Function at 0x140019f50
Capabilities:
Check if file exists
Delete file
Move file
Timestomp file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x14010a010]
xor rax, rsp
mov qword [rbp + 0xb8], rax
mov r15, rdx
mov r12, rcx
mov qword [rbp - 0x78], rdx
mov edx, 0x5c
lea r13, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceLogSessionHelper.cpp
mov rcx, r13
call fcn.14008d088
test rax, rax
je 0x140019fb5
mov edx, 0x5c
mov rcx, r13
call fcn.14008d088
inc rax
jmp 0x140019fb8
mov rax, r13
lea r9, str.Start
lea r8, str.BackupEtlFile
mov edx, 0x13e
mov rcx, rax
call fcn.140015a30
add r12, 8
mov rcx, qword [r12 + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14001afd3
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x14001a002
mov r9, qword [r12]
mov qword [rsp + 0x30], 1
lea rax, [0x1400d9084]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r12
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x14001a03b
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea r8d, [rbx + 4]
lea rdx, str..etl
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001a0f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a0ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afd9
call fcn.140061000
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], bx
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001a142
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a13d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afdf
call fcn.140061000
mov qword [rbp], rbx
mov qword [rbp + 8], 7
mov word [rbp - 0x10], bx
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001a289
lea edx, [rax + 0x5c]
mov rcx, r13
call fcn.14008d088
test rax, rax
je 0x14001a18f
mov edx, 0x5c
mov rcx, r13
call fcn.14008d088
lea r13, [rax + 1]
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, str.File_not_exist__file_path___s
lea r8, str.BackupEtlFile
mov edx, 0x145
mov rcx, r13
call fcn.140015a30
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001a1fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14001a1f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b01b
call fcn.140061000
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14001a24d
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14001a248
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b021
mov rcx, r8
call fcn.140061000
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov word [r15], bx
xor eax, eax
mov rcx, qword [rbp + 0xb8]
xor rcx, rsp
call fcn.140060fe0
mov rbx, qword [rsp + 0x210]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x18]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x18]
call fcn.14001b040
test eax, eax
je 0x14001a1be
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rbp + 0x68]
shr rdx, 0x17
movabs rax, 0x2b6109100
sub rdx, rax
mov qword [rbp + 0x88], rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], eax
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x90]
call fcn.14009bdb0
test eax, eax
jne 0x14001a1be
mov dword [rbp + 0x10], 1
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], bx
xor r8d, r8d
mov edx, 0x104
lea rcx, [rbp - 0x30]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_unsigned_long_long_unsigned___int64___wchar_t____ptr64
nop
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
movzx esi, byte [rsp + 0x40]
mov r14, 0xffffffffffffffff
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
mov r8d, 0x104
call fcn.14008d590
mov r9, r15
cmp qword [r15 + 0x18], 8
jb 0x14001a380
mov r9, qword [r15]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov r8d, dword [rbp + 0xa0]
inc r8d
mov edx, dword [rbp + 0xa4]
add edx, 0x76c
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x9c]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], edx
lea r8, str._s__d__02d__02d__05d.etl
mov edx, 0x104
call fcn.140010240
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp], rax
mov qword [rbp + 8], 7
mov word [rbp - 0x10], ax
mov r8, r14
inc r8
cmp word [rdx + r8*2], ax
jne 0x14001a3f6
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rcx, qword [r12 + 0x10]
movabs r14, 0x7ffffffffffffffe
mov rax, r14
sub rax, rcx
cmp rax, 1
jb 0x14001afcd
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x14001a438
mov r9, qword [r12]
mov qword [rsp + 0x30], 1
lea rax, [0x1400d9084]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r12
movzx edx, bl
lea rcx, [rsp + 0x48]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x48]
movzx edx, dil
lea rcx, [rbp + 0x18]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64____ptr64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14001a4bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a4b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afeb
call fcn.140061000
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001a4fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a4f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b027
call fcn.140061000
mov rax, r14
mov rcx, qword [rbp + 0x28]
sub rax, rcx
cmp rax, 4
jb 0x14001afc1
lea r9, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae r9, qword [rbp + 0x18]
mov qword [rsp + 0x30], 4
lea rax, str..zip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x18]
movzx edx, sil
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete r14b
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete al
test r14b, r14b
je 0x14001a58a
test al, al
jne 0x14001a71a
mov r14d, dword [rbp + 0x10]
inc r14d
mov dword [rbp + 0x10], r14d
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001a5d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a5d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b027
call fcn.140061000
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], ax
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x14001a627
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a622
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b02d
call fcn.140061000
cmp r14d, 0x4e20
jl 0x14001a351
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001a674
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a66f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afe5
call fcn.140061000
xor ebx, ebx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], bx
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001a6c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a6c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b033
call fcn.140061000
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14001a24d
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14001a248
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001afc7
jmp 0x14001a245
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001a75a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b027
call fcn.140061000
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], bx
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x14001a7ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a7a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b02d
call fcn.140061000
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
mov qword [rbp + 8], 7
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x14001a7d1
mov r8, rax
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001a827
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a822
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b00f
call fcn.140061000
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rbp]
movups xmmword [rbp - 0x20], xmm1
mov rcx, qword [r12 + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 1
jb 0x14001aff1
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x14001a865
mov r9, qword [r12]
mov qword [rsp + 0x30], 1
lea rax, [0x1400d9084]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r12
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor r12d, r12d
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001a91a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aff7
call fcn.140061000
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r12w
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rdx, qword [rbp + 0x38]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov edx, 0x5c
mov rcx, r13
call fcn.14008d088
mov rcx, r13
test rax, rax
je 0x14001a975
mov edx, 0x5c
call fcn.14008d088
lea rcx, [rax + 1]
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rdx, qword [rbp + 0x38]
lea r8, [0x1400dade8]
lea r14, [0x1400dadf8]
mov rax, r14
test bl, bl
cmovne rax, r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, str.Backup_result___s__file_path___s
lea r8, str.BackupEtlFile
mov edx, 0x177
call fcn.140015a30
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001ae79
mov rax, qword [rbp + 0x48]
sub rdi, rax
cmp rdi, 4
jb 0x14001affd
lea r9, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae r9, qword [rbp + 0x38]
mov qword [rsp + 0x30], 4
lea rcx, str..zip
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x38]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x48], r12
movdqu xmmword [rsp + 0x58], xmm0
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x48]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov edx, 1
lea rcx, [rbp + 0x70]
call fcn.14001ca30
lea rax, [rbp + 0x70]
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov rbx, qword [rbp + 0x70]
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea rax, [rbp + 0x70]
mov qword [rbp - 0x60], rax
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
lea rdx, [rsp + 0x48]
mov rcx, rbx
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
add rbx, 0x20
mov rdx, rbx
mov rcx, rbx
call fcn.14001d1b0
mov qword [rbp + 0x78], rbx
lea r9, [sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x48]
call fcn.140061804
lea rax, [rbp + 0x18]
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r12
mov rdi, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x78]
cmp rdi, rsi
je 0x14001ab66
mov rdx, rsi
sub rdx, rdi
sar rdx, 5
lea rcx, [rbp + 0x18]
call fcn.14001ca30
lea rax, [rbp + 0x18]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov rbx, qword [rbp + 0x18]
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea rax, [rbp + 0x18]
mov qword [rbp - 0x60], rax
nop word [rax + rax]
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov rdx, rdi
mov rcx, rbx
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
add rbx, 0x20
mov qword [rbp - 0x68], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x14001ab30
mov rdx, rbx
mov rcx, rbx
call fcn.14001d1b0
mov qword [rbp + 0x20], rbx
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x68]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
mov esi, 4
mov rax, qword gs:[0x58]
add rsi, qword [rax]
mov eax, dword [rsi]
cmp dword [0x14010fc60], eax
jle 0x14001abcb
lea rcx, [0x14010fc60]
call fcn.1400611a0
cmp dword [0x14010fc60], 0xffffffff
jne 0x14001abcb
lea rcx, [0x1400c77a0]
call fcn.140061524
lea rcx, [0x14010fc60]
call fcn.140061140
nop
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x68]
call fcn.14005fd10
test eax, eax
setne bl
mov edx, 0x5c
mov rcx, r13
call fcn.14008d088
mov rcx, r13
test rax, rax
je 0x14001ac01
mov edx, 0x5c
call fcn.14008d088
lea rcx, [rax + 1]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov rax, r14
test bl, bl
lea rbx, [0x1400dade8]
cmovne rax, rbx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, str.Zip_result___s__file_path___s
lea r8, str.BackupEtlFile
mov edx, 0x17f
call fcn.140015a30
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x10], r12
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001acac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, r12d
jmp 0x14001acee
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne dil
lea rbx, [0x1400dade8]
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001ad2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ad29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b003
call fcn.140061000
mov edx, 0x5c
mov rcx, r13
call fcn.14008d088
mov rcx, r13
test rax, rax
je 0x14001ad51
mov edx, 0x5c
call fcn.14008d088
lea rcx, [rax + 1]
mov rax, r14
test dil, dil
cmovne rax, rbx
mov qword [rsp + 0x20], rax
lea r9, str.Update_zip_file_timestamp_result___s
lea r8, str.BackupEtlFile
mov edx, 0x183
call fcn.140015a30
lea rbx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rbx, qword [rbp - 0x10]
mov eax, dword [rsi]
cmp dword [0x14010fc60], eax
jle 0x14001adbd
lea rcx, [0x14010fc60]
call fcn.1400611a0
cmp dword [0x14010fc60], 0xffffffff
jne 0x14001adbd
lea rcx, [0x1400c77a0]
call fcn.140061524
lea rcx, [0x14010fc60]
call fcn.140061140
mov rdx, rbx
call fcn.1400600e0
test eax, eax
setne bl
mov edx, 0x5c
mov rcx, r13
call fcn.14008d088
test rax, rax
je 0x14001aded
mov edx, 0x5c
mov rcx, r13
call fcn.14008d088
lea r13, [rax + 1]
test bl, bl
lea rax, [0x1400dade8]
cmovne r14, rax
mov qword [rsp + 0x20], r14
lea r9, str.Enable_file_account_privilege_result___s
lea r8, str.BackupEtlFile
mov edx, 0x187
mov rcx, r13
call fcn.140015a30
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x70]
call fcn.14001c9c0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001ae79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ae74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b009
call fcn.140061000
movzx ebx, bl
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x14001aebc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aeb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b00f
call fcn.140061000
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r12w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001af0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001af08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b015
call fcn.140061000
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001af5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001af59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b01b
call fcn.140061000
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14001afaa
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14001afa5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b021
mov rcx, r8
call fcn.140061000
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
mov eax, ebx
jmp 0x14001a25f
call fcn.140001710
nop
call fcn.140091a84
nop
call fcn.140001710
nop
call fcn.140001710
nop
call fcn.140091a84
nop
call fcn.140091a84
int3
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140001710
nop
call fcn.140091a84
int3
call fcn.140001710
nop
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
int3