Function at 0x14002f3e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x578]
sub rsp, 0x678
mov r12, rcx
lea r8, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp + 0x200]
mov edx, 0x104
call fcn.14007699c
lea rcx, [rbp + 0x200]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14002f427
lea rbx, [rbp + 0x200]
mov r9d, 2
add rbx, rax
lea rcx, [0x1400a73b8]
xor r8d, r8d
mov qword [rsp + 0x40], rbx
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
xor r13d, r13d
mov dword [rbp + 0x5b8], 0x104
mov qword [rsp + 0x48], rax
mov r14, rax
mov dword [rbp + 0x5c0], r13d
mov r15d, r13d
cmp rax, 0xffffffffffffffff
je 0x14002f9ec
xor eax, eax
mov dword [rbp + 0x5c8], r13d
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x60], 0x20
mov rcx, r14
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14002f984
mov qword [rsp + 0x670], rsi
mov qword [rsp + 0x668], rdi
nop dword [rax]
lea rax, [rsp + 0x50]
mov r8d, 0xb
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x28], 0x28
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x14002f94e
cmp dword [rbp - 0x30], 0x61766441
jne 0x14002f94e
cmp dword [rbp - 0x2c], 0x6465636e
jne 0x14002f94e
lea rax, [rsp + 0x50]
mov r8d, 4
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
mov dword [rsp + 0x28], 0xe1
lea rdx, [rsp + 0x60]
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x14002f94e
lea rax, [rbp + 0x5b8]
mov dword [rbp + 0x5b8], 0x104
mov qword [rsp + 0x28], rax
lea r8, str.ImagePath
lea rax, [rbp + 0x450]
mov r9d, 2
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.140043e50
cmp eax, 1
jne 0x14002f94e
cmp dword [rbp + 0x5b8], 0
jbe 0x14002f94e
lea r8, [0x1400da620]
mov edx, 0x104
lea rcx, [rbp + 0x50]
call fcn.14007699c
lea r8, [rbp + 0x45c]
mov edx, 0x104
lea rcx, [rbp + 0x50]
call fcn.1400762b8
lea rax, [rbp + 0x50]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x14002f5f0
lea ecx, [rdx - 1]
mov dword [rbp + 0x5b8], edx
cmp byte [rbp + rcx + 0x50], 0x5c
je 0x14002f624
nop dword [rax]
lea eax, [rcx - 1]
mov dword [rbp + 0x5b8], ecx
cmp byte [rbp + rax + 0x50], 0x5c
mov edx, ecx
mov ecx, eax
jne 0x14002f610
movsd xmm0, qword [str....inf]
lea rcx, [rbp + 0x50]
mov eax, edx
lea rdx, [rbp + 0x310]
add rcx, rax
movzx eax, byte [0x1400b1a08]
movsd qword [rcx], xmm0
mov byte [rcx + 8], al
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x14002f94e
mov edx, dword [rbp + 0x5b8]
lea rcx, [rbp + 0x33c]
add edx, 3
lea r9, [rbp + 0x50]
sub rdx, rcx
lea r8, [rbp + 0x33c]
add r9, rdx
nop
movzx ecx, byte [r8]
mov byte [r9 + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x14002f680
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x50]
mov esi, 1
mov dword [rsp + 0x28], r13d
mov r8d, esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002f94e
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r13
mov r8d, 0x96
lea rdx, [rbp + 0x160]
mov rcx, rax
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002f7dd
cmp dword [rsp + 0x58], 0x96
jne 0x14002f7dd
nop dword [rax + rax]
mov eax, ebx
inc ebx
movzx ecx, byte [rbp + rax + 0x160]
sub cl, 0x30
cmp cl, 9
jbe 0x14002f731
cmp ebx, 0x96
jb 0x14002f710
jmp 0x14002f7dd
cmp ebx, 0x96
jae 0x14002f7dd
nop dword [rax]
mov eax, ebx
inc ebx
test r13b, r13b
jne 0x14002f760
cmp byte [rbp + rax + 0x160], 0x2d
je 0x14002f760
cmp ebx, 0x96
jb 0x14002f740
jmp 0x14002f7dd
cmp ebx, 0x96
jae 0x14002f7dd
mov r8d, r13d
nop dword [rax + rax]
movzx edx, byte [rbp + rbx + 0x160]
inc ebx
sub dl, 0x30
cmp dl, 9
ja 0x14002f795
movzx eax, dl
lea ecx, [r8 + r8*4]
lea r8d, [rax + rcx*2]
cmp ebx, 0x96
jb 0x14002f770
mov ecx, r13d
cmp ebx, 0x96
jae 0x14002f7dd
movzx edx, byte [rbp + rbx + 0x160]
inc ebx
sub dl, 0x30
cmp dl, 9
ja 0x14002f7c5
movzx eax, dl
lea ecx, [rcx + rcx*4]
lea ecx, [rax + rcx*2]
cmp ebx, 0x96
jb 0x14002f7a0
jmp 0x14002f7dd
cmp ebx, 0x96
jae 0x14002f7dd
cmp r8d, 0x15
ja 0x14002f7da
jne 0x14002f7dd
cmp ecx, 0x28
jb 0x14002f7dd
mov esi, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x14002f949
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x50]
call fcn.140030b10
test al, al
je 0x14002f949
test r15d, r15d
jne 0x14002f83b
lea r8, [rbp + 0x50]
mov edx, 0x104
mov rcx, r12
call fcn.14007699c
lea r8, [rbp - 0x80]
lea edx, [rsi + 0x50]
lea rcx, [rbp]
call fcn.14007699c
mov r15d, 1
mov dword [rbp + 0x5c0], r15d
jmp 0x14002f949
mov esi, r13d
lea rcx, [rbp - 0x80]
mov r12, r13
mov edi, r13d
mov r15, r13
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14002f852
test rax, rax
je 0x14002f93b
nop dword [rax]
nop dword [rax + rax]
movsxd r13, edi
lea rcx, [rbp]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14002f880
cmp r13, rax
jae 0x14002f933
xor edx, edx
movsxd r14, esi
lea rcx, [rbp - 0x80]
add rcx, r14
lea r8d, [rdx + 0xa]
call fcn.140078ad0
xor edx, edx
lea rcx, [rbp]
add rcx, r13
mov ebx, eax
lea r8d, [rdx + 0xa]
call fcn.140078ad0
cmp ebx, eax
jg 0x14002f9b5
jl 0x14002f933
lea rax, [rbp - 0x80]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x14002f8d0
cmp r14, rdx
jae 0x14002f8f7
nop
movzx eax, byte [rbp + r12 - 0x80]
inc esi
inc r12
cmp al, 0x2e
je 0x14002f8f7
movsxd rax, esi
cmp rax, rdx
jb 0x14002f8e0
lea rax, [rbp]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14002f902
cmp r13, rcx
jae 0x14002f927
movzx eax, byte [rbp + r15]
inc edi
inc r15
cmp al, 0x2e
je 0x14002f927
movsxd rax, edi
cmp rax, rcx
jb 0x14002f910
movsxd rax, esi
cmp rax, rdx
jb 0x14002f870
mov r14, qword [rsp + 0x48]
xor r13d, r13d
mov r12, qword [rbp + 0x5b0]
mov r15d, dword [rbp + 0x5c0]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rbp + 0x5c8]
lea r8, [rsp + 0x60]
inc eax
mov rcx, r14
mov edx, eax
mov dword [rbp + 0x5c8], eax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14002f4d0
mov rdi, qword [rsp + 0x668]
mov rsi, qword [rsp + 0x670]
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test r15d, r15d
je 0x14002f9ec
mov eax, dword [rbp + 0x5b8]
mov byte [rax + r12], 0
mov eax, dword [rbp + 0x5b8]
add rsp, 0x678
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
mov r12, qword [rbp + 0x5b0]
lea r8, [rbp + 0x50]
mov rcx, r12
mov edx, 0x104
call fcn.14007699c
lea r8, [rbp - 0x80]
mov edx, 0x50
lea rcx, [rbp]
call fcn.14007699c
mov r14, qword [rsp + 0x48]
xor r13d, r13d
jmp 0x14002f942
mov eax, r13d
add rsp, 0x678
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret