Function at 0x18003faa0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [0x180058970], rax
xor edx, edx
xor ecx, ecx
or ebx, 0xffffffff
mov qword [0x180058978], rax
mov qword [0x180058980], rax
mov qword [0x180058970], 0xffffffffffffffff
mov qword [0x180058988], rax
mov qword [0x180058990], rax
mov qword [0x180058998], rax
mov qword [0x1800589a0], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x180058978], rax
test rax, rax
je 0x18003fe02
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor edi, edi
mov qword [0x180058980], rax
test rax, rax
je 0x18003fdd8
mov qword [rsp + 0x30], rdi
lea r8d, [rbx + 4]
lea rcx, str..VBoxUSBMon
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x180058970], rax
cmp rax, 0xffffffffffffffff
jne 0x18003fc3b
lea rcx, str.VBoxUSBMon
call fcn.1800435b0
test eax, eax
jne 0x18003fbf7
mov qword [rsp + 0x30], rdi
lea r8d, [rbx + 4]
lea rcx, str..VBoxUSBMon
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x180058970], rax
cmp rax, 0xffffffffffffffff
jne 0x18003fc3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.VBoxRT.dll_RTLogRelDefaultInstance]
test rax, rax
je 0x18003fbf2
test byte [rax + 0xc008], 1
jne 0x18003fbf2
lea r9, str.USBLibInit:_CreateFile_failed_winEr__d__n
lea edx, [rdi + 2]
lea r8d, [rdi + 0x69]
mov rcx, rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ebx, 0xffffff9a
mov rax, qword [0x180058970]
cmp rax, 0xffffffffffffffff
jne 0x18003fc3b
call qword [sym.imp.VBoxRT.dll_RTLogRelDefaultInstance]
test rax, rax
je 0x18003fc31
test byte [rax + 0xc008], 1
jne 0x18003fc31
mov edx, 2
lea r9, str.USBLibInit:_USB_Service_not_found_n
mov rcx, rax
lea r8d, [rdx + 0x67]
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ebx, 0xffffff9a
jmp 0x18003fdc2
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov edx, 0x229840
mov rcx, rax
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18003fd9f
cmp dword [rsp + 0x58], 5
jne 0x18003fd53
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov qword [0x180058998], rax
test rax, rax
je 0x18003fd4b
lea r8, [0x18003f8e0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180058988], rax
test rax, rax
je 0x18003fd28
mov rcx, qword [0x180058978]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [0x180058990], rdi
je 0x18003fcfe
mov rcx, qword [0x180058978]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [0x180058988]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x180058988]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180058988], 0xffffffffffffffff
jmp 0x18003fd31
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebx, 0xffffffff
mov rcx, qword [0x180058998]
or rdx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov qword [0x180058998], rdi
jmp 0x18003fdaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18003fdaa
call qword [sym.imp.VBoxRT.dll_RTLogRelDefaultInstance]
mov rcx, rax
test rax, rax
je 0x18003fda5
test byte [rax + 0xc008], 1
jne 0x18003fda5
mov eax, dword [rsp + 0x5c]
mov qword [rsp + 0x38], rdi
mov edx, 2
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x58]
lea r9, str.USBLibInit:_USB_Monitor_driver_version_mismatch__driver_u._u_library_u._u_n
lea r8d, [rdx + 0x67]
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x18003fda5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfffffff5
mov rcx, qword [0x180058970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180058970], 0xffffffffffffffff
mov rcx, qword [0x180058980]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180058980], rdi
jmp 0x18003fde1
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebx, 0xffffffff
mov rcx, qword [0x180058978]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180058978], rdi
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret