Function at 0x1400ff470
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rbx, qword [0x140173a28]
test rbx, rbx
je 0x1400ff4d3
test rbx, rbx
sete bl
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14010e4a0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 0x48
call fcn.14010b888
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.14010b888
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x140173a28], rsi
call fcn.140054750
cmp eax, 3
jne 0x1400ff596
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x80]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x140146a10]
movaps xmmword [rsi], xmm0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rsi
mov rdx, rax
call fcn.140046f70
movzx eax, byte [rsi + 0x17]
mov r8, qword [rsi]
mov rdx, rax
test al, al
jns 0x1400ff57a
mov rdx, qword [rsp + 0x88]
mov rsi, r8
test rdx, rdx
jle 0x1400ff5f2
xor edi, edi
mov rcx, rdx
cmp word [rsi + rdi], 0x3d
je 0x1400ff5e9
add rdi, 2
dec rcx
jne 0x1400ff584
jmp 0x1400ff5f2
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400ff5aa
xor eax, eax
jmp 0x1400ff5b2
mov rcx, rax
call fcn.14010b924
lea rsi, [rsp + 0x60]
mov qword [rsi + 8], rax
lea rdx, str.single_argument
mov rcx, rsi
xor r8d, r8d
call fcn.1401009b0
mov rcx, qword [0x140173a28]
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
call fcn.140046da0
jmp 0x1400ff4a4
add rsi, rdi
jne 0x1400ff7e1
xor eax, eax
lea r14, [rsp + 0xb4]
mov dword [r14], eax
lea r15, [rsp + 0xb0]
mov dword [r15], eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 0
lea rdx, [0x14014d210]
lea r8, str.OverrideCommandLineArgs
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400ff6fd
cmp dword [rsp + 0xb4], 1
jne 0x1400ff6fd
mov edi, dword [rsp + 0xb0]
shr rdi, 1
test edi, edi
jne 0x1400ff673
xor esi, esi
jmp 0x1400ff693
add rdi, rdi
mov rcx, rdi
call fcn.14010b888
mov rsi, rax
test rdi, rdi
je 0x1400ff693
mov rcx, rsi
xor edx, edx
mov r8, rdi
call fcn.140110bf0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea rdx, [0x14014d210]
lea r8, str.OverrideCommandLineArgs
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400ff6f0
lea rdi, [rsp + 0x98]
mov rcx, rdi
mov rdx, rsi
call fcn.140046f70
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x68], xmm0
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x60], 1
test rsi, rsi
je 0x1400ff6fd
mov rcx, rsi
call fcn.14010b880
cmp byte [rsp + 0x60], 0
je 0x1400ff779
lea r8, [rsp + 0x68]
lea rdx, [0x14014d164]
lea rsi, [rsp + 0x98]
mov rcx, rsi
call fcn.14003ec00
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ff73a
mov r8, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.14001df60
cmp byte [rsp + 0xaf], 0
jns 0x1400ff761
mov rcx, qword [rsp + 0x98]
call fcn.14010b880
cmp byte [rsp + 0x60], 0
je 0x1400ff779
cmp byte [rsp + 0x7f], 0
jns 0x1400ff779
mov rcx, qword [rsp + 0x68]
call fcn.14010b880
mov al, byte [rsp + 0x97]
mov r8, qword [rsp + 0x80]
mov rsi, qword [0x140173a28]
test al, al
lea rcx, [rsp + 0x80]
cmovs rcx, r8
mov qword [rsp + 0x50], rcx
test rcx, rcx
jne 0x1400ff7ab
xor eax, eax
jmp 0x1400ff7b0
call fcn.14010b924
lea rdx, [rsp + 0x50]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140046da0
cmp byte [rsp + 0x97], 0
jns 0x1400ff4a4
mov rcx, qword [rsp + 0x80]
call fcn.14010b880
jmp 0x1400ff4a4
add rdx, rdx
cmp rdx, rdi
je 0x1400ff5f2
cmp rdi, 0xfffffffffffffffe
jne 0x1400ff788
jmp 0x1400ff5f2