Function at 0x1400ff800
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rbx, qword [0x1401693a8]
test rbx, rbx
je 0x1400ff863
test rbx, rbx
sete bl
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140107cc0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 0x48
call fcn.140105030
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.140105030
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1401693a8], rsi
call fcn.140022330
cmp eax, 3
jne 0x1400ff926
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x80]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x140141df0]
movaps xmmword [rsi], xmm0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rsi
mov rdx, rax
call fcn.140023900
movzx eax, byte [rsi + 0x17]
mov r8, qword [rsi]
mov rcx, rax
test al, al
jns 0x1400ff90a
mov rcx, qword [rsp + 0x88]
mov rsi, r8
test rcx, rcx
jle 0x1400ff960
xor edi, edi
mov rdx, rcx
cmp word [rsi + rdi], 0x3d
je 0x1400ff94e
add rdi, 2
dec rdx
jne 0x1400ff914
jmp 0x1400ff960
mov rsi, qword [0x1401693a8]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400ff947
cmp word [rax], 0
jne 0x1400ff9e1
xor ecx, ecx
jmp 0x1400ff9f2
add rcx, rcx
cmp rcx, rdi
je 0x1400ff960
cmp rdi, 0xfffffffffffffffe
jne 0x1400ffb1d
xor eax, eax
lea r14, [rsp + 0xb4]
mov dword [r14], eax
lea r15, [rsp + 0xb0]
mov dword [r15], eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 0
lea rdx, [0x140145438]
lea r8, str.OverrideCommandLineArgs
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400ffa92
cmp dword [rsp + 0xb4], 1
jne 0x1400ffa92
mov edi, dword [rsp + 0xb0]
shr rdi, 1
test edi, edi
jne 0x1400ffa08
xor esi, esi
jmp 0x1400ffa28
xor edx, edx
lea rcx, [rdx + 1]
cmp word [rax + rdx*2 + 2], 0
mov rdx, rcx
jne 0x1400ff9e3
lea rdx, [rsp + 0x40]
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.1400236e0
jmp 0x1400ff834
add rdi, rdi
mov rcx, rdi
call fcn.140105030
mov rsi, rax
test rdi, rdi
je 0x1400ffa28
mov rcx, rsi
xor edx, edx
mov r8, rdi
call fcn.14010a410
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea rdx, [0x140145438]
lea r8, str.OverrideCommandLineArgs
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400ffa85
lea rdi, [rsp + 0x98]
mov rcx, rdi
mov rdx, rsi
call fcn.140023900
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x68], xmm0
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x60], 1
test rsi, rsi
je 0x1400ffa92
mov rcx, rsi
call fcn.140105028
cmp byte [rsp + 0x60], 0
je 0x1400ffb0e
lea r8, [rsp + 0x68]
lea rdx, [0x1401453c4]
lea rsi, [rsp + 0x98]
mov rcx, rsi
call fcn.140044a20
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ffacf
mov r8, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.140027980
cmp byte [rsp + 0xaf], 0
jns 0x1400ffaf6
mov rcx, qword [rsp + 0x98]
call fcn.140105028
cmp byte [rsp + 0x60], 0
je 0x1400ffb0e
cmp byte [rsp + 0x7f], 0
jns 0x1400ffb0e
mov rcx, qword [rsp + 0x68]
call fcn.140105028
mov al, byte [rsp + 0x97]
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1401693a8]
test al, al
lea rax, [rsp + 0x80]
cmovs rax, r8
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400ffb42
cmp word [rax], 0
jne 0x1400ffb46
xor edi, edi
jmp 0x1400ffb57
xor edx, edx
lea rdi, [rdx + 1]
cmp word [rax + rdx*2 + 2], 0
mov rdx, rdi
jne 0x1400ffb48
lea rdx, [rsp + 0x50]
mov qword [rdx + 8], rdi
call fcn.1400236e0
cmp byte [rsp + 0x97], 0
jns 0x1400ff834
mov rcx, qword [rsp + 0x80]
call fcn.140105028
jmp 0x1400ff834