Function at 0x1400eb810
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov edi, r8d
mov rsi, rcx
cmp edx, 0x26001401
ja 0x1400e87af
je 0x1400e8754
add edx, 0xd9ffeeff
cmp edx, 5
ja case.0x1400e87d9.637599764
mov eax, edx
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0xe8cf8]
add rax, rdx
jmp rax
mov rdx, qword [rcx + 0x90]
test rdx, rdx
jne 0x1400e84f5
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_venderspecsetting.cpp
mov edx, 0x641
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
xor ebx, ebx
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdx, qword [rdx + 0x1bd8]
test rdx, rdx
je 0x1400e853b
mov rax, rdx
test rdx, rdx
je 0x1400e8cf2
mov rax, qword [rax + 0x10]
mov rdx, qword [rdx]
test rax, rax
je 0x1400e8536
cmp dword [rax + 0x168], 0
je 0x1400e8536
mov ecx, edi
test edi, edi
je 0x1400e85ad
sub ecx, 1
je 0x1400e8590
cmp ecx, 1
je 0x1400e8554
test rdx, rdx
jne 0x1400e8501
mov ebx, 1
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2300010f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1403db8b0]
xor ebx, ebx
test eax, eax
mov edx, 0x2300010f
sete bl
xor r9d, r9d
mov r10, qword [rcx]
mov r8d, ebx
call qword [r10 + 0x28]
mov ebx, eax
jmp 0x1400e8540
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
mov edx, 0x2300010f
mov rax, qword [rcx]
lea r8d, [r9 + 1]
call qword [rax + 0x28]
mov ebx, eax
jmp 0x1400e8540
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2300010f
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ebx, eax
jmp 0x1400e8540
cmp dword [0x1403dba84], 0
je 0x1400e85f0
lea rdx, str._2Finformation_2Fprivacy
lea rcx, [rsp + 0x40]
call fcn.140014bb0
xor edx, edx
mov rcx, rax
call fcn.140077fe0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp 0x1400eb810
mov rcx, qword [rcx - 0xa8]
mov edx, 0xa359
cmp edi, 1
jne 0x1400e8638
xor r9d, r9d
lea r8d, [rdi + 0x63]
call qword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.USER32.dll_KillTimer]
jmp case.0x1400e87d9.637599764
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
mov edx, 0x21010093
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsi - 0xa8]
mov edx, 0xa360
cmp edi, 1
jne 0x1400e8687
xor r9d, r9d
lea r8d, [rdi + 0x77]
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.USER32.dll_KillTimer]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000201
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400e86d8
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
mov r8d, edi
mov edx, 0x23000211
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000202
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400e8bfa
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
mov r8d, edi
mov edx, 0x23000212
mov rax, qword [rcx]
call qword [rax + 0x28]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [0x1403db8b0], 0
jne 0x1400e853b
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_venderspecsetting.cpp
mov edx, 0x6d5
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
xor ebx, ebx
jmp 0x1400e8540
mov rcx, qword [0x1403dba60]
xor ebx, ebx
mov dword [rsp + 0x78], edi
test rcx, rcx
je 0x1400e879b
mov edx, 4
mov dword [rsp + 0x40], ebx
lea rax, [rsp + 0x40]
mov r9d, edx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x78]
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x78]
mov edx, 0x300
mov qword [rsp + 0x20], rax
call fcn.14005e130
mov ebx, eax
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
add edx, 0xd9feffef
cmp edx, 0x65
ja case.0x1400e87d9.637599764
mov eax, edx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0xe8d50]
mov ecx, dword [rdx + rax*4 + 0xe8d10]
add rcx, rdx
jmp rcx
mov rax, qword [rsi + 0x90]
mov qword [rsp + 0x70], rbp
lea rbp, [rsi - 0xe8]
test byte [rax + 0x80], 1
je 0x1400e888d
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000211
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400e887a
mov rcx, rbp
call fcn.1400e9310
mov edx, 4
movzx esi, ax
mov ebx, eax
lea rcx, str.CVenderSpecSetting::GetAsusRogAmpLevelMode_nAmpLevlVal___x__nRearLevelMode___d__nFrontLevelMode___d
shr ebx, 0x10
cmp ebx, 2
cmova ebx, edx
cmp esi, 2
mov r9d, ebx
cmova esi, edx
mov edx, eax
mov r8d, esi
call fcn.140052e90
mov rcx, qword [0x1403db8b0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x21ff0309
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp eax, 3
je 0x1400e887c
mov r8d, ebx
mov edx, edi
mov rcx, rbp
mov esi, edi
call fcn.1400e92c0
jmp 0x1400e8897
mov esi, edi
mov ebx, edi
mov edx, esi
mov r8d, ebx
mov rcx, rbp
call fcn.1400e92c0
jmp 0x1400e8897
mov edx, edi
mov rcx, rbp
call fcn.1400e9460
mov edx, eax
mov ebx, eax
call fcn.1400e9110
mov rbp, qword [rsp + 0x70]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400e88f5
mov edx, edi
call fcn.140010a20
test eax, eax
je 0x1400e88f5
mov ebx, 1
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
xor ebx, ebx
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400e88f5
mov edx, edi
call fcn.140010a60
test eax, eax
je 0x1400e88f5
mov ebx, 1
jmp 0x1400e88f7
mov rsi, qword [rsi + 0xb8]
test rsi, rsi
je 0x1400e89f8
lea r8, str.AsusSoundStageFeatureBitsData
lea rdx, str.DevRestore
lea rcx, [0x1403dd120]
test edi, edi
je 0x1400e89b6
mov r9d, 0x11
call fcn.140102880
mov r9d, 2
lea r8, str.AsusSoundStageMasterVolume
lea rdx, str.DevRestore
mov ebx, eax
lea rcx, [0x1403dd120]
call fcn.140102880
movzx ecx, byte [rsi + 0x21]
shl cx, 8
movzx edx, cx
mov ecx, 0x26010056
movzx eax, al
or edx, eax
mov dword [rsi + 0x18], ebx
mov dword [rsi + 0x20], edx
call fcn.140025c30
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov r9d, dword [rsi + 0x18]
movzx ebx, byte [rsi + 0x20]
call fcn.140102e14
mov r9d, ebx
mov dword [rsi + 0x18], 0x11
lea r8, str.AsusSoundStageMasterVolume
lea rdx, str.DevRestore
lea rcx, [0x1403dd120]
call fcn.140102e14
movzx eax, byte [rsi + 0x21]
shl ax, 8
movzx ecx, ax
or ecx, 2
mov dword [rsi + 0x20], ecx
mov ecx, 0x26010056
call fcn.140025c30
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400e8a53
mov edx, edi
call fcn.140010b00
test eax, eax
je 0x1400e8a53
mov ecx, 0x26010050
mov ebx, 1
call fcn.140025c30
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor ebx, ebx
mov ecx, 0x26010050
call fcn.140025c30
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400e88f5
cmp dword [rdx], 0
jne 0x1400e8a99
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_asusacpi.cpp
mov edx, 0x274
jmp 0x1400e88e9
movzx eax, byte [rdx + 0x20]
movzx ecx, dil
shl cl, 4
xor ecx, eax
movzx eax, byte [rdx + 0x20]
and ecx, 0x70
xor ecx, eax
mov dword [rdx + 0x20], ecx
mov eax, dword [rdx + 0x18]
mov ebx, 1
and eax, 0xffffffee
or eax, 0x22
mov dword [rdx + 0x18], eax
jmp 0x1400e88f7
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400e88f5
cmp dword [rdx], 0
jne 0x1400e8aee
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_asusacpi.cpp
mov edx, 0x29f
jmp 0x1400e88e9
movzx ecx, byte [rdx + 0x24]
mov ebx, 1
movzx eax, dil
xor ecx, eax
movzx eax, byte [rdx + 0x24]
and ecx, 7
xor ecx, eax
mov eax, dword [rdx + 0x18]
and eax, 0xffffffee
mov dword [rdx + 0x24], ecx
or eax, 0x44
mov dword [rdx + 0x18], eax
jmp 0x1400e88f7
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400e88f5
cmp dword [rdx], 0
jne 0x1400e8b40
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_asusacpi.cpp
mov edx, 0x2b5
jmp 0x1400e88e9
movzx ecx, byte [rdx + 0x1c]
mov ebx, 1
movzx eax, dil
xor ecx, eax
movzx eax, byte [rdx + 0x1c]
and ecx, 7
xor ecx, eax
mov eax, dword [rdx + 0x18]
and eax, 0xffffffee
mov dword [rdx + 0x1c], ecx
or eax, 0x88
mov dword [rdx + 0x18], eax
jmp 0x1400e88f7
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400e88f5
cmp dword [rdx], 0
jne 0x1400e8b94
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_asusacpi.cpp
mov edx, 0x28a
jmp 0x1400e88e9
and dil, 0xf
movzx eax, dil
mov ecx, eax
shl ecx, 4
or ecx, eax
mov dword [rdx + 0x28], ecx
jmp 0x1400e8ab2
lea rcx, [rsi - 0xe8]
mov edx, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.1400ea660
lea rcx, [rsi - 0xe8]
mov edx, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.1400ea510
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400e8bfa
call fcn.140010c30
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [0x1403bee48]
xor ebx, ebx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x78], ebx
test eax, eax
jg 0x1400e8c5c
lea r8, str.c:userschunyung_source_repos_rtkngui_rtknguidriverpropertyclient.cpp
lea edx, [rbx + 0x61]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
xor edx, edx
mov ecx, 0x26010072
call fcn.140025be0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
movups xmm0, xmmword [0x140327e90]
movaps xmmword [rsp + 0x50], xmm0
test rax, rax
jle 0x1400e8cec
mov rcx, qword [0x1403bee40]
lea rax, [rsp + 0x78]
mov edx, 4
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
lea r9d, [rdx - 3]
lea r8d, [rdx + 0x2c]
lea rdx, [rsp + 0x50]
call fcn.14005d300
xor edx, edx
mov ecx, 0x26010072
mov ebx, eax
call fcn.140025be0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor ebx, ebx
lea r11, [rsp + 0x60]
test edi, edi
mov eax, 1
setne bl
mov dword [rsi + 0xac], ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400f5890
int3
call fcn.1400f5890
int3
push rbp
lea rbp, [rsp - 0x1fd0]
mov eax, 0x20d0
call fcn.140282780
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x20e0], rbx
mov qword [rsp + 0x20e8], rsi
mov qword [rsp + 0x20f0], rdi
mov qword [rsp + 0x20f8], r14
mov rax, qword [0x1403b88b0]
xor rax, rsp
mov qword [rbp + 0x1fc0], rax
call fcn.1400f5f94
mov rcx, rax
test rax, rax
je 0x1400eba07
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp - 0x40]
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400eb8a0
xor r14d, r14d
cmp word [rbp + rax*2 - 0x42], 0x5c
jne 0x1400eb8d0
lea rax, [rax*2 - 2]
cmp rax, 0x2000
jae 0x1400eba01
mov word [rbp + rax - 0x40], r14w
lea r8, [rbp - 0x40]
lea rdx, str._sHPGoogleAnalyticsPrivacyPolicy.htm
lea rcx, [rsp + 0x30]
call fcn.14000dd70
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
call fcn.1400f5f94
mov rcx, rax
test rax, rax
je 0x1400eba12
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rbx, str.HTML_FILE
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140014ab0
test al, al
jne 0x1400eb94b
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400eb930
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140010390
nop
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx - 0x18]
call fcn.140014810
add rax, 0x18
mov qword [rsp + 0x28], rax
mov r8d, 0x66
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140025e50
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1402841a0
mov dword [rsp + 0x50], VarBstrFromDisp
mov qword [rsp + 0x58], r14
lea rax, str.open
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov dword [rbp - 0x80], 3
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lock xadd dword [rbx - 8], esi
sub esi, 1
jg 0x1400eb9d0
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x1fc0]
xor rcx, rsp
call fcn.140281bf0
lea r11, [rsp + 0x20d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140281ffc
nop
mov ecx, 0x80004005
call fcn.14000dc70
nop
mov ecx, 0x80004005
call fcn.14000dc70
int3