Function at 0x1400170e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x198]
sub rsp, 0x290
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0x180], rax
cmp dword [0x140096714], 0
jne 0x14001743b
mov qword [r11 + 8], rbx
lea rax, [rsp + 0x58]
mov qword [r11 + 0x10], rsi
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSwitch
xor esi, esi
mov qword [r11 + 0x18], rdi
mov r9d, 0x20019
mov qword [rsp + 0x58], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov ebx, esi
mov edi, esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400171db
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x64], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.BootTimeHighDate
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
test eax, eax
lea rdx, str.BootTimeLowDate
lea rax, [rsp + 0x60]
cmove ebx, dword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmove edi, dword [rsp + 0x64]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSwitch
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x140017423
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.BackupRestoreUAP
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.BootTimeHighDate
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.BootTimeLowDate
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.CheckASUS
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.InstalledConfigAction
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x20a
call fcn.140043ce0
lea r8, [0x140096fa0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140049578
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.1400521f8
mov r9d, 1
xor r8d, r8d
mov rcx, rbx
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x70]
lea rdx, str.InstalledDir
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.RemoveCacheComplete
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
mov dword [rsp + 0x60], esi
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
lea rdx, str.RestartMigration
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.SystemDriveOnly
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x290
pop rbp
ret