Function at 0x439f20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rdi, rcx
xor esi, esi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], si
xor r8d, r8d
lea rdx, [0x004b993c]
lea rcx, [rbp + 0x40]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea edx, [rsi + 0x7c]
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceCommandHandler.cpp
call fcn.004036d0
lea r14, [0x004c1550]
lea rdx, [r14 + rax*2]
lea r9, str._CheckGiftBoxAgent__In
lea ecx, [rsi + 4]
mov r8d, 0x294
call fcn.0044a600
mov rcx, rdi
call fcn.004387d0
mov edx, dword [rdi + 0x14]
call fcn.00437df0
lea edx, [rsi + 0x7c]
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceCommandHandler.cpp
call fcn.004036d0
lea rdx, [r14 + rax*2]
lea r9, str._CheckGiftBoxAgent__Clear_the_agent_ticket_recorder_
lea ecx, [rsi + 4]
mov r8d, 0x2a0
call fcn.0044a600
mov rcx, rdi
call fcn.0043a710
call fcn.004377a0
mov rbx, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xf0]
call fcn.004a2370
cmp qword [rbx + 0x30], rsi
je 0x43a015
lea rdx, [rbx + 0x20]
jmp 0x43a0ed
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0xf0]
call fcn.004a2244
test rax, rax
je 0x43a04d
mov word [rax + 2], si
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], 7
lea rax, [rbp + 0xf0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x43a070
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x48]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
add rbx, 0x20
lea rax, [rbp - 0x48]
cmp rbx, rax
je 0x43a0a7
xor r8d, r8d
lea rdx, [rbp - 0x48]
mov rcx, rbx
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Move_assign_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64__struct_std::integral_constant_bool__1_____ptr64
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x43a0ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a0e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a0e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov rdx, rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x58]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
mov r9d, 1
lea r8, [0x004c0c30]
xor edx, edx
lea rcx, [rsp + 0x58]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::insert_unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov r8d, 0x1c
lea rdx, str.AsusSoftwareManagerAgent.exe
lea rcx, [rbp - 0x68]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov r8d, 1
lea rdx, [0x004c0c30]
lea rcx, [rsp + 0x78]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x40]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Move_assign_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64__struct_std::integral_constant_bool__1_____ptr64
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x43a215
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a20f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a20f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x43a259
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a254
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], si
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x43a2ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a2a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a2a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], si
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x43a302
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a2fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a2fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
lea r8, [rdi + 0x18]
mov rcx, qword [r8 + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 8
jb 0x43a6fe
lfence
mov rax, r8
cmp qword [r8 + 0x18], 8
jb 0x43a331
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 8
lea r9, str._Start__
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x18]
call sym.AsusSoftwareManager.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov r8d, 1
lea rdx, [0x004c0c30]
lea rcx, [rbp + 0x18]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 8]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x40]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x43a400
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a3fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a3fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x43a443
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a43e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a43e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rbx, qword [rbp + 0x40]
mov edx, 0x7c
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceCommandHandler.cpp
call fcn.004036d0
lea rdx, [r14 + rax*2]
mov qword [rsp + 0x20], rbx
lea r9, str._CommandHandler::CheckGiftBoxAgent___s
mov ecx, 4
mov r8d, 0x2a9
call fcn.0044a600
mov dword [rbp + 0x38], esi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ProcessIdToSessionId]
test eax, eax
je 0x43a512
cmp dword [rbp + 0x38], 0
jne 0x43a512
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r8, qword [rbp + 0x40]
call fcn.0043c1c0
mov ebx, eax
mov edx, 0x7c
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceCommandHandler.cpp
test eax, eax
jne 0x43a4e9
call fcn.004036d0
lea rdx, [r14 + rax*2]
lea r9, str._CheckGiftBoxAgent__Create_user_agent_failed_
lea ecx, [rbx + 4]
mov r8d, 0x2b5
call fcn.0044a600
jmp 0x43a667
call fcn.004036d0
lea rdx, [r14 + rax*2]
mov dword [rsp + 0x20], ebx
lea r9, str._CheckGiftBoxAgent__Create_user_agent_pid__
mov ecx, 4
mov r8d, 0x2b7
call fcn.0044a600
jmp 0x43a667
lea rbx, [rdi + 0x140]
cmp dword [rdi + 0x150], 0
je 0x43a538
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rdi + 0x148]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x84], xmm1
movups xmmword [rbp + 0x94], xmm1
movups xmmword [rbp + 0xa4], xmm1
movups xmmword [rbp + 0xb4], xmm1
movups xmmword [rbp + 0xc4], xmm1
movups xmmword [rbp + 0xd4], xmm1
mov dword [rbp + 0xe4], eax
mov dword [rbp + 0x80], 0x68
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x43a667
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov edx, eax
lea rcx, [rbp + 0x60]
call fcn.0042dc10
nop
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rbx, qword [rbp + 0x60]
mov edx, 0x7c
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceCommandHandler.cpp
call fcn.004036d0
lea rdx, [r14 + rax*2]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
lea r9, str._CheckGiftBoxAgent__Create_debug_agent_failed__d___s__
mov ecx, 4
mov r8d, 0x2da
call fcn.0044a600
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x43a667
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a662
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov edx, 0x7c
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceCommandHandler.cpp
call fcn.004036d0
lea rdx, [r14 + rax*2]
lea r9, str._CheckGiftBoxAgent__Out_
mov ecx, 4
mov r8d, 0x2dd
call fcn.0044a600
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x43a6d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x43a6d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x43a6d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.004038b0
nop
int3