Function at 0x140006df0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140067080]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor r15d, r15d
mov r14d, r15d
mov dword [rbp - 0x68], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x28]
call fcn.1400055a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x59
lea rdx, str.It_is_recommend_to_uninstall_device_s__in_Device_Manager_now__Then_continue_process_here.
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a574]
lea rdx, [0x14006a568]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140006ec7
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ec2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008467
call fcn.140027a30
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x1f
lea rdx, str.List_of_devices_you_can_block:_n
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5bc]
lea rdx, [0x14006a5b0]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140006f44
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008467
call fcn.140027a30
mov rdi, r15
mov rax, qword [rbp - 0x20]
sub rax, qword [rbp - 0x28]
sar rax, 7
test rax, rax
je 0x140006ff7
mov rbx, r15
nop
lea rdx, [rdi + 1]
mov rdi, rdx
lea rcx, [0x140068dc0]
call fcn.140009c50
mov rcx, rax
lea rdx, [0x14005c92c]
call fcn.14000e370
mov rdx, qword [rbp - 0x28]
add rdx, rbx
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140006f97
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140015280
lea rdx, str.__Class:
mov rcx, rax
call fcn.14000e370
mov rdx, qword [rbp - 0x28]
add rdx, 0x60
add rdx, rbx
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140006fc7
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140015280
lea rdx, [0x14005c910]
mov rcx, rax
call fcn.14000e370
sub rbx, 0xffffffffffffff80
mov rax, qword [rbp - 0x20]
sub rax, qword [rbp - 0x28]
sar rax, 7
cmp rdi, rax
jb 0x140006f60
lea rdx, [0x14005c934]
call fcn.14000e810
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], r15
mov ebx, dword [rbp - 0x68]
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov r8d, 0x40
lea rdx, str.Enter_the_number_of_the_device_you_want_to_block__0_to_finish_:
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5bc]
lea rdx, [0x14006a5b0]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000709d
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007098
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
mov dword [rbp - 0x68], ebx
lea rdx, [rbp - 0x68]
call fcn.14000ee30
mov ebx, dword [rbp - 0x68]
test ebx, ebx
je 0x1400071c6
cmp ebx, 1
jl 0x1400070f7
mov rax, qword [rbp - 0x20]
sub rax, qword [rbp - 0x28]
sar rax, 7
cmp ebx, eax
jg 0x1400070f7
lea eax, [rbx - 1]
mov dword [rbp - 0x68], eax
mov rdx, qword [rbp - 0x58]
cmp rdx, qword [rbp - 0x50]
je 0x1400070e5
mov dword [rdx], eax
add qword [rbp - 0x58], 4
jmp 0x140007020
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x60]
call fcn.140016000
jmp 0x140007020
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov r8d, 0x2c
lea rdx, str.Invalid_choice._Please_enter_a_valid_number.
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.14000e060
nop
lea r8, [0x14006a58c]
lea rdx, [0x14006a580]
mov rcx, rax
call fcn.140003410
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140007181
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000717b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400083f5
call fcn.140027a30
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140007020
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
jmp 0x140007020
mov rax, qword [rbp - 0x58]
cmp qword [rbp - 0x60], rax
jne 0x14000725a
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x1d
lea rdx, str.No_devices_selected_to_block.
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a58c]
lea rdx, [0x14006a580]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140008309
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
jmp 0x140008309
lea rcx, [0x14005c9d8]
call fcn.140033870
lea rdx, [0x14005c934]
call fcn.14000e810
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x1a
lea rdx, str.Selected_devices_to_block:
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5a4]
lea rdx, [0x14006a598]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400072ef
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
mov rbx, r15
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
test rax, rax
je 0x14000740f
nop word [rax + rax]
movsxd rdx, dword [rcx + rbx*4]
shl rdx, 7
add rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14000a4f0
nop
mov r8, rax
lea rdx, str.___
lea rcx, [rsp + 0x78]
call fcn.14000e1a0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140007349
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140068dc0]
call fcn.140015280
mov rcx, rax
call fcn.14000e630
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x1400073a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000739d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400083fb
call fcn.140027a30
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x1400073f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008401
call fcn.140027a30
inc rbx
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
cmp rbx, rax
jb 0x140007310
lea rcx, [0x14005c9d8]
call fcn.140033870
lea rdx, [0x14005c934]
call fcn.14000e810
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x28
lea rdx, str.Selected_devices_to_block_and_uninstall:
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5a4]
lea rdx, [0x14006a598]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400074a4
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000749f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
mov rbx, r15
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
test rax, rax
je 0x1400075bf
nop
movsxd rdx, dword [rcx + rbx*4]
shl rdx, 7
add rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14000a4f0
nop
mov r8, rax
lea rdx, str.___
lea rcx, [rsp + 0x78]
call fcn.14000e1a0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1400074f9
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140068dc0]
call fcn.140015280
mov rcx, rax
call fcn.14000e630
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140007552
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000754d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008407
call fcn.140027a30
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x1400075a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000759f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000840d
call fcn.140027a30
inc rbx
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
cmp rbx, rax
jb 0x1400074c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x3e
lea rdx, str.Uninstalling_and_blocking_the_selected_devices__please_wait...
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5bc]
lea rdx, [0x14006a5b0]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000763c
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007637
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
mov rdi, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x58]
cmp rdi, rsi
je 0x140007813
movabs r12, 0x7ffffffffffffffe
nop word [rax + rax]
movsxd rax, dword [rdi]
test eax, eax
js 0x140007806
mov rbx, rax
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
sub rax, rcx
sar rax, 7
cmp rbx, rax
jae 0x140007806
shl rbx, 7
add rcx, 0x40
add rcx, rbx
call fcn.140005110
mov rcx, qword [rbp - 0x28]
add rcx, rbx
mov rdx, qword [rcx + 0x10]
test al, al
mov rax, r12
je 0x14000775d
sub rax, rdx
cmp rax, 0x1a
jb 0x140008413
cmp qword [rcx + 0x18], 7
jbe 0x1400076c3
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x1a
lea r9, str.Successfully_uninstalled:
lea rcx, [rsp + 0x78]
call fcn.140014430
or r14d, 0x20
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [0x140068dc0]
call fcn.140015280
mov rcx, rax
call fcn.14000e630
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140007806
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007801
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400083ef
jmp 0x140007801
sub rax, rdx
cmp rax, 0x15
jb 0x14000841f
cmp qword [rcx + 0x18], 7
jbe 0x140007774
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], SafeArrayUnaccessData
lea r9, str.Failed_to_uninstall:
lea rcx, [rsp + 0x78]
call fcn.140014430
or r14d, 0x40
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [0x140068dc0]
call fcn.140015280
mov rcx, rax
call fcn.14000e630
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140007806
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007801
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008419
call fcn.140027a30
add rdi, 4
cmp rdi, rsi
jne 0x140007660
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x35
lea rdx, str.Uninstalling_the_selected_devices_has_been_completed_
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5a4]
lea rdx, [0x14006a598]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140007890
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000788b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x2d
lea rdx, str.Blocking_the_selected_devices__please_wait...
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5bc]
lea rdx, [0x14006a5b0]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000790d
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007908
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsDeviceInstallRestrictions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400079b6
mov dword [rbp - 0x68], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DenyDeviceIDs
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DenyDeviceIDsRetroactive
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
mov rax, qword [rbp - 0x58]
sub rax, qword [rbp - 0x60]
sar rax, 2
test rax, rax
je 0x140007c2e
nop
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x20]
call fcn.14004d600
lea rcx, [rbp + 0x20]
call fcn.140009430
nop
lea rsi, [rdi + 1]
mov rdx, rsi
lea rcx, [rbp + 0x30]
call fcn.140009c50
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
or r14d, 0x10
mov dword [rbp - 0x68], r14d
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
mov ecx, dword [rbp + 0xa8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140007a5d
mov rax, qword [rbp + 0x78]
mov rdx, qword [rax]
test rdx, rdx
je 0x140007a5d
mov rax, qword [rbp + 0x58]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0xa0]
cmovb rdx, qword [rbp + 0xa0]
sub rdx, r9
jmp 0x140007a88
test cl, 4
jne 0x140007abe
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax]
test rcx, rcx
je 0x140007abe
mov rax, qword [rbp + 0x50]
mov r9, qword [rax]
mov rax, qword [rbp + 0x88]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, rcx
mov rax, r9
sar rdx, 1
test rax, rax
je 0x140007abe
lea rcx, [rsp + 0x78]
cmp rdx, 7
ja 0x140007ab9
mov qword [rbp - 0x78], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.14004cde0
mov word [rsp + rbx + 0x78], r15w
jmp 0x140007abe
call fcn.140010b50
and r14d, 0xffffffef
or r14d, 8
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsDeviceInstallRestrictionsDenyDeviceIDs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140007bba
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + rdi*4]
shl rcx, 7
mov rdx, qword [rbp - 0x28]
add rdx, 0x40
add rdx, rcx
lea rcx, [rbp - 0x48]
call fcn.14000a4f0
mov eax, dword [rbp - 0x38]
lea eax, [rax*2 + 2]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rcx, qword [rbp - 0x48]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140007bba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000842b
call fcn.140027a30
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140007bfb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008431
call fcn.140027a30
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
lea rcx, [rbp + 0x20]
call fcn.140006d00
mov rdi, rsi
mov rax, qword [rbp - 0x58]
sub rax, qword [rbp - 0x60]
sar rax, 2
cmp rsi, rax
jb 0x1400079d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, SafeArrayGetLBound
lea rdx, str.gpupdate__force
lea rcx, [rsp + 0x78]
call fcn.14000f4d0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.140006300
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140007c9f
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008425
call fcn.140027a30
movdqa xmm0, xmmword [0x14005d460]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140007cf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007cec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008437
call fcn.140027a30
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x29
lea rdx, str.Device_s__have_been_blocked_successfully_
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5a4]
lea rdx, [0x14006a598]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140007d6e
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007d69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x27
lea rdx, str.Cleaning_up_related_registry_entries...
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a5bc]
lea rdx, [0x14006a5b0]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140007deb
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007de6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
call fcn.140027a30
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
mov rdx, r15
mov qword [rbp + 0x18], rdx
mov rsi, r15
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
test rax, rax
je 0x140007eac
mov rbx, qword [rbp + 0x10]
nop dword [rax]
movsxd rdi, dword [rcx + rsi*4]
shl rdi, 7
add rdi, qword [rbp - 0x28]
cmp rbx, rdx
je 0x140007e79
mov qword [rbp - 0x68], rbx
mov rdx, rdi
mov rcx, rbx
call fcn.14000a4f0
nop
lea rcx, [rbx + 0x20]
lea rdx, [rdi + 0x20]
call fcn.14000a4f0
nop
lea rcx, [rbx + 0x40]
lea rdx, [rdi + 0x40]
call fcn.14000a4f0
nop
lea rcx, [rbx + 0x60]
lea rdx, [rdi + 0x60]
call fcn.14000a4f0
nop
mov rbx, qword [rbp + 0x10]
sub rbx, 0xffffffffffffff80
mov qword [rbp + 0x10], rbx
jmp 0x140007e8c
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.1400156e0
mov rbx, qword [rbp + 0x10]
inc rsi
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
cmp rsi, rax
jae 0x140007eac
mov rdx, qword [rbp + 0x18]
jmp 0x140007e20
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x10]
call fcn.1400044c0
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x48]
call fcn.140003980
mov rbx, rax
lea rax, [rbp - 0x10]
cmp rax, rbx
je 0x140007f59
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140007f37
mov rdx, qword [rbp - 8]
call fcn.1400107f0
mov rdx, qword [rbp]
mov rcx, qword [rbp - 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000843d
call fcn.140027a30
mov qword [rbp - 0x10], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 8], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
lea rcx, [rbp - 0x48]
call fcn.14000c8a0
mov rbx, qword [rbp - 8]
mov rdi, qword [rbp - 0x10]
cmp rdi, rbx
je 0x140007f9b
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140007f7d
mov rdx, qword [rdi]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rdi, 0x20
cmp rdi, rbx
jne 0x140007f70
mov rbx, qword [rbp - 8]
mov rdi, qword [rbp - 0x10]
lea r9, [rbp - 0x33]
sub rbx, rdi
sar rbx, 5
movabs r8, 0xcccccccccccccccd
dec r9
mov rax, r8
mul rbx
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov rbx, rdx
test rdx, rdx
jne 0x140007fb0
lea r8, [rbp - 0x33]
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.140014e70
nop
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r8
mov r14d, 0x44
lea rsi, str.Related_registry_entries_have_been_cleaned_up_successfully__Amount:
cmp rax, r14
jb 0x140008088
lea rax, [r8 + 0x44]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x50]
lea rax, [0x14005cc34]
cmp rax, rbx
jbe 0x14000804b
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x14000804b
cmp rbx, rsi
ja 0x140008043
mov rdi, r15
jmp 0x14000804e
mov rdi, rbx
sub rdi, rsi
jmp 0x14000804e
mov rdi, r14
inc r8
lea rcx, [rbx + 0x44]
mov rdx, rbx
call fcn.14004cde0
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14004cde0
sub r14, rdi
lea rdx, [rsi + 0x44]
add rdx, rdi
lea rcx, [rbx + rdi]
mov r8, r14
call fcn.14004cde0
lea rax, [rsp + 0x50]
jmp 0x14000809f
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14001aeb0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetLBound
mov byte [rax], 0
lea r8, [0x14006a5a4]
lea rdx, [0x14006a598]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140008114
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000810e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008443
call fcn.140027a30
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140008151
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000814c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008449
call fcn.140027a30
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x30
lea rdx, str.Please_restart_your_computer_and_verify_changes.
lea rcx, [rsp + 0x78]
call fcn.14000f600
nop
lea r8, [0x14006a58c]
lea rdx, [0x14006a580]
lea rcx, [rsp + 0x78]
call fcn.140003410
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400081ce
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000844f
call fcn.140027a30
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, SafeArrayGetLBound
lea rdx, str.powercfg__h_off
lea rcx, [rsp + 0x78]
call fcn.14000f4d0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.140006300
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000823f
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000823a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008455
call fcn.140027a30
movdqa xmm0, xmmword [0x14005d460]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140008292
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000828c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000845b
call fcn.140027a30
nop
lea rcx, [rbp - 0x10]
call fcn.14000c8a0
nop
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x140008309
mov rdi, qword [rbp + 0x10]
cmp rbx, rdi
je 0x1400082c5
nop
mov rcx, rbx
call fcn.1400061a0
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x1400082b0
mov rbx, qword [rbp + 8]
mov rdx, qword [rbp + 0x18]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400082f5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008461
mov rcx, rbx
call fcn.140027a30
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r15
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000835b
mov rax, qword [rbp - 0x50]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000834a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008467
call fcn.140027a30
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x1400083b9
mov rdi, qword [rbp - 0x20]
cmp rbx, rdi
je 0x140008385
nop dword [rax]
mov rcx, rbx
call fcn.1400061a0
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x140008370
mov rbx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x18]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400083b1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400083e9
mov rcx, rbx
call fcn.140027a30
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140027a10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
int3
call fcn.140001730
int3
call fcn.140033f90
int3
call fcn.140001730
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
int3
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
int3