I don't think its the main()'s responsibility to be working out how to dump the config, or the format()'s responsibility to determine what is and isn't a valid BOM
move those functions out to their own functions, this gives clear roles and responsibilities and it makes it easier to add new additional capabilities.
May I suggest getInvalidBOM(const StringRef) for the function name and parameter type?