Function at 0x10005300
Capabilities:
Accept command line arguments
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x758
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov rax, qword [0x10014030]
xor rax, rsp
mov qword [rsp + 0x710], rax
call fcn.100063f0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.100060d0
mov rbp, rax
mov esi, dword [rsp + 0x38]
sub esi, 1
xor edi, edi
cmp byte [0x10015144], dil
jne 0x10008cd9
call fcn.10006ca0
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x40], 0xffffffff80000001
lea r12d, [rdi + 1]
mov r14, 0xffffffffffffffff
cmp dword [0x100140d4], r14d
je 0x10008a90
cmp dword [0x10014a14], edi
jne 0x10008bc2
lea r8, [0x10003de8]
mov edx, 0x40
lea rcx, [rsp + 0x690]
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
lea r8, [0x10001858]
mov edx, 0x40
lea rcx, [rsp + 0x690]
call qword [sym.imp.MSVCR80.dll_wcscat_s]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x690]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rbx, eax
test eax, eax
jne 0x10008be2
cmp dword [0x10014a10], 0
jne 0x10008c8c
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x10003e00]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005486
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x10001858]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10008caf
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x10003e00]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100054f9
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x10001858]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10008cc4
mov r12d, edi
mov dword [0x10015140], r12d
mov byte [0x10015144], 1
test r12d, r12d
jne 0x10008ce5
lea r12, [0x100148a0]
mov rax, qword [0x100016e8]
mov qword [r12], rax
mov rax, qword [0x100016f0]
mov qword [r12 + 8], rax
cmp esi, 1
je 0x10008cf1
cmp esi, 2
je 0x10005561
cmp esi, 4
jne 0x10008db7
lea rdx, [0x10001a80]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
jne 0x10008db7
lea rdx, [0x10001a98]
mov rcx, qword [rbp + 8]
call qword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
jne 0x10008db7
mov rbx, qword [rbp + 0x10]
mov r8d, 0x200
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x250]
call fcn.100052a0
nop
mov rdx, rbx
lea rcx, [rsp + 0x250]
call fcn.10004f10
nop
lea rcx, [rsp + 0x130]
call fcn.10006580
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x250]
call fcn.10006620
mov rcx, rax
mov rdx, r12
call fcn.10006790
test eax, eax
js 0x10008d94
mov qword [0x10014240], r12
mov r8d, 0x200
lea rdx, [rsp + 0x488]
lea rcx, [rsp + 0x470]
call fcn.100052a0
nop
lea rdx, [0x10001ab0]
lea rcx, [rsp + 0x470]
call fcn.10004f10
nop
lea rcx, [rsp + 0x250]
call fcn.10005880
mov rdx, rax
lea rcx, [rsp + 0x470]
call fcn.10004ff0
lea rcx, [rsp + 0x470]
call fcn.10005880
mov r9, rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x100149b0], rax
test rax, rax
je 0x10008db1
call fcn.10005920
mov edi, eax
lea rcx, [rsp + 0x470]
call fcn.10005810
nop
lea rcx, [rsp + 0x130]
call fcn.10006c10
nop
lea rcx, [rsp + 0x250]
call fcn.10005810
mov eax, edi
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.10007870
mov rbx, qword [rsp + 0x750]
mov rbp, qword [rsp + 0x748]
mov rsi, qword [rsp + 0x740]
mov rdi, qword [rsp + 0x738]
mov r12, qword [rsp + 0x730]
mov r13, qword [rsp + 0x728]
mov r14, qword [rsp + 0x720]
add rsp, 0x758
ret
lea rdx, [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, 2
test eax, eax
cmovne ecx, dword [rsp + 0x78]
mov dword [0x10014a40], ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, r14d
lea r8, [0x10003f6c]
mov edx, 8
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
setne byte [0x100149f2]
mov dword [rsp + 0x90], 0x94
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10008b06
cmp dword [rsp + 0xa0], 2
je 0x10008ba2
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x10003f70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10008b8e
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffff80000001
jne 0x10008b9c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x10003f88]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008b8e
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffff80000001
je 0x10008ba2
mov dword [0x100140d4], edi
mov dword [0x100140d8], edi
jmp 0x10008b93
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffff80000001
je 0x10008ba2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x100140d4], r14d
jne 0x100053a8
mov dword [0x100140d4], r12d
mov dword [0x100140d8], r12d
jmp 0x100053a8
lea rdx, [0x10001858]
lea rcx, [0x100150c0]
call fcn.1000ae80
test eax, eax
je 0x10005406
jmp 0x100053b4
mov eax, 2
mul rbx
cmovo rax, r14
lea rdx, [0x10001838]
mov rcx, rax
call fcn.1000c6f0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], edi
xor edx, edx
mov rcx, rax
call fcn.100091d0
mov ecx, edi
test eax, eax
cmove ecx, r12d
mov dword [rsp + 0x60], ecx
mov r13, qword [rsp + 0x58]
test r13, r13
je 0x10008c3f
mov r8d, ebx
mov rdx, r13
lea rcx, [rsp + 0x690]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r13, qword [rsp + 0x58]
mov dword [rsp + 0x60], edi
lea rcx, [rsp + 0x58]
call fcn.1000c9b0
test r13, r13
je 0x10005406
mov r8d, 0x10
lea rdx, [rsp + 0x68]
mov rcx, r13
call qword [sym.imp.MSVCR80.dll_wcstoul]
mov r12d, eax
mov ebx, edi
cmp qword [rsp + 0x68], r13
setne bl
mov rcx, r13
call fcn.1000c680
test ebx, ebx
jne 0x100054fc
jmp 0x10005406
lea rdx, [0x10001858]
lea rcx, [0x100150a0]
call fcn.1000ae80
test eax, eax
jne 0x10005413
mov r12d, edi
jmp 0x100054fc
cmp dword [rsp + 0x34], 4
jne 0x10005486
mov r12d, dword [rsp + 0x30]
jmp 0x100054fc
cmp dword [rsp + 0x34], 4
jne 0x100054f9
mov r12d, dword [rsp + 0x30]
jmp 0x100054fc
mov r12d, dword [0x10015140]
jmp 0x1000550a
call qword [sym.imp.KERNEL32.dll_DebugBreak]
nop
jmp 0x10005513
lea rdx, [0x10001880]
mov rcx, qword [rbp + 8]
call qword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
jne 0x10008d32
call fcn.1000eeb0
test eax, eax
js 0x10005693
xor r9d, r9d
lea r8, [0x100018a0]
lea rdx, [0x10001900]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
jmp 0x10005693
lea rdx, [0x100019a0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
jne 0x10008d73
call fcn.1000eb20
test eax, eax
js 0x10005693
xor r9d, r9d
lea r8, [0x100018a0]
lea rdx, [0x100019c0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
jmp 0x10005693
lea rdx, [0x10001a68]
mov rcx, qword [rbp + 8]
call qword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
jne 0x10008db7
call fcn.10005920
mov edi, eax
jmp 0x10005693
lea rcx, [rsp + 0x130]
call fcn.10006c10
nop
lea rcx, [rsp + 0x250]
call fcn.10005810
jmp 0x10008db7
call fcn.1000ed80
nop
lea rdx, [rbp + 8]
mov ecx, esi
call fcn.1000b310
nop
jmp 0x10005695