Function at 0x1400eef60
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov edi, r8d
mov rsi, rcx
cmp edx, 0x26001401
ja 0x1400ebbcf
je 0x1400ebb74
add edx, 0xd9ffeeff
cmp edx, 5
ja case.0x1400ebbf9.637599764
mov eax, edx
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0xec11c]
add rax, rdx
jmp rax
mov rdx, qword [rcx + 0x90]
test rdx, rdx
jne 0x1400eb915
lea r8, str.VenderSpecSetting.cpp
mov edx, 0x641
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor ebx, ebx
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdx, qword [rdx + 0x1bd8]
test rdx, rdx
je 0x1400eb95b
mov rax, rdx
test rdx, rdx
je 0x1400ec110
mov rax, qword [rax + 0x10]
mov rdx, qword [rdx]
test rax, rax
je 0x1400eb956
cmp dword [rax + 0x168], 0
je 0x1400eb956
mov ecx, edi
test edi, edi
je 0x1400eb9cd
sub ecx, 1
je 0x1400eb9b0
cmp ecx, 1
je 0x1400eb974
test rdx, rdx
jne 0x1400eb921
mov ebx, 1
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [0x1403ff420]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2300010f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1403ff420]
xor ebx, ebx
test eax, eax
mov edx, 0x2300010f
sete bl
xor r9d, r9d
mov r10, qword [rcx]
mov r8d, ebx
call qword [r10 + 0x28]
mov ebx, eax
jmp 0x1400eb960
mov rcx, qword [0x1403ff420]
xor r9d, r9d
mov edx, 0x2300010f
mov rax, qword [rcx]
lea r8d, [r9 + 1]
call qword [rax + 0x28]
mov ebx, eax
jmp 0x1400eb960
mov rcx, qword [0x1403ff420]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2300010f
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ebx, eax
jmp 0x1400eb960
cmp dword [0x1403ff5f4], 0
je 0x1400eba10
lea rdx, str._2Finformation_2Fprivacy
lea rcx, [rsp + 0x40]
call fcn.140015b30
xor edx, edx
mov rcx, rax
call fcn.14007a230
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp 0x1400eef60
mov rcx, qword [rcx - 0xa8]
mov edx, 0xa359
cmp edi, 1
jne 0x1400eba58
xor r9d, r9d
lea r8d, [rdi + 0x63]
call qword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.USER32.dll_KillTimer]
jmp case.0x1400ebbf9.637599764
mov rcx, qword [0x1403ff420]
xor r9d, r9d
mov edx, 0x21010093
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsi - 0xa8]
mov edx, 0xa360
cmp edi, 1
jne 0x1400ebaa7
xor r9d, r9d
lea r8d, [rdi + 0x77]
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.USER32.dll_KillTimer]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [0x1403ff420]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000201
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400ebaf8
mov rcx, qword [0x1403ff420]
xor r9d, r9d
mov r8d, edi
mov edx, 0x23000211
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x1403ff420]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000202
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400ec01a
mov rcx, qword [0x1403ff420]
xor r9d, r9d
mov r8d, edi
mov edx, 0x23000212
mov rax, qword [rcx]
call qword [rax + 0x28]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [0x1403ff420], 0
jne 0x1400eb95b
lea r8, str.VenderSpecSetting.cpp
mov edx, 0x6d5
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor ebx, ebx
jmp 0x1400eb960
mov rcx, qword [0x1403ff5d0]
xor ebx, ebx
mov dword [rsp + 0x78], edi
test rcx, rcx
je 0x1400ebbbb
mov edx, 4
mov dword [rsp + 0x40], ebx
lea rax, [rsp + 0x40]
mov r9d, edx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x78]
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x78]
mov edx, 0x300
mov qword [rsp + 0x20], rax
call fcn.140060440
mov ebx, eax
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
add edx, 0xd9feffef
cmp edx, 0x65
ja case.0x1400ebbf9.637599764
mov eax, edx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0xec174]
mov ecx, dword [rdx + rax*4 + 0xec134]
add rcx, rdx
jmp rcx
mov rax, qword [rsi + 0x90]
mov qword [rsp + 0x70], rbp
lea rbp, [rsi - 0xe8]
test byte [rax + 0x80], 1
je 0x1400ebcad
mov rcx, qword [0x1403ff420]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000211
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400ebc9a
mov rcx, rbp
call fcn.1400ec730
mov edx, 4
movzx esi, ax
mov ebx, eax
lea rcx, str.CVenderSpecSetting::GetAsusRogAmpLevelMode_nAmpLevlVal___x__nRearLevelMode___d__nFrontLevelMode___d
shr ebx, 0x10
cmp ebx, 2
cmova ebx, edx
cmp esi, 2
mov r9d, ebx
cmova esi, edx
mov edx, eax
mov r8d, esi
call fcn.140055180
mov rcx, qword [0x1403ff420]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x21ff0309
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp eax, 3
je 0x1400ebc9c
mov r8d, ebx
mov edx, edi
mov rcx, rbp
mov esi, edi
call fcn.1400ec6e0
jmp 0x1400ebcb7
mov esi, edi
mov ebx, edi
mov edx, esi
mov r8d, ebx
mov rcx, rbp
call fcn.1400ec6e0
jmp 0x1400ebcb7
mov edx, edi
mov rcx, rbp
call fcn.1400ec940
mov edx, eax
mov ebx, eax
call fcn.1400ec530
mov rbp, qword [rsp + 0x70]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400ebd15
mov edx, edi
call fcn.140010b50
test eax, eax
je 0x1400ebd15
mov ebx, 1
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor ebx, ebx
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400ebd15
mov edx, edi
call fcn.140010ca0
test eax, eax
je 0x1400ebd15
mov ebx, 1
jmp 0x1400ebd17
mov rsi, qword [rsi + 0xb8]
test rsi, rsi
je 0x1400ebe18
lea r8, str.AsusSoundStageFeatureBitsData
lea rdx, str.DevRestore
lea rcx, [0x140400ce0]
test edi, edi
je 0x1400ebdd6
mov r9d, 0x11
call fcn.1401076a0
mov r9d, 2
lea r8, str.AsusSoundStageMasterVolume
lea rdx, str.DevRestore
mov ebx, eax
lea rcx, [0x140400ce0]
call fcn.1401076a0
movzx ecx, byte [rsi + 0x21]
shl cx, 8
movzx edx, cx
mov ecx, 0x26010056
movzx eax, al
or edx, eax
mov dword [rsi + 0x18], ebx
mov dword [rsi + 0x20], edx
call fcn.1400271f0
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov r9d, dword [rsi + 0x18]
movzx ebx, byte [rsi + 0x20]
call fcn.140107c34
mov r9d, ebx
mov dword [rsi + 0x18], 0x11
lea r8, str.AsusSoundStageMasterVolume
lea rdx, str.DevRestore
lea rcx, [0x140400ce0]
call fcn.140107c34
movzx eax, byte [rsi + 0x21]
shl ax, 8
movzx ecx, ax
or ecx, 2
mov dword [rsi + 0x20], ecx
mov ecx, 0x26010056
call fcn.1400271f0
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400ebe73
mov edx, edi
call fcn.140010f40
test eax, eax
je 0x1400ebe73
mov ecx, 0x26010050
mov ebx, 1
call fcn.1400271f0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor ebx, ebx
mov ecx, 0x26010050
call fcn.1400271f0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400ebd15
cmp dword [rdx], 0
jne 0x1400ebeb9
lea r8, str.AsusAcpi.cpp
mov edx, 0x274
jmp 0x1400ebd09
movzx eax, byte [rdx + 0x20]
movzx ecx, dil
shl cl, 4
xor ecx, eax
movzx eax, byte [rdx + 0x20]
and ecx, 0x70
xor ecx, eax
mov dword [rdx + 0x20], ecx
mov eax, dword [rdx + 0x18]
mov ebx, 1
and eax, 0xffffffee
or eax, 0x22
mov dword [rdx + 0x18], eax
jmp 0x1400ebd17
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400ebd15
cmp dword [rdx], 0
jne 0x1400ebf0e
lea r8, str.AsusAcpi.cpp
mov edx, 0x29f
jmp 0x1400ebd09
movzx ecx, byte [rdx + 0x24]
mov ebx, 1
movzx eax, dil
xor ecx, eax
movzx eax, byte [rdx + 0x24]
and ecx, 7
xor ecx, eax
mov eax, dword [rdx + 0x18]
and eax, 0xffffffee
mov dword [rdx + 0x24], ecx
or eax, 0x44
mov dword [rdx + 0x18], eax
jmp 0x1400ebd17
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400ebd15
cmp dword [rdx], 0
jne 0x1400ebf60
lea r8, str.AsusAcpi.cpp
mov edx, 0x2b5
jmp 0x1400ebd09
movzx ecx, byte [rdx + 0x1c]
mov ebx, 1
movzx eax, dil
xor ecx, eax
movzx eax, byte [rdx + 0x1c]
and ecx, 7
xor ecx, eax
mov eax, dword [rdx + 0x18]
and eax, 0xffffffee
mov dword [rdx + 0x1c], ecx
or eax, 0x88
mov dword [rdx + 0x18], eax
jmp 0x1400ebd17
mov rdx, qword [rsi + 0xb8]
test rdx, rdx
je 0x1400ebd15
cmp dword [rdx], 0
jne 0x1400ebfb4
lea r8, str.AsusAcpi.cpp
mov edx, 0x28a
jmp 0x1400ebd09
and dil, 0xf
movzx eax, dil
mov ecx, eax
shl ecx, 4
or ecx, eax
mov dword [rdx + 0x28], ecx
jmp 0x1400ebed2
lea rcx, [rsi - 0xe8]
mov edx, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.1400edcc0
lea rcx, [rsi - 0xe8]
mov edx, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.1400edb70
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x1400ec01a
call fcn.140011520
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [0x1403df148]
xor ebx, ebx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x78], ebx
test eax, eax
jg 0x1400ec07c
lea r8, str.DriverPropertyClient.cpp
lea edx, [rbx + 0x61]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor edx, edx
mov ecx, 0x26010072
call fcn.1400271a0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
movups xmm0, xmmword [0x140345590]
movaps xmmword [rsp + 0x50], xmm0
test rax, rax
jle 0x1400ec116
mov rcx, qword [0x1403df140]
lea rax, [rsp + 0x78]
mov edx, 4
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
lea r9d, [rdx - 3]
lea r8d, [rdx + 0x2c]
lea rdx, [rsp + 0x50]
call fcn.14005f420
xor edx, edx
mov ecx, 0x26010072
mov ebx, eax
call fcn.1400271a0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor ebx, ebx
lea r11, [rsp + 0x60]
test edi, edi
mov eax, 1
setne bl
mov dword [rsi + 0xac], ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400f91a0
int3
call fcn.1400f91a0
int3
push rbp
lea rbp, [rsp - 0x1fd0]
mov eax, 0x20d0
call fcn.14029e430
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x20e0], rbx
mov qword [rsp + 0x20e8], rsi
mov qword [rsp + 0x20f0], rdi
mov qword [rsp + 0x20f8], r14
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rbp + 0x1fc0], rax
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x1400ef151
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp - 0x40]
or rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400eeff0
xor r14d, r14d
cmp word [rbp + rax*2 - 0x42], 0x5c
jne 0x1400ef020
lea rax, [rax*2 - 2]
cmp rax, 0x2000
jae 0x1400ef167
mov word [rbp + rax - 0x40], r14w
lea r8, [rbp - 0x40]
lea rdx, str._sHPGoogleAnalyticsPrivacyPolicy.htm
lea rcx, [rsp + 0x30]
call fcn.14000dfa0
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x1400ef15c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rbx, str.HTML_FILE
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140015a40
test al, al
jne 0x1400ef09b
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400ef080
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400105e0
nop
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx - 0x18]
call fcn.140015740
add rax, 0x18
mov qword [rsp + 0x28], rax
mov r8d, 0x66
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140027410
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14029ff20
mov dword [rsp + 0x50], VarBstrFromDisp
mov qword [rsp + 0x58], r14
lea rax, str.open
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov dword [rbp - 0x80], 3
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lock xadd dword [rbx - 8], esi
sub esi, 1
jg 0x1400ef120
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x1fc0]
xor rcx, rsp
call fcn.14029d880
lea r11, [rsp + 0x20d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
int3
call fcn.14029dc94
int3