Function at 0x1401f9510
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x540
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov r12, rcx
lea rcx, [rsp + 0x2e8]
call fcn.1401ff160
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x14034efb0]
lea rcx, [rsp + 0x2e8]
call fcn.14020cc00
mov r8, rax
xor r14d, r14d
mov qword [rsp + 0x268], r14
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x280], 7
mov word [rsp + 0x268], r14w
cmp qword [rsp + 0x2f8], rax
cmovb r8, qword [rsp + 0x2f8]
lea rdx, [rsp + 0x2e8]
cmp qword [rsp + 0x300], 8
cmovae rdx, qword [rsp + 0x2e8]
lea rcx, [rsp + 0x268]
call fcn.140101ff0
nop
movabs r13, 0x7ffffffffffffffe
mov rax, r13
mov rcx, qword [rsp + 0x278]
sub rax, rcx
cmp rax, 0x2c
jb 0x1401faf51
lea r15, [rsp + 0x268]
cmp qword [rsp + 0x280], 8
cmovae r15, qword [rsp + 0x268]
mov qword [rsp + 0x1e8], r14
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x200], r14
lea rsi, [rcx + 0x2c]
mov ebx, 7
lea rdi, [rsp + 0x1e8]
cmp rsi, rbx
jbe 0x1401f967a
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x1401f97b1
mov rbx, r13
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400eb1a0
mov rdi, rax
mov qword [rsp + 0x1e8], rax
mov rcx, qword [rsp + 0x278]
mov qword [rsp + 0x1f8], rsi
mov qword [rsp + 0x200], rbx
lea rbx, [rcx + rcx]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140253310
movaps xmm0, xmmword [str.ASUSSoftwareManagerAsusSoftwareManager.exe]
movups xmmword [rbx + rdi], xmm0
movaps xmm1, xmmword [0x1403667e0]
movups xmmword [rbx + rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1403667f0]
movups xmmword [rbx + rdi + 0x20], xmm0
movaps xmm1, xmmword [0x140366800]
movups xmmword [rbx + rdi + 0x30], xmm1
movaps xmm0, xmmword [0x140366810]
movups xmmword [rbx + rdi + 0x40], xmm0
movsd xmm1, qword [0x140366820]
movsd qword [rbx + rdi + 0x50], xmm1
mov word [rdi + rsi*2], r14w
lea rax, [rsp + 0x1e8]
cmp r12, rax
je 0x1401f9722
lea rdx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 8
cmovae rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x1f8]
mov rcx, r12
call fcn.140101ff0
nop
lea rcx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 8
cmovae rcx, qword [rsp + 0x1e8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401fad7c
mov qword [rsp + 0x208], r14
mov qword [rsp + 0x218], r14
mov qword [rsp + 0x220], 7
mov word [rsp + 0x208], r14w
mov r8d, 0x35
lea rdx, str.C:ProgramDataASUSASUS_System_Control_Interfacelog
lea rcx, [rsp + 0x208]
call fcn.140101ff0
nop
lea rcx, [rsp + 0x408]
call fcn.140202110
mov r12, rax
mov rax, r13
sub rax, qword [rsp + 0x218]
cmp rax, 0x15
jb 0x1401faf57
jmp 0x1401f97d9
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1401faf5d
jmp 0x1401f965c
lea r15, [rsp + 0x208]
cmp qword [rsp + 0x220], 8
cmovae r15, qword [rsp + 0x208]
mov qword [rsp + 0x308], r14
mov qword [rsp + 0x318], r14
mov qword [rsp + 0x320], r14
mov rsi, qword [rsp + 0x218]
add rsi, 0x15
mov ebx, 7
lea rdi, [rsp + 0x308]
cmp rsi, rbx
jbe 0x1401f985c
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x1401f9939
mov rbx, r13
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400eb1a0
mov rdi, rax
mov qword [rsp + 0x308], rax
mov qword [rsp + 0x318], rsi
mov qword [rsp + 0x320], rbx
mov rcx, qword [rsp + 0x218]
lea rbx, [rcx + rcx]
mov qword [rsp + 0x50], rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140253310
movups xmm0, xmmword [str.AsusSoftwareManager_]
movups xmmword [rbx + rdi], xmm0
movups xmm1, xmmword [0x1403668c0]
movups xmmword [rbx + rdi + 0x10], xmm1
movsd xmm0, qword [0x1403668d0]
movsd qword [rbx + rdi + 0x20], xmm0
movzx eax, word [0x1403668d8]
mov word [rbx + rdi + 0x28], ax
mov word [rdi + rsi*2], r14w
mov r9, r12
lea r8, [rsp + 0x308]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x2c8]
call fcn.14012c4c0
nop
mov rdx, qword [rsp + 0x2d8]
mov r8, qword [rsp + 0x2e0]
mov rax, r8
sub rax, rdx
cmp rax, 4
jb 0x1401f9962
lea rcx, [rdx + 4]
mov qword [rsp + 0x2d8], rcx
lea rax, [rsp + 0x2c8]
cmp r8, 8
cmovae rax, qword [rsp + 0x2c8]
movabs r8, 0x6500780065002e
mov qword [rax + rdx*2], r8
mov word [rax + rcx*2], r14w
lea rax, [rsp + 0x2c8]
jmp 0x1401f9989
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1401faf63
jmp 0x1401f9846
lfence
mov qword [rsp + 0x20], 4
lea r9, str..exe
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rsp + 0x2c8]
call fcn.14012c340
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x1d8], r14
mov qword [rsp + 0x1e0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x1c8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1d8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 8
jb 0x1401f9a10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f9a0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faf69
call fcn.14021ecec
mov qword [rsp + 0x2d8], r14
mov qword [rsp + 0x2e0], 7
mov word [rsp + 0x2c8], r14w
mov rdx, qword [rsp + 0x320]
cmp rdx, 8
jb 0x1401f9a76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f9a70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faf6f
call fcn.14021ecec
nop
mov rdx, qword [rsp + 0x420]
cmp rdx, 8
jb 0x1401f9abe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f9ab9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faf75
call fcn.14021ecec
mov qword [rsp + 0x418], r14
mov qword [rsp + 0x420], 7
mov word [rsp + 0x408], r14w
mov qword [rsp + 0x2a8], r14
mov qword [rsp + 0x2b8], r14
mov qword [rsp + 0x2c0], 7
mov word [rsp + 0x2a8], r14w
mov r8d, 0x1a
lea rdx, str.AsusSoftwareManager_.exe
lea rcx, [rsp + 0x2a8]
call fcn.140101ff0
nop
lea rax, [rsp + 0x98]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
lea rsi, [rsp + 0x2a8]
cmp qword [rsp + 0x2c0], 8
cmovae rsi, qword [rsp + 0x2a8]
mov rdi, qword [rsp + 0x2b8]
movabs r15, 0x7fffffffffffffff
cmp rdi, 8
jae 0x1401f9b84
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x98], xmm0
mov ebx, 7
jmp 0x1401f9bcd
mov rbx, rdi
or rbx, 7
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, r15
ja 0x1401faf7b
lfence
add rcx, rcx
call fcn.1400eb1a0
mov qword [rsp + 0x98], rax
mov rdi, qword [rsp + 0x2b8]
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140253310
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
lea rdi, [rsp + 0x208]
cmp qword [rsp + 0x220], 8
cmovae rdi, qword [rsp + 0x208]
cmp qword [rsp + 0x218], 8
jae 0x1401f9c26
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x78], xmm0
mov ebx, 7
jmp 0x1401f9c6a
mov rbx, qword [rsp + 0x218]
or rbx, 7
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, r15
ja 0x1401faf81
lfence
add rcx, rcx
call fcn.1400eb1a0
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x50]
add r8, 2
mov rdx, rdi
mov rcx, rax
call fcn.140253310
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.140200a60
nop
mov byte [rsp + 0x40], 1
mov ecx, r14d
movzx ebx, byte [rsp + 0x40]
mov dword [rsp + 0x50], ecx
mov rsi, qword [rsp + 0x60]
mov rax, rsi
mov rdi, qword [rsp + 0x58]
sub rax, rdi
sar rax, 5
movsxd r15, ecx
cmp r15, rax
jae 0x1401fa047
shl r15, 5
lea r10, [rdi + r15]
mov rax, r10
mov rdi, qword [r10 + 0x18]
cmp rdi, 8
jb 0x1401f9ce3
mov rax, qword [r10]
lea r9, [rsp + 0x1c8]
mov rsi, qword [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 8
cmovae r9, rsi
mov r11, qword [r10 + 0x10]
mov r12, qword [rsp + 0x1d8]
mov rcx, r12
cmp r11, r12
cmovb rcx, r11
test rcx, rcx
je 0x1401f9d34
sub r9, rax
nop
movzx edx, word [rax + r9]
cmp dx, word [rax]
jne 0x1401f9d40
add rax, 2
sub rcx, 1
jne 0x1401f9d20
cmp r12, r11
jae 0x1401f9d51
mov eax, 0xffffffff
jmp 0x1401f9d57
mov eax, 1
mov rcx, 0xffffffffffffffff
cmovb eax, ecx
jmp 0x1401f9d57
mov eax, r14d
seta al
test eax, eax
jne 0x1401f9fc7
mov rax, r13
sub rax, r12
cmp rax, 0x33
jb 0x1401faf87
lea rax, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 8
cmovae rax, rsi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x228], r14
mov qword [rsp + 0x238], r14
mov qword [rsp + 0x240], r14
lea r15, [r12 + 0x33]
mov edi, 7
lea rsi, [rsp + 0x228]
cmp r15, rdi
jbe 0x1401f9deb
mov rdi, r15
or rdi, 7
cmp rdi, r13
jbe 0x1401f9ec9
mov rdi, r13
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400eb1a0
mov rsi, rax
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], rdi
movaps xmm0, xmmword [str._Utility__CopySoftwareManagerBinaryAndEtlLog__File]
movups xmmword [rsi], xmm0
movaps xmm1, xmmword [0x140366950]
movups xmmword [rsi + 0x10], xmm1
movaps xmm0, xmmword [0x140366960]
movups xmmword [rsi + 0x20], xmm0
movaps xmm1, xmmword [0x140366970]
movups xmmword [rsi + 0x30], xmm1
movaps xmm0, xmmword [0x140366980]
movups xmmword [rsi + 0x40], xmm0
movaps xmm1, xmmword [0x140366990]
movups xmmword [rsi + 0x50], xmm1
mov eax, dword [0x1403669a0]
mov dword [rsi + 0x60], eax
movzx eax, word [0x1403669a4]
mov word [rsi + 0x64], ax
lea rcx, [rsi + 0x66]
lea r8, [r12 + r12]
mov rdx, qword [rsp + 0x70]
call fcn.140253310
mov word [rsi + r15*2], r14w
mov rcx, qword [rsp + 0x238]
mov rdx, qword [rsp + 0x240]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1401f9ef2
lea rsi, [rcx + 0xf]
mov qword [rsp + 0x238], rsi
lea rdi, [rsp + 0x228]
cmp rdx, 8
cmovae rdi, qword [rsp + 0x228]
lea rcx, [rdi + rcx*2]
mov r8d, 0x1e
lea rdx, str._already_exist.
call fcn.140253310
mov word [rdi + rsi*2], r14w
lea rax, [rsp + 0x228]
jmp 0x1401f9f19
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1401faf8c
jmp 0x1401f9dd5
lfence
mov qword [rsp + 0x20], SafeArrayLock
lea r9, str._already_exist.
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x228]
call fcn.14012c340
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xc8], r14
mov qword [rsp + 0xd0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rsp + 0xb8]
call fcn.1401a82f0
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 8
jb 0x1401f9fae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f9fa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faf91
call fcn.14021ecec
mov word [rsp + 0x228], r14w
mov byte [rsp + 0x40], 0
mov ecx, dword [rsp + 0x50]
inc ecx
jmp 0x1401f9ca7
cmp rdi, 8
jb 0x1401f9fd0
mov r10, qword [r10]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, qword [rsp + 0x58]
add r8, r15
mov rcx, qword [r8 + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 0x35
jb 0x1401faf97
lfence
mov rax, r8
cmp qword [r8 + 0x18], 8
jb 0x1401fa005
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x35
lea r9, str._Utility__CopySoftwareManagerBinaryAndEtlLog__Delete
movzx edx, bl
lea rcx, [rsp + 0x128]
call fcn.140144e00
lea rcx, [rsp + 0x128]
call fcn.1401a82f0
mov ecx, dword [rsp + 0x50]
inc ecx
jmp 0x1401f9ca7
cmp byte [rsp + 0x40], 0
jne 0x1401fa2e8
test rdi, rdi
je 0x1401fa0bd
cmp rdi, rsi
je 0x1401fa076
nop dword [rax]
mov rcx, rdi
call fcn.14011ed90
add rdi, 0x20
cmp rdi, rsi
jne 0x1401fa060
mov rdi, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x1401fa0a7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb002
mov rcx, rdi
call fcn.14021ecec
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov rdx, qword [rsp + 0x2c0]
cmp rdx, 8
jb 0x1401fa106
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa100
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb008
call fcn.14021ecec
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 8
jb 0x1401fa14e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa149
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb00e
call fcn.14021ecec
mov qword [rsp + 0x1d8], r14
mov qword [rsp + 0x1e0], 7
mov word [rsp + 0x1c8], r14w
mov rdx, qword [rsp + 0x220]
cmp rdx, 8
jb 0x1401fa1b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa1ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb014
call fcn.14021ecec
nop
mov rdx, qword [rsp + 0x200]
cmp rdx, 8
jb 0x1401fa1fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa1f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faf9d
call fcn.14021ecec
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x200], 7
mov word [rsp + 0x1e8], r14w
mov rdx, qword [rsp + 0x280]
cmp rdx, 8
jb 0x1401fa261
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa25c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafa3
call fcn.14021ecec
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x280], 7
mov word [rsp + 0x268], r14w
mov rdx, qword [rsp + 0x300]
cmp rdx, 8
jb 0x1401fa2c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa2c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafa9
call fcn.14021ecec
mov qword [rsp + 0x2f8], r14
mov qword [rsp + 0x300], 7
mov word [rsp + 0x2e8], r14w
jmp 0x1401faf1a
lea rdx, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 8
cmovae rdx, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 8
cmovae rcx, qword [rsp + 0x1e8]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.success
lea rdx, str.fail
test eax, eax
cmovne rdx, rcx
mov qword [rsp + 0x348], r14
mov qword [rsp + 0x358], r14
mov qword [rsp + 0x360], 7
mov word [rsp + 0x348], r14w
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1401fa370
mov r8, rax
lea rcx, [rsp + 0x348]
call fcn.140101ff0
nop
mov r15, qword [rsp + 0x1d8]
mov rax, r13
sub rax, r15
cmp rax, 0x33
jb 0x1401fafaf
lea r12, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 8
cmovae r12, qword [rsp + 0x1c8]
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x258], r14
mov qword [rsp + 0x260], r14
lea rsi, [r15 + 0x33]
mov ebx, 7
lea rdi, [rsp + 0x248]
cmp rsi, rbx
jbe 0x1401fa41e
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x1401fa500
mov rbx, r13
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400eb1a0
mov rdi, rax
mov qword [rsp + 0x248], rax
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x260], rbx
movaps xmm0, xmmword [str._Utility__CopySoftwareManagerBinaryAndEtlLog__Copy]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x140366a50]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x140366a60]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x140366a70]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x140366a80]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x140366a90]
movups xmmword [rdi + 0x50], xmm1
mov eax, dword [0x140366aa0]
mov dword [rdi + 0x60], eax
movzx eax, word [0x140366aa4]
