Function at 0x444cb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], di
lea r8d, [rdi + 9]
lea rdx, str.CdnResult
lea rcx, [rsp + 0x80]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea r8d, [rdi + 0x4e]
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSoftwareManagerAsusLiveUpdate
lea rcx, [rsp + 0x40]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov dword [rsp + 0x100], edi
mov dword [rsp + 0x110], 4
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x445120
mov eax, dword [rsp + 0x100]
mov dword [rbx], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x444e0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x444e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x444e09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x444e6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x444e67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x444e67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], 7
mov word [rsp + 0xa0], di
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetLBound
lea rdx, str.CdnResultRecordTime
lea rcx, [rsp + 0xa0]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
mov r8d, 0x4e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSoftwareManagerAsusLiveUpdate
lea rcx, [rsp + 0x60]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0x108], rdi
mov dword [rsp + 0x114], 8
lea r8, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae r8, qword [rsp + 0xa0]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x114]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov r9d, 0x40
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x44514c
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x444f98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x444f93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x444f93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x444ff6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x444ff1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x444ff1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rsi, rax
mov rbx, qword [rsp + 0x108]
cmp rax, rbx
jb 0x445024
mov rcx, rax
sub rcx, rbx
cmp rcx, 0x15180
jae 0x445024
xor al, al
jmp 0x4450ee
movzx eax, byte [0x004c59ee]
cmp al, 0x2f
je 0x445056
cmp al, 0x5c
je 0x445056
lfence
mov edx, 0x7d
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceLiveUpdateHelper.cpp
call fcn.004036d0
mov edi, 0x7f
mov rbx, qword [rsp + 0x108]
jmp 0x44505d
mov edi, 0x7f
mov eax, edi
lea r15, [0x004c5840]
lea rdx, [r15 + rax*2]
mov dword [rsp + 0x30], 0x15180
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.Record_time_is_expired._Record___llu___Now___lld___Expiry___ld__n
mov ecx, 1
mov r8d, 0x18b
call fcn.0044a600
movzx eax, byte [0x004c59ee]
cmp al, 0x2f
je 0x4450bf
cmp al, 0x5c
je 0x4450bf
lfence
mov edx, 0x7d
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceLiveUpdateHelper.cpp
call fcn.004036d0
mov rdi, rax
mov rbx, qword [rsp + 0x108]
lea rdx, [r15 + rdi*2]
mov dword [rsp + 0x30], 0x15180
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.Record_time_is_expired._Record___llu___Now___lld___Expiry___ld__n
mov ecx, 1
mov r8d, 0x18b
call fcn.0044b390
mov al, 1
mov byte [r14], al
mov al, 1
jmp 0x4450f7
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov r8d, eax
lea rdx, str.Cannot_read_DWORD_from_registry.
lea rcx, [rsp + 0xc0]
call fcn.00457540
lea rdx, [0x004e7a40]
lea rcx, [rsp + 0xc0]
call fcn.004a2510
nop
mov r8d, eax
lea rdx, str.Cannot_read_DWORD64_from_registry.
lea rcx, [rsp + 0xe0]
call fcn.00457540
lea rdx, [0x004e7a40]
lea rcx, [rsp + 0xe0]
call fcn.004a2510
int3