Function at 0x140026730
Capabilities:
Check if file exists
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x14010b010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
call fcn.140026d10
test eax, eax
jne 0x140026a0d
lea rcx, [rdi + 0x70]
cmp qword [rcx + 0x18], 8
jb 0x140026775
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140026a0d
xor ebx, ebx
mov qword [rbp - 0x19], rbx
mov qword [rbp - 9], rbx
mov qword [rbp - 1], 7
mov word [rbp - 0x19], bx
lea r8d, [rbx + 0xe]
lea rdx, str.DownloadRegion
lea rcx, [rbp - 0x19]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea rdx, [rdi + 0x230]
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], bx
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400267d0
lea rcx, [rbp - 0x39]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
call fcn.140001760
mov rcx, rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
mov r8, 0xffffffff80000002
lea rdx, [rbp + 0xf]
call fcn.14005bd20
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x14002684b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026cf2
call fcn.140061310
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], bx
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x14002689b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026896
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026cf8
call fcn.140061310
mov qword [rbp - 9], rbx
mov qword [rbp - 1], 7
mov word [rbp - 0x19], bx
lea r9, [rbp + 0xf]
mov rdi, qword [rbp + 0xf]
mov rsi, qword [rbp + 0x27]
cmp rsi, 8
cmovae r9, rdi
mov edx, 2
mov r10, qword [rbp + 0x1f]
cmp r10, rdx
jne 0x1400268f7
mov r8d, edx
lea rcx, [0x1400dd5d0]
sub r9, rcx
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r9 + rcx], ax
jne 0x1400268f7
add rcx, rdx
sub r8, 1
jne 0x1400268e0
mov al, 1
jmp 0x140026928
lea r8, [rbp + 0xf]
cmp rsi, 8
cmovae r8, rdi
cmp r10, rdx
jne 0x140026985
lea rcx, [0x1400ddb40]
sub r8, rcx
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140026985
add rcx, 2
sub rdx, 1
jne 0x140026912
xor al, al
mov byte [r14], al
cmp rsi, 8
jb 0x140026966
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002695e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026cfe
mov rcx, rdi
call fcn.140061310
mov eax, 1
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400612f0
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, 0x5c
lea rbx, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceNpsHelper.cpp
mov rcx, rbx
call fcn.14008d398
test rax, rax
je 0x1400269af
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d398
lea rbx, [rax + 1]
lea r9, str.Read_DownloadRegion_reg_fail
lea r8, str.DownloadJwtFileStatus
mov edx, 0x24b
mov rcx, rbx
call fcn.140015b90
nop
cmp rsi, 8
jb 0x140026a06
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400269fe
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026cfe
mov rcx, rdi
call fcn.140061310
xor eax, eax
jmp 0x14002696b
mov rdx, r14
mov rcx, rdi
call fcn.1400260a0
test eax, eax
jne 0x140026a66
lea edx, [rax + 0x5c]
lea rbx, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceNpsHelper.cpp
mov rcx, rbx
call fcn.14008d398
test rax, rax
je 0x140026a44
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d398
lea rbx, [rax + 1]
lea r9, str.Download_jwt_file_fail
lea r8, str.DownloadJwtFileStatus
mov edx, 0x232
mov rcx, rbx
call fcn.140015b90
xor eax, eax
jmp 0x14002696b
lea rdx, [rbp + 0xf]
call fcn.140028660
nop
xor ebx, ebx
mov qword [rbp - 0x19], rbx
mov qword [rbp - 9], rbx
mov qword [rbp - 1], 7
mov word [rbp - 0x19], bx
lea r8d, [rbx + 0x13]
lea rdx, str.DownloadJwtFileTime
lea rcx, [rbp - 0x19]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea rdx, [rdi + 0x230]
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], bx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140026ac0
lea rcx, [rbp - 0x39]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
call fcn.140001760
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140026b62
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rcx, qword [rbp + 0xf]
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov eax, dword [rbp + 0x1f]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140026ba7
mov edx, 0x5c
lea rdi, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceUtility.cpp
mov rcx, rdi
call fcn.14008d398
test rax, rax
je 0x140026b8c
mov edx, 0x5c
mov rcx, rdi
call fcn.14008d398
lea rdi, [rax + 1]
lea r9, str.Set_FAIL
lea r8, str.RegWriteString
mov edx, 0x1a1
mov rcx, rdi
call fcn.140015b90
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140026bb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x140026bf7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026bf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026d04
call fcn.140061310
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], bx
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x140026c47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026c42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026ce6
call fcn.140061310
mov edx, 0x5c
lea rbx, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceNpsHelper.cpp
mov rcx, rbx
call fcn.14008d398
test rax, rax
je 0x140026c71
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d398
lea rbx, [rax + 1]
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rax, qword [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea r9, str.Download_Jwt_File_Time___s
lea r8, str.DownloadJwtFileStatus
mov edx, 0x239
mov rcx, rbx
call fcn.140015b90
mov byte [rsi], 1
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140026966
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026961
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026cec
jmp 0x140026961
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
int3