Function at 0x14000c6f0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdx, r8
mov rsi, rcx
mov r8b, 0xac
lea rcx, [0x140023a60]
call fcn.14000ffc0
mov edx, 0xf1
lea rcx, [rbp + 0x2b0]
call fcn.14000d2d0
mov r8d, 0x104
lea rdx, str._VRMayaSpawner.log
lea rcx, [rbp + 0x2b0]
call fcn.14000d8e0
mov edi, 1
mov r9d, edi
lea r8, [rbp + 0x2b0]
lea rdx, [rsp + 0x30]
lea rcx, [0x140029b38]
call fcn.14000f900
xor r12d, r12d
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14000c7ae
sub dword [rbx + 0x220], edi
jne 0x14000c7ae
mov rcx, qword [rbx + 0x210]
test rcx, rcx
je 0x14000c79e
call fcn.14000b3f0
mov qword [rbx + 0x210], r12
mov rcx, rbx
call qword [rbx + 0x218]
lea rdx, str._Starting_new_session_
lea rcx, [0x140029b38]
call fcn.14000fab0
mov qword [0x1400206c0], rsi
mov edx, 0xc9
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [0x1400206c8], rax
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [rsp + 0x38], 0x3e8
mov r8d, edi
lea rdx, [rsp + 0x38]
mov rcx, rax
call sub.IPHLPAPI.DLL_GetIpAddrTable
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
movups xmm0, xmmword [0x1400175d8]
movups xmmword [0x140029e20], xmm0
lea rbx, [0x140023900]
cmp rbx, 0xffffffffffffffff
je 0x14000c841
mov qword [0x140029ba8], rbx
cmp qword [0x140023900], r12
je 0x14000c841
movzx ecx, dil
call qword [rbx + 0x40]
lea rbx, [rbx + 0x48]
cmp qword [rbx], r12
jne 0x14000c831
mov rbx, qword [0x140020680]
mov rcx, qword [0x140020688]
cmp rbx, rcx
jae 0x14000c873
mov rax, qword [rbx]
test rax, rax
je 0x14000c86a
movzx ecx, dil
call qword [rax + 0x38]
mov rcx, qword [0x140020688]
add rbx, 8
cmp rbx, rcx
jb 0x14000c854
mov rcx, r12
lea rdx, [0x1400159d0]
lea r13, [0x140029b60]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
mov byte [rcx + r13 + 0x50], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000c890
mov qword [0x140029cb0], r12
mov dword [0x140029cb8], 0x10
mov dword [0x140029cbc], edi
mov qword [0x140029cc0], rdi
mov qword [0x140029cc8], r12
mov dword [0x140029cd0], r12d
mov dword [0x140029cd8], r12d
or r8d, 0xffffffff
lea rdx, str.quiet
lea rcx, [0x140023a60]
call fcn.14000fe90
mov ecx, dword [0x1400206d0]
cmp eax, 0xffffffff
cmovne ecx, edi
mov dword [0x1400206d0], ecx
or r8d, 0xffffffff
lea rdx, str.StdApp
lea rcx, [0x140023a60]
call fcn.14000fe90
mov r15d, r12d
cmp eax, 0xffffffff
cmovne r15d, edi
or r8d, 0xffffffff
lea rdx, str.Service
lea rcx, [0x140023a60]
call fcn.14000fe90
mov esi, r12d
cmp eax, 0xffffffff
cmovne esi, edi
or r8d, 0xffffffff
lea rdx, str.RegServer
lea rcx, [0x140023a60]
call fcn.14000fe90
mov ebx, r12d
cmp eax, 0xffffffff
cmovne ebx, edi
or r8d, 0xffffffff
lea rdx, str.UnregServer
lea rcx, [0x140023a60]
call fcn.14000fe90
mov edx, r12d
cmp eax, 0xffffffff
cmovne edx, edi
test ebx, ebx
je 0x14000c994
xor r8d, r8d
mov edx, edi
mov rcx, r13
call fcn.140007cf0
jmp 0x14000d04f
test esi, esi
je 0x14000c9aa
mov r8d, edi
mov edx, edi
mov rcx, r13
call fcn.140007cf0
jmp 0x14000d04f
test edx, edx
je 0x14000ca9d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x14000d04f
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x64]
mov rcx, r13
mov rax, qword [0x140029b60]
call qword [rax + 0x40]
mov rcx, r13
call fcn.140009fe0
mov rbx, qword [0x140029ba8]
test rbx, rbx
je 0x14000ca1d
cmp qword [rbx], r12
je 0x14000ca1d
call qword [rbx + 0x38]
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rbx]
call fcn.140004a70
test eax, eax
js 0x14000ca8f
xor ecx, ecx
call qword [rbx + 8]
test eax, eax
js 0x14000ca8f
add rbx, 0x48
cmp qword [rbx], r12
jne 0x14000c9f2
mov rax, qword [0x140020658]
test rax, rax
je 0x14000ca2f
call rax
test eax, eax
js 0x14000ca8f
mov ecx, r12d
mov rdi, qword [0x140020680]
mov rax, qword [0x140020688]
cmp rdi, rax
jae 0x14000ca81
mov rbx, qword [rdi]
test rbx, rbx
je 0x14000ca74
call qword [rbx + 0x30]
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rbx]
call fcn.140004a70
test eax, eax
js 0x14000ca8f
xor ecx, ecx
call qword [rbx + 8]
mov ecx, eax
test eax, eax
js 0x14000ca8f
mov rax, qword [0x140020688]
add rdi, 8
cmp rdi, rax
jb 0x14000ca45
test ecx, ecx
js 0x14000ca8f
xor edx, edx
mov rcx, qword [0x140020678]
call fcn.1400052b0
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, r12d
jmp 0x14000d04f
or r8d, 0xffffffff
lea rdx, [0x140015a10]
lea rcx, [0x140023a60]
call fcn.14000fe90
lea rbx, [0x1400206e0]
cmp eax, 0xffffffff
je 0x14000cb76
lea rdx, [0x140015a28]
lea rcx, [0x140023a60]
call fcn.14000ff80
mov r8d, r12d
mov rcx, r12
lea rdx, [0x1400208e8]
mov r10, rax
sub r10, rdx
nop word [rax + rax]
lea rdx, [rbx + 0x208]
add rdx, rcx
movzx r9d, byte [rdx + r10]
test r9b, r9b
je 0x14000cb6b
mov byte [rdx], r9b
movzx r9d, byte [rcx + rax + 1]
test r9b, r9b
je 0x14000cb68
mov byte [rdx + 1], r9b
movzx r9d, byte [rcx + rax + 2]
test r9b, r9b
je 0x14000cb62
mov byte [rdx + 2], r9b
movzx r9d, byte [rcx + rax + 3]
test r9b, r9b
je 0x14000cb5c
mov byte [rdx + 3], r9b
movzx r9d, byte [rcx + rax + 4]
test r9b, r9b
je 0x14000cb56
mov byte [rdx + 4], r9b
add rcx, 5
add r8d, 5
cmp rcx, 0xfff
jl 0x14000caf0
jmp 0x14000cb6b
add r8d, 4
jmp 0x14000cb6b
add r8d, 3
jmp 0x14000cb6b
add r8d, 2
jmp 0x14000cb6b
inc r8d
movsxd rax, r8d
mov byte [rax + rbx + 0x208], r12b
or r8d, 0xffffffff
lea rdx, [0x140015a38]
lea rcx, [0x140023a60]
call fcn.14000fe90
cmp eax, 0xffffffff
je 0x14000cbd7
lea rdx, [0x140015a40]
lea rcx, [0x140023a60]
call fcn.14000ff80
mov r9d, r12d
mov rcx, r12
sub rax, rbx
nop
lea rdx, [rcx + rbx]
movzx r8d, byte [rdx + rax]
test r8b, r8b
je 0x14000cbd0
mov byte [rdx], r8b
inc r9d
inc rcx
cmp rcx, 0x103
jl 0x14000cbb0
movsxd rax, r9d
mov byte [rax + rbx], r12b
or r8d, 0xffffffff
lea rdx, [0x140015a48]
lea rcx, [0x140023a60]
call fcn.14000fe90
cmp eax, 0xffffffff
je 0x14000cc53
lea rdx, [0x140015a50]
lea rcx, [0x140023a60]
call fcn.14000ff80
mov r9d, r12d
mov rcx, r12
lea rdx, [0x1400207e4]
sub rax, rdx
nop word [rax + rax]
lea rdx, [rcx + rbx]
movzx r8d, byte [rdx + rax + 0x104]
test r8b, r8b
je 0x14000cc48
mov byte [rdx + 0x104], r8b
inc r9d
inc rcx
cmp rcx, 0x103
jl 0x14000cc20
movsxd rax, r9d
mov byte [rax + rbx + 0x104], r12b
mov dword [0x1400238f0], 0xffffffff
mov dword [0x1400218e8], r12d
mov dword [0x1400228ec], r12d
or r8d, 0xffffffff
lea rdx, [0x140015a58]
lea rcx, [0x140023a60]
call fcn.14000fe90
cmp eax, 0xffffffff
je 0x14000ccb4
lea rdx, [0x140015a60]
lea rcx, [0x140023a60]
call fcn.14000ff80
mov rcx, rax
lea r8, [0x1400218ec]
mov edx, 0x400
call fcn.14000b880
mov dword [0x1400218e8], eax
or r8d, 0xffffffff
lea rdx, [0x140015a68]
lea rcx, [0x140023a60]
call fcn.14000fe90
cmp eax, 0xffffffff
je 0x14000ccfd
lea rdx, [0x140015a70]
lea rcx, [0x140023a60]
call fcn.14000ff80
mov rcx, rax
lea r8, [0x1400228f0]
mov edx, 0x400
call fcn.14000b880
mov dword [0x1400228ec], eax
or r8d, 0xffffffff
lea rdx, [0x140015a78]
lea rcx, [0x140023a60]
call fcn.14000fe90
cmp eax, 0xffffffff
je 0x14000cd45
lea r8, [0x1400238f0]
lea rdx, [0x140015a80]
lea rcx, [0x140023a60]
call fcn.14000ff30
