Function at 0x1400049b4
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x270
mov rax, qword [0x140014198]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rax, qword [0x140014068]
xor r13d, r13d
cmp qword [0x140014080], r13
mov rdi, r8
mov ebx, 0x80070057
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [rsp + 0x38], xmm0
je 0x140004a16
lea ecx, [r13 + 5]
int 0x29
xorps xmm0, xmm0
lea r9, [0x140014080]
lea r8, [0x140014060]
lea rdx, [0x140001010]
lea rcx, [rsp + 0x38]
movdqu xmmword [0x140014088], xmm0
call qword [sym.imp.ADVAPI32.dll_EventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x140004ae6
mov rsi, qword [0x140014068]
lea r8, [rsp + 0x30]
lea rdx, str.api_ms_win_eventing_provider_l1_1_0.dll
xor ecx, ecx
movzx r14d, word [rsi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004a96
lea r8, [rsp + 0x30]
xor ecx, ecx
lea rdx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
je 0x140004ae6
mov rcx, qword [rsp + 0x30]
lea rdx, str.EventSetInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140004ad5
mov r9d, r14d
movabs r10, 0xd1313e1f72571970
mov rcx, qword [0x140014080]
mov r8, rsi
mov edx, 2
call qword [0x14000e9d0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
cmp word [rdi], r13w
je 0x140004dd9
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop dword [rax + rax]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov qword [rsp + 0x38], rax
mov rsi, rax
test rax, rax
je 0x140004d7c
movups xmm0, xmmword [str.ie4uinit.log]
lea rcx, [rsp + 0x6a]
movzx eax, word [0x14000ffe8]
movsd xmm1, qword [0x14000ffe0]
xor edx, edx
mov r8d, 0x1ee
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
mov word [rsp + 0x68], ax
call sub.msvcrt.dll_memset
cmp dword [rsp + 0x30], r13d
jle 0x140004b9b
mov r9, qword [rsi]
lea r8, str.ie4uinit_s.log
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140001380
lea rdx, [rsp + 0x50]
call fcn.140004038
mov r8, rdi
lea rdx, str.Starting_ie4uShowIE.exe._Command_Line:_1_lS__n
lea rcx, [0x1400140e8]
call fcn.1400040e4
mov eax, dword [rsp + 0x30]
mov edi, r13d
test eax, eax
jle 0x140004c75
mov rbx, rsi
lea rsi, str._OfflineSoftwareRegistryPath
mov r12d, r13d
mov r15, r13
mov r14, rsi
mov r8d, dword [r14 + 8]
mov rdx, qword [r14]
mov rcx, qword [rbx]
call fcn.140004610
test eax, eax
jne 0x140004c02
inc r12d
inc r15
add r14, 0x18
cmp r12d, 2
jb 0x140004bdd
jmp 0x140004c5e
lea r14, [r15 + r15*2]
mov r8, qword [rsi + r14*8]
lea rdx, str.ie4uShowIE:_Handling_Parameter:__1_lS__n
lea rcx, [0x1400140e8]
call fcn.1400040e4
mov eax, dword [rsp + 0x30]
dec eax
cmp edi, eax
jge 0x140004c47
inc edi
add rbx, 8
movabs r10, 0xce6587ff12d2d870
mov rcx, qword [rbx]
mov rax, qword [rsi + r14*8 + 0x10]
call qword [0x14000e9d0]
jmp 0x140004c5e
mov r8, qword [rsi + r14*8]
lea rdx, str.ie4uShowIE:_Warning:_the_passed_in_parameter___1_lS___is_incomplete_or_invalid._Ignore_this_parameter._n
lea rcx, [0x1400140e8]
call fcn.1400040e4
mov eax, dword [rsp + 0x30]
inc edi
add rbx, 8
cmp edi, eax
jl 0x140004bd4
mov rsi, qword [rsp + 0x38]
cmp dword [0x140014800], r13d
jne 0x140004c9e
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
nop dword [rax + rax]
test eax, eax
jns 0x140004c9a
mov ebx, 0x80004005
jmp 0x140004d6b
mov eax, dword [rsp + 0x30]
mov ebx, r13d
mov r14d, r13d
test eax, eax
jle 0x140004d56
mov r12, rsi
lea rsi, section..data
test ebx, ebx
js 0x140004d51
mov r15d, r13d
mov rdi, rsi
mov r8d, dword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, qword [r12]
call fcn.140004610
test eax, eax
jne 0x140004cea
inc r15d
inc r13
add rdi, 0x18
cmp r15d, 2
jb 0x140004cc4
jmp 0x140004d39
lea rbx, [r13*2]
add rbx, r13
lea rdx, str.ie4uShowIE:_Executing_Command:__1_lS__n
lea rcx, [0x1400140e8]
mov r8, qword [rsi + rbx*8]
call fcn.1400040e4
movabs r10, 0xd43837ae10dbc970
mov rax, qword [rsi + rbx*8 + 0x10]
call qword [0x14000e9d0]
mov r8d, eax
lea rdx, str.ie4uShowIE:_Command_Result:_0x_1_08lx__n
lea rcx, [0x1400140e8]
mov ebx, eax
call fcn.1400040e4
inc r14d
add r12, 8
mov r13d, 0
cmp r14d, dword [rsp + 0x30]
jl 0x140004cb6
mov rsi, qword [rsp + 0x38]
cmp dword [0x140014800], r13d
jne 0x140004d6b
call qword [sym.imp.ole32.dll_OleUninitialize]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
jmp 0x140004d96
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
lea rdx, str.ie4uShowIE.exe_exiting.__Process_Result:_0x_1_08lx__n_n
lea rcx, [0x1400140e8]
call fcn.1400040e4
lea rcx, [0x1400140e8]
call fcn.140004270
mov rcx, qword [0x140014080]
mov qword [0x140014080], r13
mov dword [0x140014060], r13d
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14000d000
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret