Function at 0x14001a270
Capabilities:
Check if file exists
Delete file
Move file
Timestomp file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x14010b010]
xor rax, rsp
mov qword [rbp + 0xb8], rax
mov r15, rdx
mov r12, rcx
mov qword [rbp - 0x78], rdx
mov edx, 0x5c
lea r13, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceLogSessionHelper.cpp
mov rcx, r13
call fcn.14008d398
test rax, rax
je 0x14001a2d5
mov edx, 0x5c
mov rcx, r13
call fcn.14008d398
inc rax
jmp 0x14001a2d8
mov rax, r13
lea r9, str.Start
lea r8, str.BackupEtlFile
mov edx, 0x14e
mov rcx, rax
call fcn.140015b90
add r12, 8
mov rcx, qword [r12 + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14001b2f3
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x14001a322
mov r9, qword [r12]
mov qword [rsp + 0x30], 1
lea rax, [0x1400da084]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r12
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x14001a35b
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea r8d, [rbx + 4]
lea rdx, str..etl
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001a412
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a40d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b2f9
call fcn.140061310
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], bx
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001a462
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a45d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b2ff
call fcn.140061310
mov qword [rbp], rbx
mov qword [rbp + 8], 7
mov word [rbp - 0x10], bx
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001a5a9
lea edx, [rax + 0x5c]
mov rcx, r13
call fcn.14008d398
test rax, rax
je 0x14001a4af
mov edx, 0x5c
mov rcx, r13
call fcn.14008d398
lea r13, [rax + 1]
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, str.File_not_exist__file_path___s
lea r8, str.BackupEtlFile
mov edx, 0x155
mov rcx, r13
call fcn.140015b90
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001a51e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14001a519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b33b
call fcn.140061310
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14001a56d
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14001a568
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b341
mov rcx, r8
call fcn.140061310
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov word [r15], bx
xor eax, eax
mov rcx, qword [rbp + 0xb8]
xor rcx, rsp
call fcn.1400612f0
mov rbx, qword [rsp + 0x210]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x18]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x18]
call fcn.14001b360
test eax, eax
je 0x14001a4de
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rbp + 0x68]
shr rdx, 0x17
movabs rax, 0x2b6109100
sub rdx, rax
mov qword [rbp + 0x88], rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], eax
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x90]
call fcn.14009c0c0
test eax, eax
jne 0x14001a4de
mov dword [rbp + 0x10], 1
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], bx
xor r8d, r8d
mov edx, 0x104
lea rcx, [rbp - 0x30]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_unsigned_long_long_unsigned___int64___wchar_t____ptr64
nop
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
movzx esi, byte [rsp + 0x40]
mov r14, 0xffffffffffffffff
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
mov r8d, 0x104
call fcn.14008d8a0
mov r9, r15
cmp qword [r15 + 0x18], 8
jb 0x14001a6a0
mov r9, qword [r15]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov r8d, dword [rbp + 0xa0]
inc r8d
mov edx, dword [rbp + 0xa4]
add edx, 0x76c
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x9c]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], edx
lea r8, str._s__d__02d__02d__05d.etl
mov edx, 0x104
call fcn.1400103a0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp], rax
mov qword [rbp + 8], 7
mov word [rbp - 0x10], ax
mov r8, r14
inc r8
cmp word [rdx + r8*2], ax
jne 0x14001a716
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rcx, qword [r12 + 0x10]
movabs r14, 0x7ffffffffffffffe
mov rax, r14
sub rax, rcx
cmp rax, 1
jb 0x14001b2ed
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x14001a758
mov r9, qword [r12]
mov qword [rsp + 0x30], 1
lea rax, [0x1400da084]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r12
movzx edx, bl
lea rcx, [rsp + 0x48]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x48]
movzx edx, dil
lea rcx, [rbp + 0x18]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64____ptr64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14001a7dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a7d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b30b
call fcn.140061310
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001a81d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b347
call fcn.140061310
mov rax, r14
mov rcx, qword [rbp + 0x28]
sub rax, rcx
cmp rax, 4
jb 0x14001b2e1
lea r9, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae r9, qword [rbp + 0x18]
mov qword [rsp + 0x30], 4
lea rax, str..zip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x18]
movzx edx, sil
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete r14b
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete al
test r14b, r14b
je 0x14001a8aa
test al, al
jne 0x14001aa3a
mov r14d, dword [rbp + 0x10]
inc r14d
mov dword [rbp + 0x10], r14d
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001a8f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a8f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b347
call fcn.140061310
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], ax
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x14001a947
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a942
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b34d
call fcn.140061310
cmp r14d, 0x4e20
jl 0x14001a671
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001a994
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a98f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b305
call fcn.140061310
xor ebx, ebx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], bx
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001a9e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a9e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b353
call fcn.140061310
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14001a56d
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14001a568
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b2e7
jmp 0x14001a565
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001aa7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b347
call fcn.140061310
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], bx
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x14001aacc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aac7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b34d
call fcn.140061310
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
mov qword [rbp + 8], 7
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x14001aaf1
mov r8, rax
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001ab47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ab42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b32f
call fcn.140061310
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rbp]
movups xmmword [rbp - 0x20], xmm1
mov rcx, qword [r12 + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 1
jb 0x14001b311
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x14001ab85
mov r9, qword [r12]
mov qword [rsp + 0x30], 1
lea rax, [0x1400da084]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r12
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor r12d, r12d
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001ac3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ac35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b317
call fcn.140061310
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r12w
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rdx, qword [rbp + 0x38]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov edx, 0x5c
mov rcx, r13
call fcn.14008d398
mov rcx, r13
test rax, rax
je 0x14001ac95
mov edx, 0x5c
call fcn.14008d398
lea rcx, [rax + 1]
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rdx, qword [rbp + 0x38]
lea r8, [0x1400dbe28]
lea r14, [0x1400dbe38]
mov rax, r14
test bl, bl
cmovne rax, r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, str.Backup_result___s__file_path___s
lea r8, str.BackupEtlFile
mov edx, 0x187
call fcn.140015b90
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001b199
mov rax, qword [rbp + 0x48]
sub rdi, rax
cmp rdi, 4
jb 0x14001b31d
lea r9, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae r9, qword [rbp + 0x38]
mov qword [rsp + 0x30], 4
lea rcx, str..zip
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x38]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x10]
call sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64___wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x48], r12
movdqu xmmword [rsp + 0x58], xmm0
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x48]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov edx, 1
lea rcx, [rbp + 0x70]
call fcn.14001cd50
lea rax, [rbp + 0x70]
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov rbx, qword [rbp + 0x70]
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea rax, [rbp + 0x70]
mov qword [rbp - 0x60], rax
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
lea rdx, [rsp + 0x48]
mov rcx, rbx
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
add rbx, 0x20
mov rdx, rbx
mov rcx, rbx
call fcn.14001d4d0
mov qword [rbp + 0x78], rbx
lea r9, [sym.AsusAppService.exe_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x48]
call fcn.140061b14
lea rax, [rbp + 0x18]
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r12
mov rdi, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x78]
cmp rdi, rsi
je 0x14001ae86
mov rdx, rsi
sub rdx, rdi
sar rdx, 5
lea rcx, [rbp + 0x18]
call fcn.14001cd50
lea rax, [rbp + 0x18]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov rbx, qword [rbp + 0x18]
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea rax, [rbp + 0x18]
mov qword [rbp - 0x60], rax
nop word [rax + rax]
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov rdx, rdi
mov rcx, rbx
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
add rbx, 0x20
mov qword [rbp - 0x68], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x14001ae50
mov rdx, rbx
mov rcx, rbx
call fcn.14001d4d0
mov qword [rbp + 0x20], rbx
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x68]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
mov esi, 4
mov rax, qword gs:[0x58]
add rsi, qword [rax]
mov eax, dword [rsi]
cmp dword [0x140110c60], eax
jle 0x14001aeeb
lea rcx, [0x140110c60]
call fcn.1400614b0
cmp dword [0x140110c60], 0xffffffff
jne 0x14001aeeb
lea rcx, [0x1400c7ad0]
call fcn.140061834
lea rcx, [0x140110c60]
call fcn.140061450
nop
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x68]
call fcn.140060020
test eax, eax
setne bl
mov edx, 0x5c
mov rcx, r13
call fcn.14008d398
mov rcx, r13
test rax, rax
je 0x14001af21
mov edx, 0x5c
call fcn.14008d398
lea rcx, [rax + 1]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov rax, r14
test bl, bl
lea rbx, [0x1400dbe28]
cmovne rax, rbx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, str.Zip_result___s__file_path___s
lea r8, str.BackupEtlFile
mov edx, 0x18f
call fcn.140015b90
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x10], r12
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001afcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, r12d
jmp 0x14001b00e
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne dil
lea rbx, [0x1400dbe28]
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001b04e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b049
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b323
call fcn.140061310
mov edx, 0x5c
mov rcx, r13
call fcn.14008d398
mov rcx, r13
test rax, rax
je 0x14001b071
mov edx, 0x5c
call fcn.14008d398
lea rcx, [rax + 1]
mov rax, r14
test dil, dil
cmovne rax, rbx
mov qword [rsp + 0x20], rax
lea r9, str.Update_zip_file_timestamp_result___s
lea r8, str.BackupEtlFile
mov edx, 0x193
call fcn.140015b90
lea rbx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rbx, qword [rbp - 0x10]
mov eax, dword [rsi]
cmp dword [0x140110c60], eax
jle 0x14001b0dd
lea rcx, [0x140110c60]
call fcn.1400614b0
cmp dword [0x140110c60], 0xffffffff
jne 0x14001b0dd
lea rcx, [0x1400c7ad0]
call fcn.140061834
lea rcx, [0x140110c60]
call fcn.140061450
mov rdx, rbx
call fcn.1400603f0
test eax, eax
setne bl
mov edx, 0x5c
mov rcx, r13
call fcn.14008d398
test rax, rax
je 0x14001b10d
mov edx, 0x5c
mov rcx, r13
call fcn.14008d398
lea r13, [rax + 1]
test bl, bl
lea rax, [0x1400dbe28]
cmovne r14, rax
mov qword [rsp + 0x20], r14
lea r9, str.Enable_file_account_privilege_result___s
lea r8, str.BackupEtlFile
mov edx, 0x197
mov rcx, r13
call fcn.140015b90
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x70]
call fcn.14001cce0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001b199
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b194
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b329
call fcn.140061310
movzx ebx, bl
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x14001b1dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b1d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b32f
call fcn.140061310
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r12w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001b22d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b228
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b335
call fcn.140061310
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001b27e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b279
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b33b
call fcn.140061310
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14001b2ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14001b2c5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b341
mov rcx, r8
call fcn.140061310
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
mov eax, ebx
jmp 0x14001a57f
call fcn.140001710
nop
call fcn.140091d94
nop
call fcn.140001710
nop
call fcn.140001710
nop
call fcn.140091d94
nop
call fcn.140091d94
int3
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140001710
nop
call fcn.140091d94
int3
call fcn.140001710
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
int3