Function at 0x140004df0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xd8], rbx
mov rax, qword [0x14000d018]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r8
mov rdi, rdx
mov rbx, rcx
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x20]
mov edx, 0x15
lea rcx, [0x1400093e8]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference]
mov r14d, 1
test eax, eax
jns 0x140004e66
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov ecx, 0xc000000d
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rcx, qword [rbx + 0x30]
xor r13d, r13d
test rcx, rcx
je 0x140004e7c
mov qword [rbx + 0x30], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rdi]
lea r8, [rbx + 0x30]
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call qword [rax + 0x38]
mov edi, eax
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
test edi, edi
js 0x1400050fa
mov qword [rbp - 0x50], r13
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x20]
mov edx, 0x2a
lea rcx, str.Windows.UI.Notifications.ToastNotification
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference]
test eax, eax
jns 0x140004ed7
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov ecx, 0xc000000d
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rdi, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140004eee
mov qword [rbp - 0x50], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
lea r8, [rbp - 0x50]
lea rdx, [0x140009448]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_winrt_l1_1_0.dll_RoGetActivationFactory]
mov edi, eax
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
test edi, edi
js 0x1400050e7
mov rdi, qword [rbp - 0x50]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140004f2d
mov qword [rbx + 0x38], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rdi]
lea r8, [rbx + 0x38]
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x30]
mov edi, eax
test eax, eax
js 0x1400050e7
mov ecx, 0x48
call fcn.140006600
mov rdi, rax
mov qword [rbp - 0x40], rax
mov r8, qword [rbx + 0x10]
add r8, 0x1620
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
lea rax, vtable.ToastEventHandler.1.0
mov qword [rdi], rax
lea rax, vtable.ToastEventHandler.0
mov qword [rdi + 8], rax
lea rax, vtable.ToastEventHandler.2.0
mov qword [rdi + 0x10], rax
mov dword [rdi + 0x20], r13d
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rdx
mov qword [rdi + 0x38], r8
mov dword [rdi + 0x40], r13d
cmp qword [rbx + 0x40], rdi
je 0x140004fc0
mov rcx, rdi
call qword [0x140009530]
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x40], rdi
test rcx, rcx
je 0x140004fc0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x38]
mov rax, qword [rcx]
lea r8, [rbx + 0x18]
mov rdx, qword [rbx + 0x40]
call qword [rax + 0x58]
mov edi, eax
test eax, eax
js 0x1400050e7
mov rax, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
mov r9, qword [rcx]
lea r8, [rbx + 0x20]
lea rdx, [rax + 8]
test rax, rax
cmove rdx, r13
call qword [r9 + 0x48]
mov edi, eax
test eax, eax
js 0x1400050e7
mov rax, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
mov r9, qword [rcx]
lea r8, [rbx + 0x28]
lea rdx, [rax + 0x10]
test rax, rax
cmove rdx, r13
call qword [r9 + 0x68]
mov edi, eax
test eax, eax
js 0x1400050e7
mov qword [rbp - 0x40], r13
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20101
xor r8d, r8d
lea rdx, str.SOFTWAREASUSARMOURY_CRATE_Service
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400050d7
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400050d7
mov dword [rbp - 0x48], r13d
mov dword [rbp - 0x34], 4
mov dword [rbp - 0x38], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x34]
xor r8d, r8d
lea rdx, str.IsDisableReminder
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400050aa
mov r14d, r13d
cmp dword [rbp - 0x48], r13d
sete r14b
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
jne 0x1400050d7
mov rax, qword [rbx + 0x10]
cmp dword [rax], 3
je 0x1400050d7
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 2]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400050e7
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x38]
call qword [rax + 0x30]
mov edi, eax
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400050fa
mov qword [rbp - 0x50], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140006340
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret