Function at 0x473c10
Capabilities:
Create thread
Get file version info
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov rsi, rdx
mov r15d, ecx
xor r12d, r12d
mov r14d, r12d
mov r8d, 0x104
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea r13d, [r12 + 1]
test eax, eax
je 0x473d17
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
mov dword [rsp + 0x50], eax
test eax, eax
jle 0x473d17
movsxd rcx, eax
call fcn.00479588
mov rbx, rax
mov r9, rax
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x6c]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
test eax, eax
je 0x473d0f
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [0x004ba928]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x473d0f
mov rcx, qword [rsp + 0x58]
movzx eax, word [rcx + 0xa]
mov word [0x005030e8], ax
movzx eax, word [rcx + 8]
mov word [0x005030ea], ax
movzx eax, word [rcx + 0xe]
mov word [0x005030ec], ax
movzx eax, word [rcx + 0xc]
mov word [0x005030ee], ax
mov rcx, rbx
call fcn.00479330
mov edi, r13d
jmp 0x473d1a
mov rcx, rbx
call fcn.00479330
mov edi, r12d
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
movzx ecx, word [0x005030ee]
movzx r8d, word [0x005030ec]
movzx r9d, word [0x005030ea]
movzx r10d, word [0x005030e8]
lea rdx, [0x004d16f0]
lea rdx, [rdx + rax*2]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r10d
lea r9, str.ASUS_SoftwareManager_service_start____d._d._d._d___d_._n
mov ecx, 4
mov r8d, 0x221
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
movzx ecx, word [0x005030ee]
movzx r10d, word [0x005030ec]
movzx r11d, word [0x005030ea]
movzx ebx, word [0x005030e8]
lea rdx, [0x004d16f0]
lea rdx, [rdx + rax*2]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
lea r9, str.ASUS_SoftwareManager_service_start____d._d._d._d___d_._n
mov ecx, 4
mov r8d, 0x221
call fcn.0044b390
call fcn.00431f60
lea rax, str.ASUSLiveUpdateAgent
lea rdx, str.ASUSSoftwareManager
cmp byte [0x005022c7], r12b
cmovne rdx, rax
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x473e15
lea rdi, [0x004fb730]
mov rcx, rdi
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rcx, str.wldp.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x473e8d
mov dword [rsp + 0x68], 2
lea rdx, str.WldpQueryWindowsLockdownMode
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
je 0x473e84
lea rcx, [rsp + 0x68]
call rax
test eax, eax
jne 0x473e84
mov eax, dword [rsp + 0x68]
dec eax
mov ecx, dword [0x005028cc]
cmp eax, r13d
cmovbe ecx, r13d
mov dword [0x005028cc], ecx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
call fcn.00424070
mov ebx, 0xfffd
cmp r15d, 2
jle 0x473ec7
mov rdx, qword [rsi + 0x10]
movzx eax, word [rdx]
sub ax, 0x2d
test bx, ax
jne 0x473ed0
add rdx, 2
lea rcx, str.nosec
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x473ed0
mov r14d, r13d
jmp 0x473ed0
cmp r15d, r13d
jle 0x473ffa
mov rdx, qword [rsi + 8]
movzx eax, word [rdx]
sub ax, 0x2d
test bx, ax
jne 0x473ffa
add rdx, 2
lea rcx, str.install
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x473f16
cmp qword [0x004fb748], 8
cmovae rdi, qword [0x004fb730]
mov rcx, rdi
call fcn.00475850
jmp 0x474334
mov rdx, qword [rsi + 8]
add rdx, 2
lea rcx, str.remove
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x473f4c
cmp qword [0x004fb748], 8
cmovae rdi, qword [0x004fb730]
mov rcx, rdi
call fcn.00475c70
jmp 0x474334
mov rdx, qword [rsi + 8]
add rdx, 2
lea rcx, str.debug
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x474334
mov eax, dword [0x00503140]
test r14d, r14d
cmovne eax, r13d
mov dword [0x00503140], eax
cmp dword [0x005028cc], r12d
je 0x473ff0
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rbx, [0x004d16f0]
lea rdx, [rbx + rax*2]
lea r9, str.Cant_support_S_Mode_n
mov r8d, 0x261
mov ecx, r13d
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rdx, [rbx + rax*2]
lea r9, str.Cant_support_S_Mode_n
mov r8d, 0x261
mov ecx, r13d
call fcn.0044b390
mov eax, 0xffffffff
jmp 0x474336
call fcn.004749e0
jmp 0x474334
mov dword [rsp + 0x74], r12d
mov dword [rsp + 0x70], r12d
cmp dword [0x005028cc], r12d
je 0x474075
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea r15, [0x004d16f0]
lea rdx, [r15 + rax*2]
lea r9, str.Remove_Update_checker_n
mov r8d, 0x26f
mov ecx, r13d
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rdx, [r15 + rax*2]
lea r9, str.Remove_Update_checker_n
mov r8d, 0x26f
mov ecx, r13d
call fcn.0044b390
call fcn.004722b0
jmp 0x47407c
lea r15, [0x004d16f0]
mov rcx, rdi
cmp qword [0x004fb748], 8
cmovae rcx, qword [0x004fb730]
call fcn.00472880
mov rbx, rdi
cmp qword [0x004fb748], 8
cmovae rbx, qword [0x004fb730]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x47419e
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x474195
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.004a2370
mov r8d, 0x104
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x470]
call fcn.004a2370
lea r9, [rbp + 0x260]
lea r8, str.__s__129
mov edx, 0x104
lea rcx, [rbp + 0x470]
call fcn.00429370
lea rax, [rbp + 0x470]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x60]
mov edx, r13d
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
mov ebx, eax
mov edx, 0x79
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rdx, [r15 + rax*2]
mov dword [rsp + 0x20], ebx
lea r9, str.ChangeServiceConfig2_Description___d
mov ecx, 4
mov r8d, 0x15e
call fcn.0044a600
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
call fcn.00472b60
call fcn.00473350
cmp dword [0x005028cc], r12d
jne 0x4741d6
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x74]
lea r8, [0x00472030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
xor edx, edx
mov r8d, 0xa8
lea rcx, [rbp - 0x80]
call fcn.004a2370
cmp qword [0x004fb748], 8
cmovae rdi, qword [0x004fb730]
lea rax, [0x004b993c]
test rdi, rdi
cmove rdi, rax
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [rbp - 0x6c], 2
mov qword [rbp - 0x68], 0xc5
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x58], r12d
lea rax, vtable.CGiftBoxService.0
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.api_ms_win_power_base_l1_1_0.dll_GetPwrCapabilities]
nop
lea rax, [rbp - 0x80]
mov qword [0x00503148], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp + 0x30], rax
lea rax, [0x00475110]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x474325
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.Service_failed_to_run_w_err_0x_08lx_n
call fcn.00442ff0
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
mov rbx, rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, [r15 + rbx*2]
mov dword [rsp + 0x20], eax
lea r9, str.Exit:_Service_failed_to_run_w_err_0x_08lx_n
mov r8d, 0x281
mov ecx, r13d
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
mov rbx, rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, [r15 + rbx*2]
mov dword [rsp + 0x20], eax
lea r9, str.Exit:_Service_failed_to_run_w_err_0x_08lx_n
mov r8d, 0x281
mov ecx, r13d
call fcn.0044b390
call fcn.00460eb0
nop
lea rcx, [rbp - 0x80]
call fcn.0043f380
xor eax, eax
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret