Function at 0x14000dd50
Capabilities:
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x5c10]
mov eax, 0x5d10
call fcn.14002e240
sub rsp, rax
mov qword [rbp + 0x5a0], 0xfffffffffffffffe
mov qword [rsp + 0x5d30], rbx
mov qword [rsp + 0x5d38], rsi
mov qword [rsp + 0x5d40], rdi
mov qword [rsp + 0x5d48], r12
mov rax, qword [0x14009d080]
xor rax, rsp
mov qword [rbp + 0x5c00], rax
xor edi, edi
mov r12d, edi
mov dword [rbp - 0x78], edi
lea rcx, [rbp + 0xb20]
call fcn.14000aaf0
lea rcx, [rbp + 0xb60]
call fcn.14000af40
mov byte [rsp + 0x50], dil
call fcn.14000c8b0
mov byte [rsp + 0x51], al
lea rax, [rbp + 0xdc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea r14, [rdi - 1]
test eax, eax
js 0x14000e1c0
mov qword [rbp + 0xb90], rdi
mov qword [rbp + 0xb98], 0xf
mov byte [rbp + 0xb80], dil
lea rax, [rbp + 0xdc0]
mov r8, r14
inc r8
cmp byte [rax + r8], dil
jne 0x14000de21
lea rdx, [rbp + 0xdc0]
lea rcx, [rbp + 0xb80]
call fcn.1400013b0
mov r8d, 0x38
lea rdx, str.ASUSARMOURY_CRATE_DiagnosisAsusLog_atkexcom_AxIns.log
lea rcx, [rbp + 0xb80]
call fcn.140001500
mov qword [rbp + 0xa58], rdi
mov qword [rbp + 0xa98], rdi
mov qword [rbp + 0xad8], rdi
mov qword [rbp + 0xb18], rdi
lea rdx, [rbp + 0xb80]
cmp qword [rbp + 0xb98], 0x10
cmovae rdx, qword [rbp + 0xb80]
mov qword [rbp + 0xc90], rdi
mov qword [rbp + 0xc98], 0xf
mov byte [rbp + 0xc80], dil
mov r8, r14
inc r8
cmp byte [rdx + r8], dil
jne 0x14000dea5
lea rcx, [rbp + 0xc80]
call fcn.1400013b0
mov qword [rbp + 0xc70], rdi
mov qword [rbp + 0xc78], 0xf
mov byte [rbp + 0xc60], dil
mov r8d, 9
lea rdx, str.AxIns.exe
lea rcx, [rbp + 0xc60]
call fcn.1400013b0
lea rax, [rbp + 0xa20]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0xc80]
lea rdx, [rbp + 0xc60]
lea rcx, [rbp + 0x90]
call fcn.140014fc0
mov rdx, qword [rbp + 0xc78]
cmp rdx, 0x10
jb 0x14000df53
inc rdx
mov rcx, qword [rbp + 0xc60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001037f
call fcn.14002d510
mov rdx, qword [rbp + 0xc98]
cmp rdx, 0x10
jb 0x14000df94
inc rdx
mov rcx, qword [rbp + 0xc80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010385
call fcn.14002d510
lea rcx, [rbp + 0xa20]
call fcn.140008cf0
mov qword [rbp + 0x438], rdi
mov qword [rbp + 0x440], 0xf
mov byte [rbp + 0x428], dil
mov r8d, 0x2b
lea rdx, str._Y__m__d__H:_M:_S._e__x64_P:_P_T:_t__l_:__v
lea rcx, [rbp + 0x428]
call fcn.1400013b0
lea rcx, [rbp + 0x428]
call fcn.140008a20
mov qword [rbp + 0x5a8], 3
call fcn.1400087f0
mov r15, rax
lea rcx, [rax + 0x50]
call fcn.14002bf84
test eax, eax
je 0x14000e005
mov ecx, eax
call fcn.14002c284
mov ecx, 0xb0
call fcn.14002d4d4
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_a53e80b6bab74162aa299a142b2d8110___void___.0
mov qword [rbp + 0xca0], rcx
mov qword [rbp + 0xca8], r15
lea rcx, [rbp + 0xca0]
mov qword [rbp + 0xcd8], rcx
mov r8d, 3
lea rdx, [rbp + 0xca0]
mov rcx, rax
call fcn.14001f130
mov rsi, rax
mov rcx, qword [rbp + 0xcd8]
test rcx, rcx
je 0x14000e071
mov r8, qword [rcx]
lea rax, [rbp + 0xca0]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov qword [rbp + 0xcd8], rdi
lea rax, [r15 + 0x1d0]
lea rcx, [rbp + 0x5b0]
cmp rax, rcx
je 0x14000e091
mov rdx, qword [rax]
mov qword [rax], rsi
test rdx, rdx
je 0x14000e09f
jmp 0x14000e099
test rsi, rsi
je 0x14000e09f
mov rdx, rsi
call fcn.1400113f0
nop
lea rcx, [r15 + 0x50]
call fcn.14002bfa8
test eax, eax
je 0x14000e0b4
mov ecx, eax
call fcn.14002c284
nop
call fcn.1400087f0
mov rbx, rax
mov rcx, rax
call fcn.14002bf84
test eax, eax
je 0x14000e0cf
mov ecx, eax
call fcn.14002c284
mov rcx, qword [rbx + 0xf8]
mov rax, qword [rcx]
cmp rax, rcx
je 0x14000e0f5
nop
mov r8, qword [rax + 0x30]
mov edx, 1
xchg dword [r8 + 0x40], edx
mov rax, qword [rax]
cmp rax, rcx
jne 0x14000e0e0
mov dword [rbx + 0x178], 1
mov rcx, rbx
call fcn.14002bfa8
test eax, eax
je 0x14000e113
mov ecx, eax
call fcn.14002c284
nop
mov rax, qword [rbp + 0x98]
test rax, rax
je 0x14000e123
lock inc dword [rax + 8]
movaps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp + 0x5e0], xmm0
call fcn.1400087f0
mov rcx, rax
lea rdx, [rbp + 0x5e0]
call fcn.1400084e0
nop
mov rbx, qword [rbp + 0x98]
test rbx, rbx
je 0x14000e17f
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000e17f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000e17f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xb98]
cmp rdx, 0x10
jb 0x14000e1c0
inc rdx
mov rcx, qword [rbp + 0xb80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e1bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001038b
call fcn.14002d510
call fcn.1400087f0
mov qword [rbp - 0x18], rdi
lea rcx, [0x140087690]
mov qword [rbp + 0x270], rcx
mov qword [rbp + 0x278], 0x2f
movaps xmm0, xmmword [rbp + 0x270]
movdqa xmmword [rbp + 0x5f0], xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rdi
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x650], xmm0
movsd xmm1, qword [rbp - 0x10]
movsd qword [rbp + 0x660], xmm1
lea r9, [rbp + 0x5f0]
mov r8d, 1
lea rdx, [rbp + 0x650]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
mov dword [rbp - 0x80], edi
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xd60]
call fcn.14000dbc0
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x54]
lea rcx, [rbp + 0xc40]
call fcn.14000dbc0
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x7c], eax
lea rdx, [rbp - 0x7c]
lea rcx, [rbp + 0xc20]
call fcn.14000dbc0
lea rax, str.ppid____name_:_
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], 0x14
lea rcx, [rbp + 0xc40]
cmp qword [rbp + 0xc58], 8
cmovae rcx, qword [rbp + 0xc40]
mov rax, qword [rbp + 0xc50]
lea rbx, [rcx + rax*2]
mov qword [rbp + 0x5b8], rbx
lea rsi, [rbp + 0xc40]
cmovae rsi, qword [rbp + 0xc40]
mov qword [rbp + 0xbd0], rdi
mov qword [rbp + 0xbd8], 0xf
mov byte [rbp + 0xbc0], 0
mov rdx, rbx
sub rdx, rsi
sar rdx, 1
lea rcx, [rbp + 0xbc0]
call fcn.140001bb0
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0xbc0]
call fcn.14001c970
call fcn.1400087f0
mov qword [rbp], rdi
mov qword [rbp - 8], rdi
mov qword [rbp + 8], rdi
movaps xmm0, xmmword [rbp + 0x280]
movdqa xmmword [rbp + 0x600], xmm0
movups xmm1, xmmword [rbp - 8]
movaps xmmword [rbp + 0x670], xmm1
movsd xmm0, qword [rbp + 8]
movsd qword [rbp + 0x680], xmm0
lea rcx, [rbp + 0xbc0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x54]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x600]
lea rdx, [rbp + 0x670]
mov rcx, qword [rax + 0x1d8]
call fcn.140022820
mov rdx, qword [rbp + 0xbd8]
cmp rdx, 0x10
jb 0x14000e3ad
inc rdx
mov rcx, qword [rbp + 0xbc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e3a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010391
call fcn.14002d510
lea rax, str.pppid____name_:_
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], 0x15
lea rcx, [rbp + 0xc20]
cmp qword [rbp + 0xc38], 8
cmovae rcx, qword [rbp + 0xc20]
mov rax, qword [rbp + 0xc30]
lea rbx, [rcx + rax*2]
mov qword [rbp + 0x5c0], rbx
lea rsi, [rbp + 0xc20]
cmovae rsi, qword [rbp + 0xc20]
mov qword [rbp + 0xbf0], rdi
mov qword [rbp + 0xbf8], 0xf
mov byte [rbp + 0xbe0], 0
mov rdx, rbx
sub rdx, rsi
sar rdx, 1
lea rcx, [rbp + 0xbe0]
call fcn.140001bb0
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0xbe0]
call fcn.14001c970
call fcn.1400087f0
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], rdi
movaps xmm0, xmmword [rbp + 0x290]
movdqa xmmword [rbp + 0x610], xmm0
movups xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x690], xmm1
movsd xmm0, qword [rbp + 0x20]
movsd qword [rbp + 0x6a0], xmm0
lea rcx, [rbp + 0xbe0]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x610]
lea rdx, [rbp + 0x690]
mov rcx, qword [rax + 0x1d8]
call fcn.140022820
mov rdx, qword [rbp + 0xbf8]
cmp rdx, 0x10
jb 0x14000e4e6
inc rdx
mov rcx, qword [rbp + 0xbe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e4e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010397
call fcn.14002d510
lea rax, str.main:_targetVer__
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], 0x14
call fcn.1400087f0
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x50], rdi
movaps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x620], xmm0
movups xmm1, xmmword [rbp + 0x40]
movaps xmmword [rbp + 0x6b0], xmm1
movsd xmm0, qword [rbp + 0x50]
movsd qword [rbp + 0x6c0], xmm0
lea rcx, [rbp + 0xb20]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x620]
lea rdx, [rbp + 0x6b0]
mov rcx, qword [rax + 0x1d8]
call fcn.140020130
lea rax, str.main:_currentVer__
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2b8], 0x15
call fcn.1400087f0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x68], rdi
movaps xmm0, xmmword [rbp + 0x2b0]
movdqa xmmword [rbp + 0x630], xmm0
movups xmm1, xmmword [rbp + 0x58]
movaps xmmword [rbp + 0x6d0], xmm1
movsd xmm0, qword [rbp + 0x68]
movsd qword [rbp + 0x6e0], xmm0
lea rcx, [rbp + 0xb60]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x630]
lea rdx, [rbp + 0x6d0]
mov rcx, qword [rax + 0x1d8]
call fcn.140020130
lea rax, str.main:_bExist__
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], 0x11
call fcn.1400087f0
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x80], rdi
movaps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x640], xmm0
movups xmm1, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0x6f0], xmm1
movsd xmm0, qword [rbp + 0x80]
movsd qword [rbp + 0x700], xmm0
lea rcx, [rsp + 0x51]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x640]
lea rdx, [rbp + 0x6f0]
mov rcx, qword [rax + 0x1d8]
call fcn.140022ad0
cmp qword [rbp + 0xb30], 0
sete al
test al, al
je 0x14000e74f
cmp qword [rbp + 0xb70], 0
jne 0x14000e74f
call fcn.1400087f0
mov qword [rbp + 0x1f8], rdi
lea rcx, str.main:_targetVer_and_currentVer_are_empty
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 0x28
movaps xmm0, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x990], xmm0
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x200], rdi
movups xmm0, xmmword [rbp + 0x1f0]
movaps xmmword [rbp + 0x710], xmm0
movsd xmm1, qword [rbp + 0x200]
movsd qword [rbp + 0x720], xmm1
lea r9, [rbp + 0x990]
mov r8d, 1
lea rdx, [rbp + 0x710]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
lea rcx, [rbp + 0x9a0]
call fcn.140008c50
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
mov rbx, qword [rbp + 0x9a8]
test rbx, rbx
je 0x14000e73d
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000e73d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r14d
cmp r14d, 1
jne 0x14000e73d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
call fcn.1400087f0
mov rcx, rax
call fcn.140008670
jmp 0x1400102a5
mov edx, 1
lea rcx, [rbp + 0x9d0]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rbp + 0x9d0]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [rbp + 0x410], 0x18
mov dword [rbp + 0x420], edi
lea rax, [rbp + 0x9d0]
mov qword [rbp + 0x418], rax
lea r8, str.Global_atkex_install
xor edx, edx
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1400a3d38], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.1400087f0
mov qword [rbp + 0x210], rdi
lea rcx, str.acquire_gEnterSetupMutex
mov qword [rbp + 0x2e0], rcx
mov qword [rbp + 0x2e8], 0x18
movaps xmm0, xmmword [rbp + 0x2e0]
movdqa xmmword [rbp + 0x9b0], xmm0
mov qword [rbp + 0x208], rdi
mov qword [rbp + 0x218], rdi
movups xmm0, xmmword [rbp + 0x208]
movaps xmmword [rbp + 0x730], xmm0
movsd xmm1, qword [rbp + 0x218]
movsd qword [rbp + 0x740], xmm1
lea r9, [rbp + 0x9b0]
mov r8d, 1
lea rdx, [rbp + 0x730]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.14000d240
call fcn.1400087f0
mov qword [rbp + 0x228], rdi
lea rcx, str.get_gEnterSetupMutex
mov qword [rbp + 0x2f0], rcx
mov qword [rbp + 0x2f8], 0x14
movaps xmm0, xmmword [rbp + 0x2f0]
movdqa xmmword [rbp + 0x9c0], xmm0
mov qword [rbp + 0x220], rdi
mov qword [rbp + 0x230], rdi
movups xmm0, xmmword [rbp + 0x220]
movaps xmmword [rbp + 0x750], xmm0
movsd xmm1, qword [rbp + 0x230]
movsd qword [rbp + 0x760], xmm1
lea r9, [rbp + 0x9c0]
mov r8d, 1
lea rdx, [rbp + 0x750]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
lea rcx, [rbp + 0xb20]
cmp qword [rbp + 0xb38], 0x10
cmovae rcx, qword [rbp + 0xb20]
add rcx, qword [rbp + 0xb30]
mov qword [rbp + 0x5c8], rcx
lea r10, [rbp + 0xb20]
cmp qword [rbp + 0xb38], 0x10
cmovae r10, qword [rbp + 0xb20]
lea rdx, [rbp + 0xb60]
mov r9, qword [rbp + 0xb60]
mov r8, qword [rbp + 0xb78]
cmp r8, 0x10
cmovae rdx, r9
mov rax, qword [rbp + 0xb70]
add rax, rdx
mov qword [rbp + 0x5d0], rax
lea rdx, [rbp + 0xb60]
cmp r8, 0x10
cmovae rdx, r9
cmp rdx, rax
je 0x14000e96d
nop dword [rax]
cmp r10, rcx
je 0x14000e968
movzx r8d, byte [rdx]
movzx r9d, byte [r10]
cmp r8b, r9b
jl 0x14000ebd0
cmp r9b, r8b
jl 0x14000e976
inc rdx
inc r10
cmp rdx, rax
jne 0x14000e940
jmp 0x14000e96d
cmp rdx, rax
jne 0x14000e976
cmp r10, rcx
jne 0x14000ebd0
call fcn.1400087f0
mov qword [rbp + 0x240], rdi
lea rcx, str.the_same_version
mov qword [rbp + 0x300], rcx
mov qword [rbp + 0x308], 0x10
movaps xmm0, xmmword [rbp + 0x300]
movdqa xmmword [rbp + 0x450], xmm0
mov qword [rbp + 0x238], rdi
mov qword [rbp + 0x248], rdi
movups xmm0, xmmword [rbp + 0x238]
movaps xmmword [rbp + 0x770], xmm0
movsd xmm1, qword [rbp + 0x248]
movsd qword [rbp + 0x780], xmm1
lea r9, [rbp + 0x450]
mov r8d, 1
lea rdx, [rbp + 0x770]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.1400087f0
mov r8d, 1
cmp byte [rsp + 0x51], 0
je 0x14000eb65
mov qword [rbp + 0x258], rdi
lea rcx, str.service_is_still_alive__just_return.
mov qword [rbp + 0x310], rcx
mov qword [rbp + 0x318], 0x24
movaps xmm0, xmmword [rbp + 0x310]
movdqa xmmword [rbp + 0x460], xmm0
mov qword [rbp + 0x250], rdi
mov qword [rbp + 0x260], rdi
movups xmm0, xmmword [rbp + 0x250]
movaps xmmword [rbp + 0x790], xmm0
movsd xmm1, qword [rbp + 0x260]
movsd qword [rbp + 0x7a0], xmm1
lea r9, [rbp + 0x460]
lea rdx, [rbp + 0x790]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.14000da80
call fcn.1400087f0
mov qword [rbp + 0xa8], rdi
lea rcx, str.release_gLeaveSetupMutex
mov qword [rbp + 0x320], rcx
mov qword [rbp + 0x328], 0x18
movaps xmm0, xmmword [rbp + 0x320]
movdqa xmmword [rbp + 0x470], xmm0
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rdi
movups xmm0, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0x7b0], xmm0
movsd xmm1, qword [rbp + 0xb0]
movsd qword [rbp + 0x7c0], xmm1
lea r9, [rbp + 0x470]
mov r8d, 1
lea rdx, [rbp + 0x7b0]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
lea rcx, [rbp + 0x480]
call fcn.140008c50
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
mov rbx, qword [rbp + 0x488]
test rbx, rbx
je 0x14000eb53
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000eb53
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r14d
cmp r14d, 1
jne 0x14000eb53
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
call fcn.1400087f0
mov rcx, rax
call fcn.140008670
jmp 0x1400102a5
mov qword [rbp + 0x30], rdi
lea rcx, str.service_is_dead__reinstall_it...
mov qword [rbp + 0x330], rcx
mov qword [rbp + 0x338], 0x20
movaps xmm0, xmmword [rbp + 0x330]
movdqa xmmword [rbp + 0x490], xmm0
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x38], rdi
movups xmm0, xmmword [rbp + 0x28]
movaps xmmword [rbp + 0x7d0], xmm0
movsd xmm1, qword [rbp + 0x38]
movsd qword [rbp + 0x7e0], xmm1
lea r9, [rbp + 0x490]
lea rdx, [rbp + 0x7d0]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
mov byte [rsp + 0x50], 1
lea rdx, [rbp + 0xb20]
lea rcx, [rbp + 0x9f8]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp + 0xb40]
call fcn.14000b1d0
lea rax, str.main:_bForceCopy____
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0x19
call fcn.1400087f0
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xc8], rdi
movaps xmm0, xmmword [rbp + 0x400]
movdqa xmmword [rbp + 0x4a0], xmm0
movups xmm1, xmmword [rbp + 0xb8]
movaps xmmword [rbp + 0x7f0], xmm1
movsd xmm0, qword [rbp + 0xc8]
movsd qword [rbp + 0x800], xmm0
lea rcx, [rbp + 0xb40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x4a0]
lea rdx, [rbp + 0x7f0]
mov rcx, qword [rax + 0x1d8]
call fcn.140022d50
cmp byte [rsp + 0x50], 0
je 0x14000ee50
lea rcx, [rbp + 0xda0]
call fcn.140002770
mov rcx, rax
lea rdx, [rbp + 0xb40]
call fcn.14000ba50
mov rdx, qword [rbp + 0xdb8]
cmp rdx, 0x10
jb 0x14000ece9
inc rdx
mov rcx, qword [rbp + 0xda0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ece4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001039d
call fcn.14002d510
call fcn.1400087f0
mov qword [rbp + 0x108], rdi
lea rcx, str.main:_UnRegisterATKService
mov qword [rbp + 0x3a0], rcx
mov qword [rbp + 0x3a8], 0x1a
movaps xmm0, xmmword [rbp + 0x3a0]
movdqa xmmword [rbp + 0x4e0], xmm0
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x110], rdi
movups xmm0, xmmword [rbp + 0x100]
movaps xmmword [rbp + 0x850], xmm0
movsd xmm1, qword [rbp + 0x110]
movsd qword [rbp + 0x860], xmm1
lea r9, [rbp + 0x4e0]
mov r8d, 1
lea rdx, [rbp + 0x850]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.14000c1a0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400087f0
mov qword [rbp + 0x120], rdi
lea rcx, str.main:_delete_registry
mov qword [rbp + 0x340], rcx
mov qword [rbp + 0x348], 0x15
movaps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x118], rdi
mov qword [rbp + 0x128], rdi
movups xmm0, xmmword [rbp + 0x118]
movaps xmmword [rbp + 0x870], xmm0
movsd xmm1, qword [rbp + 0x128]
movsd qword [rbp + 0x880], xmm1
lea r9, [rbp + 0x4f0]
mov r8d, 1
lea rdx, [rbp + 0x870]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
mov ebx, 0x208
mov edx, ebx
lea rcx, [rbp + 0xed0]
lea r8, str.SOFTWAREClassesAppID63882250_25AD_4ED6_8003_B9AD33F1FC33
lea rax, [rbp + 0xed0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f021
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f021
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000ee20
jmp 0x14000f026
lea rcx, [rbp + 0xce0]
call fcn.140002770
mov rcx, rax
lea rdx, [rbp + 0xb40]
call fcn.14000b420
test al, al
sete bl
mov rdx, qword [rbp + 0xcf8]
cmp rdx, 0x10
jb 0x14000eeb1
inc rdx
mov rcx, qword [rbp + 0xce0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eeac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400103a3
call fcn.14002d510
test bl, bl
je 0x14000ece9
call fcn.1400087f0
mov qword [rbp + 0xd8], rdi
lea rcx, str.main:_CopyData__fail
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], 0x15
movaps xmm0, xmmword [rbp + 0x3f0]
movdqa xmmword [rbp + 0x4b0], xmm0
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xe0], rdi
movups xmm0, xmmword [rbp + 0xd0]
movaps xmmword [rbp + 0x810], xmm0
movsd xmm1, qword [rbp + 0xe0]
movsd qword [rbp + 0x820], xmm1
lea r9, [rbp + 0x4b0]
mov r8d, 1
lea rdx, [rbp + 0x810]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.14000da80
call fcn.1400087f0
mov qword [rbp + 0xf0], rdi
lea rcx, str.release_gLeaveSetupMutex
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3e8], 0x18
movaps xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0x4c0], xmm0
mov qword [rbp + 0xe8], rdi
mov qword [rbp + 0xf8], rdi
movups xmm0, xmmword [rbp + 0xe8]
movaps xmmword [rbp + 0x830], xmm0
movsd xmm1, qword [rbp + 0xf8]
movsd qword [rbp + 0x840], xmm1
lea r9, [rbp + 0x4c0]
mov r8d, 1
lea rdx, [rbp + 0x830]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
lea rcx, [rbp + 0x4d0]
call fcn.140008c50
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
mov rbx, qword [rbp + 0x4d8]
test rbx, rbx
je 0x14000f00c
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000f00c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000f00c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
call fcn.1400087f0
mov rcx, rax
call fcn.140008670
mov edi, r14d
jmp 0x140010299
test rdx, rdx
jne 0x14000f02a
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0xed0]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x12e0]
lea r8, str.SOFTWAREClassesCLSID2627F8BE_4482_4081_BC62_8A12CA24BDF8
lea rax, [rbp + 0x12e0]
sub r8, rax
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f079
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f079
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f054
jmp 0x14000f07e
test rdx, rdx
jne 0x14000f082
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x12e0]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x16f0]
lea r8, str.SOFTWAREClassesCLSIDBC50CF2A_E12C_4F18_90CE_714CC8600CEE
lea rax, [rbp + 0x16f0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f0d5
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f0d5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f0b0
jmp 0x14000f0da
test rdx, rdx
jne 0x14000f0de
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x16f0]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x1b00]
lea r8, str.SOFTWAREClassesTypeLib34AAD71E_0356_470C_94B7_593BE46311BB
lea rax, [rbp + 0x1b00]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f135
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f135
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f110
jmp 0x14000f13a
test rdx, rdx
jne 0x14000f13e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x1b00]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x1f10]
lea r8, str.SOFTWAREClassesInterface06C3AFD6_D472_490D_AEAE_2237472DD131
lea rax, [rbp + 0x1f10]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f195
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f195
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f170
jmp 0x14000f19a
test rdx, rdx
jne 0x14000f19e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x1f10]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x2320]
lea r8, str.SOFTWAREClassesInterface49F3C89A_3486_4806_A5B3_6C63AE4E1237
lea rax, [rbp + 0x2320]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f1f5
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f1f5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f1d0
jmp 0x14000f1fa
test rdx, rdx
jne 0x14000f1fe
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x2320]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x2730]
lea r8, str.SOFTWAREClassesInterface9535A1FD_296A_4B0C_A333_F0E6ADADBE42
lea rax, [rbp + 0x2730]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f255
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f255
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f230
jmp 0x14000f25a
test rdx, rdx
jne 0x14000f25e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x2730]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x2b40]
lea r8, str.SOFTWAREClassesInterface11AEAF13_36FE_46F8_8C62_6670EB0BCC04
lea rax, [rbp + 0x2b40]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f2b5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f2b5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f290
jmp 0x14000f2ba
test rdx, rdx
jne 0x14000f2be
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x2b40]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x2f50]
lea r8, str.SOFTWAREClassesInterfaceE35A7B57_D5BF_4281_B366_E6C75570B104
lea rax, [rbp + 0x2f50]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f315
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000f315
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f2f0
jmp 0x14000f31a
test rdx, rdx
jne 0x14000f31e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x2f50]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x3360]
lea r8, str.SOFTWAREClassesInterfaceB29B1E7E_078F_48C6_8933_433D0A135033
lea rax, [rbp + 0x3360]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f375
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f375
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f350
jmp 0x14000f37a
test rdx, rdx
jne 0x14000f37e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x3360]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x3770]
lea r8, str.SOFTWAREClassesInterface46A13EDA_6981_49B6_ACAD_B645C8D9F0E5
lea rax, [rbp + 0x3770]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f3d5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f3d5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f3b0
jmp 0x14000f3da
test rdx, rdx
jne 0x14000f3de
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x3770]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x3b80]
lea r8, str.SOFTWAREClassesInterface065F60A5_F6CF_41B5_937D_DAEF68654572
lea rax, [rbp + 0x3b80]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f435
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f435
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f410
jmp 0x14000f43a
test rdx, rdx
jne 0x14000f43e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x3b80]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x3f90]
lea r8, str.SOFTWAREClasses_atkexCom.axdata
lea rax, [rbp + 0x3f90]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f495
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f495
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f470
jmp 0x14000f49a
test rdx, rdx
jne 0x14000f49e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x3f90]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x43a0]
lea r8, str.SOFTWAREClasses_atkexCom.axdata.1
lea rax, [rbp + 0x43a0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f4f5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f4f5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f4d0
jmp 0x14000f4fa
test rdx, rdx
jne 0x14000f4fe
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x43a0]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x47b0]
lea r8, str.SOFTWAREClasses_aaHM.acpiHmData2
lea rax, [rbp + 0x47b0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f555
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f555
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f530
jmp 0x14000f55a
test rdx, rdx
jne 0x14000f55e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x47b0]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x4bc0]
lea r8, str.SOFTWAREClasses_aaHM.acpiHmData2.1
lea rax, [rbp + 0x4bc0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f5b5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f5b5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f590
jmp 0x14000f5ba
test rdx, rdx
jne 0x14000f5be
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x4bc0]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x4fd0]
lea r8, str.SOFTWAREASUSAXSP
lea rax, [rbp + 0x4fd0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f615
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f615
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f5f0
jmp 0x14000f61a
test rdx, rdx
jne 0x14000f61e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x4fd0]
call fcn.1400096e0
mov rdx, rbx
lea rcx, [rbp + 0x53e0]
lea r8, str.SYSTEMControlSet001Services_asComSvc
lea rax, [rbp + 0x53e0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x14000f675
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f675
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f650
jmp 0x14000f67a
test rdx, rdx
jne 0x14000f67e
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x53e0]
call fcn.1400096e0
lea rcx, [rbp + 0x57f0]
lea rdx, str.SYSTEMCurrentControlSetServices_asComSvc
lea rax, [rbp + 0x57f0]
sub rdx, rax
nop word [rax + rax]
lea rax, [rbx + 0x7ffffdf6]
test rax, rax
je 0x14000f6d4
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14000f6d4
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14000f6b0
jmp 0x14000f6d9
test rbx, rbx
jne 0x14000f6dd
sub rcx, 2
mov word [rcx], di
lea rdx, [rbp + 0x57f0]
call fcn.1400096e0
mov byte [rsp + 0x68], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x58], edi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREWOW6432NodeASUSARMOURY_CRATE_Diagnosis
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000f822
mov rbx, qword [rsp + 0x60]
lea ecx, [rax + 0x18]
call fcn.14002d4d4
mov rdx, rbx
mov rcx, rax
call fcn.14002b1d0
mov qword [rsp + 0x78], rax
mov ecx, 0x18
call fcn.14002d4d4
mov rdx, rbx
mov rcx, rax
call fcn.14002b270
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x68], 1
mov dword [rbp - 0x70], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x24]
xor r8d, r8d
lea rdx, str.EnableLog
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [rsp + 0x68], 0
je 0x14000f7ca
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x68], 0
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x14000f7f1
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14000f818
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
cmp dword [rsp + 0x58], 6
jne 0x14000f85c
mov r12d, 1
lea rcx, [rbp + 0xd00]
call fcn.14000a290
cmp qword [rax + 0x18], 0x10
jb 0x14000f845
mov rax, qword [rax]
mov r8, rax
lea rcx, [rsp + 0x60]
call fcn.14002b480
test al, al
je 0x14000f85c
movzx ebx, r12b
jmp 0x14000f85e
xor bl, bl
test r12b, 1
je 0x14000f8a9
and r12d, 0xfffffffe
mov rdx, qword [rbp + 0xd18]
cmp rdx, 0x10
jb 0x14000f8a9
inc rdx
mov rcx, qword [rbp + 0xd00]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f8a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400103a9
call fcn.14002d510
test bl, bl
je 0x14000f953
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x78], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableLog
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [rsp + 0x68], 0
je 0x14000f8fb
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x68], 0
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x14000f922
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14000f949
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
call fcn.1400087f0
mov qword [rbp + 0x138], rdi
lea rcx, str.main:_RegisterService
mov qword [rbp + 0x350], rcx
mov qword [rbp + 0x358], 0x15
movaps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x590], xmm0
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x140], rdi
movups xmm0, xmmword [rbp + 0x130]
movaps xmmword [rbp + 0x890], xmm0
movsd xmm1, qword [rbp + 0x140]
movsd qword [rbp + 0x8a0], xmm1
lea r9, [rbp + 0x590]
mov r8d, 1
lea rdx, [rbp + 0x890]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
lea rcx, [rbp + 0xb40]
call fcn.14000c420
movzx esi, al
test al, al
je 0x14000fa8f
call fcn.1400087f0
mov qword [rbp + 0x150], rdi
lea rcx, str.main:_RegisterService__sucessfully
mov qword [rbp + 0x360], rcx
mov qword [rbp + 0x368], 0x22
movaps xmm0, xmmword [rbp + 0x360]
movdqa xmmword [rbp + 0x500], xmm0
mov qword [rbp + 0x148], rdi
mov qword [rbp + 0x158], rdi
movups xmm0, xmmword [rbp + 0x148]
movaps xmmword [rbp + 0x8b0], xmm0
movsd xmm1, qword [rbp + 0x158]
movsd qword [rbp + 0x8c0], xmm1
lea r9, [rbp + 0x500]
mov r8d, 1
lea rdx, [rbp + 0x8b0]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.14000cb20
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000cfa0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000fb8f
call fcn.1400087f0
mov qword [rbp + 0x168], rdi
lea rcx, str.main:_RegisterService__failure
mov qword [rbp + 0x370], rcx
mov qword [rbp + 0x378], 0x1e
movaps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rbp + 0x510], xmm0
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x170], rdi
movups xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x8d0], xmm0
movsd xmm1, qword [rbp + 0x170]
movsd qword [rbp + 0x8e0], xmm1
lea r9, [rbp + 0x510]
mov r8d, 1
lea rdx, [rbp + 0x8d0]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.1400087f0
mov qword [rbp + 0x180], rdi
lea rcx, str.main:_Software_registry_is_empty
mov qword [rbp + 0x380], rcx
mov qword [rbp + 0x388], 0x20
movaps xmm0, xmmword [rbp + 0x380]
movdqa xmmword [rbp + 0x520], xmm0
mov qword [rbp + 0x178], rdi
mov qword [rbp + 0x188], rdi
movups xmm0, xmmword [rbp + 0x178]
movaps xmmword [rbp + 0x8f0], xmm0
movsd xmm1, qword [rbp + 0x188]
movsd qword [rbp + 0x900], xmm1
lea r9, [rbp + 0x520]
mov r8d, 1
lea rdx, [rbp + 0x8f0]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
mov byte [rbp - 0x40], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
test sil, sil
je 0x14000fbce
or r12d, 2
lea rcx, [rbp + 0xd20]
call fcn.14000a290
cmp qword [rax + 0x18], 0x10
jb 0x14000fbba
mov rax, qword [rax]
mov r8, rax
lea rcx, [rbp - 0x48]
call fcn.14002b480
test al, al
je 0x14000fbce
mov bl, 1
jmp 0x14000fbd0
xor bl, bl
test r12b, 2
je 0x14000fc17
mov rdx, qword [rbp + 0xd38]
cmp rdx, 0x10
jb 0x14000fc17
inc rdx
mov rcx, qword [rbp + 0xd20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400103af
call fcn.14002d510
test bl, bl
je 0x14000fe89
lea rcx, [rbp + 0xd80]
call fcn.14000a6e0
lea r8, [rbp + 0xb40]
cmp qword [rbp + 0xb58], 0x10
cmovae r8, qword [rbp + 0xb40]
mov r9, qword [rbp + 0xb50]
xor edx, edx
mov rcx, rax
call fcn.140001d70
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xba0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xbb0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xd98]
cmp rdx, 0x10
jb 0x14000fcb8
inc rdx
mov rcx, qword [rbp + 0xd80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fcb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400103b5
call fcn.14002d510
lea rax, str.VERSION_
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x398], 0xa
call fcn.1400087f0
mov qword [rbp + 0x1e0], rdi
mov qword [rbp + 0x1d8], rdi
mov qword [rbp + 0x1e8], rdi
movaps xmm0, xmmword [rbp + 0x390]
movdqa xmmword [rbp + 0x530], xmm0
movups xmm1, xmmword [rbp + 0x1d8]
movaps xmmword [rbp + 0x910], xmm1
movsd xmm0, qword [rbp + 0x1e8]
movsd qword [rbp + 0x920], xmm0
lea rcx, [rbp + 0xb20]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x530]
lea rdx, [rbp + 0x910]
mov rcx, qword [rax + 0x1d8]
call fcn.140020130
lea rax, str.EXEPATH_
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], 0xa
call fcn.1400087f0
mov qword [rbp + 0x198], rdi
mov qword [rbp + 0x190], rdi
mov qword [rbp + 0x1a0], rdi
movaps xmm0, xmmword [rbp + 0x3b0]
movdqa xmmword [rbp + 0x540], xmm0
movups xmm1, xmmword [rbp + 0x190]
movaps xmmword [rbp + 0x930], xmm1
movsd xmm0, qword [rbp + 0x1a0]
movsd qword [rbp + 0x940], xmm0
lea rcx, [rbp + 0xba0]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x540]
lea rdx, [rbp + 0x930]
mov rcx, qword [rax + 0x1d8]
call fcn.140020130
lea rcx, [rbp + 0xb20]
cmp qword [rbp + 0xb38], 0x10
cmovae rcx, qword [rbp + 0xb20]
mov eax, dword [rbp + 0xb30]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.VERSION
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rbp + 0xba0]
cmp qword [rbp + 0xbb8], 0x10
cmovae rcx, qword [rbp + 0xba0]
mov eax, dword [rbp + 0xbb0]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.EXEPATH
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp + 0xbb8]
cmp rdx, 0x10
jb 0x14000fe89
inc rdx
mov rcx, qword [rbp + 0xba0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fe84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400103bb
call fcn.14002d510
cmp byte [rbp - 0x40], 0
je 0x14000fe9d
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp - 0x40], 0
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x14000fec3
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x14000fee9
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x38], rdi
mov byte [rbp - 0x60], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
test sil, sil
je 0x140010090
lea r8, str.SOFTWAREWOW6432NodeASUSAXSP
lea rcx, [rbp - 0x68]
call fcn.14002b480
test al, al
je 0x14001007c
lea rcx, [rbp + 0xd40]
call fcn.14000a6e0
lea r8, [rbp + 0xb40]
cmp qword [rbp + 0xb58], 0x10
cmovae r8, qword [rbp + 0xb40]
mov r9, qword [rbp + 0xb50]
xor edx, edx
mov rcx, rax
call fcn.140001d70
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc00], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xd58]
cmp rdx, 0x10
jb 0x14000ffb7
inc rdx
mov rcx, qword [rbp + 0xd40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ffb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400103c1
call fcn.14002d510
lea rcx, [rbp + 0xb20]
cmp qword [rbp + 0xb38], 0x10
cmovae rcx, qword [rbp + 0xb20]
mov eax, dword [rbp + 0xb30]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.VERSION
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rbp + 0xc00]
cmp qword [rbp + 0xc18], 0x10
cmovae rcx, qword [rbp + 0xc00]
mov eax, dword [rbp + 0xc10]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.EXEPATH
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp + 0xc18]
cmp rdx, 0x10
jb 0x14001007c
inc rdx
mov rcx, qword [rbp + 0xc00]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010077
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010379
call fcn.14002d510
cmp byte [rbp - 0x60], 0
je 0x140010090
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp - 0x60], 0
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x1400100b6
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x1400100dc
mov dword [rbx + 0x10], edi
mov rcx, qword [rbx + 8]
call fcn.14002d510
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14002d510
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x58], rdi
test sil, sil
je 0x1400102e5
cmp qword [rbp + 0xb70], 0
jne 0x140010232
call fcn.1400087f0
mov qword [rbp + 0x1b0], rdi
lea rcx, str.new_install
mov qword [rbp + 0x3c0], rcx
mov qword [rbp + 0x3c8], 0xb
movaps xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x1a8], rdi
mov qword [rbp + 0x1b8], rdi
movups xmm0, xmmword [rbp + 0x1a8]
movaps xmmword [rbp + 0x950], xmm0
movsd xmm1, qword [rbp + 0x1b8]
movsd qword [rbp + 0x960], xmm1
lea r9, [rbp + 0x550]
mov r8d, 1
lea rdx, [rbp + 0x950]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
call fcn.14000da80
call fcn.1400087f0
mov qword [rbp + 0x1c8], rdi
lea rcx, str.release_gLeaveSetupMutex
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0x18
movaps xmm0, xmmword [rbp + 0x3d0]
movdqa xmmword [rbp + 0x560], xmm0
mov qword [rbp + 0x1c0], rdi
mov qword [rbp + 0x1d0], rdi
movups xmm0, xmmword [rbp + 0x1c0]
movaps xmmword [rbp + 0x970], xmm0
movsd xmm1, qword [rbp + 0x1d0]
movsd qword [rbp + 0x980], xmm1
lea r9, [rbp + 0x560]
mov r8d, 1
lea rdx, [rbp + 0x970]
mov rcx, qword [rax + 0x1d8]
call fcn.140005930
lea rcx, [rbp + 0x570]
call fcn.140008c50
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
lea rcx, [rbp + 0x570]
call fcn.1400113a0
nop
call fcn.1400087f0
mov rcx, rax
call fcn.140008670
jmp 0x14001027d
call fcn.1400151a0
call fcn.14000da80
lea rcx, str.release_gLeaveSetupMutex
call fcn.140014f40
lea rcx, [rbp + 0x580]
call fcn.140008c50
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
lea rcx, [rbp + 0x580]
call fcn.1400113a0
nop
call fcn.1400087f0
mov rcx, rax
call fcn.140008670
mov edi, 1
lea rcx, [rbp - 0x68]
call fcn.14002b540
lea rcx, [rbp - 0x48]
call fcn.14002b540
lea rcx, [rsp + 0x60]
call fcn.14002b540
lea rcx, [rbp + 0xb40]
call fcn.140001130
lea rcx, [rbp + 0xc20]
call fcn.1400010c0
lea rcx, [rbp + 0xc40]
call fcn.1400010c0
lea rcx, [rbp + 0xd60]
call fcn.1400010c0
lea rcx, [rbp + 0xb60]
call fcn.140001130
lea rcx, [rbp + 0xb20]
call fcn.140001130
mov eax, edi
jmp 0x140010349
lea rcx, [rbp - 0x68]
call fcn.14002b540
lea rcx, [rbp - 0x48]
call fcn.14002b540
lea rcx, [rsp + 0x60]
call fcn.14002b540
lea rcx, [rbp + 0xb40]
call fcn.140001130
lea rcx, [rbp + 0xc20]
call fcn.1400010c0
lea rcx, [rbp + 0xc40]
call fcn.1400010c0
lea rcx, [rbp + 0xd60]
call fcn.1400010c0
lea rcx, [rbp + 0xb60]
call fcn.140001130
lea rcx, [rbp + 0xb20]
call fcn.140001130
mov rcx, qword [rbp + 0x5c00]
xor rcx, rsp
call fcn.14002d4b0
lea r11, [rsp + 0x5d10]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3
call fcn.14004ecdc
int3