Function at 0x140037be4
Capabilities:
Create directory
Delete file
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xba8
xor r13d, r13d
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x1c8], r13
cmp qword [0x14010dd08], r13
jne 0x140037c3a
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.1400156e4
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x140]
mov rdx, rsi
call fcn.140016ff0
mov rcx, qword [0x14010dd78]
lea r8, [rsp + 0x990]
mov r9d, 0x104
mov edx, 0x2711
mov qword [rsp + 0x248], r13
call fcn.1400509b4
lea rdx, [0x1400f5f60]
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x210], r13
call fcn.14006252c
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x2c8], r13
call fcn.140058038
lea rcx, [rsp + 0x208]
mov ebx, 0x80000000
mov qword [rsp + 0x2c0], r13
mov dword [rsp + 0x100], ebx
call fcn.140058038
lea rcx, [rsp + 0x218]
call fcn.140058038
lea rax, [rsp + 0x2c0]
lea r11, [rsp + 0x2c8]
mov qword [rsp + 0x2e0], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x2d8], r11
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x2e8], r13
call fcn.140053a2c
shr rax, 0x10
mov byte [rsp + 0x51], r13b
lea ecx, [rax - 0x60000]
cmp eax, 0x60000
mov qword [rsp + 0x2a8], rax
setae byte [rsp + 0x4d]
cmp ecx, 0xffff
lea rcx, [rsp + 0x70]
setbe dil
mov byte [rsp + 0x4e], dil
call fcn.140058038
mov rcx, qword [str._SystemRoot__]
mov rax, qword [0x1400f5f48]
lea r11, [rsp + 0x280]
lea r8, [rsp + 0x70]
mov qword [r11], rcx
mov qword [r11 + 8], rax
mov rax, qword [0x1400f5f50]
mov qword [r11 + 0x10], rax
mov eax, dword [0x1400f5f58]
lea rdx, [rsp + 0x280]
mov dword [r11 + 0x18], eax
xor eax, eax
xor r9d, r9d
lea r14d, [rax + 1]
mov rcx, rsi
mov dword [rsp + 0x29c], eax
mov dword [rsp + 0x2a0], eax
mov dword [rsp + 0x2a4], eax
mov byte [rsp + 0x20], r14b
call fcn.14006a438
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x1d0], eax
lea ecx, [rax + 0x1e]
movsxd rdx, ecx
lea rcx, [rsp + 0x70]
call fcn.140058138
cmp dil, r13b
lea esi, [r14 + 2]
jl 0x140037e31
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xc00]
call fcn.14006252c
lea rdx, str.System32Drvload.exe
lea rcx, [rsp + 0xc00]
call fcn.140058174
mov rcx, qword [rsp + 0xc00]
call fcn.1400d34e4
lea rcx, [rsp + 0xc00]
neg eax
sbb dil, dil
and dil, sil
mov byte [rsp + 0x4e], dil
call fcn.140050424
lea rcx, [rsp + 0x1c0]
mov edx, 0x400032
mov rbp, r14
mov qword [rsp + 0xf8], r14
mov dil, r13b
mov byte [rsp + 0x4c], r13b
call fcn.140057dc0
mov rcx, qword [rsp + 0x1c0]
lea rdx, [0x1400f5f00]
mov r8d, 0xa
call fcn.14001aa74
mov rcx, qword [rsp + 0x1c0]
mov qword [rcx + 0xa], r13
mov rax, qword [rsp + 0x1c0]
add rax, 0x12
mov qword [rsp + 0x58], rax
mov esi, 2
cmp dil, 0xff
jae 0x140037ea0
add dil, r14b
mov byte [rsp + 0x4c], dil
lea rcx, [rsp + 0x210]
mov rdx, r12
mov r14b, r13b
call fcn.140062644
mov r11, qword [rsp + 0x210]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], r11
mov bpl, r13b
mov dword [rsp + 0x190], r13d
mov qword [rsp + 0x168], r13
mov byte [rsp + 0x11c], sil
mov byte [rsp + 0x4f], r13b
call fcn.140014d28
mov rdx, qword [rsp + 0x40]
xor eax, eax
lea r8d, [rax + 8]
mov byte [rsp + 0x50], r13b
mov r12d, r13d
mov dword [rsp + 0x48], r13d
lea rcx, str.listdev:
mov r13b, 0xf0
mov byte [rsp + 0xc08], sil
mov byte [rsp + 0x198], al
mov byte [rsp + 0x19d], al
mov dword [rsp + 0x64], r13d
mov r15, rax
mov qword [rsp + 0xc0], rax
mov rdi, rax
mov qword [rsp + 0x268], rax
call fcn.140051938
xor r8d, r8d
cmp al, r8b
je 0x14003804b
mov rax, qword [rsp + 0x40]
mov r12d, 0x100
add rax, 0x10
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140037fd3
lea edx, [rdi + 9]
lea r9d, [rdi + 0xd]
cmp dx, cx
ja 0x140037f82
cmp cx, r9w
jbe 0x140037f9a
mov r10d, 0x20
cmp r10w, cx
cmovne rdi, rax
mov qword [rsp + 0x268], rdi
jmp 0x140037fa0
mov r10d, 0x20
cmp dx, cx
ja 0x140037fab
cmp cx, r9w
jbe 0x140037fc4
cmp r10w, cx
je 0x140037fc4
add rax, rsi
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140037fd3
jmp 0x140037fa0
cmp word [rax], r8w
je 0x140037fd3
mov word [rax], r8w
add qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.140014d28
cmp word [rdi], r8w
jne 0x14003806e
lea rcx, [rsp + 0x1c0]
call fcn.140050424
lea rcx, [rsp + 0x70]
call fcn.140050424
lea rcx, [rsp + 0x218]
call fcn.140050424
lea rcx, [rsp + 0x208]
call fcn.140050424
lea rcx, [rsp + 0x260]
call fcn.140050424
lea rcx, [rsp + 0x1f0]
call fcn.140050424
lea rcx, [rsp + 0x210]
call fcn.140050424
mov rax, 0xffffffff80070057
jmp 0x14003b6e8
lea rdx, [rsp + 0x40]
lea rcx, str.buildcache:
mov r8d, 0xa
call fcn.14005a8ec
xor r8d, r8d
cmp al, r8b
jne 0x14003b605
cmp dword [rsp + 0x2a8], 0x60000
movzx esi, byte [rsp + 0x4e]
mov eax, 3
cmovae esi, eax
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
mov dl, r8b
mov qword [rsp + 0x90], r8
mov word [rsp + 0x194], r8w
mov byte [rsp + 0x1a0], r8b
mov dil, 0xff
mov byte [rsp + 0xc00], dl
cmp cx, word [rax]
jne 0x140038ca8
mov bl, byte [rsp + 0x4e]
lea rdx, [rsp + 0x40]
lea rcx, str.extract
mov r8d, 8
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400380fc
lea eax, [r8 + 1]
mov byte [rsp + 0x198], al
mov byte [rsp + 0xc08], al
mov r14b, al
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.cab
mov r8d, 4
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038123
mov r14b, 1
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.nocheck
mov r8d, 8
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038152
lea eax, [r8 + 1]
mov byte [rsp + 0x19d], al
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.devcon
mov r8d, 7
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038181
lea eax, [r8 + 1]
mov byte [rsp + 0x19e], al
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.rescan
mov r8d, 7
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400381ad
mov r13b, r8b
mov dword [rsp + 0x64], r13d
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.norescan
mov r8d, 9
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400381d1
mov r13b, 0xc0
jmp 0x1400381a3
mov rdx, qword [rsp + 0x40]
lea rcx, str.rescan:
mov r8d, 8
call fcn.140051938
xor edx, edx
cmp al, dl
je 0x14003822f
add qword [rsp + 0x40], 0x10
movsx eax, r13b
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0xa8], eax
call fcn.1400ab4bc
mov r13d, dword [rsp + 0xa8]
xor r8d, r8d
cmp r13b, r8b
mov dword [rsp + 0x64], r13d
jge 0x140038c57
jmp 0x1400381a0
lea rdx, [rsp + 0x40]
lea rcx, str.dummy
mov r8d, 6
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x14003825e
lea eax, [r8 + 1]
mov byte [rsp + 0x19f], al
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.sub
mov r8d, 4
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038287
mov byte [rsp + 0x50], 1
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.self
mov r8d, 5
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400382b0
mov byte [rsp + 0x50], 2
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.7pe
mov r8d, 4
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400382d7
mov sil, 3
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.7pe_
mov r8d, 4
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400382fe
mov sil, bl
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.drvload
mov r8d, 8
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
jne 0x1400382f6
lea rdx, [rsp + 0x40]
lea rcx, str.inner
mov r8d, 6
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038344
mov sil, 0xc0
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.nnverify
mov r8d, 9
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038370
mov byte [rsp + 0xc08], 1
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.rverify
mov r8d, 8
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x14003839c
mov byte [rsp + 0xc08], r8b
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.listdevi
mov r8d, 0xa
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400383cb
and r12d, 0xff00
or r12d, 2
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.listdevc
mov r8d, 0xa
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400383fa
and r12d, 0xff00
or r12d, 4
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.listdev
mov r8d, 0xa
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038429
and r12d, 0xff00
or r12d, 8
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.comp
mov r8d, 6
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x14003845a
lea eax, [r8 + 1]
mov dl, al
mov byte [rsp + 0xc00], al
jmp 0x140038c5e
lea rdx, [rsp + 0x40]
lea rcx, str.hwid
mov r8d, 5
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038483
bts r12d, 0xc
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5ddc]
mov r8d, 5
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400384ac
bts r12d, 0xb
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.inst
mov r8d, 5
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400384d5
bts r12d, 0xd
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.All
mov r8d, 4
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400384fe
bts r12d, 9
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5dc4]
mov r8d, 5
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038527
bts r12d, 0xa
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.auto
mov r8d, 5
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038557
lea eax, [r8 + 3]
mov word [rsp + 0x194], ax
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.sys
mov r8d, 4
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038586
lea eax, [r8 + 1]
mov byte [rsp + 0x1a0], al
jmp 0x140038c57
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xa
inc rcx
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400385b1
or bpl, 1
jmp 0x140038c57
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xb
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x1400385d9
or bpl, 3
jmp 0x140038c57
mov rcx, qword [str.AutoDisverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xe
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038601
or bpl, 0x10
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.sysdir:
mov r8d, 7
call fcn.14005a8ec
xor edx, edx
cmp al, dl
je 0x14003864b
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x1cd
mov qword [rsp + 0x1b0], rax
call fcn.140024200
xor r8d, r8d
mov qword [rsp + 0x40], rax
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5da0]
mov r8d, 4
call fcn.14005a8ec
xor r8d, r8d
cmp al, r8b
je 0x140038710
mov rax, qword [rsp + 0x40]
cmp word [rax], r8w
je 0x140038c4d
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rax]
ja 0x140038691
cmp word [rax], r10w
jbe 0x1400386b7
mov r11d, 0x20
cmp r11w, word [rax]
je 0x1400386bd
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x1a8], rcx
jmp 0x1400386bd
mov r11d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x140038c4d
mov edx, 2
cmp r9w, cx
ja 0x1400386db
cmp cx, r10w
jbe 0x1400386f8
cmp r11w, cx
je 0x1400386f8
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140038c4d
jmp 0x1400386cf
cmp word [rax], r8w
je 0x140038c4d
mov word [rax], r8w
add qword [rsp + 0x40], rdx
jmp 0x140038c4d
lea rdx, [rsp + 0x40]
lea rcx, str.IdCah:
mov r8d, 6
call fcn.14005a8ec
xor r8d, r8d
cmp al, r8b
je 0x1400387dd
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x1400387b4
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, ax
ja 0x140038755
cmp ax, r10w
jbe 0x140038775
mov rdx, qword [rsp + 0x1c8]
mov r11d, 0x20
cmp r11w, ax
cmovne rdx, rcx
mov qword [rsp + 0x1c8], rdx
jmp 0x14003877b
mov r11d, 0x20
mov edx, 2
cmp r9w, ax
ja 0x14003878c
cmp ax, r10w
jbe 0x1400387a5
cmp r11w, ax
je 0x1400387a5
add rcx, rdx
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
je 0x1400387b4
jmp 0x140038780
cmp word [rcx], r8w
je 0x1400387b4
mov word [rcx], r8w
add qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.140014d28
mov rax, qword [rsp + 0x1c8]
cmp word [rax], r8w
jne 0x140038c57
mov qword [rsp + 0x1c8], r8
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.retid:
mov r8d, 6
call fcn.14005a8ec
xor r8d, r8d
cmp al, r8b
je 0x140038892
mov rax, qword [rsp + 0x40]
cmp word [rax], r8w
je 0x140038c4d
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rax]
ja 0x140038823
cmp word [rax], r10w
jbe 0x140038849
mov r11d, 0x20
cmp r11w, word [rax]
je 0x14003884f
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x2c8], rax
mov qword [rsp + 0x160], rcx
jmp 0x14003884f
mov r11d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x140038c4d
mov edx, 2
cmp r9w, cx
ja 0x140038871
cmp cx, r10w
jbe 0x1400386f8
cmp r11w, cx
je 0x1400386f8
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140038c4d
jmp 0x140038861
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevClass:
mov r8d, 0xa
call fcn.140051938
xor r8d, r8d
cmp al, r8b
je 0x140038955
mov rcx, qword [rsp + 0x40]
add rcx, 0x14
mov qword [rsp + 0x40], rcx
cmp word [rcx], r8w
je 0x140038c4d
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rcx]
ja 0x1400388e1
cmp word [rcx], r10w
jbe 0x140038901
mov rax, qword [rsp + 0x168]
mov r11d, 0x20
cmp r11w, word [rcx]
cmovne rax, rcx
mov qword [rsp + 0x168], rax
jmp 0x140038907
mov r11d, 0x20
movzx eax, word [rcx]
cmp ax, r8w
je 0x140038c4d
mov edx, 2
cmp r9w, ax
ja 0x140038925
cmp ax, r10w
jbe 0x140038942
cmp r11w, ax
je 0x140038942
add rcx, rdx
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
je 0x140038c4d
jmp 0x140038919
cmp word [rcx], r8w
je 0x140038c4d
mov word [rcx], r8w
jmp 0x140038706
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevID:
mov r8d, 7
call fcn.140051938
xor ecx, ecx
cmp al, cl
je 0x140038a26
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
cmp word [rax], cx
je 0x1400389a5
lea edx, [rcx + 9]
cmp dx, word [rax]
ja 0x140038999
lea ecx, [rdx + 4]
cmp word [rax], cx
jbe 0x1400389a5
mov ecx, 0x20
cmp cx, word [rax]
cmovne r15, rax
lea rcx, [rsp + 0x40]
mov edx, 0x27
call fcn.14001af18
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
cmp word [rcx], r8w
je 0x1400389cf
lea eax, [r8 + 2]
mov word [rcx], r8w
add qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.140014d28
cmp r15, r8
je 0x140038c57
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rcx, eax
cmp rcx, r8
jle 0x140038a15
lea edx, [r8 + 1]
lea r9d, [r8 + 0x26]
cmp r9w, word [r15 + rcx*2 - 2]
jne 0x140038a15
mov word [r15 + rcx*2], r8w
sub rcx, rdx
sub eax, edx
cmp rcx, r8
jg 0x1400389fe
cmp eax, r8d
jg 0x140038c57
mov r15, r8
jmp 0x140038c57
lea rdx, [rsp + 0x40]
lea rcx, str.infcache:
mov r8d, 0xa
call fcn.14005a948
xor ecx, ecx
cmp al, cl
je 0x140038aac
mov rax, qword [rsp + 0x40]
cmp word [rax], cx
je 0x140038a79
lea edx, [rcx + 9]
cmp dx, word [rax]
ja 0x140038a5d
lea ecx, [rdx + 4]
cmp word [rax], cx
jbe 0x140038a79
mov rcx, qword [rsp + 0x248]
mov edx, 0x20
cmp dx, word [rax]
cmovne rcx, rax
mov qword [rsp + 0x248], rcx
lea rcx, [rsp + 0x40]
mov edx, 0x27
call fcn.14001af18
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
cmp word [rcx], r8w
je 0x140038c4d
lea eax, [r8 + 2]
mov word [rcx], r8w
add qword [rsp + 0x40], rax
jmp 0x140038c4d
mov rdx, qword [rsp + 0x40]
lea rcx, str.disable:
mov r8d, 9
call fcn.140051938
xor edx, edx
cmp al, dl
je 0x140038adc
mov rcx, qword [rsp + 0x40]
lea eax, [rdx + 2]
add rcx, rax
mov dil, al
jmp 0x140038b92
mov rdx, qword [rsp + 0x40]
lea rcx, str.enable:
mov r8d, 8
call fcn.140051938
xor ecx, ecx
cmp al, cl
je 0x140038afe
mov dil, 1
jmp 0x140038b1e
mov rdx, qword [rsp + 0x40]
lea rcx, str.remove:
mov r8d, 8
call fcn.140051938
xor ecx, ecx
cmp al, cl
je 0x140038b25
mov dil, 5
mov rcx, qword [rsp + 0x40]
jmp 0x140038b92
mov rdx, qword [rsp + 0x40]
lea rcx, str.update:
mov r8d, 8
call fcn.140051938
xor ecx, ecx
cmp al, cl
je 0x140038b47
mov dil, 0x11
jmp 0x140038b1e
mov rdx, qword [rsp + 0x40]
lea rcx, str.status:
mov r8d, 8
call fcn.140051938
xor ecx, ecx
cmp al, cl
je 0x140038b69
mov dil, 0x12
jmp 0x140038b1e
mov rdx, qword [rsp + 0x40]
lea rcx, str.restart:
mov r8d, 9
call fcn.140051938
xor ecx, ecx
cmp al, cl
je 0x140038bdf
mov rcx, qword [rsp + 0x40]
mov dil, 3
add rcx, 2
add rcx, 0x10
xor eax, eax
mov qword [rsp + 0x40], rcx
cmp word [rcx], ax
je 0x140038a79
mov eax, 9
cmp ax, word [rcx]
ja 0x140038bbe
mov eax, 0xd
cmp word [rcx], ax
jbe 0x140038a79
mov rax, qword [rsp + 0x90]
mov edx, 0x20
cmp dx, word [rcx]
cmovne rax, rcx
mov qword [rsp + 0x90], rax
jmp 0x140038a79
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5d04]
mov r8d, 3
call fcn.14005a810
xor r8d, r8d
cmp al, r8b
je 0x140038c05
mov byte [rsp + 0x4f], 1
jmp 0x140038c57
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x140038c4d
mov edx, 9
lea ebx, [rdx + 4]
lea r13d, [rdx - 7]
lea r9d, [rdx + 0x17]
cmp dx, ax
ja 0x140038c2d
cmp ax, bx
jbe 0x140038c44
cmp r9w, ax
je 0x140038c44
add rcx, r13
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
jne 0x140038c23
mov r13d, dword [rsp + 0x64]
mov bl, byte [rsp + 0x4e]
lea rcx, [rsp + 0x40]
call fcn.140014d28
mov dl, byte [rsp + 0xc00]
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
je 0x1400380c3
mov ebx, dword [rsp + 0x100]
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0xc0], r15
mov dword [rsp + 0x48], r12d
movzx eax, byte [rsp + 0x198]
cmp r13b, 0xf0
mov r13d, r12d
setl byte [rsp + 0x88]
shr r13d, 8
mov r9d, 1
and r13b, r9b
cmovne eax, r8d
mov dword [rsp + 0x118], r13d
mov byte [rsp + 0x198], al
cmp r12d, r8d
je 0x140038cf6
mov al, r13b
neg al
sbb cl, cl
and cl, dl
mov dl, cl
mov byte [rsp + 0xc00], cl
bt r12d, 0xd
jae 0x140038d0e
bt r12d, 0xa
jae 0x140038d0e
btr r12d, 0xa
mov dword [rsp + 0x48], r12d
cmp r13b, r8b
je 0x140038d48
mov eax, 2
test al, r12b
je 0x140038d35
test r12d, 0x3c00
jne 0x140038d35
cmp dl, r8b
jne 0x140038d35
bts r12d, 0xd
mov dword [rsp + 0x48], r12d
cmp r13b, r8b
je 0x140038d48
cmp qword [rsp + 0x268], r8
je 0x14003a9ed
cmp dil, r8b
jge 0x14003b27a
cmp bpl, r8b
jne 0x14003b262
mov rdi, qword [rsp + 0xbf0]
cmp sil, r8b
mov ecx, r8d
movzx eax, sil
cmovge ecx, eax
or byte [rsp + 0x4d], cl
mov byte [rsp + 0x19c], cl
cmp r13b, r8b
jne 0x140038d98
mov rax, qword [rsp + 0x2e8]
cmp byte [rsp + 0x4c], r9b
cmove rax, rdi
mov qword [rsp + 0x2e8], rax
mov r12, qword [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x250], r15
mov qword [r12], r8
lea r8d, [rdx + 0x20]
lea rcx, [r12 + 0x400000]
call fcn.1400d3e60
mov rbp, qword [rsp + 0x1c8]
xor r15d, r15d
mov rsi, r15
cmp rbp, r15
je 0x140038e5d
lea rcx, [0x14010ee78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.140016218
mov rdi, rax
cmp rax, r15
je 0x140038e50
mov rdx, qword [rax + 8]
cmp rdx, r15
je 0x140038e50
mov rcx, qword [rax + 0x18]
movabs rax, 0x3fffffffffffffff
and rcx, rax
cmp rcx, 0x400032
jb 0x140038e50
lea r8d, [r15 + 0xa]
lea rcx, [0x1400f5f00]
call fcn.140050454
cmp eax, r15d
jne 0x140038e50
mov rsi, qword [rdi + 8]
mov r8d, 0x400020
mov rcx, r12
add rsi, 0x12
mov rdx, rsi
call fcn.14001aa74
lea rcx, [0x14010ee78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rsi, r15
mov ecx, r15d
mov eax, 0x20
sete byte [rsp + 0x98]
mov dword [rsp + 0x280], eax
xor eax, eax
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x140], r12
mov dword [rsp + 0x284], r15d
cmp word [rax], 0x24
mov esi, r15d
mov edi, 2
sete cl
mov dword [rsp + 0x60], ecx
cmp ecx, r15d
je 0x140038edf
add rax, rdi
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
jne 0x140038edf
lea ecx, [rdi - 1]
add rax, rdi
add esi, ecx
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
je 0x140038ecf
lea rcx, [rsp + 0x40]
call fcn.140014d28
mov rcx, qword [rsp + 0x40]
mov edx, 0x2c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r12, r15
mov qword [rsp + 0xb8], r15
mov rbp, rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x80], r15
cmp rax, r15
je 0x140038f9a
lea rcx, [rsp + 0xc8]
add rbp, rdi
mov word [rax], r15w
mov qword [rsp + 0xc8], rbp
call fcn.140014d28
mov rbp, qword [rsp + 0xc8]
mov rcx, rbp
mov edx, 0x2c
mov qword [rsp + 0xc8], rbp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r12, rax
mov qword [rsp + 0xb8], rax
cmp rax, r15
je 0x140038f92
add r12, rdi
lea rcx, [rsp + 0xb8]
mov word [rax], r15w
mov qword [rsp + 0xb8], r12
call fcn.140014d28
mov r12, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], r12
mov rcx, rbp
call fcn.140016410
mov rcx, qword [rsp + 0x40]
call fcn.140016410
cmp r12, r15
je 0x140039004
mov edx, 0x2c
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, r15
je 0x140038ffc
lea rcx, [rsp + 0x130]
add rdi, 2
mov word [rax], r15w
mov qword [rsp + 0x130], rdi
call fcn.140014d28
mov rdi, qword [rsp + 0x130]
mov rcx, rdi
mov qword [rsp + 0x80], rdi
call fcn.140016410
mov rcx, r12
call fcn.140016410
mov rax, qword [rsp + 0x40]
cmp word [rax], r15w
je 0x140039106
lea rcx, [rsp + 0x40]
mov edx, 1
call fcn.14006a164
cmp rax, r15
je 0x140039106
mov ecx, 0x23
cmp cx, word [rax]
jne 0x140039106
lea rcx, [rsp + 0x200]
call fcn.140058038
lea r11, str..tmp.cab
lea r9, str.devi
lea rdx, [rsp + 0x200]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call fcn.140007060
lea rdx, str.__dd__len16M___
lea rcx, [rsp + 0x1d8]
call fcn.14006252c
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x1d8]
call fcn.140058174
lea rdx, [0x1400f5ca8]
lea rcx, [rsp + 0x1d8]
call fcn.140058174
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x1d8]
call fcn.140058174
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.1400b0224
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x218]
call fcn.140017280
lea rcx, [rsp + 0x1d8]
