Function at 0x1400b9f00
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r14
push r15
sub rsp, 0x350
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x338], rbx
mov r15, r9
mov rbx, rdx
mov qword [rbp + 0x340], rsi
mov qword [rbp + 0x348], rdi
xor edx, edx
mov rdi, r8
mov rcx, rbx
xor r8d, r8d
call fcn.1400ba5a0
movabs rsi, 0xffffffffffffff0
lea r8, [rax + 1]
lea rax, [r8 + r8]
lea r10, [rax + 0xf]
cmp r10, rax
ja 0x1400b9f5f
mov r10, rsi
and r10, 0xfffffffffffffff0
mov rax, r10
call fcn.1400bd490
sub rsp, rax
mov rcx, rbx
lea rax, [rsp + 0x40]
mov rdx, rax
mov qword [rbp + 0x10], rax
call fcn.1400ba5a0
xor r14d, r14d
mov r8, rdi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r14
lea r9d, [r14 - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x1400b9fab
dec eax
jmp 0x1400b9fae
mov eax, r14d
movsxd rdx, eax
inc rdx
lea rax, [rdx + rdx]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400b9fc4
mov rcx, rsi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400bd490
sub rsp, rcx
mov r9d, 0xffffffff
mov r8, rdi
mov ecx, 0xfde9
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [rbp + 0x358]
xor r9d, r9d
mov rcx, qword [rbp + 0x350]
xor r8d, r8d
call fcn.1400ba390
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r14d
mov r8, r15
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [rax - 1]
test eax, eax
jg 0x1400ba040
mov ecx, r14d
movsxd rbx, ecx
test rdi, rdi
je 0x1400ba053
lea rsi, [0x1400dfae4]
test ecx, ecx
jne 0x1400ba05a
lea rsi, [0x1400de310]
mov dword [rsp + 0x28], r14d
mov r9d, 0xffffffff
mov r8, rsi
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x1400ba082
dec eax
jmp 0x1400ba085
mov eax, r14d
cdqe
inc rax
add rbx, rax
add rbx, rdi
lea rax, [rbx + rbx]
lea r8, [rax + 0xf]
cmp r8, rax
ja 0x1400ba0a7
movabs r8, 0xffffffffffffff0
and r8, 0xfffffffffffffff0
mov rax, r8
call fcn.1400bd490
mov edx, dword [rbp + 0x358]
sub rsp, r8
mov rcx, qword [rbp + 0x350]
mov r9, rbx
lea r14, [rsp + 0x40]
mov r8, r14
call fcn.1400ba390
mov edx, ebx
mov r9d, 0xffffffff
sub edx, eax
mov r8, rsi
mov dword [rsp + 0x28], edx
mov rdi, rax
lea rcx, [r14 + rax*2]
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x1400ba105
dec eax
jmp 0x1400ba107
xor eax, eax
cdqe
mov r9d, 0xffffffff
add rdi, rax
mov r8, r15
sub ebx, edi
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
lea rax, [r14 + rdi*2]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400ba1d2
lea rax, [rbp + 8]
mov dword [rbp + 8], 0x208
mov qword [rsp + 0x30], rax
lea r8, str.Debugger
lea rax, [rbp + 0x100]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400ba1ce
lea rdx, [rbp + 4]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x100]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rbp + 4], 0
mov rbx, rax
jle 0x1400ba1ab
mov rcx, qword [rax]
jmp 0x1400ba1b2
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x1400ba1ce
test dil, 0x10
je 0x1400ba1d2
xor bl, bl
jmp 0x1400ba1d4
mov bl, 1
xorps xmm0, xmm0
mov dword [rbp + 0x20], 1
lea rax, str.Exit
mov dword [rbp + 0x2c], 5
mov qword [rbp + 0x24], rax
lea rcx, str.Ignore
mov qword [rbp + 0x3c], rax
lea rax, str.Debug
mov qword [rbp + 0x48], rax
xor eax, eax
mov qword [rbp + 0xf4], rax
mov dword [rbp + 0xfc], eax
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x38], 1
mov dword [rbp + 0x44], 4
mov dword [rbp + 0x50], 5
mov qword [rbp + 0x54], rcx
mov dword [rbp + 0x60], 0xa0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x74], 0x1000009
mov qword [rbp + 0x64], rax
lea r9, [rbp + 0xc]
mov rax, qword [rbp + 0x10]
lea rdx, [rbp]
mov qword [rbp + 0x7c], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x8c], rax
movzx eax, bl
add eax, 2
mov qword [rbp + 0x84], 0xfffe
mov dword [rbp + 0x9c], eax
test bl, bl
mov rbx, qword [rbp + 0x360]
lea rax, [rbp + 0x38]
cmove rax, rcx
mov qword [rbp + 0x94], r14
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x60]
lea rax, str._a_I_need_help___a_
mov dword [rbp + 0xa8], 1
mov qword [rbp + 0xe4], rax
test rbx, rbx
lea rax, [0x1400b99a0]
mov qword [rbp + 0xec], rax
lea rax, str.Do_not_show_this_message_again
cmove rax, qword [rbp + 0xbc]
xor r8d, r8d
mov qword [rbp + 0xbc], rax
call qword [rbp + 0x330]
mov eax, dword [rbp]
cmp eax, 2
jne 0x1400ba33c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
add eax, 5
mov dword [rbp], eax
cmp eax, 1
jne 0x1400ba358
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [rbp]
test rbx, rbx
je 0x1400ba366
cmp dword [rbp + 0xc], 0
je 0x1400ba366
mov byte [rbx], 1
mov rbx, qword [rbp + 0x338]
cmp eax, 4
mov rsi, qword [rbp + 0x340]
mov rdi, qword [rbp + 0x348]
sete al
lea rsp, [rbp + 0x310]
pop r15
pop r14
pop rbp
ret