Function at 0x14000ff00
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x520
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x530], rbx
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x510], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREASUSARMOURY_CRATE_Service
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010187
mov dword [rsp + 0x68], 0x400
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.WebSocketTarget
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010187
xor edx, edx
lea r8d, [rax + 0x78]
lea rcx, [rsp + 0x90]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x90]
call fcn.140011710
nop
lea r9, [rsp + 0x110]
cmp word [rsp + 0x110], 0
je 0x14000ffdb
nop
add r9, 2
cmp word [r9], 0
jne 0x14000ffd0
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.140012990
lea rdi, [0x140194358]
mov rcx, rdi
call fcn.140004bd0
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [0x140194358], xmm0
movups xmm1, xmmword [rsp + 0x80]
movups xmmword [0x140194368], xmm1
movdqa xmm0, xmmword [0x140147830]
movdqu xmmword [rsp + 0x80], xmm0
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call fcn.140004bd0
mov r8, rdi
mov r11, qword [0x140194358]
mov rbx, qword [reloc.WS2_32.dll_ntohs]
cmp rbx, 0x10
cmovae r8, r11
mov r9, qword [0x140194368]
mov r10, 0xffffffffffffffff
cmp r9, 1
jb 0x1400100a9
lea rax, [r9 - 1]
mov rcx, r10
cmp rax, rcx
cmovb rcx, rax
add rcx, r8
movzx eax, word [0x14013e7b8]
cmp byte [rcx], 0x3a
jne 0x14001009a
cmp byte [rcx], al
jne 0x140010091
xor edx, edx
jmp 0x140010096
sbb edx, edx
or edx, 1
test edx, edx
je 0x1400100a4
cmp rcx, r8
je 0x1400100a9
dec rcx
jmp 0x140010084
sub rcx, r8
jmp 0x1400100ac
mov rcx, r10
inc rcx
movdqa xmm0, xmmword [0x140147830]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
cmp r9, rcx
jb 0x1400101aa
sub r9, rcx
cmp r9, 0xffffffffffffffff
cmovb r10, r9
mov rdx, rdi
cmp rbx, 0x10
cmovae rdx, r11
add rdx, rcx
mov r8, r10
lea rcx, [rsp + 0x30]
call fcn.140004c30
mov rcx, rdi
call fcn.140004bd0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [0x140194358], xmm0
add eax, 0x184253
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [0x140194368], xmm1
movdqa xmm0, xmmword [0x140147830]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140004bd0
nop
lea rax, vtable.std::wstring_convert_class_std::codecvt_utf8_utf16_wchar_t__1114111__0___wchar_t__class_std::allocator_wchar_t___class_std::allocator_char__.0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0xd0]
call fcn.1400049f0
lea rcx, [rsp + 0xb0]
call fcn.140004bd0
nop
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140010180
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x140010180
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov eax, 1
jmp 0x140010189
xor eax, eax
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0x530]
add rsp, 0x520
pop rdi
ret
call fcn.140013370
int3