Function at 0x140004000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x688
mov rax, qword [0x140030f30]
xor rax, rsp
mov qword [rsp + 0x670], rax
cmp qword [0x1400371c8], 0
jne 0x140004297
mov qword [r11 + 8], rbx
mov qword [r11 - 8], rdi
lea rcx, [rsp + 0x42]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.140014ae0
lea rax, [rsp + 0x30]
lea r9d, [rdi + 1]
lea rdx, str.SOFTWAREASUSASUS_Smart_Gesture
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov ebx, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x3c], 0x208
mov dword [rsp + 0x38], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x3c]
lea rax, [rsp + 0x460]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x38]
lea rdx, str.InstalledDir
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400040d6
lea r8, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140013628
lea ebx, [rdi + 1]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000418b
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREASUSASUS_Touch_Pad
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, edi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 0x208
mov dword [rsp + 0x3c], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
lea rax, [rsp + 0x460]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], r11
lea rdx, str.InstalledDir
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004178
lea r8, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140013628
mov ebx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140004293
lea rcx, [rsp + 0x252]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x250], di
call fcn.140014ae0
lea r11, str.AsTPCenterx64AsusTPApi.dll
lea r9, [rsp + 0x40]
lea r8, str._s_s
lea rcx, [rsp + 0x250]
mov edx, 0x104
mov qword [rsp + 0x20], r11
call fcn.140013410
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1400371c8], rax
test rax, rax
je 0x140004293
lea rdx, str.ATPDLL_GetTPStatus
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400371c8]
lea rdx, str.ATPDLL_SetTPStatus
mov qword [0x1400371d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400371c8]
lea rdx, str.ATPDLL_AsusTPHwInit
mov qword [0x1400371d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400371c8]
lea rdx, str.ATPDLL_AsusTPHwDeInit
mov qword [0x1400371e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400371e8], rax
mov rax, qword [0x1400371e0]
test rax, rax
je 0x140004266
call rax
mov eax, 1
mov rbx, qword [rsp + 0x690]
mov rdi, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1400133f0
add rsp, 0x688
ret
xor eax, eax
jmp 0x14000426b
mov eax, 1
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1400133f0
add rsp, 0x688
ret