Function at 0x140173b60
Capabilities:
Create thread
Modify service
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x820]
sub rsp, 0x920
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rbp + 0x818], rax
mov r14, rcx
lea rax, [rbp + 0x160]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x50], rax
xor r15d, r15d
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x170], r15
mov qword [rbp + 0x178], 7
lea r8d, [r15 + 1]
lea rdx, [0x1402caff8]
lea rcx, [rbp + 0x160]
call fcn.1400f8950
nop
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 7
lea r8d, [r15 + 0xa]
lea rdx, str.DoingJ0Job
lea rcx, [rbp + 0x180]
call fcn.1400f8950
nop
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], 7
lea r8d, [r15 + 0x3e]
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x1a0]
call fcn.1400f8950
nop
lea r9, [rbp + 0x160]
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, 0xffffffff80000002
call fcn.1401de7f0
mov qword [rsp + 0x50], 1
mov dword [rbp + 0x4e0], 0x15180
mov qword [rbp + 0x4f0], r15
mov qword [rbp + 0x4e8], r15
mov dword [rbp + 0x4f8], 1
lea rax, [rsp + 0x50]
mov qword [rbp + 0x500], rax
xor edx, edx
xor ecx, ecx
lea r8d, [r15 + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140173d19
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, eax
lea rcx, [0x140000000]
lea rdx, [rcx + 0x2dad60]
lea rdx, [rdx + rax*2]
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1d0], r15
mov qword [rbp + 0x1d8], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140173cf1
lea rcx, [rbp + 0x1c0]
call fcn.1400f8950
lea rcx, [rbp + 0x1c0]
call fcn.140195940
jmp 0x140173e40
mov r8d, 0xf003f
lea rdx, str.ASUSSystemAnalysis
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140173d99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, eax
lea rcx, [0x140000000]
lea rdx, [rcx + 0x2dad90]
lea rdx, [rdx + rax*2]
mov qword [rbp + 0x1e0], r15
mov qword [rbp + 0x1f0], r15
mov qword [rbp + 0x1f8], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140173d71
lea rcx, [rbp + 0x1e0]
call fcn.1400f8950
lea rcx, [rbp + 0x1e0]
call fcn.140195940
jmp 0x140173e37
lea r8, [rbp + 0x4e0]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x140173df0
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x218], 7
lea r8d, [rax + 0x1c]
lea rdx, str.ChangeServiceConfig2_failed_n
lea rcx, [rbp + 0x200]
call fcn.1400f8950
lea rcx, [rbp + 0x200]
call fcn.140195940
jmp 0x140173e2e
mov qword [rbp + 0x220], r15
mov qword [rbp + 0x230], r15
mov qword [rbp + 0x238], 7
mov r8d, 0x2a
lea rdx, str.Service_description_updated_successfully._n
lea rcx, [rbp + 0x220]
call fcn.1400f8950
lea rcx, [rbp + 0x220]
call fcn.1401953a0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [r14 + 0xf8]
call fcn.14019a520
lea rcx, [rsp + 0x58]
call fcn.140197310
nop
lea rcx, [rsp + 0x58]
call fcn.140198b10
mov ebx, eax
mov edx, eax
lea rcx, [rbp + 0x760]
call fcn.140103db0
nop
mov r8, rax
lea rdx, str._AsusSystemAnalysisService__is_s_mode_
lea rcx, [rbp + 0x620]
call fcn.1400e1940
mov rcx, rax
call fcn.1401955b0
nop
mov rdx, qword [rbp + 0x778]
cmp rdx, 0x10
jb 0x140173ed2
inc rdx
mov rcx, qword [rbp + 0x760]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140173ecd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140175415
call fcn.14020be84
mov byte [rbp + 0x760], 0
cmp ebx, 1
jne 0x140173f7f
lea rdx, str.C:RecoveryOEMAsusWinREMainAsusWinRE_S.exe
lea rcx, str.C:RecoveryOEMAsusWinREMainAsusWinRE.exe
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140174013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x780]
call fcn.14011d870
nop
mov r8, rax
lea rdx, str._MoveFile__Error_has_occurred:
lea rcx, [rbp + 0x520]
call fcn.1400e1940
mov rcx, rax
call fcn.1401955b0
nop
mov rdx, qword [rbp + 0x798]
cmp rdx, 0x10
jb 0x140173f73
inc rdx
mov rcx, qword [rbp + 0x780]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140173f6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017541b
call fcn.14020be84
mov byte [rbp + 0x780], 0
jmp 0x140174013
lea rdx, str.C:RecoveryOEMAsusWinREMainAsusWinRE.exe
lea rcx, str.C:RecoveryOEMAsusWinREMainAsusWinRE_S.exe
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140174013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x7a0]
call fcn.14011d870
nop
mov r8, rax
lea rdx, str._MoveFile__Error_has_occurred:
lea rcx, [rbp + 0x540]
call fcn.1400e1940
mov rcx, rax
call fcn.1401955b0
nop
mov rdx, qword [rbp + 0x7b8]
cmp rdx, 0x10
jb 0x14017400c
inc rdx
mov rcx, qword [rbp + 0x7a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140174007
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140175421
call fcn.14020be84
mov byte [rbp + 0x7a0], 0
lea rax, [rbp + 0x240]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x250], r15
mov qword [rbp + 0x258], 7
mov r8d, 7
lea rdx, str.EcFwRev
lea rcx, [rbp + 0x240]
call fcn.1400f8950
nop
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x270], r15
mov qword [rbp + 0x278], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x260]
call fcn.1400f8950
nop
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x260]
mov rcx, 0xffffffff80000002
call fcn.1401dd660
lea rax, [rbp + 0x280]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x290], r15
mov qword [rbp + 0x298], 7
mov r8d, SafeArrayGetLBound
lea rdx, str.SERVICEVERSION
lea rcx, [rbp + 0x280]
call fcn.1400f8950
nop
mov qword [rbp + 0x2a0], r15
mov qword [rbp + 0x2b0], r15
mov qword [rbp + 0x2b8], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x2a0]
call fcn.1400f8950
nop
lea r9, [rbp + 0x280]
lea r8, [rbp + 0x2a0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x740]
call fcn.1401de260
nop
lea rcx, [rbp + 0x640]
call fcn.1401edf90
nop
lea r8, [rbp + 0x740]
mov r10, qword [rbp + 0x740]
mov r11, qword [rbp + 0x758]
cmp r11, 8
cmovae r8, r10
mov r9, qword [rbp + 0x750]
mov rdx, r9
mov eax, 0xd
cmp r9, rax
cmova rdx, rax
lea rsi, str.ERROR_READREG
mov rcx, rsi
test rdx, rdx
je 0x140174199
sub r8, rsi
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x1401741a3
add rcx, 2
sub rdx, 1
jne 0x140174185
cmp r9, 0xd
je 0x140174326
lea rcx, [rbp + 0x640]
cmp qword [rbp + 0x658], 8
cmovae rcx, qword [rbp + 0x640]
lea r8, [rbp + 0x740]
cmp r11, 8
cmovae r8, r10
mov rdx, r9
mov r10, qword [rbp + 0x650]
cmp r10, r9
cmovb rdx, r10
test rdx, rdx
je 0x1401741f6
sub r8, rcx
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140174201
add rcx, 2
sub rdx, 1
jne 0x1401741e2
cmp r9, r10
jb 0x140174201
jbe 0x1401743a2
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], SafeArrayLock
mov ecx, 0x30
call fcn.1400e1b00
mov rdx, rax
mov qword [rbp - 0x70], 0x2f
mov qword [rbp - 0x68], 0x2f
movups xmm0, xmmword [str._AsusSystemAnalysisService__Service_is_updated.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d9128]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1402d9138]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x1402d9140]
mov dword [rax + 0x28], ecx
movzx ecx, word [0x1402d9144]
mov word [rax + 0x2c], cx
movzx eax, byte [0x1402d9146]
mov byte [rdx + 0x2e], al
mov byte [rdx + 0x2f], 0
mov qword [rbp - 0x80], rdx
lea rcx, [rbp - 0x80]
call fcn.1401955b0
mov ecx, SafeArrayLock
call fcn.14020be48
test rax, rax
je 0x14017429e
mov qword [rax], r14
lea rcx, [0x1401760f0]
mov qword [rax + 8], rcx
jmp 0x1401742a1
mov rax, r15
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14016db60]
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140175448
mov qword [rsp + 0x30], r15
cmp dword [rsp + 0x48], 0
je 0x140175427
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x48], eax
je 0x140175432
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x510], xmm0
xor edx, edx
lea rcx, [rbp + 0x510]
call fcn.14020f4c4
test eax, eax
jne 0x14017543d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
jmp 0x1401743a2
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], SafeArrayLock
mov ecx, 0x40
call fcn.1400e1b00
mov rdx, rax
mov qword [rbp - 0x50], 0x37
mov qword [rbp - 0x48], 0x3f
movups xmm0, xmmword [str._AsusSystemAnalysisService__Install_service_first_time.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d90f0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1402d9100]
movups xmmword [rax + 0x20], xmm0
mov ecx, dword [0x1402d9110]
mov dword [rax + 0x30], ecx
movzx ecx, word [0x1402d9114]
mov word [rax + 0x34], cx
movzx eax, byte [0x1402d9116]
mov byte [rdx + 0x36], al
mov byte [rdx + 0x37], 0
mov qword [rbp - 0x60], rdx
lea rcx, [rbp - 0x60]
call fcn.140195010
lea rax, [rbp + 0x560]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x560]
call fcn.1400eabe0
mov rbx, rax
mov qword [rbp + 0x2c0], r15
mov qword [rbp + 0x2d0], r15
mov qword [rbp + 0x2d8], 7
mov r8d, SafeArrayGetLBound
lea rdx, str.SERVICEVERSION
lea rcx, [rbp + 0x2c0]
call fcn.1400f8950
nop
mov qword [rbp + 0x2e0], r15
mov qword [rbp + 0x2f0], r15
mov qword [rbp + 0x2f8], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x2e0]
call fcn.1400f8950
nop
mov r9, rbx
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x2e0]
mov rcx, 0xffffffff80000002
call fcn.1401de7f0
lea rax, [rbp + 0x300]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x320]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x300], r15
mov qword [rbp + 0x310], r15
mov qword [rbp + 0x318], 7
mov r8d, 1
lea rdx, [0x1402cb050]
lea rcx, [rbp + 0x300]
call fcn.1400f8950
nop
mov qword [rbp + 0x320], r15
mov qword [rbp + 0x330], r15
mov qword [rbp + 0x338], 7
mov r8d, SafeArrayLock
lea rdx, str.ISSERVICERUNNING
lea rcx, [rbp + 0x320]
call fcn.1400f8950
nop
mov qword [rbp + 0x340], r15
mov qword [rbp + 0x350], r15
mov qword [rbp + 0x358], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x340]
call fcn.1400f8950
nop
lea r9, [rbp + 0x300]
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x340]
mov rcx, 0xffffffff80000002
call fcn.1401de7f0
lea rax, [rbp + 0x360]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x380]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x360], r15
mov qword [rbp + 0x370], r15
mov qword [rbp + 0x378], 7
mov r8d, 7
lea rdx, str.2.1.8.0
lea rcx, [rbp + 0x360]
call fcn.1400f8950
nop
mov qword [rbp + 0x380], r15
mov qword [rbp + 0x390], r15
mov qword [rbp + 0x398], 7
mov r8d, SafeArrayLock
lea rdx, str.SETTINGFILEVERSION
lea rcx, [rbp + 0x380]
call fcn.1400f8950
nop
mov qword [rbp + 0x3a0], r15
mov qword [rbp + 0x3b0], r15
mov qword [rbp + 0x3b8], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x3a0]
call fcn.1400f8950
nop
lea r9, [rbp + 0x360]
lea r8, [rbp + 0x380]
lea rdx, [rbp + 0x3a0]
mov rcx, 0xffffffff80000002
call fcn.1401de7f0
lea rcx, str.SYSTEMCurrentControlSetEnumACPIASUS1000
call fcn.14019a4d0
movzx edx, al
lea rcx, [rbp + 0x7c0]
call fcn.140103f30
nop
mov r8, rax
lea rdx, str._AsusSystemAnalysisService__HWID_is_V1:
lea rcx, [rbp + 0x580]
call fcn.1401472b0
mov rcx, rax
call fcn.140195940
nop
mov rdx, qword [rbp + 0x7d8]
cmp rdx, 8
jb 0x140174678
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140174673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140175458
call fcn.14020be84
mov r12, qword [rbp + 0x650]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 0x29
jb 0x14017545e
lea r13, [rbp + 0x640]
cmp qword [rbp + 0x658], 8
cmovae r13, qword [rbp + 0x640]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea r15, [r12 + 0x29]
mov ebx, 7
lea rdi, [rsp + 0x60]
cmp r15, rbx
jbe 0x140174703
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x140174ac1
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400e1b00
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
movaps xmm0, xmmword [str._AsusSystemAnalysisService__SCI_inf_ver:]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x1402d9210]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1402d9220]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x1402d9230]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x1402d9240]
movups xmmword [rdi + 0x40], xmm0
movzx eax, word [0x1402d9250]
mov word [rdi + 0x50], ax
lea rcx, [rdi + 0x52]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.140244220
xor r12d, r12d
mov word [rdi + r15*2], r12w
lea rcx, [rsp + 0x60]
call fcn.140195940
mov qword [rbp + 0x6a0], r12
mov qword [rbp + 0x6b0], r12
mov qword [rbp + 0x6b8], 7
mov word [rbp + 0x6a0], r12w
lea r8d, [r12 + 8]
lea rdx, [0x1402d9258]
lea rcx, [rbp + 0x6a0]
call fcn.1400f8950
nop
lea r8, [rbp + 0x6a0]
lea rdx, str._AsusSystemAnalysisService__Service_ver:
lea rcx, [rbp + 0x5a0]
call fcn.1401472b0
mov rcx, rax
call fcn.140195940
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 8
jb 0x140174813
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017480e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140175464
call fcn.14020be84
mov qword [rbp + 0x6c0], r12
mov qword [rbp + 0x6d0], r12
mov qword [rbp + 0x6d8], 7
mov word [rbp + 0x6c0], r12w
mov r8d, 7
lea rdx, str.2.1.8.0
lea rcx, [rbp + 0x6c0]
call fcn.1400f8950
nop
lea r8, [rbp + 0x6c0]
lea rdx, str._AsusSystemAnalysisService__Setting_file_ver:
lea rcx, [rbp + 0x5c0]
call fcn.1401472b0
mov rcx, rax
call fcn.140195940
nop
mov rdx, qword [rbp + 0x6d8]
cmp rdx, 8
jb 0x1401748b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401748b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017546a
call fcn.14020be84
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x3c0], r12
mov qword [rbp + 0x3d0], r12
mov qword [rbp + 0x3d8], 7
mov r15d, 0xd
mov r8d, r15d
lea rdx, str.FirstBootTime
lea rcx, [rbp + 0x3c0]
call fcn.1400f8950
nop
mov qword [rbp + 0x3e0], r12
mov qword [rbp + 0x3f0], r12
mov qword [rbp + 0x3f8], 7
lea r8d, [r15 + 0x31]
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x3e0]
call fcn.1400f8950
nop
lea r9, [rbp + 0x3c0]
lea r8, [rbp + 0x3e0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x680]
call fcn.1401de260
nop
lea r8, [rbp + 0x680]
cmp qword [rbp + 0x698], 8
cmovae r8, qword [rbp + 0x680]
mov r9, qword [rbp + 0x690]
mov rdx, r9
cmp r9, r15
cmova rdx, r15
mov rcx, rsi
test rdx, rdx
je 0x140174998
sub r8, rsi
nop
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140174c09
add rcx, 2
sub rdx, 1
jne 0x140174980
cmp r9, 0xd
jne 0x140174c09
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov rbx, rax
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140154130
nop
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x400]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0x5e0]
call fcn.1400eabe0
mov rdi, rax
mov qword [rbp + 0x400], r12
mov qword [rbp + 0x410], r12
mov qword [rbp + 0x418], 7
mov r8, r15
lea rdx, str.FirstBootTime
lea rcx, [rbp + 0x400]
call fcn.1400f8950
nop
mov qword [rbp + 0x420], r12
mov qword [rbp + 0x430], r12
mov qword [rbp + 0x438], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x420]
call fcn.1400f8950
nop
mov r9, rdi
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x420]
mov rcx, 0xffffffff80000002
call fcn.1401de7f0
lea r9, [rbp + 0x815]
movabs r8, 0xcccccccccccccccd
test rbx, rbx
jns 0x140174af0
neg rbx
nop dword [rax]
nop word [rax + rax]
dec r9
mov rax, r8
mul rbx
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov rbx, rdx
test rdx, rdx
jne 0x140174a90
dec r9
mov byte [r9], 0x2d
jmp 0x140174b18
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14017540f
jmp 0x1401746f0
dec r9
mov rax, r8
mul rbx
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov rbx, rdx
test rdx, rdx
jne 0x140174af0
mov qword [rbp + 0x6e0], r12
mov qword [rbp + 0x6f0], r12
mov qword [rbp + 0x6f8], SafeArrayLock
mov byte [rbp + 0x6e0], 0
lea rax, [rbp + 0x815]
cmp r9, rax
je 0x140174b5e
lea r8, [rbp + 0x815]
sub r8, r9
mov rdx, r9
lea rcx, [rbp + 0x6e0]
call fcn.1400f8840
nop
lea r8, [rbp + 0x6e0]
lea rdx, str._AsusSystemAnalysisService__Set_the_first_boot_time:
lea rcx, [rbp + 0x600]
call fcn.1400e1940
mov rcx, rax
call fcn.140195010
nop
mov rdx, qword [rbp + 0x6f8]
cmp rdx, 0x10
jb 0x140174bc3
inc rdx
mov rcx, qword [rbp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140174bbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140175470
call fcn.14020be84
nop
mov rdx, qword [rbp + 0x7f8]
cmp rdx, 8
jb 0x140174c09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x7e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140174c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140175409
call fcn.14020be84
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], SafeArrayLock
mov ecx, 0x30
call fcn.1400e1b00
mov qword [rbp - 0x10], 0x2b
mov qword [rbp - 8], 0x2f
movups xmm0, xmmword [str._AsusSystemAnalysisService__Set_active_date]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d9398]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1402d93a8]
movsd qword [rax + 0x20], xmm0
movzx ecx, word [0x1402d93b0]
mov word [rax + 0x28], cx
movzx ecx, byte [0x1402d93b2]
mov byte [rax + 0x2a], cl
mov byte [rax + 0x2b], 0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.140195010
call fcn.1401f5e00
lea rcx, [rbp + 0x720]
call fcn.1401fb0c0
nop
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], SafeArrayLock
mov ecx, 0x30
call fcn.1400e1b00
mov qword [rbp - 0x30], 0x28
mov qword [rbp - 0x28], 0x2f
movups xmm0, xmmword [str._AsusSystemAnalysisService__RandomUUID:]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d93c8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1402d93d8]
movsd qword [rax + 0x20], xmm0
mov byte [rax + 0x28], 0
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x40]
call fcn.140195010
call fcn.1401ff220
test al, al
je 0x140174fa4
mov qword [rbp + 0x440], r12
mov qword [rbp + 0x450], r12
mov qword [rbp + 0x458], SafeArrayLock
mov r8d, 0x2f
lea rdx, str._AsusSystemAnalysisService__OnStart____________
lea rcx, [rbp + 0x440]
call fcn.1400f8840
lea rcx, [rbp + 0x440]
call fcn.140195010
lea rax, [rbp + 0x460]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x460], r12
mov qword [rbp + 0x470], r12
mov qword [rbp + 0x478], 7
mov ebx, 0xa
mov r8d, ebx
lea rdx, str.MainSwitch
lea rcx, [rbp + 0x460]
call fcn.1400f8950
nop
mov qword [rbp + 0x480], r12
mov qword [rbp + 0x490], r12
mov qword [rbp + 0x498], 7
lea r8d, [rbx + 0x34]
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x480]
call fcn.1400f8950
nop
lea r9, [rbp + 0x460]
lea r8, [rbp + 0x480]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x700]
call fcn.1401de260
nop
lea rdx, [rbp + 0x700]
cmp qword [rbp + 0x718], 8
cmovae rdx, qword [rbp + 0x700]
mov r8, qword [rbp + 0x710]
mov rcx, r8
cmp r8, 0xd
cmova rcx, r15
test rcx, rcx
je 0x140174e17
sub rdx, rsi
nop word [rax + rax]
movzx eax, word [rsi]
cmp word [rsi + rdx], ax
jne 0x140174f0d
add rsi, 2
sub rcx, 1
jne 0x140174e00
cmp r8, 0xd
jne 0x140174f0d
mov qword [rbp + 0x4a0], r12
mov qword [rbp + 0x4b0], r12
mov qword [rbp + 0x4b8], SafeArrayLock
mov r8d, 0x36
lea rdx, str._AsusSystemAnalysisService__set_main_switch_to_enable.
