Function at 0x14002e1b0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov rbx, qword [0x140175a90]
test rbx, rbx
je 0x14002e217
test rbx, rbx
sete bl
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.14007d5a0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 0x48
call fcn.14007a994
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.14007a994
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x140175a90], rsi
call fcn.14005da20
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, rax
cmp edi, 3
jne 0x14002e288
test rsi, rsi
jne 0x14002e298
xor eax, eax
jmp 0x14002e2a0
test rsi, rsi
jne 0x14002e36e
xor edi, edi
jmp 0x14002e379
mov rcx, rsi
call fcn.14007adcc
mov rcx, qword [0x140175a90]
lea rdx, [rsp + 0x90]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
call fcn.14005f3e0
mov rax, qword [0x140175a90]
cmp qword [rax + 0x38], 0
jne 0x14002e1e6
xor eax, eax
lea r14, [rsp + 0xc0]
mov dword [r14], eax
lea rsi, [rsp + 0xbc]
mov dword [rsi], eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 0
lea rdx, [0x14014e1a4]
lea r8, str.OverrideCommandLineArgs
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14002e4fe
cmp dword [rsp + 0xc0], 1
jne 0x14002e4fe
mov edi, dword [rsp + 0xbc]
shr rdi, 1
test edi, edi
je 0x14002e3c4
add rdi, rdi
mov rcx, rdi
call fcn.14007a994
mov r15, rax
test rdi, rdi
je 0x14002e3c7
mov rcx, r15
xor edx, edx
mov r8, rdi
call fcn.14007f940
jmp 0x14002e3c7
mov rcx, rsi
call fcn.14007adcc
mov rdi, rax
lea rax, str.single_argument
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
mov qword [rdx + 8], 0xf
lea rcx, [rsp + 0xa0]
mov qword [rcx], rsi
mov qword [rcx + 8], rdi
xor r8d, r8d
call fcn.14005ff60
mov rcx, qword [0x140175a90]
lea rdx, [rsp + 0x40]
mov qword [rdx], rsi
mov qword [rdx + 8], rdi
call fcn.14005f3e0
jmp 0x14002e1e6
xor r15d, r15d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
lea rdx, [0x14014e1a4]
lea r8, str.OverrideCommandLineArgs
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14002e4f1
movabs rsi, 0x7fffffffffffffef
mov rcx, r15
call fcn.14007adcc
cmp rax, rsi
ja 0x14002e85c
mov rdi, rax
cmp rax, 0xb
jb 0x14002e469
lea r12, [rdi + 8]
and r12, 0xfffffffffffffff8
lea rcx, [r12 + r12]
call fcn.14007a994
mov r14, rax
mov qword [rsp + 0xa0], rax
add rsi, 0x11
or rsi, r12
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xa8], rdi
mov r8, rdi
add r8, rdi
mov rcx, r14
mov rdx, r15
call fcn.14007f530
jmp 0x14002e496
lea r14, [rsp + 0xa0]
mov byte [r14 + 0x17], dil
cmp rdi, 3
jne 0x14002e83c
movzx eax, word [r15 + 4]
mov word [rsp + 0xa4], ax
mov eax, dword [r15]
mov dword [rsp + 0xa0], eax
mov word [r14 + rdi*2], 0
lea rsi, [rsp + 0x78]
cmp byte [rsi - 8], 0
je 0x14002e4d5
cmp byte [rsp + 0x8f], 0
jns 0x14002e4bc
mov rcx, qword [rsp + 0x78]
call fcn.14007a98c
mov rax, qword [rsp + 0xb0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsi], xmm0
jmp 0x14002e4f1
mov rax, qword [rsp + 0xb0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x70], 1
test r15, r15
je 0x14002e4fe
mov rcx, r15
call fcn.14007a98c
cmp byte [rsp + 0x70], 0
je 0x14002e1e6
movabs r15, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0xa0]
mov qword [r14 + 0x10], r15
movaps xmm6, xmmword [0x140147b90]
movaps xmmword [r14], xmm6
lea rax, [0x14014e0fe]
lea r8, [rsp + 0x60]
mov qword [r8], rax
mov qword [r8 + 8], 1
lea rax, [rsp + 0x78]
movzx ecx, byte [rax + 0x17]
test cl, cl
mov rdi, qword [rax]
cmovns rdi, rax
lea rdx, [rsp + 0x50]
mov qword [rdx], rdi
cmovs rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
mov dword [rsp + 0x20], 1
mov rcx, r14
mov r9d, 1
call fcn.14002eed0
mov rsi, qword [r14]
mov rdi, qword [r14 + 8]
mov rcx, qword [r14 + 0x10]
cmp rdi, rcx
jae 0x14002e5ee
cmp rsi, rdi
je 0x14002e669
mov qword [rsp + 0xcd], r15
movaps xmmword [rsp + 0xc0], xmm6
lea r9, [rsi + 0x18]
lea rcx, [rsp + 0xa0]
mov rdx, rsi
mov r8, rdi
call fcn.140009550
cmp byte [rsi + 0x17], 0
jns 0x14002e5c8
mov rcx, qword [rsi]
call fcn.14007a98c
mov word [rsi], 0
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi + 2], xmm0
mov rax, qword [rsp + 0xcd]
mov qword [rsi + 0xf], rax
mov byte [rsi + 0x17], 0
jmp 0x14002e76b
movabs r8, 0xaaaaaaaaaaaaaaa
mov rdx, rdi
sub rdx, rsi
sar rdx, 3
movabs rax, 0xaaaaaaaaaaaaaaab
imul rdx, rax
inc rdx
cmp rdx, r8
ja 0x14002e84a
sub rcx, rsi
sar rcx, 3
imul rcx, rax
lea rax, [rcx + rcx]
cmp rax, rdx
cmovb rax, rdx
movabs rdx, 0x555555555555555
cmp rcx, rdx
cmovae rax, r8
test rax, rax
je 0x14002e683
cmp rax, r8
ja 0x14002e857
shl rax, 3
lea r14, [rax + rax*2]
mov rcx, r14
call fcn.14007a994
mov r8, rax
add r8, r14
jmp 0x14002e694
mov byte [rsi + 0x17], 0
mov word [rsi], 0
add rsi, 0x18
mov qword [rsp + 0xa8], rsi
jmp 0x14002e76b
mov ecx, 0x18
call fcn.14007a994
mov r8, rax
add r8, 0x18
mov byte [rax + 0x17], 0
mov word [rax], 0
lea rdx, [rax + 0x18]
cmp rsi, rdi
je 0x14002e746
xorps xmm0, xmm0
mov rcx, qword [rsi + 0x10]
mov qword [rdx + 0x10], rcx
movups xmm1, xmmword [rsi]
movups xmmword [rdx], xmm1
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
add rsi, 0x18
add rdx, 0x18
cmp rdi, rsi
jne 0x14002e6ad
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
cmp rdi, rsi
je 0x14002e75e
lea r14, [rdi - 0x18]
cmp byte [rdi - 1], 0
js 0x14002e869
cmp r14, rsi
je 0x14002e75e
lea r14, [rdi - 0x30]
cmp byte [rdi - 0x19], 0
js 0x14002e876
cmp r14, rsi
je 0x14002e75e
lea r14, [rsi + 0x30]
cmp byte [rdi - 0x31], 0
js 0x14002e73b
add rdi, 0xffffffffffffffe8
cmp r14, rdi
je 0x14002e75e
jmp 0x14002e72a
mov rcx, qword [rdi - 0x48]
call fcn.14007a98c
jmp 0x14002e730
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
test rsi, rsi
je 0x14002e76b
mov rcx, rsi
call fcn.14007a98c
mov rcx, qword [0x140175a90]
lea rsi, [rsp + 0xa0]
mov rdx, rsi
call fcn.14005f6d0
mov rsi, qword [rsi]
test rsi, rsi
je 0x14002e7f6
mov rdi, qword [rsp + 0xa8]
cmp rdi, rsi
je 0x14002e7e6
lea r14, [rdi - 0x18]
cmp byte [rdi - 1], 0
jns 0x14002e7a9
mov rcx, qword [r14]
call fcn.14007a98c
cmp r14, rsi
je 0x14002e7dc
lea r14, [rdi - 0x30]
cmp byte [rdi - 0x19], 0
jns 0x14002e7c0
mov rcx, qword [r14]
call fcn.14007a98c
cmp r14, rsi
je 0x14002e7dc
lea r14, [rdi - 0x48]
cmp byte [rdi - 0x31], 0
jns 0x14002e7d7
mov rcx, qword [r14]
call fcn.14007a98c
cmp r14, rsi
jne 0x14002e81e
mov rcx, qword [rsp + 0xa0]
jmp 0x14002e7e9
mov rcx, rsi
mov qword [rsp + 0xa8], rsi
call fcn.14007a98c
cmp byte [rsp + 0x70], 0
je 0x14002e1e6
cmp byte [rsp + 0x8f], 0
jns 0x14002e1e6
mov rcx, qword [rsp + 0x78]
call fcn.14007a98c
jmp 0x14002e1e6
lea r14, [rsi + 0x48]
cmp byte [rdi - 0x49], 0
jns 0x14002e831
mov rcx, qword [rdi - 0x60]
call fcn.14007a98c
add rdi, 0xffffffffffffffe8
cmp r14, rdi
je 0x14002e7dc
jmp 0x14002e822
test rdi, rdi
je 0x14002e496
jmp 0x14002e456
lea rcx, [rsp + 0xa0]
call fcn.1400da03c
call fcn.14007bcd0
lea rcx, [rsp + 0xa0]
call fcn.1400da168
mov rcx, qword [r14]
call fcn.14007a98c
jmp 0x14002e70e
mov rcx, qword [r14]
call fcn.14007a98c
jmp 0x14002e721