Function at 0x140025480
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Query or enumerate registry value
Set file attributes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1210
call fcn.1400dbd60
sub rsp, rax
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov qword [rsp + 0x1248], rbx
mov qword [rsp + 0x1250], rbp
mov qword [rsp + 0x1258], rsi
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x1200], rax
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0xb8], ebp
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400254fa
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea r12, [0x1400deee8]
mov rdi, r12
shr rdi, 0x10
jne 0x140025544
movzx ebx, r12w
mov ecx, ebx
call fcn.14004aef8
test rax, rax
je 0x140025555
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140005b70
jmp 0x140025555
mov rdx, r12
lea rcx, [rsp + 0xd0]
call fcn.140005ff0
nop
mov qword [rsp + 0xe8], rbp
mov dword [rsp + 0xf0], ebp
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140025583
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
test rdi, rdi
jne 0x1400255c1
movzx edi, r12w
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400255d3
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140005b70
mov rsi, qword [rsp + 0x50]
jmp 0x1400255d3
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140005ff0
mov rsi, qword [rsp + 0x50]
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400255f2
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rdx, str.FUNC_01VEN_10EC
test rdx, 0xffffffffffff0000
jne 0x14002563b
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140025649
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140005b70
jmp 0x140025649
lea rcx, [rsp + 0x98]
call fcn.140005ff0
nop
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140025668
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r15, [rax + 0x18]
mov qword [rsp + 0x88], r15
lea rdx, [0x1400e1128]
test rdx, 0xffffffffffff0000
jne 0x1400256b9
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400256ce
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140005b70
mov r15, qword [rsp + 0x88]
jmp 0x1400256ce
lea rcx, [rsp + 0x88]
call fcn.140005ff0
mov r15, qword [rsp + 0x88]
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400256ed
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r14, [rax + 0x18]
mov qword [rsp + 0x80], r14
lea rdx, [0x1400e1110]
test rdx, 0xffffffffffff0000
jne 0x14002573e
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140025753
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140005b70
mov r14, qword [rsp + 0x80]
jmp 0x140025753
lea rcx, [rsp + 0x80]
call fcn.140005ff0
mov r14, qword [rsp + 0x80]
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140025772
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r13, [rax + 0x18]
mov qword [rsp + 0xb0], r13
lea rdx, [0x1400e10f8]
test rdx, 0xffffffffffff0000
jne 0x1400257c3
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400257d8
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140005b70
mov r13, qword [rsp + 0xb0]
jmp 0x1400257d8
lea rcx, [rsp + 0xb0]
call fcn.140005ff0
mov r13, qword [rsp + 0xb0]
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400257f7
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x90], r12
lea rdx, [0x1400e10e0]
test rdx, 0xffffffffffff0000
jne 0x140025848
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x14002585d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140005b70
mov r12, qword [rsp + 0x90]
jmp 0x14002585d
lea rcx, [rsp + 0x90]
call fcn.140005ff0
mov r12, qword [rsp + 0x90]
call fcn.14004b0d0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14002587c
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0xa0], rbp
lea rdx, [0x1400e10c8]
test rdx, 0xffffffffffff0000
jne 0x1400258cd
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400258e2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140005b70
mov rbp, qword [rsp + 0xa0]
jmp 0x1400258e2
lea rcx, [rsp + 0xa0]
call fcn.140005ff0
mov rbp, qword [rsp + 0xa0]
call fcn.14004b0d0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140025901
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xa8], rbx
lea rdx, [0x1400e10b0]
test rdx, 0xffffffffffff0000
jne 0x140025952
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140025967
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.140005b70
mov rbx, qword [rsp + 0xa8]
jmp 0x140025967
lea rcx, [rsp + 0xa8]
call fcn.140005ff0
mov rbx, qword [rsp + 0xa8]
call fcn.14004b0d0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140025986
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x78], rdi
lea rax, [0x1400e1098]
test rax, 0xffffffffffff0000
jne 0x1400259d3
movzx ecx, ax
call fcn.14004aef8
test rax, rax
je 0x1400259e5
lea rcx, [0x1400e1098]
movzx r8d, cx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140005b70
mov rdi, qword [rsp + 0x78]
jmp 0x1400259e5
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140005ff0
mov rdi, qword [rsp + 0x78]
mov word [rsp + 0xde0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xde2]
call fcn.140091a50
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x140025b8a
lea rdx, [rdi - 0x18]
or rdi, rax
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025a45
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025a69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025a8d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025ab1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025ad5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025af9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025b1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025b41
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140025b62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x140025b83
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400273f9
mov dword [rsp + 0x128], SafeArrayDestroyData
mov dword [rsp + 0x5c], 0
lea r8, [rsp + 0x128]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400262ab
nop
nop
mov qword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [rsp + 0x5b0]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
lea rdx, str.HDAUDIO
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
jne 0x140025c20
lea rdx, str.INTELAUDIO
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140026272
lea rdx, str.HDAUDIO
lea rcx, [rsp + 0x5b0]
call fcn.140090770
lea rdx, str.INTELAUDIO
lea rcx, [rsp + 0x5b0]
call fcn.140090770
xor ecx, ecx
test rax, rax
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x58], ecx
lea r8, [rsp + 0x5b0]
mov edx, 0x100
lea rcx, [rsp + 0x9d0]
call fcn.1400921b0
cmp dword [rsp + 0x58], 0
je 0x140025c86
mov word [rsp + 0xa4a], 0
jmp 0x140025c90
mov word [rsp + 0xa44], 0
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140025cbc
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2a8], 0
jne 0x140025de5
mov rdx, r15
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140025ce3
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2ac], 0
jne 0x140025de0
mov rdx, r14
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140025d0a
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2ac], 0
jne 0x140025ddb
mov rdx, r13
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140025d31
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2ac], 0
jne 0x140025dd6
mov rdx, r12
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140025d54
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2ac], 0
jne 0x140025dd1
mov rdx, rbp
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140025d77
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2ac], 0
jne 0x140025dcc
mov rdx, rbx
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140025d9a
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2ac], 0
jne 0x140025dc7
mov rdx, rdi
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140026272
mov rdi, qword [rsp + 0x40]
cmp dword [rdi + 0x2ac], 0
je 0x140026272
jmp 0x140025de8
mov rdi, rax
jmp 0x140025de8
mov rdi, rax
jmp 0x140025de8
mov rdi, rax
jmp 0x140025de8
mov rdi, rax
jmp 0x140025de8
mov rdi, rax
jmp 0x140025de8
mov rdi, rax
jmp 0x140025de8
mov rdi, rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x60], rax
call fcn.14004b0d0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x1400262a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0x5b0]
lea rax, [rsp + 0x5b0]
test rax, 0xffffffffffff0000
jne 0x140025e62
movzx ecx, cx
call fcn.14004aef8
test rax, rax
je 0x140025e94
lea rcx, [rsp + 0x5b0]
movzx r8d, cx
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.140005b70
jmp 0x140025e94
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x5b0]
lea rcx, [rsp + 0xc8]
call fcn.140005dc0
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0xc8]
mov rcx, rdi
call fcn.140008500
lea r11, [rsp + 0xf0]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0xe8]
mov r8d, 4
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x48]
call fcn.140002500
test eax, eax
je 0x140026272
lea rdx, str.IntcAzAudAddService
mov rcx, qword [rsp + 0xe8]
call fcn.140090770
test rax, rax
jne 0x140025f0f
lea rdx, str.RTHDMIAzAudService
mov rcx, qword [rsp + 0xe8]
call fcn.140090770
test rax, rax
je 0x140026272
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x140026272
xor ecx, ecx
mov edx, dword [0x1401232c8]
cmp edx, 0x5a
mov eax, 0x1e
cmovl ecx, eax
add edx, ecx
mov dword [0x1401232c8], edx
movsxd r8, edx
xor r9d, r9d
mov edx, 0x402
mov rcx, qword [rdi + 0x3b060]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rdi
call fcn.140002180
mov eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 0x208
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xbd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026267
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call fcn.140092260
lea r8, [rsp + 0xbd0]
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call fcn.140092260
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rax, [rsp + 0xde0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x1400261ac
xor r8d, r8d
lea rdx, [rsp + 0x5b0]
mov rcx, rdi
call fcn.14001b290
lea r8, [rsp + 0x128]
mov rdx, qword [rsp + 0x48]
mov ecx, 5
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x120]
call fcn.140011950
mov rdx, rax
mov rcx, rdi
call fcn.140014b20
test eax, eax
je 0x1400260c1
movsxd rcx, dword [rdi + 0x3afd0]
imul rcx, rcx, 0x12c8
mov eax, dword [rsp + 0x58]
mov dword [rcx + rdi + 0x4bc], eax
xor eax, eax
mov ecx, dword [0x1401232c8]
cmp ecx, 0x5a
mov edx, 0xa
cmovl eax, edx
add ecx, eax
mov dword [0x1401232c8], ecx
movsxd r8, ecx
xor r9d, r9d
mov edx, 0x402
mov rcx, qword [rdi + 0x3b060]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rdi
call fcn.140002180
cmp dword [0x1401232e8], 0
jne 0x1400261d9
cmp dword [0x1401232ec], 0
jne 0x1400261d9
cmp dword [0x1401232f0], 0
jne 0x1400261d9
cmp dword [0x1401232f4], 0
jne 0x1400261d9
cmp dword [0x1401232f8], 0
jne 0x1400261d9
mov edx, 0x80
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400decf4]
lea rcx, [rsp + 0x3a0]
call fcn.140090770
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x1401232e8], 0
jne 0x1400261d9
cmp dword [0x1401232ec], 0
jne 0x1400261d9
cmp dword [0x1401232f0], 0
jne 0x1400261d9
cmp dword [0x1401232f4], 0
jne 0x1400261d9
cmp dword [0x1401232f8], 0
je 0x140026257
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0x3a0]
call fcn.1400027c0
test eax, eax
je 0x14002620b
mov r8d, eax
mov edx, 3
mov rcx, rdi
call fcn.14000b6d0
jmp 0x140026257
lea rdx, [0x1400decf4]
lea rcx, [rsp + 0x3a0]
call fcn.140090770
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x9d0]
mov rcx, rdi
call fcn.14001a5c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x5c]
add eax, 1
mov dword [rsp + 0x5c], eax
lea r8, [rsp + 0x128]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400262ab
mov rdi, qword [rsp + 0x78]
jmp 0x140025bc0
mov ecx, 0x80004005
call fcn.140001610
int3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400266c0
mov dword [rsp + 0x128], SafeArrayDestroyData
xor r15d, r15d
mov r14d, r15d
lea r8, [rsp + 0x128]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400266b5
mov qword [rsp + 0x20], r15
mov r9d, 0x104
lea r8, [rsp + 0x5b0]
lea rdx, [rsp + 0x128]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
lea rdx, str.HDAUDIO
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
jne 0x14002635c
lea rdx, str.INTELAUDIO
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140026689
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x5b0]
call fcn.140090770
test rax, rax
je 0x140026689
mov rbx, qword [rsp + 0x40]
cmp dword [rbx + 0x2a8], 0
je 0x140026689
mov dword [rsp + 0x5c], r15d
mov dword [rsp + 0x58], r15d
lea rdx, [rsp + 0x5b0]
mov rcx, rbx
call fcn.14000f2c0
mov edi, eax
xor r9d, r9d
mov r8d, dword [rsp + 0x13c]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov ecx, r15d
test eax, eax
mov r13d, 1
cmovne ecx, r13d
test edi, edi
jne 0x1400263de
test ecx, ecx
je 0x140026689
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, r13d
lea rdx, [rsp + 0x128]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140026689
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x74], 0x208
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xbd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026680
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call fcn.140092260
lea r8, [rsp + 0xbd0]
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call fcn.140092260
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rax, [rsp + 0xde0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0x128]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x140026670
xor r8d, r8d
lea rdx, [rsp + 0x5b0]
mov rcx, rbx
call fcn.14001b290
lea r8, [rsp + 0x128]
mov rdx, rbp
mov ecx, 5
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
mov r13d, eax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x60], rax
call fcn.14004b0d0
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x1400266aa
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x3a0]
lea rax, [rsp + 0x3a0]
test rax, 0xffffffffffff0000
jne 0x140026576
movzx edi, cx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400265a4
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140005b70
jmp 0x1400265a4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x3a0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0xc0]
call fcn.140005dc0
nop
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.140014b20
test eax, eax
je 0x1400265ce
movsxd rax, dword [rbx + 0x3afd0]
imul rax, rax, 0x12c8
mov dword [rax + rbx + 0x4bc], r13d
cmp dword [0x1401232e8], 0
jne 0x140026670
cmp dword [0x1401232ec], 0
jne 0x140026670
cmp dword [0x1401232f0], 0
jne 0x140026670
cmp dword [0x1401232f4], 0
jne 0x140026670
cmp dword [0x1401232f8], 0
jne 0x140026670
mov edx, 0x80
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400decf4]
lea rcx, [rsp + 0x3a0]
call fcn.140090770
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x9d0]
mov rcx, rbx
call fcn.14001a5c0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r14d, 1
lea r8, [rsp + 0x128]
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400266b5
jmp 0x140026302
mov ecx, 0x80004005
call fcn.140001610
int3
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
jmp 0x1400266c3
xor r15d, r15d
xor r8d, r8d
lea rdx, [0x1400ded98]
mov rbp, qword [rsp + 0x40]
mov rcx, rbp
call fcn.14001b290
cmp dword [0x1401232e8], 0
jne 0x14002674f
cmp dword [0x1401232ec], 0
jne 0x14002674f
cmp dword [0x1401232f0], 0
jne 0x14002674f
cmp dword [0x1401232f4], 0
jne 0x14002674f
cmp dword [0x1401232f8], 0
jne 0x14002674f
mov edx, 0x208
lea rcx, [rsp + 0xff0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.INF_
mov edx, 0x104
lea rcx, [rsp + 0xff0]
call fcn.140092260
lea r8, [rbp + 0x3b020]
lea rdx, [rsp + 0xff0]
mov rcx, rbp
call fcn.14001c8c0
jmp 0x140026fdd
mov eax, r15d
mov ecx, dword [0x1401232c8]
cmp ecx, 0x5a
mov edx, 0x1e
cmovl eax, edx
add ecx, eax
mov dword [0x1401232c8], ecx
movsxd r8, ecx
xor r9d, r9d
mov edx, 0x402
mov rcx, qword [rbp + 0x3b060]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rbp
call fcn.140002180
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x150]
call fcn.140091a50
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.infoem.inf
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call fcn.140092260
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x140026fd4
or r12, 0xffffffffffffffff
call fcn.14004b0d0
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x140026fc9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x17c]
lea rax, [rsp + 0x17c]
test rax, 0xffffffffffff0000
jne 0x140026864
movzx edi, cx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140026970
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140005b70
mov rbx, qword [rsp + 0x48]
jmp 0x140026970
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x17c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x1400268e0
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140026970
cmp dword [rdx + 0x10], eax
jge 0x1400268ac
cmp dword [rbx - 0xc], eax
jl 0x140026f8b
mov dword [rbx - 0x10], r15d
mov word [rbx], ax
jmp 0x140026970
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400268c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov rsi, qword [rsp + 0x50]
jmp 0x140026970
mov r12d, dword [rbx - 0x10]
lea r13, [rsp + 0x17c]
sub r13, rbx
sar r13, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140026914
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140004650
mov rbx, qword [rsp + 0x48]
cmp r13, r12
ja 0x140026934
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rbx
call fcn.1400908b0
jmp 0x140026951
movsxd rax, edi
lea r12, [rax + rax]
mov r9, r12
lea r8, [rsp + 0x17c]
mov rdx, r12
mov rcx, rbx
call fcn.1400907e0
test edi, edi
js 0x140026fbe
cmp edi, dword [rbx - 0xc]
jg 0x140026fbe
mov dword [rbx - 0x10], edi
mov word [r12 + rbx], 0
or r12, 0xffffffffffffffff
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140026f4e
mov ecx, r15d
mov edx, dword [0x1401232c8]
cmp edx, 0x5a
mov eax, 5
cmovl ecx, eax
add edx, ecx
mov dword [0x1401232c8], edx
movsxd r8, edx
xor r9d, r9d
mov edx, 0x402
mov rcx, qword [rbp + 0x3b060]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rbp
call fcn.140002180
lea r9, [rsp + 0xf8]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140026f44
mov qword [rsp + 0x20], r15
mov r9d, 0x100
lea r8, [rsp + 0x7c0]
mov r13d, 1
mov edx, r13d
lea rcx, [rsp + 0xf8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140026f44
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x7c0]
mov rdx, r14
mov rcx, rbp
call fcn.140003650
test eax, eax
jne 0x140026a78
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140026f6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140026f6a
lea r9, [rsp + 0xf8]
xor r8d, r8d
lea rdx, [rsp + 0x7c0]
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140026f44
mov qword [rsp + 0x20], r15
mov r9d, 0x100
lea r8, [rsp + 0x7c0]
mov edx, 2
lea rcx, [rsp + 0xf8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140026f44
lea rdx, [0x1400ded98]
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026af0
cmp dword [rbp + 0x2a8], 0
jne 0x140026bf2
lea rdx, str.FUNC_01VEN_8086
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026b16
cmp dword [rbp + 0x2ac], 0
jne 0x140026bf2
lea rdx, str.FUNC_01VEN_1002
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026b3c
cmp dword [rbp + 0x2ac], 0
jne 0x140026bf2
lea rdx, str.FUNC_01VEN_1022
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026b62
cmp dword [rbp + 0x2ac], 0
jne 0x140026bf2
lea rdx, str.FUNC_01VEN_10DE
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026b84
cmp dword [rbp + 0x2ac], 0
jne 0x140026bf2
lea rdx, str.FUNC_01VEN_1106
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026ba6
cmp dword [rbp + 0x2ac], 0
jne 0x140026bf2
lea rdx, str.FUNC_01VEN_1039
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026bc8
cmp dword [rbp + 0x2ac], 0
jne 0x140026bf2
lea rdx, str.FUNC_01VEN_10B9
lea rcx, [rsp + 0x7c0]
call fcn.140090770
test rax, rax
je 0x140026f44
cmp dword [rbp + 0x2ac], 0
je 0x140026f44
lea r9, [rsp + 0xf8]
lea r8, str.MfgName
lea rdx, str.Strings
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140026f1c
mov qword [rsp + 0x20], r15
mov r9d, 0x100
lea r8, [rsp + 0x7c0]
mov edx, r13d
lea rcx, [rsp + 0xf8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140026ef4
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x7c0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
mov rdi, rcx
test ecx, ecx
jne 0x140026cc0
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140026d56
cmp dword [rdx + 0x10], eax
jge 0x140026c8c
cmp dword [rsi - 0xc], eax
jl 0x140026f96
mov dword [rsi - 0x10], r15d
mov word [rsi], ax
jmp 0x140026d56
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140026ca4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x48]
jmp 0x140026d56
mov r12d, dword [rsi - 0x10]
lea r13, [rsp + 0x7c0]
sub r13, rsi
sar r13, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140026cf4
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004650
mov rsi, qword [rsp + 0x50]
cmp r13, r12
ja 0x140026d14
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rsi + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rsi
call fcn.1400908b0
jmp 0x140026d31
movsxd rax, edi
lea r12, [rax + rax]
mov r9, r12
lea r8, [rsp + 0x7c0]
mov rdx, r12
mov rcx, rsi
call fcn.1400907e0
test edi, edi
js 0x140026fac
cmp edi, dword [rsi - 0xc]
jg 0x140026fac
mov dword [rsi - 0x10], edi
mov word [r12 + rsi], 0
or r12, 0xffffffffffffffff
mov r13d, 1
movsxd rdi, dword [rsi - 0x10]
mov ecx, r13d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140026d7a
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004650
mov rsi, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.140090d90
test edi, edi
js 0x140026fa1
cmp edi, dword [rsi - 0xc]
jg 0x140026fa1
mov dword [rsi - 0x10], edi
mov word [rsi + rdi*2], 0
lea rdx, str.REALTEK
lea rcx, [rsp + 0x50]
call fcn.14000d910
test al, al
je 0x140026de6
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140026f6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140026f6a
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call fcn.140092260
lea r8, [rsp + 0x17c]
mov edx, 0x104
lea rcx, [rsp + 0x3a0]
call fcn.140092260
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x118]
call fcn.140011950
mov rdx, rax
mov rcx, rbp
call fcn.140014b20
mov edi, eax
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0x3a0]
call fcn.1400027c0
test eax, eax
je 0x140026e83
mov r8d, eax
mov edx, 3
mov rcx, rbp
call fcn.14000b6d0
jmp 0x140026f44
test edi, edi
je 0x140026e9d
movsxd rax, dword [rbp + 0x3afd0]
imul rax, rax, 0x12c8
mov dword [rax + rbp + 0x4bc], r13d
lea rdx, [0x1400decf4]
lea rcx, [rsp + 0x3a0]
call fcn.140090770
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov edx, 0x80
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140026f44
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140026f6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140026f6a
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140026f6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140026f6a
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140026f6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140026fb7
mov rsi, qword [rsp + 0x50]
jmp 0x1400267f7
mov ecx, 0x80070057
call fcn.140001610
nop
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
nop
mov rax, qword [rsp + 0x60]
jmp 0x140026fd4
mov ecx, 0x80070057
call fcn.140001610
nop
mov ecx, 0x80004005
call fcn.140001610
int3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rbp + 0x3b008], 0
je 0x1400271e0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
call fcn.14004b0d0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140027014
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.INTCDMIC
test rdx, 0xffffffffffff0000
jne 0x140027057
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140027075
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140005b70
jmp 0x140027075
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.140005dc0
nop
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140022010
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x60], rdx
call fcn.14004b0d0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400270b2
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xe0], rax
lea rdx, str.INTCOED
test rdx, 0xffffffffffff0000
jne 0x1400270fb
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x14002711c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.140005b70
jmp 0x14002711c
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xe0]
call fcn.140005dc0
nop
mov ebx, 1
mov r8d, ebx
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call fcn.140022010
lea rdx, [rsp + 0xd8]
mov qword [rsp + 0x60], rdx
call fcn.14004b0d0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140027161
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xd8], rax
lea rdx, str.INTCAUDIOBUS
test rdx, 0xffffffffffff0000
jne 0x1400271aa
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400271cb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140005b70
jmp 0x1400271cb
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xd8]
call fcn.140005dc0
nop
mov r8d, ebx
lea rdx, [rsp + 0xd8]
mov rcx, rbp
call fcn.140022010
jmp 0x1400271e5
mov ebx, 1
cmp dword [rbp + 0x3b00c], 0
je 0x14002728c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
call fcn.14004b0d0
mov rcx, rax
test rax, rax
mov eax, 0
setne al
test eax, eax
jne 0x14002721e
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, str.RTKAUDHM
test rdx, 0xffffffffffff0000
jne 0x14002725e
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x14002727c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140005b70
jmp 0x14002727c
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x68]
call fcn.140005dc0
nop
mov r8d, ebx
lea rdx, [rsp + 0x68]
mov rcx, rbp
call fcn.140022010
mov rcx, rbp
call fcn.1400151d0
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x1400272b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400272dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140027301
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140027325
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140027349
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002736d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140027391
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400273b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400273d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x1400273f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rcx, qword [rsp + 0x1200]
xor rcx, rsp
call fcn.140090480
lea r11, [rsp + 0x1210]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret