdx, str.UnInstallMessageHook
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x140011758
mov rcx, rbx
lea esi, [rax + 5]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400117ef
mov r8d, r12d
mov rdx, r14
mov ecx, r15d
mov rax, rdi
call qword [0x14001c2e0]
test eax, eax
jne 0x14001177c
mov rcx, rbx
lea esi, [rax + 4]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400117ef
xor r9d, r9d
lea rcx, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400117c0
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x140011793
mov rax, rbp
call qword [0x14001c2e0]
test eax, eax
mov ecx, 6
cmove esi, ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400117ef
lea rcx, str.no_dll_path_given_n
call fcn.140011000
mov esi, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400117ff
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, str.wWinMain
lea rcx, str._s_____n
call fcn.140011000
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret