Function at 0x1401804a0
Capabilities:
Create thread
Modify service
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x880]
sub rsp, 0x980
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rbp + 0x878], rax
mov rsi, rcx
lea rax, [rbp + 0x100]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x50], rax
xor r14d, r14d
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], 7
lea r8d, [r14 + 1]
lea rdx, [0x140347e98]
lea rcx, [rbp + 0x100]
call fcn.140101ff0
nop
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], 7
lea r8d, [r14 + 0xa]
lea rdx, str.DoingJ0Job
lea rcx, [rbp + 0x80]
call fcn.140101ff0
nop
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], 7
lea r8d, [r14 + 0x3e]
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x140]
call fcn.140101ff0
nop
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x140]
mov rcx, 0xffffffff80000002
call fcn.1401f1ca0
mov qword [rsp + 0x50], 1
mov dword [rbp + 0x520], 0x15180
mov qword [rbp + 0x530], r14
mov qword [rbp + 0x528], r14
mov dword [rbp + 0x538], 1
lea rax, [rsp + 0x50]
mov qword [rbp + 0x540], rax
xor edx, edx
xor ecx, ecx
lea r8d, [r14 + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140180659
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, eax
lea rcx, [0x140000000]
lea rdx, [rcx + 0x357f90]
lea rdx, [rdx + rax*2]
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140180631
lea rcx, [rbp + 0x160]
call fcn.140101ff0
lea rcx, [rbp + 0x160]
call fcn.1401a8890
jmp 0x140180780
mov r8d, 0xf003f
lea rdx, str.ASUSSystemAnalysis
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1401806d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, eax
lea rcx, [0x140000000]
lea rdx, [rcx + 0x357fc0]
lea rdx, [rdx + rax*2]
mov qword [rbp + 0x180], r14
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x198], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1401806b1
lea rcx, [rbp + 0x180]
call fcn.140101ff0
lea rcx, [rbp + 0x180]
call fcn.1401a8890
jmp 0x140180777
lea r8, [rbp + 0x520]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x140180730
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1b8], 7
lea r8d, [rax + 0x1c]
lea rdx, str.ChangeServiceConfig2_failed_n
lea rcx, [rbp + 0x1a0]
call fcn.140101ff0
lea rcx, [rbp + 0x1a0]
call fcn.1401a8890
jmp 0x14018076e
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], 7
mov r8d, 0x2a
lea rdx, str.Service_description_updated_successfully._n
lea rcx, [rbp + 0x1c0]
call fcn.140101ff0
lea rcx, [rbp + 0x1c0]
call fcn.1401a82f0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsi + 0xf8]
call fcn.1401ad980
call fcn.1401ad4c0
test al, al
je 0x140180804
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], SafeArrayLock
mov ecx, 0x40
call fcn.1400eb1a0
mov qword [rbp - 0x50], 0x36
mov qword [rbp - 0x48], 0x3f
movups xmm0, xmmword [str._AsusSystemAnalysisService__IsArchitectureARM64__true]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140356118]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140356128]
movups xmmword [rax + 0x20], xmm0
mov ecx, dword [0x140356138]
mov dword [rax + 0x30], ecx
movzx ecx, word [0x14035613c]
mov word [rax + 0x34], cx
mov byte [rax + 0x36], 0
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x60]
call fcn.1401a8500
call fcn.140204190
test al, al
je 0x1401808e5
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], SafeArrayLock
mov ecx, 0x30
call fcn.1400eb1a0
mov rdx, rax
mov qword [rbp - 0x30], 0x2f
mov qword [rbp - 0x28], 0x2f
movups xmm0, xmmword [str._AsusSystemAnalysisService__IsProductNUC__true]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140356150]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140356160]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x140356168]
mov dword [rax + 0x28], ecx
movzx ecx, word [0x14035616c]
mov word [rax + 0x2c], cx
movzx eax, byte [0x14035616e]
mov byte [rdx + 0x2e], al
mov byte [rdx + 0x2f], 0
mov qword [rbp - 0x40], rdx
lea rcx, [rbp - 0x40]
call fcn.1401a8500
lea rcx, [rbp + 0x820]
call fcn.14020e150
mov rdx, qword [rbp + 0x838]
cmp rdx, 0x10
jb 0x140181d0e
inc rdx
mov rcx, qword [rbp + 0x820]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401808db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181d4a
call fcn.14021ecec
jmp 0x140181d0e
lea rcx, [rsp + 0x58]
call fcn.1401aa2c0
nop
lea rcx, [rsp + 0x58]
call fcn.1401abb00
mov ebx, eax
mov edx, eax
lea rcx, [rbp + 0x780]
call fcn.14010d460
nop
mov r8, rax
lea rdx, str._AsusSystemAnalysisService__is_s_mode_
lea rcx, [rbp + 0x560]
call fcn.1400eafe0
mov rcx, rax
call fcn.1401a8500
nop
mov rdx, qword [rbp + 0x798]
cmp rdx, 0x10
jb 0x14018096b
inc rdx
mov rcx, qword [rbp + 0x780]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140180966
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181d50
call fcn.14021ecec
mov byte [rbp + 0x780], 0
cmp ebx, 1
jne 0x140180a18
lea rdx, str.C:RecoveryOEMAsusWinREMainAsusWinRE_S.exe
lea rcx, str.C:RecoveryOEMAsusWinREMainAsusWinRE.exe
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140180aac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x7a0]
call fcn.140127290
nop
mov r8, rax
lea rdx, str._MoveFile__Error_has_occurred:
lea rcx, [rbp + 0x580]
call fcn.1400eafe0
mov rcx, rax
call fcn.1401a8500
nop
mov rdx, qword [rbp + 0x7b8]
cmp rdx, 0x10
jb 0x140180a0c
inc rdx
mov rcx, qword [rbp + 0x7a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140180a07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181d56
call fcn.14021ecec
mov byte [rbp + 0x7a0], 0
jmp 0x140180aac
lea rdx, str.C:RecoveryOEMAsusWinREMainAsusWinRE.exe
lea rcx, str.C:RecoveryOEMAsusWinREMainAsusWinRE_S.exe
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140180aac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x7c0]
call fcn.140127290
nop
mov r8, rax
lea rdx, str._MoveFile__Error_has_occurred:
lea rcx, [rbp + 0x5a0]
call fcn.1400eafe0
mov rcx, rax
call fcn.1401a8500
nop
mov rdx, qword [rbp + 0x7d8]
cmp rdx, 0x10
jb 0x140180aa5
inc rdx
mov rcx, qword [rbp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140180aa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181d5c
call fcn.14021ecec
mov byte [rbp + 0x7c0], 0
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x1e0], r14
mov qword [rbp + 0x1f0], r14
mov qword [rbp + 0x1f8], 7
mov r8d, 7
lea rdx, str.EcFwRev
lea rcx, [rbp + 0x1e0]
call fcn.140101ff0
nop
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x200]
call fcn.140101ff0
nop
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x200]
mov rcx, 0xffffffff80000002
call fcn.1401f0b10
lea rax, [rbp + 0x220]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x230], r14
mov qword [rbp + 0x238], 7
mov r8d, SafeArrayGetLBound
lea rdx, str.SERVICEVERSION
lea rcx, [rbp + 0x220]
call fcn.140101ff0
nop
mov qword [rbp + 0x240], r14
mov qword [rbp + 0x250], r14
mov qword [rbp + 0x258], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x240]
call fcn.140101ff0
nop
lea r9, [rbp + 0x220]
lea r8, [rbp + 0x240]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x720]
call fcn.1401f1710
nop
lea rcx, [rbp + 0x680]
call fcn.1402012d0
nop
lea r8, [rbp + 0x720]
mov r10, qword [rbp + 0x720]
mov r11, qword [rbp + 0x738]
cmp r11, 8
cmovae r8, r10
mov r9, qword [rbp + 0x730]
mov rdx, r9
mov eax, 0xd
cmp r9, rax
cmova rdx, rax
lea rdi, str.ERROR_READREG
mov rcx, rdi
test rdx, rdx
je 0x140180c34
sub r8, rdi
nop
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140180c3e
add rcx, 2
sub rdx, 1
jne 0x140180c20
cmp r9, 0xd
je 0x140180dc1
lea rcx, [rbp + 0x680]
cmp qword [rbp + 0x698], 8
cmovae rcx, qword [rbp + 0x680]
lea r8, [rbp + 0x720]
cmp r11, 8
cmovae r8, r10
mov rdx, r9
mov r10, qword [rbp + 0x690]
cmp r10, r9
cmovb rdx, r10
test rdx, rdx
je 0x140180c94
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140180c9f
add rcx, 2
sub rdx, 1
jne 0x140180c80
cmp r9, r10
jb 0x140180c9f
jbe 0x140180e3d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], SafeArrayLock
mov ecx, 0x30
call fcn.1400eb1a0
mov rdx, rax
mov qword [rbp - 0x10], 0x2f
mov qword [rbp - 8], 0x2f
movups xmm0, xmmword [str._AsusSystemAnalysisService__Service_is_updated.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1403562f8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140356308]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x140356310]
mov dword [rax + 0x28], ecx
movzx ecx, word [0x140356314]
mov word [rax + 0x2c], cx
movzx eax, byte [0x140356316]
mov byte [rdx + 0x2e], al
mov byte [rdx + 0x2f], 0
mov qword [rbp - 0x20], rdx
lea rcx, [rbp - 0x20]
call fcn.1401a8500
mov ecx, SafeArrayLock
call fcn.14021ecb0
test rax, rax
je 0x140180d3c
mov qword [rax], rsi
lea rcx, [0x140182a30]
mov qword [rax + 8], rcx
jmp 0x140180d3f
mov rax, r14
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140179d40]
xor edx, edx
xor ecx, ecx
call fcn.14028e0ec
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140181d83
mov qword [rsp + 0x30], r14
cmp dword [rsp + 0x48], 0
je 0x140181d62
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x48], eax
je 0x140181d6d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x550], xmm0
xor edx, edx
lea rcx, [rbp + 0x550]
call fcn.140222334
test eax, eax
jne 0x140181d78
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
jmp 0x140180e3d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], SafeArrayLock
mov ecx, 0x40
call fcn.1400eb1a0
mov rdx, rax
mov qword [rbp - 0x70], 0x37
mov qword [rbp - 0x68], 0x3f
movups xmm0, xmmword [str._AsusSystemAnalysisService__Install_service_first_time.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1403562c0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1403562d0]
movups xmmword [rax + 0x20], xmm0
mov ecx, dword [0x1403562e0]
mov dword [rax + 0x30], ecx
movzx ecx, word [0x1403562e4]
mov word [rax + 0x34], cx
movzx eax, byte [0x1403562e6]
mov byte [rdx + 0x36], al
mov byte [rdx + 0x37], 0
mov qword [rbp - 0x80], rdx
lea rcx, [rbp - 0x80]
call fcn.1401a7f60
lea rax, [rbp + 0x5c0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x5c0]
call fcn.1400f4280
mov rbx, rax
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x270], r14
mov qword [rbp + 0x278], 7
mov r8d, SafeArrayGetLBound
lea rdx, str.SERVICEVERSION
lea rcx, [rbp + 0x260]
call fcn.140101ff0
nop
mov qword [rbp + 0x280], r14
mov qword [rbp + 0x290], r14
mov qword [rbp + 0x298], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x280]
call fcn.140101ff0
nop
mov r9, rbx
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x280]
mov rcx, 0xffffffff80000002
call fcn.1401f1ca0
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x2a0], r14
mov qword [rbp + 0x2b0], r14
mov qword [rbp + 0x2b8], 7
mov r8d, 1
lea rdx, [0x140347ef0]
lea rcx, [rbp + 0x2a0]
call fcn.140101ff0
nop
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2d0], r14
mov qword [rbp + 0x2d8], 7
mov r8d, SafeArrayLock
lea rdx, str.ISSERVICERUNNING
lea rcx, [rbp + 0x2c0]
call fcn.140101ff0
nop
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x2f0], r14
mov qword [rbp + 0x2f8], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x2e0]
call fcn.140101ff0
nop
lea r9, [rbp + 0x2a0]
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x2e0]
mov rcx, 0xffffffff80000002
call fcn.1401f1ca0
lea rax, [rbp + 0x300]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x320]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x300], r14
mov qword [rbp + 0x310], r14
mov qword [rbp + 0x318], 7
mov r8d, 7
lea rdx, str.2.1.9.0
lea rcx, [rbp + 0x300]
call fcn.140101ff0
nop
mov qword [rbp + 0x320], r14
mov qword [rbp + 0x330], r14
mov qword [rbp + 0x338], 7
mov r8d, SafeArrayLock
lea rdx, str.SETTINGFILEVERSION
lea rcx, [rbp + 0x320]
call fcn.140101ff0
nop
mov qword [rbp + 0x340], r14
mov qword [rbp + 0x350], r14
mov qword [rbp + 0x358], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x340]
call fcn.140101ff0
nop
lea r9, [rbp + 0x300]
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x340]
mov rcx, 0xffffffff80000002
call fcn.1401f1ca0
lea rcx, str.SYSTEMCurrentControlSetEnumACPIASUS1000
call fcn.1401ad930
movzx edx, al
lea rcx, [rbp + 0x7e0]
call fcn.14010d5e0
nop
mov r8, rax
lea rdx, str._AsusSystemAnalysisService__HWID_is_V1:
lea rcx, [rbp + 0x5e0]
call fcn.1401524e0
mov rcx, rax
call fcn.1401a8890
nop
mov rdx, qword [rbp + 0x7f8]
cmp rdx, 8
jb 0x140181113
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x7e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018110e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181d93
call fcn.14021ecec
mov r12, qword [rbp + 0x690]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 0x29
jb 0x140181d99
lea r13, [rbp + 0x680]
cmp qword [rbp + 0x698], 8
cmovae r13, qword [rbp + 0x680]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea r15, [r12 + 0x29]
mov ebx, 7
lea r14, [rsp + 0x60]
cmp r15, rbx
jbe 0x14018119e
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14018152c
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400eb1a0
mov r14, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
movaps xmm0, xmmword [str._AsusSystemAnalysisService__SCI_inf_ver:]
movups xmmword [r14], xmm0
movaps xmm1, xmmword [0x1403563e0]
movups xmmword [r14 + 0x10], xmm1
movaps xmm0, xmmword [0x1403563f0]
movups xmmword [r14 + 0x20], xmm0
movaps xmm1, xmmword [0x140356400]
movups xmmword [r14 + 0x30], xmm1
movaps xmm0, xmmword [0x140356410]
movups xmmword [r14 + 0x40], xmm0
movzx eax, word [0x140356420]
mov word [r14 + 0x50], ax
lea rcx, [r14 + 0x52]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.140253310
xor r12d, r12d
mov word [r14 + r15*2], r12w
lea rcx, [rsp + 0x60]
call fcn.1401a8890
mov qword [rbp + 0x6a0], r12
mov qword [rbp + 0x6b0], r12
mov qword [rbp + 0x6b8], 7
mov word [rbp + 0x6a0], r12w
lea r8d, [r12 + 8]
lea rdx, [0x140356428]
lea rcx, [rbp + 0x6a0]
call fcn.140101ff0
nop
lea r8, [rbp + 0x6a0]
lea rdx, str._AsusSystemAnalysisService__Service_ver:
lea rcx, [rbp + 0x600]
call fcn.1401524e0
mov rcx, rax
call fcn.1401a8890
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 8
jb 0x1401812b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401812af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181d9f
call fcn.14021ecec
mov qword [rbp + 0x6c0], r12
mov qword [rbp + 0x6d0], r12
mov qword [rbp + 0x6d8], 7
mov word [rbp + 0x6c0], r12w
mov r8d, 7
lea rdx, str.2.1.9.0
lea rcx, [rbp + 0x6c0]
call fcn.140101ff0
nop
lea r8, [rbp + 0x6c0]
lea rdx, str._AsusSystemAnalysisService__Setting_file_ver:
lea rcx, [rbp + 0x620]
call fcn.1401524e0
mov rcx, rax
call fcn.1401a8890
nop
mov rdx, qword [rbp + 0x6d8]
cmp rdx, 8
jb 0x140181358
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140181353
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181da5
call fcn.14021ecec
lea rax, [rbp + 0x360]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x360], r12
mov qword [rbp + 0x370], r12
mov qword [rbp + 0x378], 7
mov r15d, 0xd
mov r8d, r15d
lea rdx, str.FirstBootTime
lea rcx, [rbp + 0x360]
call fcn.140101ff0
nop
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x390], r12
mov qword [rbp + 0x398], 7
lea r8d, [r15 + 0x31]
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x380]
call fcn.140101ff0
nop
lea r9, [rbp + 0x360]
lea r8, [rbp + 0x380]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x740]
call fcn.1401f1710
nop
lea r8, [rbp + 0x740]
cmp qword [rbp + 0x758], 8
cmovae r8, qword [rbp + 0x740]
mov r9, qword [rbp + 0x750]
mov rdx, r9
cmp r9, r15
cmova rdx, r15
mov rcx, rdi
test rdx, rdx
je 0x140181438
sub r8, rdi
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14018164e
add rcx, 2
sub rdx, 1
jne 0x140181420
cmp r9, 0xd
jne 0x14018164e
xor ecx, ecx
call fcn.140287a5c
mov r14, rax
mov rdx, rax
lea rcx, [rbp + 0x800]
call fcn.14015f720
nop
lea rax, [rbp + 0x640]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x640]
call fcn.1400f4280
mov rbx, rax
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x3b0], r12
mov qword [rbp + 0x3b8], 7
mov r8, r15
lea rdx, str.FirstBootTime
lea rcx, [rbp + 0x3a0]
call fcn.140101ff0
nop
mov qword [rbp + 0x3c0], r12
mov qword [rbp + 0x3d0], r12
mov qword [rbp + 0x3d8], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x3c0]
call fcn.140101ff0
nop
mov r9, rbx
lea r8, [rbp + 0x3a0]
lea rdx, [rbp + 0x3c0]
mov rcx, 0xffffffff80000002
call fcn.1401f1ca0
lfence
lea rcx, [rbp + 0x875]
test r14, r14
jns 0x140181555
neg r14
mov rdx, r14
call fcn.1400ecbf0
dec rax
mov byte [rax], 0x2d
jmp 0x14018155d
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140181d44
jmp 0x14018118b
mov rdx, r14
call fcn.1400ecbf0
mov qword [rbp + 0x6e0], r12
mov qword [rbp + 0x6f0], r12
mov qword [rbp + 0x6f8], SafeArrayLock
mov byte [rbp + 0x6e0], 0
lea rcx, [rbp + 0x875]
cmp rax, rcx
je 0x1401815a3
lea r8, [rbp + 0x875]
sub r8, rax
mov rdx, rax
lea rcx, [rbp + 0x6e0]
call fcn.140101ee0
nop
lea r8, [rbp + 0x6e0]
lea rdx, str._AsusSystemAnalysisService__Set_the_first_boot_time:
lea rcx, [rbp + 0x660]
call fcn.1400eafe0
mov rcx, rax
call fcn.1401a7f60
nop
mov rdx, qword [rbp + 0x6f8]
cmp rdx, 0x10
jb 0x140181608
inc rdx
mov rcx, qword [rbp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140181602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181dab
call fcn.14021ecec
nop
mov rdx, qword [rbp + 0x818]
cmp rdx, 8
jb 0x14018164e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x800]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140181649
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140181d3e
call fcn.14021ecec
mov qword [rbp + 0x3e0], r12
mov qword [rbp + 0x3f0], r12
mov qword [rbp + 0x3f8], SafeArrayLock
mov r8d, 0x2b
lea rdx, str._AsusSystemAnalysisService__Set_active_date
lea rcx, [rbp + 0x3e0]
call fcn.140101ee0
lea rcx, [rbp + 0x3e0]
call fcn.1401a7f60
call fcn.140209180
lea rcx, [rbp + 0x840]
call fcn.14020e150
nop
mov qword [rbp + 0x400], r12
mov qword [rbp + 0x410], r12
mov qword [rbp + 0x418], SafeArrayLock
mov r8d, 0x28
lea rdx, str._AsusSystemAnalysisService__RandomUUID:
lea rcx, [rbp + 0x400]
call fcn.140101ee0
lea rcx, [rbp + 0x400]
call fcn.1401a7f60
call fcn.1402122c0
test al, al
je 0x1401819c5
mov qword [rbp + 0x420], r12
mov qword [rbp + 0x430], r12
mov qword [rbp + 0x438], SafeArrayLock
mov r8d, 0x2f
lea rdx, str._AsusSystemAnalysisService__OnStart____________
lea rcx, [rbp + 0x420]
call fcn.140101ee0
lea rcx, [rbp + 0x420]
call fcn.1401a7f60
lea rax, [rbp + 0x440]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x440], r12
mov qword [rbp + 0x450], r12
mov qword [rbp + 0x458], 7
mov ebx, 0xa
mov r8d, ebx
lea rdx, str.MainSwitch
lea rcx, [rbp + 0x440]
call fcn.140101ff0
nop
mov qword [rbp + 0x460], r12
mov qword [rbp + 0x470], r12
mov qword [rbp + 0x478], 7
lea r8d, [rbx + 0x34]
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x460]
call fcn.140101ff0
nop
lea r9, [rbp + 0x440]
lea r8, [rbp + 0x460]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x700]
call fcn.1401f1710
nop
lea rdx, [rbp + 0x700]
cmp qword [rbp + 0x718], 8
cmovae rdx, qword [rbp + 0x700]
mov r9, qword [rbp + 0x710]
mov rcx, r9
cmp r9, 0xd
cmova rcx, r15
test rcx, rcx
je 0x140181807
sub rdx, rdi
nop dword [rax]
movzx eax, word [rdi]
cmp word [rdi + rdx], ax
jne 0x14018191c
add rdi, 2
sub rcx, 1
jne 0x1401817f0
cmp r9, 0xd
jne 0x14018191c
mov qword [rbp + 0x480], r12
mov qword [rbp + 0x490], r12
mov qword [rbp + 0x498], SafeArrayLock
lea r8d, [r9 + 0x29]
lea rdx, str._AsusSystemAnalysisService__set_main_switch_to_enable.
lea rcx, [rbp + 0x480]
call fcn.140101ee0
lea rcx, [rbp + 0x480]
call fcn.1401a7f60
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x4c0]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x4a0], r12
mov qword [rbp + 0x4b0], r12
mov qword [rbp + 0x4b8], 7
mov r8d, 1
lea rdx, [0x140347ef0]
lea rcx, [rbp + 0x4a0]
call fcn.140101ff0
nop
mov qword [rbp + 0x4c0], r12
mov qword [rbp + 0x4d0], r12
mov qword [rbp + 0x4d8], 7
mov r8, rbx
lea rdx, str.MainSwitch
lea rcx, [rbp + 0x4c0]
call fcn.140101ff0
nop
mov qword [rbp + 0x4e0], r12
mov qword [rbp + 0x4f0], r12
mov qword [rbp + 0x4f8], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x4e0]
call fcn.140101ff0
nop
lea r9, [rbp + 0x4a0]
lea r8, [rbp + 0x4c0]
lea rdx, [rbp + 0x4e0]
mov rcx, 0xffffffff80000002
call fcn.1401f1ca0
lea rax, [rbp + 0x500]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x500], r12
mov qword [rbp + 0x510], r12
mov qword [rbp + 0x518], 7
mov r8d, SafeArrayLock
lea rdx, str.SKIP_ONPOWEREVENT
lea rcx, [rbp + 0x500]
call fcn.140101ff0
nop
mov qword [rbp], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp]
call fcn.140101ff0
nop
mov r9d, 1
lea r8, [rbp + 0x500]
lea rdx, [rbp]
mov rcx, 0xffffffff80000002
call fcn.1401f1b90
nop
mov r8, qword [rbp + 0x718]
cmp r8, 8
jb 0x1401819ca
inc r8
mov rdx, qword [rbp + 0x700]
lea rcx, [rbp + 0x700]
call fcn.140103630
jmp 0x1401819ca
mov ebx, 0xa
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], SafeArrayLock
mov r8d, 0x38
lea rdx, str._AsusSystemAnalysisService__checkCardReaderSupportStatus
lea rcx, [rbp + 0x20]
call fcn.140101ee0
lea rcx, [rbp + 0x20]
call fcn.1401a7f60
mov rcx, rsi
call fcn.140187660
test al, al
je 0x140181a12
mov edx, 0xe
mov rcx, rsi
call fcn.14017c400
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], SafeArrayLock
mov r8d, 0x3c
lea rdx, str._AsusSystemAnalysisService__call_RPC_service.__Thread__Start
lea rcx, [rbp + 0x40]
call fcn.140101ee0
lea rcx, [rbp + 0x40]
call fcn.1401a7f60
xor r8d, r8d
mov rdx, rsi
lea rcx, [0x140181ee0]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
test rax, rax
je 0x140181a62
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], SafeArrayLock
mov r8d, 0x3a
lea rdx, str._AsusSystemAnalysisService__call_RPC_service.__Thread__End
lea rcx, [rbp + 0x60]
call fcn.140101ee0
lea rcx, [rbp + 0x60]
call fcn.1401a7f60
xor edx, edx
mov rcx, rsi
call fcn.14017c400
mov edx, 1
mov rcx, rsi
call fcn.14017c400
mov edx, 2
mov rcx, rsi
call fcn.14017c400
mov edx, 8
mov rcx, rsi
call fcn.14017c400
mov edx, ebx
mov rcx, rsi
call fcn.14017c400
mov edx, VariantTimeToDosDateTime
mov rcx, rsi
call fcn.14017c400
mov edx, SafeArrayGetLBound
mov rcx, rsi
call fcn.14017c400
mov edx, SafeArrayLock
mov rcx, rsi
call fcn.14017c400
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 7
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.FinishedDate
lea rcx, [rbp + 0xa0]
call fcn.140101ff0
nop
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], 7
mov r8d, 0x43
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysisAPRP
lea rcx, [rbp + 0xc0]
call fcn.140101ff0
nop
lea r9, [rbp + 0xa0]
lea r8, [rbp + 0xc0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x760]
call fcn.1401f1710
nop
lea r8, [rbp + 0x760]
cmp qword [rbp + 0x778], 8
cmovae r8, qword [rbp + 0x760]
mov r9, qword [rbp + 0x770]
mov rdx, r9
cmp r9, 0x12
mov eax, SafeArrayLock
cmova rdx, rax
lea rcx, str.Retry_Over_90_Days
test rdx, rdx
je 0x140181bd8
sub r8, rcx
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140181bde
add rcx, 2
sub rdx, 1
jne 0x140181bc4
cmp r9, 0x12
je 0x140181bed
mov edx, 3
mov rcx, rsi
call fcn.14017c400
jmp 0x140181c2b
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xf0], r12
mov qword [rbp + SafeArrayLock8], 0xf
mov r8d, 0x5f
lea rdx, str._AsusSystemAnalysisService__OnStart__APRP_retry_over_90_days__does_not_create_aprp_timer_thread
lea rcx, [rbp + 0xe0]
call fcn.140101ee0
lea rcx, [rbp + 0xe0]
call fcn.1401a8500
mov edx, 4
mov rcx, rsi
call fcn.14017c400
mov edx, 5
mov rcx, rsi
call fcn.14017c400
mov edx, 6
mov rcx, rsi
call fcn.14017c400
mov edx, 7
mov rcx, rsi
call fcn.14017c400
mov edx, 9
mov rcx, rsi
call fcn.14017c400
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, rsi
call fcn.14017c400
mov edx, r15d
mov rcx, rsi
call fcn.14017c400
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], SafeArrayLock
mov r8d, 0x43
lea rdx, str._AsusSystemAnalysisService__OnStart_End____________________________
lea rcx, [rbp + 0x120]
call fcn.140101ee0
lea rcx, [rbp + 0x120]
call fcn.1401a8500
nop
lea rcx, [rbp + 0x760]
call fcn.14011ed90
nop
lea rcx, [rbp + 0x840]
call fcn.1400f5450
nop
lea rcx, [rbp + 0x740]
call fcn.14011ed90
nop
lea rcx, [rbp + 0x680]
call fcn.14011ed90
nop
lea rcx, [rbp + 0x720]
call fcn.14011ed90
nop
lea rcx, [rsp + 0x58]
call fcn.1401aa2f0
mov rcx, qword [rbp + 0x878]
xor rcx, rsp
call fcn.14021f250
lea r11, [rsp + 0x980]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140260f54
nop
call fcn.1401018e0
nop
call fcn.140260f54
nop
call fcn.140260f54
int3
call fcn.140260f54
int3
call fcn.140260f54
nop
mov ecx, 1
call fcn.1402259f8
int3
mov ecx, 5
call fcn.1402259f8
int3
mov ecx, 2
call fcn.1402259f8
nop
mov dword [rsp + 0x48], r14d
mov ecx, 6
call fcn.1402259f8
nop
call fcn.140260f54
int3
call fcn.140101a70
int3
call fcn.140260f54
int3
call fcn.140260f54
nop
call fcn.140260f54
int3