lea rcx, [rbp + 0x4a0]
call fcn.1400f8840
lea rcx, [rbp + 0x4a0]
call fcn.140195010
lea rax, [rbp + 0x4c0]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x4c0], r12
mov qword [rbp + 0x4d0], r12
mov qword [rbp + 0x4d8], 7
mov r8d, 1
lea rdx, [0x1402cb050]
lea rcx, [rbp + 0x4c0]
call fcn.1400f8950
nop
mov qword [rbp], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov r8, rbx
lea rdx, str.MainSwitch
lea rcx, [rbp]
call fcn.1400f8950
nop
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x20]
call fcn.1400f8950
nop
lea r9, [rbp + 0x4c0]
lea r8, [rbp]
lea rdx, [rbp + 0x20]
mov rcx, 0xffffffff80000002
call fcn.1401de7f0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov r8d, SafeArrayLock
lea rdx, str.SKIP_ONPOWEREVENT
lea rcx, [rbp + 0x40]
call fcn.1400f8950
nop
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 7
mov r8d, 0x3e
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysis
lea rcx, [rbp + 0x60]
call fcn.1400f8950
nop
mov r9d, 1
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
mov rcx, 0xffffffff80000002
call fcn.1401de6e0
nop
mov r8, qword [rbp + 0x718]
cmp r8, 8
jb 0x140174fa9
inc r8
mov rdx, qword [rbp + 0x700]
lea rcx, [rbp + 0x700]
call fcn.1400f9f90
jmp 0x140174fa9
mov ebx, 0xa
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], SafeArrayLock
mov r8d, 0x38
lea rdx, str._AsusSystemAnalysisService__checkCardReaderSupportStatus
lea rcx, [rbp + 0x80]
call fcn.1400f8840
lea rcx, [rbp + 0x80]
call fcn.140195010
mov rcx, r14
call fcn.140177530
test al, al
je 0x140175000
mov edx, 0xe
mov rcx, r14
call fcn.14016fc80
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], SafeArrayLock
mov r8d, 0x3c
lea rdx, str._AsusSystemAnalysisService__call_RPC_service.__Thread__Start
lea rcx, [rbp + 0xa0]
call fcn.1400f8840
lea rcx, [rbp + 0xa0]
call fcn.140195010
xor r8d, r8d
mov rdx, r14
lea rcx, [0x1401755a0]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
test rax, rax
je 0x14017505f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], SafeArrayLock
mov r8d, 0x3a
lea rdx, str._AsusSystemAnalysisService__call_RPC_service.__Thread__End
lea rcx, [rbp + 0xc0]
call fcn.1400f8840
lea rcx, [rbp + 0xc0]
call fcn.140195010
xor edx, edx
mov rcx, r14
call fcn.14016fc80
mov edx, 1
mov rcx, r14
call fcn.14016fc80
mov edx, 2
mov rcx, r14
call fcn.14016fc80
mov edx, 8
mov rcx, r14
call fcn.14016fc80
mov edx, ebx
mov rcx, r14
call fcn.14016fc80
mov edx, VariantTimeToDosDateTime
mov rcx, r14
call fcn.14016fc80
mov edx, SafeArrayGetLBound
mov rcx, r14
call fcn.14016fc80
mov edx, SafeArrayLock
mov rcx, r14
call fcn.14016fc80
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], 7
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.FinishedDate
lea rcx, [rbp + 0xe0]
call fcn.1400f8950
nop
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], 7
mov r8d, 0x43
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSystemAnalysisAPRP
lea rcx, [rbp + 0x100]
call fcn.1400f8950
nop
lea r9, [rbp + 0xe0]
lea r8, [rbp + 0x100]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x660]
call fcn.1401de260
nop
lea r8, [rbp + 0x660]
cmp qword [rbp + 0x678], 8
cmovae r8, qword [rbp + 0x660]
mov r9, qword [rbp + 0x670]
mov rdx, r9
cmp r9, 0x12
mov eax, SafeArrayLock
cmova rdx, rax
lea rcx, str.Retry_Over_90_Days
test rdx, rdx
je 0x1401751e4
sub r8, rcx
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x1401751ea
add rcx, 2
sub rdx, 1
jne 0x1401751d0
cmp r9, 0x12
je 0x1401751f9
mov edx, 3
mov rcx, r14
call fcn.14016fc80
jmp 0x140175237
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], SafeArrayLock
mov r8d, 0x5f
lea rdx, str._AsusSystemAnalysisService__OnStart__APRP_retry_over_90_days__does_not_create_aprp_timer_thread
lea rcx, [rbp + 0x120]
call fcn.1400f8840
lea rcx, [rbp + 0x120]
call fcn.1401955b0
mov edx, 4
mov rcx, r14
call fcn.14016fc80
mov edx, 5
mov rcx, r14
call fcn.14016fc80
mov edx, 6
mov rcx, r14
call fcn.14016fc80
mov edx, 7
mov rcx, r14
call fcn.14016fc80
mov edx, 9
mov rcx, r14
call fcn.14016fc80
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, r14
call fcn.14016fc80
mov edx, r15d
mov rcx, r14
call fcn.14016fc80
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], SafeArrayLock
mov r8d, 0x43
lea rdx, str._AsusSystemAnalysisService__OnStart_End____________________________
lea rcx, [rbp + 0x140]
call fcn.1400f8840
lea rcx, [rbp + 0x140]
call fcn.1401955b0
nop
mov r8, qword [rbp + 0x678]
cmp r8, 8
jb 0x1401752f2
inc r8
mov rdx, qword [rbp + 0x660]
lea rcx, [rbp + 0x660]
call fcn.1400f9f90
mov qword [rbp + 0x670], r12
mov qword [rbp + 0x678], 7
mov word [rbp + 0x660], r12w
mov r8, qword [rbp + 0x738]
cmp r8, 0x10
jb 0x14017532f
inc r8
mov rdx, qword [rbp + 0x720]
lea rcx, [rbp + 0x720]
call fcn.1400f9f50
mov qword [rbp + 0x730], r12
mov qword [rbp + 0x738], SafeArrayLock
mov byte [rbp + 0x720], 0
mov r8, qword [rbp + 0x698]
cmp r8, 8
jb 0x14017536b
inc r8
mov rdx, qword [rbp + 0x680]
lea rcx, [rbp + 0x680]
call fcn.1400f9f90
mov qword [rbp + 0x690], r12
mov qword [rbp + 0x698], 7
mov word [rbp + 0x680], r12w
mov r8, qword [rbp + 0x658]
cmp r8, 8
jb 0x1401753a8
inc r8
mov rdx, qword [rbp + 0x640]
lea rcx, [rbp + 0x640]
call fcn.1400f9f90
mov qword [rbp + 0x650], r12
mov qword [rbp + 0x658], 7
mov word [rbp + 0x640], r12w
lea rcx, [rbp + 0x740]
call fcn.1401156c0
nop
lea rcx, [rsp + 0x58]
call fcn.140197340
mov rcx, qword [rbp + 0x818]
xor rcx, rsp
call fcn.14020c3e0
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call fcn.1400f8240
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
mov ecx, 1
call fcn.14021690c
int3
mov ecx, 5
call fcn.14021690c
int3
mov ecx, 2
call fcn.14021690c
nop
mov dword [rsp + 0x48], r15d
mov ecx, 6
call fcn.14021690c
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400f83d0
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3