mov word [rdi + 0x64], ax
lea rcx, [rdi + 0x66]
lea r8, [r15 + r15]
mov rdx, r12
call fcn.140253310
mov word [rdi + rsi*2], r14w
mov rcx, qword [rsp + 0x258]
mov rdx, qword [rsp + 0x260]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x1401fa529
lea rdi, [rcx + 0xa]
mov qword [rsp + 0x258], rdi
lea rbx, [rsp + 0x248]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x248]
lea rcx, [rbx + rcx*2]
mov r8d, reloc.OLEAUT32.dll_SafeArrayLock
lea rdx, str._result_:
call fcn.140253310
mov word [rbx + rdi*2], r14w
lea rax, [rsp + 0x248]
mov r12d, 0xa
jmp 0x1401fa551
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1401fafb4
jmp 0x1401fa408
lfence
mov r12d, 0xa
mov qword [rsp + 0x20], r12
lea r9, str._result_:
xor r8d, r8d
mov edx, r12d
lea rcx, [rsp + 0x248]
call fcn.14012c340
mov qword [rsp + 0x328], r14
mov qword [rsp + 0x338], r14
mov qword [rsp + 0x340], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x328], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x338], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rsp + 0x348]
cmp qword [rsp + 0x360], 8
cmovae rdx, qword [rsp + 0x348]
mov r8, qword [rsp + 0x358]
lea rcx, [rsp + 0x328]
call fcn.140167730
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xf0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rsp + 0xd8]
call fcn.1401a82f0
nop
mov rdx, qword [rsp + 0x340]
cmp rdx, 8
jb 0x1401fa654
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa64f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafba
call fcn.14021ecec
mov qword [rsp + 0x338], r14
mov qword [rsp + 0x340], 7
mov word [rsp + 0x328], r14w
mov rdx, qword [rsp + 0x260]
cmp rdx, 8
jb 0x1401fa6b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa6b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafc0
call fcn.14021ecec
mov rax, r13
sub rax, qword [rsp + 0x218]
cmp rax, 0x22
jb 0x1401fafc6
lea r15, [rsp + 0x208]
cmp qword [rsp + 0x220], 8
cmovae r15, qword [rsp + 0x208]
mov qword [rsp + 0x288], r14
mov qword [rsp + 0x298], r14
mov qword [rsp + 0x2a0], r14
mov rsi, qword [rsp + 0x218]
add rsi, 0x22
mov ebx, 7
lea rdi, [rsp + 0x288]
cmp rsi, rbx
jbe 0x1401fa751
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x1401fa84a
mov rbx, r13
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400eb1a0
mov rdi, rax
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x2a0], rbx
mov rcx, qword [rsp + 0x218]
lea rbx, [rcx + rcx]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140253310
movaps xmm0, xmmword [str.ASUS_System_Control_Interface.etl]
movups xmmword [rdi + rbx], xmm0
movaps xmm1, xmmword [0x140366ac0]
movups xmmword [rdi + rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140366ad0]
movups xmmword [rdi + rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140366ae0]
movups xmmword [rdi + rbx + 0x30], xmm1
mov eax, dword [0x140366af0]
mov dword [rdi + rbx + 0x40], eax
mov word [rdi + rsi*2], r14w
lea rcx, [rsp + 0x490]
call fcn.1401f4c40
nop
xor ecx, ecx
call fcn.140287a5c
mov rdx, rax
lea rcx, [rsp + 0x3e8]
call fcn.14015f720
nop
lea rdx, [rsp + 0x3e8]
lea rcx, [rsp + 0x148]
call fcn.1400f4280
mov rdx, rax
lea rcx, [rsp + 0x3c8]
call fcn.140215df0
nop
mov rdx, qword [rsp + 0x400]
cmp rdx, 8
jb 0x1401fa873
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa86e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafcc
jmp 0x1401fa86e
cmp rbx, 0xa
cmovb rbx, r12
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1401fafd2
jmp 0x1401fa73b
call fcn.14021ecec
mov qword [rsp + 0x3f8], r14
mov qword [rsp + 0x400], 7
mov word [rsp + 0x3e8], r14w
lea r8, [rsp + 0x3c8]
cmp qword [rsp + 0x3e0], 0x10
cmovae r8, qword [rsp + 0x3c8]
mov r9, qword [rsp + 0x3d8]
add r9, r8
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x490]
call fcn.14020cd80
nop
lfence
lea r9, [rsp + 0x208]
cmp qword [rsp + 0x220], 8
cmovae r9, qword [rsp + 0x208]
mov qword [rsp + 0x30], reloc.OLEAUT32.dll_SafeArrayLock
lea rax, str.SoftwareManagerLog_
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x208]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x448]
call fcn.140144e00
nop
lea r9, [rsp + 0x428]
lea r8, [rsp + 0x448]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x3a8]
call fcn.14012c4c0
nop
mov r8d, 4
lea rdx, str..etl
lea rcx, [rsp + 0x3a8]
call fcn.140167730
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 8
jb 0x1401fa9c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fa9bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafd8
call fcn.14021ecec
movups xmmword [rsp + 0x1c8], xmm6
movups xmmword [rsp + 0x1d8], xmm7
mov rdx, qword [rsp + 0x3c0]
cmp rdx, 8
jb 0x1401faa19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401faa14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafde
call fcn.14021ecec
mov qword [rsp + 0x3b8], r14
mov qword [rsp + 0x3c0], 7
mov word [rsp + 0x3a8], r14w
mov rdx, qword [rsp + 0x460]
cmp rdx, 8
jb 0x1401faa7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x448]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401faa79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafe4
call fcn.14021ecec
nop
mov rdx, qword [rsp + 0x440]
cmp rdx, 8
jb 0x1401faac8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401faac2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fafea
call fcn.14021ecec
nop
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 0x10
jb 0x1401fab0b
inc rdx
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fab06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faff0
call fcn.14021ecec
lea rdx, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 8
cmovae rdx, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae rcx, qword [rsp + 0x288]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
lea rcx, [rsp + 0x490]
call fcn.1401f5310
nop
mov rdx, qword [rsp + 0x2a0]
cmp rdx, 8
jb 0x1401faba2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fab9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faff6
call fcn.14021ecec
mov qword [rsp + 0x298], r14
mov qword [rsp + 0x2a0], 7
mov word [rsp + 0x288], r14w
mov rdx, qword [rsp + 0x360]
cmp rdx, 8
jb 0x1401fac08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fac02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401faffc
call fcn.14021ecec
nop
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1401fac7d
mov rdi, qword [rsp + 0x60]
cmp rbx, rdi
je 0x1401fac36
nop dword [rax]
mov rcx, rbx
call fcn.14011ed90
add rbx, 0x20
cmp rbx, rdi
jne 0x1401fac20
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1401fac67
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb002
mov rcx, rbx
call fcn.14021ecec
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov rdx, qword [rsp + 0x2c0]
cmp rdx, 8
jb 0x1401facc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401facc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb008
call fcn.14021ecec
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 8
jb 0x1401fad0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fad09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb00e
call fcn.14021ecec
mov qword [rsp + 0x1d8], r14
mov qword [rsp + 0x1e0], 7
mov word [rsp + 0x1c8], r14w
mov rdx, qword [rsp + 0x220]
cmp rdx, 8
jb 0x1401fae1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fad72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb014
call fcn.14021ecec
jmp 0x1401fae1b
sub r13, qword [rsp + 0x1f8]
cmp r13, 0x33
jb 0x1401fb01a
lfence
lea rcx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 8
cmovae rcx, qword [rsp + 0x1e8]
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x33
lea r9, str._Utility__CopySoftwareManagerBinaryAndEtlLog__File
lea r8, [rsp + 0x1e8]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x468]
call fcn.140144e00
nop
lea r8, str._not_exist.
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x168]
call fcn.14012c260
mov rcx, rax
call fcn.1401a8890
nop
lea rcx, [rsp + 0x468]
call fcn.14011ed90
nop
jmp 0x1401fae20
mov rdx, qword [rsp + 0x200]
cmp rdx, 8
jb 0x1401fae6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401fae67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb020
jmp 0x1401fae67
call fcn.14021ecec
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x200], 7
mov word [rsp + 0x1e8], r14w
mov rdx, qword [rsp + 0x280]
cmp rdx, 8
jb 0x1401faed2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401faecc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb026
call fcn.14021ecec
nop
mov rdx, qword [rsp + 0x300]
cmp rdx, 8
jb 0x1401faf1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401faf15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401fb02c
call fcn.14021ecec
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14021f250
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140101a70
nop
call fcn.140101a70
nop
call fcn.1401018e0
nop
call fcn.1401018e0
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.1401018e0
nop
call fcn.1401018e0
nop
call fcn.140101a70
call fcn.1401018e0
call fcn.140260f54
int3
call fcn.140101a70
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140101a70
call fcn.1401018e0
nop
call fcn.140260f54
nop
call fcn.140260f54
int3
call fcn.140101a70
nop
call fcn.140260f54
nop
call fcn.1401018e0
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
int3
call fcn.140101a70
nop
call fcn.140260f54
nop
call fcn.140260f54
nop
call fcn.140260f54
int3