Function at 0x140070ac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
movaps xmmword [rsp + 0x360], xmm6
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rbp + 0x258], rax
mov ebx, r9d
mov r13, r8
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rbp + 0x1c0], rcx
mov qword [rbp + 0x248], r8
xor edx, edx
mov r8d, 0x1f0
call fcn.1400c5120
xor edi, edi
mov qword [r14 + 0x1f0], rdi
mov qword [r14 + 0x1f8], rdi
mov dword [r14 + 0x200], ebx
mov word [r14 + 0x204], di
mov byte [r14 + 0x207], dil
mov qword [r14 + 0x20c], rdi
mov rax, qword [rbp + 0x2d8]
mov qword [r14 + 0x218], rax
mov qword [r14 + 0x220], rdi
movzx eax, byte [rbp + 0x2e0]
mov byte [r14 + 0x228], al
mov byte [r14 + 0x229], 1
mov dword [r14 + 0x22c], edi
mov dword [r14 + 0x230], 1
mov byte [r14 + 0x234], dil
movups xmm0, xmmword [str.ASUSLinkRemote]
movups xmmword [r14 + 0x236], xmm0
movsd xmm1, qword [0x14012e748]
movsd qword [r14 + 0x246], xmm1
mov eax, dword [0x14012e750]
mov dword [r14 + 0x24e], eax
movzx eax, word [0x14012e754]
mov word [r14 + 0x252], ax
lea rcx, [r14 + 0x254]
xor edx, edx
mov r8d, 0x1ea
call fcn.1400c5120
movups xmm0, xmmword [str.AsusLinkCloudConnection.exe]
movups xmmword [r14 + 0x43e], xmm0
movups xmm1, xmmword [0x14012e768]
movups xmmword [r14 + 0x44e], xmm1
movups xmm0, xmmword [0x14012e778]
movups xmmword [r14 + 0x45e], xmm0
movsd xmm1, qword [0x14012e788]
movsd qword [r14 + 0x46e], xmm1
lea rcx, [r14 + 0x476]
xor edx, edx
mov r8d, 0x1d0
call fcn.1400c5120
lea rcx, [r14 + 0x648]
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
xor r8d, r8d
lea rdx, [0x14010bc34]
call fcn.140017c00
nop
lea rcx, [r14 + 0x670]
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
xor r8d, r8d
lea rdx, [0x14010bc34]
call fcn.140017c00
nop
lea rcx, [r14 + 0x690]
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
lea r8d, [rdi + 5]
lea rdx, str.en_US
call fcn.140017c00
nop
lea rcx, [r14 + 0x6b0]
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
lea r8d, [rdi + 2]
lea rdx, [0x14011d974]
call fcn.140017c00
nop
mov qword [r14 + 0x6d0], rdi
mov dword [r14 + 0x6d8], edi
mov qword [r14 + 0x6e0], rdi
mov qword [r14 + 0x6e8], rdi
mov qword [r14 + 0x6f0], rdi
movups xmm0, xmmword [str..pipeAsusLinkCloudPipe]
movups xmmword [r14 + 0x6f8], xmm0
movups xmm1, xmmword [0x14012e7a0]
movups xmmword [r14 + 0x708], xmm1
movups xmm0, xmmword [0x14012e7b0]
movups xmmword [r14 + 0x718], xmm0
mov eax, dword [0x14012e7c0]
mov dword [r14 + 0x728], eax
movzx eax, word [0x14012e7c4]
mov word [r14 + 0x72c], ax
lea rcx, [r14 + 0x72e]
xor edx, edx
mov r8d, 0x1d2
call fcn.1400c5120
mov qword [r14 + 0x900], 0xffffffffffffffff
mov qword [r14 + 0x908], 0xffffffffffffffff
mov qword [r14 + 0x910], rdi
mov word [r14 + 0x918], 1
mov qword [r14 + 0x920], rdi
mov byte [r14 + 0x928], dil
mov qword [r14 + 0x930], rdi
mov qword [r14 + 0x938], rdi
mov qword [r14 + 0x940], rdi
mov qword [r14 + 0x948], rdi
mov qword [r14 + 0x950], rdi
mov qword [r14 + 0x958], rdi
mov qword [r14 + 0x960], rdi
mov qword [r14 + 0x968], rdi
mov byte [r14 + 0x970], dil
mov dword [r14 + 0x990], edi
lea rcx, [r14 + 0x994]
xor edx, edx
mov r8d, 0x14c
call fcn.1400c5120
mov qword [r14 + 0xae0], rdi
xorps xmm0, xmm0
movups xmmword [r14 + 0xae8], xmm0
movups xmmword [r14 + 0xaf8], xmm0
movups xmmword [r14 + 0xb08], xmm0
mov qword [r14 + 0xb18], rdi
lea rcx, [r14 + 0xb20]
xor edx, edx
mov r8d, 0xc3
call fcn.1400c5120
mov dword [r14 + 0xbe8], edi
lea rcx, [r14 + 0xbec]
xor edx, edx
mov r8d, 0xdc
call fcn.1400c5120
mov qword [r14 + 0xcc8], rdi
xorps xmm0, xmm0
movups xmmword [r14 + 0xcd0], xmm0
movups xmmword [r14 + 0xce0], xmm0
movups xmmword [r14 + 0xcf0], xmm0
mov qword [r14 + 0xd00], rdi
xor eax, eax
movups xmmword [r14 + 0xd08], xmm0
movups xmmword [r14 + 0xd18], xmm0
movups xmmword [r14 + 0xd28], xmm0
movups xmmword [r14 + 0xd38], xmm0
movups xmmword [r14 + 0xd48], xmm0
movups xmmword [r14 + 0xd58], xmm0
mov qword [r14 + 0xd68], rax
mov dword [r14 + 0xd70], eax
mov word [r14 + 0xd74], ax
mov byte [r14 + 0xd76], al
mov eax, dword [rbp + 0x2d0]
mov dword [r14 + 0xe98], eax
mov dword [r14 + 0xe9c], edi
mov dword [r14 + 0xea0], 0xffffffff
mov eax, 0x1234
mov word [r14 + 0xea4], ax
lea rcx, [r14 + 0xea8]
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
xor r8d, r8d
lea rdx, [0x14010bc34]
call fcn.140017c00
nop
mov word [r14 + 0xec8], di
mov byte [r14 + 0xeca], dil
mov qword [r14 + 0xed0], rdi
mov qword [r14 + 0xed8], rdi
mov qword [r14 + 0xee0], rdi
mov qword [r14 + 0xee8], rdi
mov byte [rbp - 0x80], dil
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], di
lea r8d, [rdi + 0x11]
lea rdx, str._ltm_filetransfer
lea rcx, [rbp - 0x78]
call fcn.140017c00
nop
mov byte [rbp - 0x58], 1
mov qword [rbp - 0x50], rdi
movdqa xmm0, xmmword [0x14014b780]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], di
lea r8d, [rdi + 0xb]
lea rdx, str._ltm_mirror
lea rcx, [rbp - 0x50]
call fcn.140017c00
nop
mov byte [rbp - 0x30], 2
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], di
lea r8d, [rdi + 0xd]
lea rdx, str._ltm_extender
lea rcx, [rbp - 0x28]
call fcn.140017c00
nop
mov byte [rbp - 8], 3
mov qword [rbp], rdi
movdqa xmm0, xmmword [0x14014b780]
movdqa xmmword [rbp + 0x10], xmm0
mov word [rbp], di
lea r8d, [rdi + 0xa]
lea rdx, str._ltm_share
lea rcx, [rbp]
call fcn.140017c00
nop
mov byte [rbp + 0x20], 4
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], di
lea r8d, [rdi + 0xe]
lea rdx, str._ltm_sharedcam
lea rcx, [rbp + 0x28]
call fcn.140017c00
nop
lea r15, [r14 + 0xef0]
mov qword [rsp + 0x30], r15
mov qword [r15], rdi
mov qword [r15 + 8], rdi
lfence
lea ecx, [rdi + 0x48]
call fcn.1400c2704
mov r12, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r15], rax
lea rsi, [rbp - 0x80]
movabs rbx, 0x38e38e38e38e38e
nop
mov r9, rsi
mov r8, r12
lea rdx, [rbp + 0x210]
mov rcx, r15
call fcn.14004de00
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x70], xmm0
cmp byte [rsp + 0x70], 0
jne 0x140071104
cmp qword [r15 + 8], rbx
je 0x140071756
mov rdi, qword [r15]
mov qword [rsp + 0x40], r15
xor eax, eax
mov qword [rsp + 0x48], rax
lfence
lea ecx, [rax + 0x48]
call fcn.1400c2704
mov rbx, rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsi]
mov byte [rbx + 0x20], al
lea rdx, [rsi + 8]
lea rcx, [rbx + 0x28]
call fcn.140013730
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
xor edi, edi
mov qword [rsp + 0x48], rdi
movaps xmmword [rbp + 0x1d0], xmm6
mov r8, rbx
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call fcn.140027790
movabs rbx, 0x38e38e38e38e38e
add rsi, 0x28
lea rax, [rbp + 0x48]
cmp rsi, rax
jne 0x140071060
lea r9, [0x14002d970]
mov edx, 0x28
lea r8d, [rdx - 0x23]
lea rcx, [rbp - 0x80]
call fcn.1400c29e8
mov dword [rbp + 0x50], edi
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], 7
mov word [rbp + 0x58], di
mov r8d, 4
lea rdx, str.port
lea rcx, [rbp + 0x58]
call fcn.140017c00
nop
mov dword [rbp + 0x78], 1
mov qword [rbp + 0x80], rdi
movdqa xmm0, xmmword [0x14014b780]
movdqa xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], di
mov r8d, 8
lea rdx, [0x14012e870]
lea rcx, [rbp + 0x80]
call fcn.140017c00
nop
mov dword [rbp + 0xa0], 2
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xc0], 7
mov word [rbp + 0xa8], di
mov r8d, 7
lea rdx, [0x14012e888]
lea rcx, [rbp + 0xa8]
call fcn.140017c00
nop
mov dword [rbp + 0xc8], 3
mov qword [rbp + 0xd0], rdi
movdqa xmm0, xmmword [0x14014b780]
movdqa xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], di
mov r8d, 6
lea rdx, [0x14012e898]
lea rcx, [rbp + 0xd0]
call fcn.140017c00
nop
mov dword [rbp + 0xf0], 6
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], di
mov r8d, 0xa
lea rdx, [0x14012e8a8]
lea rcx, [rbp + 0xf8]
call fcn.140017c00
nop
mov dword [rbp + 0x118], 4
mov qword [rbp + 0x120], rdi
movdqa xmm0, xmmword [0x14014b780]
movdqa xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], di
mov r8d, socket
lea rdx, str.nearServiceVersion
lea rcx, [rbp + 0x120]
call fcn.140017c00
nop
mov dword [rbp + 0x140], 5
mov qword [rbp + 0x148], rdi
mov qword [rbp + 0x158], rdi
mov qword [rbp + 0x160], 7
mov word [rbp + 0x148], di
mov r8d, 4
lea rdx, str.date
lea rcx, [rbp + 0x148]
call fcn.140017c00
nop
mov dword [rbp + 0x168], 7
mov qword [rbp + 0x170], rdi
movdqa xmm0, xmmword [0x14014b780]
movdqa xmmword [rbp + 0x180], xmm0
mov word [rbp + 0x170], di
mov r8d, 0xa
lea rdx, [0x14012e8f8]
lea rcx, [rbp + 0x170]
call fcn.140017c00
nop
mov dword [rbp + 0x190], 8
mov qword [rbp + 0x198], rdi
mov qword [rbp + 0x1a8], rdi
mov qword [rbp + 0x1b0], 7
mov word [rbp + 0x198], di
mov r8d, 4
lea rdx, [0x14012e910]
lea rcx, [rbp + 0x198]
call fcn.140017c00
nop
lea r15, [r14 + 0xf00]
mov qword [rsp + 0x30], r15
mov qword [r15], rdi
mov qword [r15 + 8], rdi
lfence
mov ecx, 0x48
call fcn.1400c2704
mov r12, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r15], rax
lea rbx, [rbp + 0x50]
nop dword [rax]
mov r9, rbx
mov r8, r12
lea rdx, [rbp + 0x228]
mov rcx, r15
call fcn.140084fa0
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x70], xmm0
cmp byte [rsp + 0x70], 0
jne 0x140071455
movabs rax, 0x38e38e38e38e38e
cmp qword [r15 + 8], rax
je 0x14007174a
mov rsi, qword [r15]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
lfence
mov ecx, 0x48
call fcn.1400c2704
mov rdi, rax
mov qword [rsp + 0x58], rax
mov eax, dword [rbx]
mov dword [rdi + 0x20], eax
lea rdx, [rbx + 8]
lea rcx, [rdi + 0x28]
call fcn.140013730
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov word [rdi + 0x18], 0
xor eax, eax
mov qword [rsp + 0x58], rax
movaps xmmword [rbp + 0x1e0], xmm6
mov r8, rdi
lea rdx, [rbp + 0x1e0]
mov rcx, r15
call fcn.140027790
xor edi, edi
add rbx, 0x28
lea rax, [rbp + 0x1b8]
cmp rbx, rax
jne 0x1400713b0
lea r9, [0x14002d970]
mov edx, 0x28
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x50]
call fcn.1400c29e8
mov qword [r14 + 0xf10], 0xffffffffffffffff
mov qword [r14 + 0xf18], 0xffffffffffffffff
mov qword [r14 + 0xf20], 0xffffffffffffffff
mov qword [r14 + 0xf28], 0xffffffffffffffff
mov qword [r14 + 0xf30], 0xffffffffffffffff
mov qword [r14 + 0xf38], 0xffffffffffffffff
mov qword [r14 + 0xf40], 0xffffffffffffffff
mov qword [r14 + 0xf50], rdi
mov qword [r14 + 0xf58], rdi
mov qword [r14 + 0xf60], rdi
mov qword [r14 + 0xf68], rdi
mov qword [r14 + 0xf90], rdi
mov qword [r14 + 0xf98], 0xffffffffffffffff
mov rdx, r13
lea rcx, [rbp + 0x1f0]
call fcn.140013730
mov rdx, rax
mov rcx, r14
call fcn.140077190
mov qword [rbp + 0x240], rdi
mov dword [rbp + 0x250], 4
mov dword [rbp + 0x254], 4
mov byte [r14 + 0x206], 0
mov word [r14 + 0x208], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14007157d
movzx eax, byte [rcx + 0x79]
mov byte [r14 + 0x231], al
movzx eax, byte [rcx + 0x7e]
mov byte [r14 + 0x232], al
movzx eax, byte [rcx + 0x80]
mov byte [r14 + 0x233], al
movzx eax, byte [rcx + 0x7d]
mov byte [r14 + 0x234], al
lea rdi, [r14 + 0x20c]
xor esi, esi
mov dword [rdi], esi
lea rbx, [r14 + 0x210]
mov dword [rbx], esi
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREASUSAsusSync
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400716b9
lea rax, [rbp + 0x250]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x254]
xor r8d, r8d
lea rdx, str.mDNSLogType
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x140071606
lea edx, [rsi + 1]
lea rcx, str._AsusSync_MdnsMgr__UpdateDebugStringConfig__REG_MDNS_PATH__RegQueryValueEx_fail:0x_X
call fcn.140095ab0
jmp 0x14007163a
mov edx, dword [rdi]
lea rcx, str._AsusSync_MdnsMgr__UpdateDebugStringConfig__REG_MDNS_PATH__Debug_setting:0x_X_n
call fcn.140095ab0
mov eax, dword [rdi]
test al, 1
je 0x140071622
mov byte [r14 + 0x206], 1
test al, 2
je 0x14007162e
mov byte [r14 + 0x208], 1
test al, 4
je 0x14007163a
mov byte [r14 + 0x209], 1
lea rax, [rbp + 0x250]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x254]
xor r8d, r8d
lea rdx, str.AgingTestSetting
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edx, esi
test eax, eax
setne dl
test eax, eax
je 0x14007168f
lea rcx, str._AsusSync_MdnsMgr__UpdateDebugStringConfig__REG_AGING_SETTING__RegQueryValueEx_fail:0x_X
call fcn.140095ab0
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1400716c8
mov edx, dword [rbx]
lea rcx, str._AsusSync_MdnsMgr__UpdateDebugStringConfig__REG_AGING_SETTING__Debug_setting:0x_X_n
call fcn.140095ab0
test byte [rbx], 1
je 0x1400716aa
mov byte [r14 + 0x207], 1
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1400716c8
mov edx, eax
lea rcx, str._AsusSync_MdnsMgr__UpdateDebugStringConfig___RegOpenKeyEx_fail:0x_X
call fcn.140095ab0
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 8
jb 0x140071704
lea rdx, [rdx*2 + 2]
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x1400716ff
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140071750
mov rcx, r8
call fcn.1400c2470
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], 7
mov word [r13], si
mov rax, r14
mov rcx, qword [rbp + 0x258]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x3b8]
movaps xmm6, xmmword [rsp + 0x360]
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140017f00
nop
call fcn.1400c8b64
nop
call fcn.140017f00
int3