Function at 0x140002e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x14010a010]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov rsi, rdx
mov qword [rsp + 0x68], rdx
xor edi, edi
mov dword [rsp + 0x40], edi
mov qword [rdx], rdi
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], 7
mov word [rdx], di
xor r8d, r8d
lea rdx, [0x1400d8d10]
mov rcx, rsi
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov dword [rsp + 0x40], 1
lea rcx, [0x1400d9090]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f4d
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002f4d
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x7c]
call fcn.14008d590
mov dword [rbp - 0x80], 0x114
lea rcx, [rbp - 0x80]
call rbx
test eax, eax
jne 0x140002f4d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xd0]
call fcn.14008d590
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x78]
mov r8d, dword [rbp - 0x7c]
lea rdx, str._d._d._d.
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0xd0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140002f33
lea rdx, [rbp + 0xd0]
mov rcx, rsi
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov r8d, 3
lea rdx, [0x1400d90d0]
lea rcx, [rsp + 0x48]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], di
mov r8d, 0x2c
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rbp + 0xa0]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
call fcn.140001760
mov dword [rsp + 0x70], edi
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140003017
mov ebx, edi
jmp 0x140003080
mov dword [rsp + 0x74], edi
mov dword [rsp + 0x70], 4
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, dword [rsp + 0x74]
test eax, eax
cmovne ebx, edi
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x1400030c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003292
call fcn.140061000
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], di
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140003121
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000311c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003298
call fcn.140061000
lea r9, [rbp + 0xca]
nop dword [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub bx, cx
add bx, 0x30
mov word [r9], bx
mov ebx, edx
test edx, edx
jne 0x140003130
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], di
lea rcx, [rbp + 0xca]
cmp r9, rcx
je 0x1400031a5
lea r8, [rbp + 0xca]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x48]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov dword [rsp + 0x40], 7
lea rdx, [rsp + 0x48]
cmp rax, 8
cmovae rdx, qword [rsp + 0x48]
mov r8, rdi
mov rcx, rsi
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000320a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003205
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000328c
call fcn.140061000
mov edx, 0x5c
lea rbx, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceBIHelper.cpp
mov rcx, rbx
call fcn.14008d088
test rax, rax
je 0x140003234
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d088
lea rbx, [rax + 1]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140003241
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rcx
lea r9, str.osVersion___s
lea r8, str.GetCurrentOSVersion
mov edx, 0x90
mov rcx, rbx
call fcn.140015a30
mov rax, rsi
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.140060fe0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
int3