mov edx, dword [0x1400238f0]
test al, al
cmove edx, r12d
mov dword [0x1400238f0], edx
or r8d, 0xffffffff
lea rdx, [0x140015a88]
lea rcx, [0x140023a60]
call fcn.14000fe90
cmp eax, 0xffffffff
je 0x14000cd8d
lea r8, [0x1400238f4]
lea rdx, [0x140015a98]
lea rcx, [0x140023a60]
call fcn.14000ff30
mov ecx, dword [0x1400238f4]
test al, al
cmove ecx, r12d
mov dword [0x1400238f4], ecx
cmp dword [0x1400228ec], r12d
jle 0x14000cda8
mov eax, dword [0x1400238f0]
test eax, eax
cmovs eax, r12d
mov dword [0x1400238f0], eax
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r12
mov r9d, 0x20019
lea r8, [0x140015774]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x40]
call fcn.140006f30
mov ebx, r12d
test eax, eax
cmovne ebx, eax
mov rsi, r12
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x68], r12
test ebx, ebx
jne 0x14000ce19
mov r9d, 0x20019
lea r8, [0x140015aa8]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140006f30
test eax, eax
cmovne ebx, eax
mov rsi, qword [rsp + 0x58]
mov dword [rbp + 0x3f0], 0x104
test ebx, ebx
jne 0x14000cea2
mov dword [rsp + 0x30], r12d
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x140015ae8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000cea8
mov ecx, dword [rbp + 0x3f0]
test ecx, ecx
je 0x14000ce8f
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000ce8f
cmp eax, 2
jbe 0x14000ce95
cmp eax, 7
jne 0x14000ce8f
cmp ecx, 1
jb 0x14000ce8f
cmp byte [rbp + rcx - 0x61], bl
jne 0x14000ce8f
cmp ecx, 1
jbe 0x14000cea8
cmp byte [rbp + rcx - 0x62], bl
je 0x14000cea8
mov byte [rbp - 0x60], 0
jmp 0x14000cea8
cmp byte [rbp + rcx - 0x61], 0
je 0x14000cea8
mov byte [rbp - 0x60], 0
jmp 0x14000cea8
mov edi, dword [0x140029cd8]
test r15d, r15d
cmovne edi, r12d
mov dword [0x140029cd8], edi
lea rax, [0x140029bb0]
mov qword [rsp + 0x70], rax
lea rax, [0x14000b120]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
test edi, edi
je 0x14000cefe
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x14000cef1
mov dword [0x140029cd8], r12d
jmp 0x14000cefe
cmp dword [0x140029cd8], 0
jne 0x14000cfe0
mov qword [0x140029cf0], r12
mov qword [rsp + 0x20], r13
lea r9, [0x14000c240]
xor r8d, r8d
mov edx, 0xd4
mov rcx, qword [0x1400206c0]
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [0x140029ce0], rax
mov edx, 0xc9
mov rcx, qword [0x1400206c0]
call qword [sym.imp.USER32.dll_LoadIconA]
mov rbx, rax
mov qword [0x140029ce8], rax
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xb0], 0x68
mov rcx, qword [0x140029ce0]
mov qword [rbp + 0xb8], rcx
mov dword [rbp + 0xc0], r12d
mov dword [rbp + 0xc4], 7
mov qword [rbp + 0xd0], rbx
mov dword [rbp + 0xc8], 0x400
movsd xmm0, qword [0x140018a60]
movsd qword [rbp + 0xd8], xmm0
mov eax, dword [0x140018a68]
mov dword [rbp + 0xe0], eax
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov rcx, qword [0x140029ce8]
call qword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [0x140029cd8], 0
jne 0x14000cfe0
mov rcx, r13
call fcn.140009080
mov rcx, qword [0x1400238f8]
test rcx, rcx
je 0x14000cff2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400206c8]
call qword [sym.imp.USER32.dll_DestroyIcon]
lea rdx, str._Ending_session_
lea rcx, [0x140029b38]
call fcn.14000fab0
mov ebx, dword [0x140029cc4]
test rsi, rsi
je 0x14000d02b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
cmp qword [rsp + 0x40], 0
je 0x14000d048
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], r12d
mov eax, ebx
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret