Function at 0x100001798
Capabilities:
Accept command line arguments
Compare security identifiers
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3a0
mov rax, qword [0x100005110]
xor rax, rsp
mov qword [rsp + 0x390], rax
lea rax, [rsp + 0x50]
mov r15, rcx
lea rdx, [0x100001420]
mov ebp, 1
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov esi, ebp
mov qword [rsp + 0x50], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000018ec
mov rcx, qword [rsp + 0x50]
or dword [rsp + 0x44], 0xffffffff
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
lea r12d, [rbp + 3]
lea rdx, [0x100001498]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x100001854
cmp dword [rsp + 0x44], edi
jne 0x100001854
mov esi, edi
jmp 0x1000018d9
lea rdx, [rsp + 0x38]
lea rcx, [0x100001548]
mov qword [rsp + 0x38], rdi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
cmp eax, edi
je 0x1000018d9
call fcn.100002834
mov rcx, qword [rsp + 0x38]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rsp + 0x38]
mov ebx, edi
cmp eax, edi
cmovne ebx, ebp
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebx, edi
je 0x1000018d9
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x34]
lea rdx, [0x1000014b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x20], rax
mov esi, edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1000018d9
cmp dword [rsp + 0x30], ebp
cmove esi, ebp
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x100001a1a
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], edi
call fcn.100001e50
cmp eax, edi
je 0x100001a1a
cmp dword [rsp + 0x30], 0x2000
jae 0x100001a1a
lea rcx, [0x1000013a0]
mov esi, 0x411
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp rax, rdi
je 0x100001984
lea rdx, [0x1000013b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rdi
je 0x10000197b
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rdi
call rax
mov rcx, qword [rsp + 0x38]
cmp rcx, rdi
je 0x10000197b
mov rax, qword [rcx]
lea rdx, [rsp + 0x34]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rsp + 0x34], ebp
jne 0x10000197b
mov esi, 0x409
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0xc6
mov word [rsp + 0x60], di
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x132]
xor edx, edx
mov r8d, 0x256
mov word [rsp + 0x130], di
call sub.msvcrt.dll_memset
cmp r15, rdi
je 0x1000019fa
lea r8, [rsp + 0x60]
mov r9d, 0x64
mov edx, 0x14b4
mov rcx, r15
mov word [rsp + 0x20], si
call fcn.100001698
lea r8, [rsp + 0x130]
mov r9d, 0x12c
mov edx, 0x14b5
mov rcx, r15
mov word [rsp + 0x20], si
call fcn.100001698
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x130]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
jmp 0x100001aef
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
lea rcx, [0x1000013d0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp rax, rdi
jne 0x100001a3c
xor eax, eax
jmp 0x100001aef
lea rdx, [0x1000013f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
cmp rax, rdi
je 0x100001ae4
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13d, edi
mov r12, rax
cmp rax, rdi
je 0x100001ac8
cmp dword [rsp + 0x40], ebp
jle 0x100001abf
lea rsi, [rax + 8]
mov rcx, qword [rsi]
lea rdx, [0x1000013f8]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, edi
je 0x100001aad
mov rcx, qword [rsi]
lea rdx, [0x100001400]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, edi
jne 0x100001ab3
mov r13d, 1
inc ebp
add rsi, 8
cmp ebp, dword [rsp + 0x40]
jl 0x100001a85
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
neg r13d
mov rcx, r15
mov qword [rsp + 0x20], rdi
sbb r9d, r9d
xor r8d, r8d
xor edx, edx
and r9d, 2
call r14
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.100002c60
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret