Function at 0x472b60
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov qword [r11 - 0xd0], rbx
mov qword [r11 - 0xc0], rbx
mov qword [r11 - 0xb8], 7
mov word [rsp + 0x1f8], bx
xor r8d, r8d
lea rdx, [0x004b993c]
lea rcx, [r11 - 0xd0]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea edx, [rbx + 0x79]
call fcn.004750e0
lea rsi, [0x004d16f0]
lea rdx, [rsi + rax*2]
lea r15, str.SelfUpdatePostProcessing
mov qword [rsp + 0x20], r15
lea r9, str._s_In
lea ecx, [rbx + 1]
mov r8d, 0x1ab
call fcn.0044b390
nop
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], rbx
lea rdx, [0x004fb7b0]
lea rcx, [rsp + 0x1d8]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
xor ecx, ecx
call fcn.00428c60
nop
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
lea r8d, [rbx + 0xe]
lea rdx, str.IsSelfUpdating
lea rcx, [rsp + 0x48]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov dword [rsp + 0x1d0], ebx
mov dword [rsp + 0x1c8], 4
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea rdx, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 8
cmovae rdx, qword [rsp + 0x1d8]
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x47331c
mov edi, dword [rsp + 0x1d0]
mov dword [rsp + 0x40], edi
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x472d29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x472d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x472d24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
lea rax, [rsp + 0x88]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], 7
mov r8d, SafeArrayGetDim
lea rdx, str.IsSelfUpdating
lea rcx, [rsp + 0x88]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbx
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0xa8]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0xa8]
call fcn.004580a0
nop
jmp 0x472dca
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], bx
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetLBound
lea rdx, str.SelfUpdateHistoryTS
lea rcx, [rsp + 0x68]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x1d8]
lea rcx, [rsp + 0xc8]
call fcn.00457840
lea rcx, [rsp + 0x1f8]
cmp rcx, rax
je 0x472e37
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Move_assign_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64__struct_std::integral_constant_bool__1_____ptr64
mov rdx, qword [rsp + 0xe0]
cmp rdx, 8
jb 0x472e82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x472e7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x472e7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], 7
mov word [rsp + 0xc8], bx
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x472ee6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x472ee1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x472ee1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], 7
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetLBound
lea rdx, str.SelfUpdateHistoryTS
lea rcx, [rsp + 0xe8]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], rbx
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x108]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0x108]
call fcn.004580a0
nop
jmp 0x472f87
lea rax, [rsp + 0x128]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x140], 7
mov r8d, 0xa
lea rdx, str.NeedReboot
lea rcx, [rsp + 0x128]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x160], rbx
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x148]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x148]
call fcn.004580a0
mov ecx, 0xa
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop
jmp 0x473033
mov edx, 0x79
call fcn.004750e0
lea rdx, [rsi + rax*2]
mov dword [rsp + 0x20], edi
lea r9, str.IsSelfUpdating:__d
mov ecx, 1
mov r8d, 0x1d1
call fcn.0044b390
lea r14, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 8
cmovae r14, qword [rsp + 0x1f8]
mov edx, 0x79
call fcn.004750e0
lea rdx, [rsi + rax*2]
mov qword [rsp + 0x20], r14
lea r9, str.SelfUpdateHistoryTS:__s
mov ecx, 1
mov r8d, 0x1d2
call fcn.0044b390
cmp edi, 1
jne 0x4730f2
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], 7
lea r8d, [rdi + 9]
lea rdx, str.NeedReboot
lea rcx, [rsp + 0x168]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov r9d, edi
lea r8, [rsp + 0x168]
lea rdx, [rsp + 0x1d8]
call fcn.00457660
nop
mov rdx, qword [rsp + 0x1f0]
cmp rdx, 8
jb 0x47313e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x473138
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x473138
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
nop
jmp 0x473154
mov rcx, qword [0x004fb700]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x1e
jb 0x473348
lfence
lea r9, [0x004fb6f0]
cmp qword [0x004fb708], 8
cmovae r9, qword [0x004fb6f0]
mov qword [rsp + 0x30], 0x1e
lea rax, str.ASUSSoftwareManagerSelfUpdate
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [0x004fb6f0]
movzx edx, byte [rsp + 0x44]
lea rcx, [rsp + 0x298]
call sym.AsusSoftwareManager.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rbx
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x188]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
lea rcx, [rsp + 0x188]
call fcn.004065e0
movzx ebx, al
mov edx, 0x79
call fcn.004750e0
lea rdx, [rsi + rax*2]
mov dword [rsp + 0x20], ebx
lea r9, str.Try_to_remove_old_selfupdate_folder__d_
mov ecx, 1
mov r8d, 0x1e2
call fcn.0044b390
mov edx, 0x79
call fcn.004750e0
lea rdx, [rsi + rax*2]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r15
lea r9, str._s_Out_dwRet0x_08x_
mov ecx, 1
mov r8d, 0x1e4
call fcn.0044b390
nop
mov rdx, qword [rsp + 0x2b0]
cmp rdx, 8
jb 0x4732a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x298]
mov rax, rcx
cmp rdx, 0x1000
jb 0x47329b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x47329b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
nop
mov rdx, qword [rsp + 0x210]
cmp rdx, 8
jb 0x4732ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4732e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4732e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov eax, edi
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
mov r8d, eax
lea rdx, str.Cannot_read_DWORD_from_registry.
lea rcx, [rsp + 0x1a8]
call fcn.00457540
lea rdx, [0x004e7a40]
lea rcx, [rsp + 0x1a8]
call fcn.004a2510
nop
call fcn.004038b0
int3