Function at 0x1400077b9
Capabilities:
Check if file exists
Get disk information
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x718
lea rsi, str.USBSTOR
xor r11d, r11d
xor r9d, r9d
movabs rax, 0x525c4946455c3a3f
xor r8d, r8d
movabs rdx, 0x66746e5c73756675
mov qword [rsp + 0x106], rax
lea rdi, [rsp + 0x2b8]
movabs rax, 0x5f7366746e5c7375
lea r14, [rsp + 0x198]
mov qword [rsp + 0x10e], rdx
movabs rdx, 0x6966652e343678
mov dword [rsp + 0x760], ecx
mov ecx, 0x10
rep movsd dword [rdi], dword [rsi]
mov qword [rsp + 0x110], rax
xor eax, eax
lea rdi, [rsp + 0x378]
lea rsi, str._a_a_b_
mov ecx, 0x22
mov qword [rsp + 0xc0], r11
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xe
lea rdi, [rsp + 0x248]
lea rsi, str.t_a_b_
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xc
lea rdi, [rsp + 0x218]
lea rsi, [0x140079dc0]
rep movsd dword [rdi], dword [rsi]
mov ecx, 8
lea rdi, [rsp + 0x198]
mov qword [rsp + 0xc8], r11
rep stosd dword [rdi], eax
mov ecx, 8
lea rdi, [rsp + 0x1b8]
mov qword [rsp + 0x118], rdx
rep stosd dword [rdi], eax
mov edx, 0x14b
mov rax, qword [0x1400b1920]
mov dword [rsp + 0xb2], 0x3a3f2820
mov word [rsp + 0xb6], 0x29
mov dword [rsp + 0xae], 0x5c3a3f
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.140007751
lea rax, [rsp + 0xd0]
mov edx, pe_nt_image_headers64
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.14003523d
mov rcx, qword [rsp + 0x60]
mov r8d, 1
lea rdx, [0x14007fc78]
call fcn.14003527d
mov ecx, 0x104
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x378]
mov qword [rsp + 0x78], rax
je 0x140009978
xor r8d, r8d
xor edx, edx
mov r9d, 0x12
lea rcx, [0x1400807e0]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov qword [rsp + 0x58], rax
inc rax
je 0x140007c12
lea rdx, [rsp + 0xc0]
mov ecx, 0x101
call fcn.140034521
test eax, eax
jne 0x14000799b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
jmp 0x140007c12
mov dword [rsp + 0x158], 0x20
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
xor ebp, ebp
lea rbx, [rsp + 0x158]
mov rcx, qword [rsp + 0x58]
mov edx, ebp
mov r8, rbx
call rdi
test eax, eax
je 0x14000798b
mov rax, qword [0x1400b1dc0]
inc ebp
cmp dword [rax], 0
je 0x1400079e3
mov edx, ebp
lea rcx, str.Processing_Hub__d:
call fcn.140036717
lea r12, [rsp + 0x178]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
mov qword [rsp + 0x20], r12
lea r8, [0x1400807e0]
mov dword [rsp + 0x178], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x1400079af
xor r10d, r10d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
lea rsi, [rsp + 0x9c]
mov qword [rsp + 0x28], r10
mov r13, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov rdx, r12
mov qword [rsp + 0x20], rsi
call r13
test eax, eax
jne 0x1400079af
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x1400079af
mov edx, dword [rsp + 0x9c]
mov ecx, 1
mov dword [rsp + 0x74], edx
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x1400079af
xor r9d, r9d
mov dword [rax], 8
mov r8, rax
mov rdx, r12
mov qword [rsp + 0x28], r9
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x74]
call r13
test eax, eax
jne 0x140007ab3
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x1400079af
lea r13, [rsp + 0x98]
xor r8d, r8d
mov edx, dword [rsp + 0x16c]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_CM_Get_Child]
test eax, eax
jne 0x140007aa6
mov byte [r15], 0
mov rcx, qword [rsp + 0x60]
lea r12, [rbx + 4]
mov r8d, 1
mov rdx, r12
call fcn.14003527d
mov esi, eax
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x140007b0c
mov r8, r12
mov edx, esi
lea rcx, str.__Hub__d____s
call fcn.140036717
test esi, esi
js 0x140007aa6
xor r9d, r9d
mov ecx, dword [rsp + 0x98]
mov r8d, 0x104
mov rdx, r15
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x140007aa6
mov rcx, r15
call fcn.140006c80
lea rdx, [rsp + 0xc0]
mov rcx, r15
call fcn.140034600
mov edx, eax
test eax, eax
je 0x140007b64
mov eax, eax
movsxd rcx, esi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc0]
mov qword [rax + 0x10], rcx
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x140007b7f
mov r8, r15
lea rcx, str.__Found_ID__03d_:__s
call fcn.140036717
mov r12, qword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
xor r8d, r8d
mov edx, dword [rsp + 0x98]
mov rcx, r13
call r12
test eax, eax
jne 0x140007aa6
xor r9d, r9d
mov byte [r15], 0
mov r8d, 0x104
mov rdx, r15
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x140007b86
mov rcx, r15
call fcn.140006c80
lea rdx, [rsp + 0xc0]
mov rcx, r15
call fcn.140034600
mov edx, eax
test eax, eax
je 0x140007bf2
mov eax, eax
movsxd rcx, esi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc0]
mov qword [rax + 0x10], rcx
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x140007b86
mov r8, r15
lea rcx, str.__Found_ID__03d_:__s
call fcn.140036717
jmp 0x140007b86
mov rcx, r15
mov r12, r14
xor ebp, ebp
xor r13d, r13d
call sub.msvcrt.dll_free
mov dword [rsp + 0x74], 8
mov rdi, qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_List_SizeA]
lea rsi, str.UASPSTOR
mov rax, qword [rsp + 0x68]
mov rdx, rsi
mov rbx, qword [rax + rbp*8]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
mov r8d, 0x102
mov rdx, rbx
mov rcx, r12
test eax, eax
mov eax, dword [rsp + 0x74]
cmove eax, ebp
mov dword [rsp + 0x74], eax
call rdi
test eax, eax
je 0x140007c72
xor r8d, r8d
mov dword [r12], r8d
mov eax, dword [r12]
test eax, eax
je 0x140007c7f
lea r13d, [rax + r13 - 1]
inc rbp
add r12, 4
cmp rbp, 8
jne 0x140007c38
mov dword [rsp + 0x80], 0x11
xor esi, esi
lea rbx, [0x14007fcfe]
mov rax, qword [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [rax + rsi*8]
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, dword [rsp + 0x80]
cmove eax, esi
inc rsi
mov dword [rsp + 0x80], eax
cmp rsi, 0x11
jne 0x140007ca0
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov r12d, 1
lea rbp, [rsp + 0x1f8]
mov edx, 0x20
mov r9d, r12d
lea r8, str.IgnoreUsb_02d
mov rcx, rbp
call r15
mov rax, qword [0x1400b1aa0]
mov byte [rsp + 0x217], 0
mov rdx, qword [rax]
test rdx, rdx
je 0x140007d46
mov r8d, 1
mov rcx, rbp
xor ebx, ebx
call fcn.14002284a
mov rsi, rax
test rax, rax
je 0x140007f0a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_strtol
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_free
jmp 0x140007f0a
xor eax, eax
lea rdi, [rsp + 0x60c]
mov ecx, 0x41
xor edx, edx
rep stosd dword [rdi], eax
xor ecx, ecx
mov qword [rsp + 0x400], rdx
mov dword [rsp + 0x120], ecx
mov rcx, rbp
mov qword [rsp + 0x508], rdx
mov dword [rsp + 0x280], 0xffffffff
mov dword [rsp + 0x2f8], 4
call sub.msvcrt.dll_strlen
lea rdx, [rsp + 0x60c]
mov rbx, rax
test rbx, rbx
je 0x140007e16
cmp byte [rbp + rbx], 0x5c
je 0x140007dac
dec rbx
jmp 0x140007d9b
mov rdi, rdx
lea ecx, [rax + 1]
mov rsi, rbp
mov qword [rsp + 0x58], rdx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov r9d, 0x20019
mov byte [rsp + rax + 0x60c], 0
lea rax, [rsp + 0x508]
mov rcx, 0xffffffff80000001
mov byte [rsp + rbx + 0x60c], 0
inc rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140007ea5
xor eax, eax
mov qword [rsp + 0x508], rax
jmp 0x140007edd
xor r8d, r8d
lea rax, [rsp + 0x400]
mov r9d, 0x2001d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, [0x14007fd0f]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140007e53
xor eax, eax
mov qword [rsp + 0x400], rax
jmp 0x140007edd
lea rax, [rsp + 0x13c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 7
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x508]
mov rcx, qword [rsp + 0x400]
lea rdx, [0x14007fd18]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140007e07
lea rax, [rsp + 0x2f8]
lea rdx, [rbp + rbx]
xor r8d, r8d
mov rcx, qword [rsp + 0x508]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x120]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x400]
test rcx, rcx
je 0x140007ef0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x508]
test rcx, rcx
je 0x140007f03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x120]
mov dword [rsp + r12*4 + 0x1d4], ebx
inc r12
cmp r12, 9
jne 0x140007ce2
mov eax, dword [rsp + 0x74]
mov r8d, 0x24a
lea rdx, str.dev.c
lea rcx, str._uasp_start___0____uasp_start___ARRAYSIZE_usbstor_name__
dec eax
cmp eax, 6
ja 0x140007f60
mov eax, dword [rsp + 0x80]
dec eax
cmp eax, 0xf
jbe 0x140007f66
mov r8d, 0x24b
lea rdx, str.dev.c
lea rcx, str._card_start___0____card_start___ARRAYSIZE_genstor_name__
call qword [sym.imp.msvcrt.dll__wassert]
test r13d, r13d
je 0x14000806e
lea ecx, [r13 + 1]
xor r12d, r12d
xor r13d, r13d
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
je 0x140007f96
mov rbp, qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ListA]
mov rdi, qword [0x1400b1dc0]
jmp 0x140007fd6
lea rcx, str.Could_not_allocate_Device_ID_list
call fcn.140036717
jmp 0x140009978
mov rax, qword [rsp + 0x68]
mov ebx, r12d
mov r9d, 0x102
add rbx, r15
mov rsi, qword [rax + r13*2]
mov rdx, rbx
mov rcx, rsi
call rbp
test eax, eax
je 0x140007feb
add r13, 4
cmp r13, 0x20
je 0x140008071
mov r8d, dword [r13 + r14]
mov dword [rsp + r13 + 0x1b8], r12d
cmp r8d, 1
jbe 0x140007fc8
jmp 0x140007fa7
cmp dword [rdi], 0
jne 0x140008002
add r12d, dword [r14 + r13]
mov edx, r12d
lea r8d, [r12 - 2]
lea rax, [r15 + rdx]
jmp 0x14000804f
mov rdx, rsi
lea rcx, str.Processing_IDs_belonging_to__s:
lea rsi, str.___s
call fcn.140036717
cmp byte [rbx], 0
je 0x140007ff0
mov rdx, rbx
mov rcx, rsi
call fcn.140036717
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rbx, [rbx + rax + 1]
jmp 0x140008018
mov r9, rax
lea ecx, [r12 - 1]
sub r9, rdx
cmp byte [r9 + r8], 0
jne 0x14000805a
dec rax
mov r12d, ecx
cmp r12d, 2
ja 0x140008037
jmp 0x140007fc8
mov r9d, ecx
cmp byte [r15 + r9], 0
jne 0x140008049
cmp byte [rax], 0
jne 0x140008049
jmp 0x140007fc8
xor r15d, r15d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1400b1130]
mov r9d, 0x12
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov qword [rsp + 0x58], rax
inc rax
jne 0x1400080ac
call fcn.140036bd7
lea rcx, str.SetupDiGetClassDevs__Interface__failed:__s
mov rdx, rax
call fcn.140036717
jmp 0x140009978
mov dword [rsp + 0x158], 0x20
xor eax, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x84], eax
lea rax, [rsp + 0x158]
mov edx, dword [rsp + 0x84]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov r8, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400097bb
lea rbx, [rsp + 0x400]
xor eax, eax
mov ecx, 0x41
xor r12d, r12d
lea rdx, [rsp + 0x13c]
mov rdi, rbx
lea rbp, [rsp + 0x9c]
mov r8d, 0x16
rep stosd dword [rdi], eax
mov rdi, rdx
mov ecx, 7
mov rdx, qword [rsp + 0x68]
rep stosd dword [rdi], eax
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], 0x104
lea rdi, str.USBSTOR
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov rsi, qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x14000817e
call fcn.140036bd7
lea rcx, str.SetupDiGetDeviceRegistryProperty__Enumerator_Name__failed:__s
mov rdx, rax
jmp 0x140008f4b
inc r12d
cmp r12d, 8
je 0x1400081a8
mov rdx, rdi
mov rcx, rbx
call rsi
test eax, eax
jne 0x140008175
mov byte [rsp + 0x150], 1
test r12d, r12d
je 0x1400081a8
mov eax, dword [rsp + 0x74]
cmp r12d, eax
jae 0x1400081a8
mov byte [rsp + 0x152], 1
xor r12d, r12d
lea rdi, [0x14007fa17]
mov rdx, qword [rsp + r12*8 + 0x378]
mov rcx, rbx
test rdx, rdx
cmove rdx, rdi
call rsi
test eax, eax
jne 0x1400081e8
mov eax, dword [rsp + 0x80]
mov byte [rsp + 0x151], 1
cmp r12d, eax
jb 0x1400081f1
mov byte [rsp + 0x152], 1
jmp 0x1400081f1
inc r12
cmp r12, 0x11
jne 0x1400081b2
mov rsi, qword [0x1400b1dc0]
cmp dword [rsi], 0
je 0x14000820c
mov rdx, rbx
lea rcx, str.Processing__s_device:
call fcn.140036717
cmp word [rsp + 0x150], 0
jne 0x140008234
cmp dword [rsi], 0
je 0x140008228
lea rcx, str.__Unsupported_or_disabled_by_policy
call fcn.140036717
inc dword [rsp + 0x84]
jmp 0x1400080c4
xor eax, eax
mov ecx, 0x41
mov rdi, rbx
mov rdx, qword [rsp + 0x68]
rep stosd dword [rdi], eax
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], 0x104
mov r8d, 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x1400082fb
lea rax, str.Arsenal_________Virtual_
lea rsi, [0x14007fa17]
mov qword [rsp + 0x280], rax
lea rax, str.KernSafeVirtual_________
mov qword [rsp + 0x288], rax
lea rax, str.Msft____Virtual_Disk____
mov qword [rsp + 0x290], rax
lea rax, str.VMware__VMware_Virtual_S
mov qword [rsp + 0x298], rax
mov rax, qword [0x1400b17d0]
cmp dword [rax], 1
sbb r12d, r12d
xor edi, edi
add r12d, 4
cmp r12d, edi
jle 0x1400082f9
mov rdx, qword [rsp + rdi*8 + 0x280]
mov rcx, rbx
test rdx, rdx
cmove rdx, rsi
inc rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400082ce
mov eax, 1
jmp 0x1400082fb
xor eax, eax
cmp byte [rsp + 0x152], 0
mov byte [rsp + 0x154], al
jne 0x140008402
mov r8d, 7
lea rdx, str.SCSIDisk
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
jne 0x140008402
lea rax, [rsp + 0xe6]
xor r13d, r13d
mov r14d, 0xf
mov qword [rsp + 0x78], rax
mov r12, qword [rsp + r13*8 + 0x248]
mov ecx, 1
test r12, r12
je 0x14000836e
mov rcx, r12
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
mov eax, 0x10
cmp rcx, rax
cmova rcx, rax
mov rdi, qword [rsp + 0x78]
mov ecx, ecx
mov rsi, r12
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rcx, rbx
lea rdx, [rax + 1]
cmp rdx, 0x10
mov rdx, qword [rsp + 0x78]
cmovae rax, r14
mov byte [rsp + rax + 0xe6], 0
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400083b2
mov byte [rsp + 0x152], 1
jmp 0x140008402
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_strlen
cmp rax, 1
ja 0x1400083db
mov r8d, 0x2a2
lea rdx, str.dev.c
lea rcx, str.strlen_scsi_card_name_copy____1
jmp 0x140007f60
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
mov byte [rsp + rax + 0xe5], 0x26
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x1400083a8
inc r13
cmp r13, 7
jne 0x140008344
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x14000841d
mov rdx, rbx
lea rcx, str.__Hardware_ID:__s
call fcn.140036717
mov qword [rsp + 0x20], rbp
mov rdx, qword [rsp + 0x68]
lea rsi, [rsp + 0x60c]
mov r9d, 0x104
mov rcx, qword [rsp + 0x58]
mov r8, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
test eax, eax
jne 0x14000846a
call fcn.140036bd7
lea rcx, str.SetupDiGetDeviceInstanceId_failed:__s
mov rdx, rax
call fcn.140036717
lea rdx, str._N_A_
mov rcx, rsi
call sub.msvcrt.dll_strcpy
xor eax, eax
mov ecx, 0x41
mov rdi, rbx
mov rdx, qword [rsp + 0x68]
rep stosd dword [rdi], eax
lea rsi, [rsp + 0xa0]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8d, 0x1f
mov dword [rsp + 0x28], 0x104
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x1400084c0
mov eax, dword [rsp + 0x400]
sub eax, 2
cmp eax, 1
setbe al
movzx eax, al
mov byte [rsp + 0x155], al
mov rdi, rbx
xor eax, eax
mov r9, rbx
mov ecx, 0x41
mov rdx, qword [rsp + 0x68]
mov r8, rsi
rep stosd dword [rdi], eax
mov qword [rsp + 0x20], rbp
mov rcx, qword [rsp + 0x58]
call fcn.140006da4
test eax, eax
jne 0x1400085e1
call fcn.140036bd7
lea rcx, str.SetupDiGetDeviceRegistryProperty__Friendly_Name__failed:__s
mov rdx, rax
call fcn.140036717
mov ecx, 0xbe5
call fcn.14001d5c1
test rax, rax
jne 0x140008544
mov ecx, 0xbe5
mov ebx, 1
call fcn.14001d5c1
test rax, rax
je 0x140008566
mov ecx, 0xbe5
call fcn.14001d5c1
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
jmp 0x140008566
mov ecx, 0xbe5
mov ebx, 0x104
call fcn.14001d5c1
mov rcx, rax
call sub.msvcrt.dll_strlen
inc rax
cmp rax, 0x103
jbe 0x140008518
mov ecx, 0xbe5
call fcn.14001d5c1
mov rcx, rbx
mov rsi, rax
lea rax, [rsp + 0x400]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov ecx, 0xbe5
call fcn.14001d5c1
test rax, rax
jne 0x1400085b5
mov ecx, 0xbe5
call fcn.14001d5c1
test rax, rax
je 0x1400085d7
mov ecx, 0xbe5
call fcn.14001d5c1
mov rcx, rax
call sub.msvcrt.dll_strlen
jmp 0x1400085d7
mov ecx, 0xbe5
call fcn.14001d5c1
mov rcx, rax
call sub.msvcrt.dll_strlen
inc rax
cmp rax, 0x103
jbe 0x140008592
mov eax, 0x103
mov byte [rsp + rax + 0x400], 0
jmp 0x1400085f4
cmp byte [rsp + 0x154], 0
jne 0x1400085f4
test r15, r15
jne 0x140008701
xor r14d, r14d
jmp 0x1400086f5
cmp r13, rax
jae 0x140008628
mov al, byte [rbx + r13]
inc edi
cmp al, 0x5c
je 0x14000889d
test ebp, ebp
jne 0x140008862
mov rcx, rbx
mov r13d, edi
call sub.msvcrt.dll_strlen
cmp r12d, 2
jne 0x1400085fc
cmp dword [rsp + 0x13c], 0
lea rax, [0x14007fc78]
lea r12, str._ID_
cmove r12, rax
mov eax, esi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc0]
cmp qword [rax + 0x10], 0
je 0x1400088b2
imul rsi, rsi, 0x18
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + rsi + 0x10]
test rdx, rdx
je 0x140008bed
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x140008699
mov rax, qword [rsp + 0xd0]
lea rcx, str.__Matched_with_Hub__d_:__s
mov r8, qword [rax + rdx*8]
call fcn.140036717
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + rsi + 0x10]
mov rax, qword [rsp + 0xd0]
mov rdi, qword [rax + rdx*8]
test rdi, rdi
jne 0x140008941
or rbp, 0xffffffffffffffff
xor edi, edi
lea rax, [rbp - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400086d4
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test edi, edi
je 0x140008bed
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + rsi + 0x10]
mov rax, qword [rsp + 0xd0]
mov r14, qword [rax + rdx*8]
lea r12, [0x14007fc78]
jmp 0x140008bf0
mov r13, qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
mov r12, qword [sym.imp.SETUPAPI.dll_CM_Get_Child]
mov rbx, r15
mov rbp, qword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
cmp byte [rbx], 0
je 0x1400085f4
xor r8d, r8d
lea rcx, [rsp + 0x90]
mov rdx, rbx
call r13
test eax, eax
je 0x140008753
mov rax, qword [0x1400b1dc0]
mov rdx, rbx
lea rcx, str.Could_not_locate_device_node_for__s
cmp dword [rax], 0
je 0x140008bdb
jmp 0x14000878b
lea rsi, [rsp + 0x98]
mov edx, dword [rsp + 0x90]
xor r8d, r8d
mov rcx, rsi
call r12
mov edi, eax
test eax, eax
je 0x140008795
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x140008bdb
mov rdx, rbx
lea rcx, str.Could_not_get_children_of__s
call fcn.140036717
jmp 0x140008bdb
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x16c], eax
jne 0x14000880b
mov eax, dword [rsp + 0x74]
lea rdx, [rbx + 2]
mov rcx, rbx
mov eax, dword [rsp + rax*4 + 0x1b8]
add rax, r15
cmp rdx, rax
setae byte [rsp + 0x153]
call fcn.140006c80
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.140034600
mov esi, eax
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x140008858
mov r8, rbx
mov edx, esi
lea rcx, str.__Matched_with_ID__03d_:__s
call fcn.140036717
jmp 0x140008858
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x16c], eax
je 0x140008820
xor r8d, r8d
mov edx, dword [rsp + 0x98]
mov rcx, rsi
call rbp
test eax, eax
je 0x1400087fb
jmp 0x14000883f
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x1400087a5
mov rdx, rbx
lea rcx, str.NOTE:_Matched_instance_from_sibling_for__s
call fcn.140036717
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x16c], eax
jne 0x140008bdb
jmp 0x1400087a5
xor r12d, r12d
xor ebp, ebp
jmp 0x140008617
cmp al, 0x5f
jne 0x140008617
mov ecx, edi
mov r8d, 0x10
xor edx, edx
add rcx, rbx
call sub.msvcrt.dll_strtoul
movzx eax, ax
mov dword [rsp + 0x140], eax
test r12d, r12d
jne 0x1400088a7
mov dword [rsp + 0x13c], eax
mov r12d, 1
jmp 0x140008617
mov ebp, 1
jmp 0x140008617
mov r12d, 2
jmp 0x140008617
xor r8d, r8d
mov edx, dword [rsp + 0x90]
lea rcx, [rsp + 0x94]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
test eax, eax
jne 0x14000865b
xor r9d, r9d
lea rdi, [rsp + 0x508]
mov ecx, dword [rsp + 0x94]
mov r8d, 0x104
mov rdx, rdi
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x14000865b
mov rcx, rdi
call fcn.140006c80
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.140034600
mov esi, eax
mov rax, qword [0x1400b1dc0]
cmp dword [rax], 0
je 0x140008932
mov r8, rdi
mov edx, esi
lea rcx, str.__Matched_with__GP__ID__03d_:__s
call fcn.140036717
lea r12, str._GP_
mov rbx, rdi
jmp 0x14000865b
xor r8d, r8d
lea rcx, [rsp + 0xa8]
mov rdx, rbx
call qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
mov r8d, eax
test eax, eax
je 0x140008970
mov rdx, rbx
lea rcx, str.Could_not_get_device_instance_handle_for__s:_CR_error__d
call fcn.140036717
jmp 0x1400086bb
xor r13d, r13d
xor r14d, r14d
mov ecx, dword [rsp + 0xa8]
xor r8d, r8d
mov dword [rsp + 0x14c], r13d
lea r13, [rsp + 0xa4]
mov edx, 0x1d
lea r9, [rsp + 0x14c]
mov dword [rsp + 0xa4], 4
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Registry_PropertyA]
mov rdx, rbx
lea rcx, str.Could_not_get_port_for__s:_CR_error__d
mov r8d, eax
test eax, eax
jne 0x140008966
xor ebp, ebp
mov dword [rsp + 0x28], 0x40000000
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov r8d, 2
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140008a1c
call fcn.140036bd7
mov rdx, rdi
lea rcx, str.Could_not_open_hub__s:__s
mov r8, rax
call fcn.140036717
jmp 0x1400086bb
xor eax, eax
mov ecx, 0x1f
xor r11d, r11d
mov r9d, 0x23
lea rdx, [rsp + 0x284]
lea r8, [rsp + 0x280]
mov dword [rsp + 0xa4], 0x23
mov rdi, rdx
mov edx, 0x220448
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x14c]
mov qword [rsp + 0x38], r11
mov rcx, rbp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x280], eax
mov dword [rsp + 0x28], 0x23
mov qword [rsp + 0x20], r8
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov edi, eax
test eax, eax
jne 0x140008a9c
call fcn.140036bd7
mov rdx, rbx
lea rcx, str.Could_not_get_node_connection_information_for__s:__s
mov r8, rax
jmp 0x140008b76
movzx edx, word [rsp + 0x28c]
movzx eax, word [rsp + 0x28e]
xor edi, edi
mov ecx, edx
or cx, ax
je 0x140008ad9
mov dword [rsp + 0x140], eax
movzx eax, byte [rsp + 0x297]
mov edi, 1
mov dword [rsp + 0x13c], edx
inc eax
mov dword [rsp + 0x144], eax
mov eax, dword [rsp + 0x14c]
xor r9d, r9d
xor r10d, r10d
mov rcx, rbp
mov edx, 0x40000001
mov qword [rsp + 0x38], r10
lea r8, [rsp + 0xf6]
mov dword [rsp + 0xf6], eax
mov eax, 0xfffffffb
shl rdx, 4
mov qword [rsp + 0xfe], r9
shl rax, 0x20
and rax, qword [rsp + 0xfa]
mov r9d, 0x10
or rax, rdx
mov qword [rsp + 0x20], r8
mov edx, 0x22045c
mov qword [rsp + 0xfa], rax
lea rax, [rsp + 0xa4]
mov dword [rsp + 0xa4], 0x10
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x140008b80
call fcn.140036bd7
mov rdx, rbx
lea rcx, str.Could_not_get_node_connection_information__V2__for_device__s:__s
mov r8, rax
call fcn.140036717
jmp 0x1400086c1
mov al, byte [rsp + 0x102]
test al, 4
je 0x140008b9b
mov dword [rsp + 0x144], 5
jmp 0x1400086c1
test al, 1
je 0x140008baf
mov dword [rsp + 0x144], 4
jmp 0x1400086c1
test al, 8
je 0x140008bc3
mov dword [rsp + 0x148], 2
jmp 0x1400086c1
test al, 2
je 0x1400086c1
mov dword [rsp + 0x148], 1
jmp 0x1400086c1
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rbx, [rbx + rax + 1]
jmp 0x140008719
xor r14d, r14d
cmp byte [rsp + 0x153], 0
je 0x140008c75
lea rcx, [rsp + 0x400]
mov byte [rsp + 0x290], 0
movabs rax, 0x7369442049534353
movabs rdx, 0x656369766544206b
mov qword [rsp + 0x280], rax
movabs rax, 0x6976654420534155
mov qword [rsp + 0x288], rdx
lea rdx, [rsp + 0x280]
mov qword [rsp + 0xf6], rax
mov dword [rsp + 0xfd], 0x656369
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140008c75
cmp byte [rax + 0x11], 0
jne 0x140008c75
mov rdx, qword [rsp + 0xf6]
mov qword [rax], rdx
mov dword [rax + 7], 0x656369
cmp byte [rsp + 0x154], 0
lea rdx, [rsp + 0x400]
lea rcx, str.Found_VHD_device__s
jne 0x140008cc1
cmp byte [rsp + 0x152], 0
je 0x140008ccb
cmp byte [rsp + 0x150], 0
je 0x140008cb2
mov eax, dword [rsp + 0x13c]
or eax, dword [rsp + 0x140]
jne 0x140008ccb
lea rdx, [rsp + 0x400]
lea rcx, str.Found_card_reader_device__s
call fcn.140036717
jmp 0x140008ed5
test dword [rsp + 0x150], 0xff0000ff
jne 0x140008d27
cmp byte [rsp + 0x155], 0
je 0x140008d27
mov rax, qword [0x1400b1b00]
lea rdx, [rsp + 0x400]
cmp dword [rax], 0
jne 0x140008d1e
lea rcx, str.Found_non_USB_removable_device__s___Eliminated
call fcn.140036717
mov rax, qword [0x1400b1dc0]
lea rcx, str.If_you_REALLY_need__you_can_enable_listing_of_this_device_with__Ctrl__Alt__F_
cmp dword [rax], 0
je 0x140008228
jmp 0x140008223
lea rcx, str.Found_non_USB_removable_device__s
jmp 0x140008cc1
mov r9d, dword [rsp + 0x13c]
mov eax, dword [rsp + 0x140]
mov edi, r9d
or edi, eax
jne 0x140008d8c
cmp byte [rsp + 0x150], 0
jne 0x140008d6b
mov rax, qword [0x1400b1dc0]
lea rdx, [rsp + 0x400]
lea rcx, str.Found_non_USB_non_removable_device__s___Eliminated
cmp dword [rax], 0
je 0x140008228
jmp 0x140008f4b
movabs rax, 0x3f3f3f3a3f3f3f3f
mov word [rsp + 0x510], 0x3f
mov qword [rsp + 0x508], rax
jmp 0x140008e47
mov edx, 0x104
lea rbx, [rsp + 0x508]
mov dword [rsp + 0x20], eax
lea r8, str._04X:_04X
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__snprintf]
mov rax, qword [0x1400b1ae0]
mov byte [rsp + 0x60b], 0
mov edx, dword [rsp + 0x13c]
mov ecx, dword [rsp + 0x140]
cmp dword [rax], 0
je 0x140008e03
cmp edx, 0x525
jne 0x140008ddf
cmp ecx, 0x622b
jmp 0x140008dfd
cmp edx, 0x781
jne 0x140008def
cmp ecx, 0x75a0
jmp 0x140008dfd
cmp edx, 0x10d6
jne 0x140008e03
cmp ecx, 0x1101
je 0x140008228
xor eax, eax
mov r8d, dword [rsp + rax*4 + 0x1d8]
mov r9d, r8d
shr r9d, 0x10
cmp edx, r9d
jne 0x140008e3e
movzx r8d, r8w
cmp ecx, r8d
jne 0x140008e3e
lea rdx, [rsp + 0x400]
mov r8, rbx
lea rcx, str.Ignoring__s___s___per_user_settings
call fcn.140036717
jmp 0x140008228
inc rax
cmp rax, 8
jne 0x140008e05
cmp dword [rsp + 0x144], 5
jbe 0x140008e5c
xor r8d, r8d
mov dword [rsp + 0x144], r8d
cmp byte [rsp + 0x153], 0
lea rdx, [0x14007fc78]
lea rcx, str.UAS__
mov eax, dword [rsp + 0x144]
lea r9, [0x14007fc83]
mov qword [rsp + 0x30], r12
cmove r9, rdx
cmovne rdx, rcx
lea rcx, [rsp + 0x508]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x400]
mov qword [rsp + 0x20], rcx
mov r8, qword [rsp + rax*8 + 0x218]
lea rcx, str.Found__s_s_s_device__s___s___s
call fcn.140036717
mov edx, dword [rsp + 0x148]
test edx, edx
je 0x140008ed5
add edx, 0x2f
lea rcx, str.NOTE:_This_device_is_a_USB_3._c_device_operating_at_lower_speed...
call fcn.140036717
mov rax, qword [0x1400b1130]
mov r13, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
xor r12d, r12d
xor ebx, ebx
mov dword [rsp + 0x178], 0x20
mov qword [rsp + 0x88], rax
mov rcx, rbx
lea rsi, [rsp + 0x178]
call sub.msvcrt.dll_free
mov qword [rsp + 0x20], rsi
mov r9d, r12d
mov r8, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x158]
call r13
test eax, eax
jne 0x140008f61
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x103
je 0x140008f55
call fcn.140036bd7
lea rcx, str.SetupDiEnumDeviceInterfaces_failed:__s
mov rdx, rax
call fcn.140036717
jmp 0x140008228
lea rcx, str.A_device_was_eliminated_because_it_didnt_report_itself_as_a_disk
jmp 0x140008223
xor ecx, ecx
lea rdi, [rsp + 0x9c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov ebp, eax
test eax, eax
jne 0x140009022
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x140009007
mov edx, dword [rsp + 0x9c]
mov ecx, 1
mov dword [rsp + 0x68], edx
call sub.msvcrt.dll_calloc
mov r9d, dword [rsp + 0x68]
lea rcx, str.Unable_to_allocate_data_for_SP_DEVICE_INTERFACE_DETAIL_DATA
test rax, rax
mov rbx, rax
je 0x140009029
xor edx, edx
mov dword [rax], 8
mov rcx, qword [rsp + 0x58]
mov r8, rax
mov qword [rsp + 0x28], rdx
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
jne 0x140009030
call fcn.140036bd7
lea rcx, str.SetupDiGetDeviceInterfaceDetail__actual__failed:__s
mov rdx, rax
call fcn.140036717
jmp 0x1400097b3
call fcn.140036bd7
lea rcx, str.SetupDiGetDeviceInterfaceDetail__dummy__failed:__s
mov rdx, rax
call fcn.140036717
xor ebx, ebx
jmp 0x1400097b3
lea rcx, str.SetupDiGetDeviceInterfaceDetail__dummy____no_data_was_allocated
call fcn.140036717
jmp 0x14000901b
xor eax, eax
lea rsi, [rbx + 4]
xor r9d, r9d
mov r8d, 3
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x140009087
call fcn.140036bd7
mov rdx, rsi
lea rcx, [0x14008037e]
mov r8, rax
call fcn.140036717
jmp 0x1400097b3
mov rdx, rsi
mov qword [rsp + 0x68], rax
call fcn.14000dd99
mov rcx, qword [rsp + 0x68]
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test edi, edi
js 0x1400097b3
lea eax, [rdi + 0x80]
mov ecx, eax
mov dword [rsp + 0x78], eax
call fcn.14000e986
test eax, eax
jne 0x1400090ca
lea rcx, str.Device_eliminated_because_it_appears_to_contain_no_media
jmp 0x140009288
mov ecx, dword [rsp + 0x78]
call fcn.14000e8fa
mov qword [rsp + 0x68], rax
cmp rax, 0x7fffff
ja 0x1400090f6
mov edx, 8
lea rcx, str.Device_eliminated_because_it_is_smaller_than__d_MB
call fcn.140036717
jmp 0x140009657
lea rsi, [rsp + 0x120]
mov ecx, dword [rsp + 0x78]
lea r8, [rsp + 0xb8]
mov rdx, rsi
call fcn.14000e583
test eax, eax
je 0x1400097b3
cmp byte [rsp + 0x151], 0
je 0x14000918b
mov al, byte [rsp + 0x153]
or al, byte [rsp + 0x154]
jne 0x14000918b
cmp byte [rsp + 0x155], 0
je 0x140009657
mov rax, qword [0x1400b1b00]
cmp dword [rax], 0
jne 0x14000918b
mov r13, qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
lea r12, [rsp + 0xae]
mov al, byte [rsi]
test al, al
je 0x140009175
mov byte [rsp + 0xae], al
mov rcx, r12
call r13
cmp eax, 2
je 0x140009186
cmp byte [rsi], 0
je 0x14000918b
lea rcx, str.Device_eliminated_because_it_contains_a_mounted_partition_that_is_set_as_non_removable
jmp 0x140009288
inc rsi
jmp 0x14000915d
mov rsi, qword [0x1400b1750]
cmp dword [rsi], 0
jne 0x140009247
mov al, byte [rsp + 0x154]
or al, byte [rsp + 0x152]
je 0x1400091e9
cmp byte [rsp + 0x152], 0
je 0x140009247
mov eax, 0x19
mov rsi, qword [rsp + 0x68]
shl rax, 0x21
cmp rax, rsi
jae 0x140009247
lea rcx, str.Device_eliminated_because_it_was_detected_as_a_card_larger_than__d_GB
mov edx, 0xc8
call fcn.140036717
lea rcx, str.To_use_such_a_card__check_List_USB_Hard_Drives_under_advanced_drive_properties
jmp 0x140009288
movzx edx, word [rsp + 0x13c]
mov ecx, dword [rsp + 0x78]
lea r9, [rsp + 0x400]
movzx r8d, word [rsp + 0x140]
call fcn.140033b10
mov edx, eax
test eax, eax
jle 0x14000923e
lea rcx, str.Device_eliminated_because_it_was_detected_as_a_Hard_Drive__score__d___0_
call fcn.140036717
mov rax, qword [0x1400b1b00]
cmp dword [rax], 0
jne 0x140009235
lea rcx, str.If_this_device_is_not_a_Hard_Drive__please_e_mail_the_author_of_this_application
call fcn.140036717
lea rcx, str.NOTE:_You_can_enable_the_listing_of_Hard_Drives_under_advanced_drive_properties
jmp 0x140009288
cmp dword [rsi], 0
je 0x1400091ab
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14000926b
lea rdx, str.PortableBaseLayer
call sub.msvcrt.dll_strcmp
lea rcx, str.Device_eliminated_because_it_is_a_Windows_Sandbox_VHD
test eax, eax
je 0x140009288
cmp byte [rsp + 0x154], 0
je 0x140009292
mov rax, qword [0x1400b1760]
cmp dword [rax], 0
jne 0x140009292
lea rcx, str.Device_eliminated_because_listing_of_VHDs_is_disabled__Alt_G_
call fcn.140036717
jmp 0x140009657
cmp byte [rsp + 0x120], 0
jne 0x1400092d2
mov rax, qword [0x1400b1dd0]
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r8d, dword [rax]
call fcn.140037ab9
mov rdx, qword [rsp + 0xb8]
mov r8d, edi
mov ecx, 0xbe6
mov r9, rax
call fcn.14001d5c1
mov r12, rax
jmp 0x1400096df
mov rdi, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor r12d, r12d
lea rsi, [rsp + 0x106]
mov eax, r12d
mov al, byte [rsp + rax + 0x120]
test al, al
je 0x14000932f
mov byte [rsp + 0x106], al
mov rcx, rsi
call rdi
test eax, eax
je 0x14000932a
mov eax, r12d
mov edx, eax
cmp byte [rsp + rdx + 0x120], 0
je 0x140009327
lea ecx, [rax + 1]
mov rax, rcx
mov cl, byte [rsp + rcx + 0x120]
mov byte [rsp + rdx + 0x120], cl
jmp 0x140009305
dec r12d
inc r12d
jmp 0x1400092e4
cmp byte [rsp + 0x120], 0
je 0x140009352
cmp byte [rsp + 0x121], 0
je 0x140009352
mov ecx, 0xbe7
call fcn.14001d5c1
test rax, rax
jmp 0x14000935b
cmp qword [rsp + 0xb8], 0
sete al
mov dl, byte [rsp + 0x120]
test al, al
jne 0x1400093a2
test dl, dl
je 0x140009386
cmp byte [rsp + 0x121], 0
je 0x140009386
mov ecx, 0xbe7
call fcn.14001d5c1
mov rcx, rax
jmp 0x14000938e
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
mov r12d, pe_nt_image_headers64
inc rax
cmp rax, 0x7f
ja 0x14000940f
cmp byte [rsp + 0x120], 0
je 0x1400093c5
cmp byte [rsp + 0x121], 0
je 0x1400093c5
mov ecx, 0xbe7
call fcn.14001d5c1
test rax, rax
jmp 0x1400093ce
cmp qword [rsp + 0xb8], 0
sete al
mov r12d, 1
test al, al
jne 0x14000940f
cmp byte [rsp + 0x120], 0
je 0x1400093fe
cmp byte [rsp + 0x121], 0
je 0x1400093fe
mov ecx, 0xbe7
call fcn.14001d5c1
mov rcx, rax
jmp 0x140009406
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
lea r12, [rax + 1]
cmp byte [rsp + 0x120], 0
je 0x140009432
cmp byte [rsp + 0x121], 0
je 0x140009432
mov ecx, 0xbe7
call fcn.14001d5c1
mov rsi, rax
jmp 0x14000943a
mov rsi, qword [rsp + 0xb8]
lea rax, [rsp + 0x2f8]
cmp byte [rsp + 0x120], 0
mov rcx, r12
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
je 0x14000946d
cmp byte [rsp + 0x121], 0
je 0x14000946d
mov ecx, 0xbe7
call fcn.14001d5c1
test rax, rax
jmp 0x140009476
cmp qword [rsp + 0xb8], 0
sete al
mov dl, byte [rsp + 0x120]
test al, al
jne 0x1400094bd
test dl, dl
je 0x1400094a1
cmp byte [rsp + 0x121], 0
je 0x1400094a1
mov ecx, 0xbe7
call fcn.14001d5c1
mov rcx, rax
jmp 0x1400094a9
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
lea rdx, [rax + 1]
mov eax, 0x7f
cmp rdx, 0x7f
ja 0x140009524
cmp byte [rsp + 0x120], 0
je 0x1400094e0
cmp byte [rsp + 0x121], 0
je 0x1400094e0
mov ecx, 0xbe7
call fcn.14001d5c1
test rax, rax
jmp 0x1400094e9
cmp qword [rsp + 0xb8], 0
setne al
test al, al
je 0x14000997c
cmp byte [rsp + 0x120], 0
je 0x140009517
cmp byte [rsp + 0x121], 0
je 0x140009517
mov ecx, 0xbe7
call fcn.14001d5c1
mov rcx, rax
jmp 0x14000951f
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
mov byte [rsp + rax + 0x2f8], 0
xor esi, esi
movsx edi, byte [rsp + rsi + 0x120]
test ebp, ebp
jne 0x14000961a
test dil, dil
je 0x140009616
mov rax, qword [0x1400b1c10]
mov byte [rsp + 0xb4], dil
cmp dword [rax], 0
je 0x14000958f
lea rbp, [rsp + 0x2f8]
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov r8d, 0x7f
lea rdx, [0x14007fcb8]
mov rcx, rbp
sub r8, rax
mov eax, 4
cmp r8, rax
cmova r8, rax
call sub.msvcrt.dll_strncat
lea r13, [rsp + 0xb2]
lea r12, [rsp + 0x2f8]
mov rcx, r13
call sub.msvcrt.dll_strlen
mov rcx, r12
mov rbp, rax
call sub.msvcrt.dll_strlen
inc rbp
mov rdx, r13
mov rcx, r12
mov r8d, 0x7f
sub r8, rax
cmp rbp, r8
cmovbe r8, rbp
mov ebp, 2
call sub.msvcrt.dll_strncat
mov rcx, qword [0x1400b1530]
call fcn.140006d63
mov rcx, qword [0x1400b1cd0]
movsx r13d, byte [rsp + rsi + 0x120]
mov r12d, eax
call fcn.140006d63
add eax, 0x41
cmp r13d, eax
je 0x14000960e
add r12d, 0x41
xor ebp, ebp
cmp r12d, edi
sete bpl
inc rsi
jmp 0x14000952e
test ebp, ebp
je 0x140009664
dec ebp
lea rax, str.disk_from_which_Rufus_is_running
lea r8, str.system_disk
cmove r8, rax
lea eax, [rsi - 1]
movsx ecx, byte [rsp + rax + 0x120]
mov qword [rsp + 0x68], r8
call qword [sym.imp.msvcrt.dll_toupper]
mov r8, qword [rsp + 0x68]
lea rcx, str.Removing__c:_from_the_list:_This_is_the__s_
mov edx, eax
call fcn.140036717
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x140008228
mov rax, qword [0x1400b1dd0]
mov rcx, qword [rsp + 0x68]
xor edx, edx
lea r12, [rsp + 0x2f8]
mov r8d, dword [rax]
call fcn.140037ab9
lea r9, [0x14007fc78]
mov rcx, r12
mov rsi, rax
mov rax, qword [0x1400b1c10]
cmp dword [rax], 0
lea rax, [0x14007fcb8]
cmovne r9, rax
mov qword [rsp + 0x88], r9
call sub.msvcrt.dll_strlen
mov edx, pe_nt_image_headers64
mov qword [rsp + 0x20], rsi
mov r9, qword [rsp + 0x88]
sub rdx, rax
lea rcx, [r12 + rax]
lea r8, [0x140080690]
call qword [sym.imp.msvcrt.dll__snprintf]
mov byte [rsp + 0x377], 0
movsxd rdi, dword [rsp + 0x60]
mov rsi, qword [0x1400b1c20]
lea rcx, [rsp + 0x60c]
mov eax, dword [rsp + 0x78]
mov r13, qword [sym.imp.msvcrt.dll__strdup]
imul rbp, rdi, 0x38
add rbp, rsi
mov dword [rbp + 0x28], eax
call r13
lea rcx, [rsp + 0x400]
mov qword [rbp], rax
call r13
mov qword [rbp + 8], rax
test r12, r12
je 0x14000972c
mov rcx, r12
call r13
mov r12, rax
imul rax, rdi, 0x38
mov rcx, qword [rsp + 0xb8]
mov qword [rsi + rax + 0x10], r12
test rcx, rcx
je 0x14000974b
call qword [sym.imp.msvcrt.dll__strdup]
mov rcx, rax
imul rdi, rdi, 0x38
mov rax, qword [rsp + 0x68]
add rsi, rdi
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], rax
test r14, r14
je 0x14000977b
mov rcx, r14
call qword [sym.imp.msvcrt.dll__strdup]
mov qword [rsi + 0x20], rax
mov eax, dword [rsp + 0x14c]
mov dword [rsi + 0x2c], eax
inc dword [rsp + 0x60]
cmp dword [rsp + 0x60], 0x40
jne 0x140009797
mov edx, 0x40
lea rcx, str.Warning:_Found_more_than__d_drives___ignoring_remaining_ones...
call fcn.140036717
mov rcx, rbx
call sub.msvcrt.dll_free
inc dword [rsp + 0x84]
cmp dword [rsp + 0x60], 0x40
jne 0x1400080c4
jmp 0x1400097bb
inc r12d
jmp 0x140008efb
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov r13, qword [0x1400b1c20]
mov eax, dword [rsp + 0x60]
xor r8d, r8d
mov rdx, r13
lea r9d, [rax - 1]
movsxd rax, r8d
mov esi, r8d
cmp r9d, r8d
jle 0x140009851
inc r8
mov r11, qword [rdx + 0x30]
mov rcx, r8
cmp dword [rsp + 0x60], ecx
jle 0x14000980f
imul rbx, rcx, 0x38
mov rbx, qword [rbx + r13 + 0x30]
cmp rbx, r11
jae 0x14000980a
movsxd rax, ecx
mov r11, rbx
inc rcx
jmp 0x1400097f0
cmp esi, eax
je 0x14000984b
imul rax, rax, 0x38
lea rdi, [rsp + 0x280]
mov ecx, 0xe
mov rsi, rdx
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xe
mov rdi, rdx
add rax, r13
mov rsi, rax
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x280]
mov ecx, 0xe
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
add rdx, 0x38
jmp 0x1400097db
mov rsi, qword [0x1400b1920]
mov rbx, qword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
xor edi, edi
mov eax, dword [rsp + 0x60]
mov r12, qword [rsi]
cmp ebp, eax
jge 0x1400098f6
mov rcx, qword [r13 + 0x10]
mov r14d, dword [r13 + 0x28]
call fcn.140006cb6
mov rcx, r12
xor r8d, r8d
mov edx, 0x143
mov r9, rax
mov qword [rsp + 0x68], rax
call rbx
mov r12, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r9, qword [rsp + 0x68]
mov dword [rsp + 0x58], eax
test r9, r9
je 0x1400098b3
mov rcx, r9
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rcx, qword [rsi]
mov edx, 0x151
mov r9, r14
movsxd r8, r12d
call rbx
mov rdx, qword [r13 + 0x10]
mov rcx, qword [rsi]
call fcn.14003a3e5
cmp eax, edi
jl 0x1400098eb
mov rdx, qword [r13 + 0x10]
mov rcx, qword [rsi]
call fcn.14003a3e5
mov edi, eax
inc ebp
add r13, 0x38
jmp 0x140009863
xor r9d, r9d
movsxd r8, edi
mov edx, 0x160
mov rcx, r12
call rbx
cmp dword [rsp + 0x760], 0x7f
ja 0x140009914
xor edi, edi
jmp 0x140009947
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsi]
mov edx, 0x146
call rbx
cmp edi, eax
jae 0x140009910
xor r9d, r9d
mov rcx, qword [rsi]
movsxd r8, edi
mov edx, 0x150
call rbx
cmp dword [rsp + 0x760], eax
je 0x140009947
inc edi
jmp 0x140009916
mov rcx, qword [rsi]
xor r9d, r9d
movsxd r8, edi
mov edx, 0x14e
call rbx
xor r9d, r9d
mov r8d, 0x103e9
mov edx, 0x111
mov rax, qword [0x1400b19c0]
mov rcx, qword [rax]
call rbx
mov ebx, 1
jmp 0x140009983
xor ebx, ebx
jmp 0x140009983
xor eax, eax
jmp 0x140009524
mov rsi, qword [0x1400b19c0]
mov edx, 0x3eb
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9d, 1
mov edx, 0x28
mov rcx, qword [rsi]
mov r8, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r15
call sub.msvcrt.dll_free
lea rcx, [rsp + 0xd0]
call fcn.1400353aa
lea rcx, [rsp + 0xc0]
call fcn.1400345a0
mov eax, ebx
add rsp, 0x718
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret