Function at 0x1400213a0
Capabilities:
Create service
Get common file path
Persist via windows service
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x660]
sub rsp, 0x760
mov rax, qword [0x140070010]
xor rax, rsp
mov qword [rbp + 0x650], rax
mov r12, rdx
mov esi, ecx
mov dword [rsp + 0x70], ecx
xor edi, edi
mov dword [rsp + 0x74], edi
mov dword [rbp + 0x78], edi
lea r14d, [rdi + 6]
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400218a6
mov qword [rbp + 0x88], rdi
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREASUSARMOURY_CRATE_Diagnosis
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x7c], 4
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x80]
xor r8d, r8d
lea rdx, str.EnableLog
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140021894
cmp dword [rbp + 0x80], 4
jne 0x140021894
cmp dword [rbp + 0x78], eax
cmovne r14d, edi
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], al
lea rax, [rbp + 0x330]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400214c6
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0xa0]
call fcn.1400089a0
nop
mov r8d, 0x23
lea rdx, str.ASUSAsIO3AsusCertService.exe.log
lea rcx, [rbp + 0xa0]
call fcn.140008b00
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0x158], rdi
mov qword [rbp + 0x198], rdi
mov qword [rbp + 0x1d8], rdi
mov qword [rbp + 0x218], rdi
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdx, qword [rbp + 0xa0]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x140021551
lea rcx, [rbp - 0x70]
call fcn.1400089a0
nop
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov r8d, 0xf
lea rdx, [0x140063050]
lea rcx, [rbp - 0x40]
call fcn.1400089a0
nop
mov byte [rbp + 0x70], 0
mov qword [rbp + 0xd0], 3
mov qword [rbp + 0x90], 0x500000
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x50]
call fcn.140008620
lea rcx, [rbp + 0x120]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0xd0]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x90]
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.1400236e0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14002162f
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021629
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021b2a
call fcn.140026aa4
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14002166b
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021b30
call fcn.140026aa4
nop
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x14002168a
mov rax, qword [rcx]
lea rdx, [rbp + 0x1e0]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbp + 0x1d8]
test rcx, rcx
je 0x1400216a9
mov rax, qword [rcx]
lea rdx, [rbp + 0x1a0]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x1400216c8
mov rax, qword [rcx]
lea rdx, [rbp + 0x160]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x1400216e7
mov rax, qword [rcx]
lea rdx, [rbp + 0x120]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov rax, qword [rbp + 0xc8]
test rax, rax
je 0x1400216ff
lock inc dword [rax + 8]
movaps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, [rbp - 0x80]
mov qword [rbp - 0x50], rax
call fcn.140007940
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x80], xmm1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.1400205f0
nop
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x140021768
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140021768
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140021768
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
call fcn.140007940
mov r13, rax
lea rbx, [rax + 0x50]
mov qword [rbp], rbx
mov rcx, rbx
call fcn.14002843c
test eax, eax
jne 0x140021b36
mov ecx, 0xb0
call fcn.140026748
mov qword [rbp - 0x20], rax
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_a53e80b6bab74162aa299a142b2d8110___void___.0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], r13
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x48], rcx
mov dword [rsp + 0x74], 3
mov r8d, 3
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.140024170
mov r15, rax
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400217e7
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x20]
lea rax, [rbp + 0x10]
cmp rcx, rax
setne dl
call r8
lea rax, [r13 + 0x1d0]
lea rcx, [rbp + 8]
cmp rax, rcx
je 0x140021804
mov rdx, qword [rax]
mov qword [rax], r15
test rdx, rdx
je 0x140021812
jmp 0x14002180c
test r15, r15
je 0x140021812
mov rdx, r15
call fcn.140008890
nop
mov rcx, rbx
call fcn.140028460
nop
mov rbx, qword [rbp + 0xc8]
test rbx, rbx
je 0x14002184f
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14002184f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14002184f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140021890
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002188b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021b3e
call fcn.140026aa4
mov esi, dword [rsp + 0x70]
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x1400218a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140007940
mov rbx, rax
mov rcx, rax
call fcn.14002843c
test eax, eax
jne 0x140021b22
mov rcx, qword [rbx + 0xf8]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1400218e3
nop dword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
xchg dword [r8 + 0x40], edx
mov rax, qword [rax]
cmp rax, rcx
jne 0x1400218d0
mov dword [rbx + 0x178], r14d
mov rcx, rbx
call fcn.140028460
cmp esi, 1
jle 0x140021a93
lea rdx, str.install
mov rcx, qword [r12 + 8]
call fcn.140034508
test eax, eax
jne 0x140021a75
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140021945
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_fail
call fcn.1400212e0
mov edi, eax
jmp 0x140021a75
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rbp + 0x120]
lea r8, str.__s_
mov edx, 0x104
lea rcx, [rbp + 0x440]
call fcn.14001fd50
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, str.Event_Log
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x440]
mov qword [rsp + 0x38], rax
mov ecx, 1
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, str.Asus_Certificate_Service
lea rdx, str.AsusCertService
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x1400219fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Install_service_fail
call fcn.1400212e0
mov edi, eax
jmp 0x140021a75
call fcn.140007940
mov qword [rbp - 0x68], rdi
lea rcx, str.Service_installed_successfully
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], 0x1e
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
movaps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rbp - 0x70]
movaps xmmword [rbp - 0x40], xmm1
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x30], xmm0
lea r9, [rbp + 0x90]
mov r8d, 2
lea rdx, [rbp - 0x40]
mov rcx, qword [rax + 0x1d8]
call fcn.1400053b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, str.uninstall
mov rcx, qword [r12 + 8]
call fcn.140034508
test eax, eax
jne 0x140021af0
call fcn.140022310
mov edi, eax
jmp 0x140021af0
movups xmm0, xmmword [str.AsusCertService]
movups xmmword [rbp + 0xf8], xmm0
movups xmm1, xmmword [0x140063098]
movups xmmword [rbp + 0x108], xmm1
lea rax, [rbp + 0xf8]
mov qword [rbp + 0xd8], rax
lea rax, [0x140021b50]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], rdi
mov qword [rbp + 0xf0], rdi
lea rcx, [rbp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov ecx, 1
test eax, eax
cmove edi, ecx
mov eax, edi
mov rcx, qword [rbp + 0x650]
xor rcx, rsp
call fcn.140026490
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.140027a3c
nop
call fcn.140034450
nop
call fcn.140034450
nop
mov ecx, eax
call fcn.140027a3c
nop
call fcn.140034450
int3