mov qword [rsp + 0x40], rax
call fcn.140050424
lea rcx, [rsp + 0x200]
call fcn.140050424
mov rcx, qword [rsp + 0x40]
call fcn.1400d33a8
mov rcx, qword [rsp + 0x40]
mov r15d, eax
mov dword [rsp + 0x258], eax
call fcn.1400d43f0
xor r11d, r11d
mov rdi, rax
cmp r14b, r11b
jne 0x14003916b
cmp r15d, r11d
jne 0x14003915b
cmp eax, 4
jle 0x14003915b
mov rcx, qword [rsp + 0x40]
movsxd rdx, eax
lea rcx, [rcx + rdx*2 - 8]
lea rdx, str..CAB
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
je 0x14003916b
mov r14d, r11d
mov dword [rsp + 0x1e0], r11d
jmp 0x14003923a
movsxd r10, dword [rsp + 0x1d0]
mov ecx, 1
lea rax, str.SysWow64
cmp byte [0x14010b009], cl
lea rdx, str.System32
mov r14d, ecx
cmove rdx, rax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x1e0], ecx
lea rcx, [rax + r10*2]
mov r8d, 0x10
call fcn.14001aa74
mov rax, qword [rsp + 0x70]
lea ecx, [r10 + 8]
movsxd rdx, ecx
mov r8d, 0x1a
lea rcx, [rax + rdx*2]
lea rdx, str.cabinet.dll
call fcn.14001aa74
cmp r13b, r11b
jne 0x14003923a
mov rcx, qword [rsp + 0x70]
call fcn.1400d34e4
xor r11d, r11d
cmp eax, r11d
jne 0x14003923a
lea edx, [r11 + 0x63]
lea rcx, [rsp + 0x238]
call fcn.1400580ac
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x238]
lea rdx, str.__dd__bs1M__s_0__._33INDATA
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.1400b0224
lea rcx, [rsp + 0x238]
call fcn.140050424
xor r11d, r11d
cmp r12, r11
je 0x140039255
mov eax, 0x2a
cmp ax, word [r12]
cmove r12, r11
mov qword [rsp + 0xb8], r12
cmp edi, 4
jle 0x140039284
mov rax, qword [rsp + 0x40]
movsxd rcx, edi
lea rdx, [0x1400f4b88]
lea rcx, [rax + rcx*2 - 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
jne 0x140039284
lea ecx, [r11 + 1]
mov eax, ecx
jmp 0x14003928c
mov eax, r11d
mov ecx, 1
cmp r15d, r11d
jne 0x140039298
mov edi, ecx
cmp eax, r11d
jne 0x14003929b
mov edi, r11d
mov r15d, dword [rsp + 0x60]
cmp esi, ecx
je 0x1400392c2
cmp eax, r11d
je 0x1400392b3
cmp r15d, r11d
je 0x1400392b3
cmp r12, r11
jne 0x1400392c2
cmp edi, r11d
je 0x1400392bd
cmp r15d, r11d
jne 0x1400392c2
mov al, r11b
jmp 0x1400392c4
mov al, cl
cmp edi, r11d
jne 0x1400392d1
cmp al, r11b
mov eax, r11d
je 0x1400392d3
mov eax, ecx
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x150], r11
mov qword [rsp + 0x158], r11
mov word [rsp + 0x196], r11w
cmp r13b, r11b
jne 0x1400393dd
cmp r12, r11
je 0x1400393dd
cmp word [r12], r11w
je 0x1400393dd
cmp eax, r11d
jne 0x1400393dd
lea rcx, [rsp + 0x68]
mov rdx, r12
call fcn.140062644
mov rcx, qword [rsp + 0x68]
call fcn.14001b0e4
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x220]
mov edx, 0x105
call fcn.1400580ac
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov rcx, qword [rsp + 0x220]
xor eax, eax
cmp word [rcx], ax
je 0x140039390
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x220], rax
jmp 0x140039395
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov eax, 0x5c
cmp word [r12 + rcx*2 - 2], ax
je 0x1400393bc
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0x68]
call fcn.140058174
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x150], rax
call fcn.140050424
xor r11d, r11d
lea ecx, [r11 + 1]
cmp r15d, r11d
jne 0x1400393f3
cmp byte [rsp + 0x4d], r11b
je 0x140039424
cmp byte [rsp + 0x198], r11b
jne 0x140039424
mov sil, byte [rsp + 0xc08]
cmp byte [rsp + 0x1a0], r11b
jne 0x14003942c
cmp r13b, r11b
jne 0x14003942c
cmp sil, cl
je 0x14003942c
cmp ebx, r11d
je 0x14003942c
xor edx, edx
xor ecx, ecx
call fcn.1400c0e90
xor r11d, r11d
mov ebx, eax
jmp 0x14003942c
mov sil, byte [rsp + 0xc08]
mov eax, 2
cmp sil, al
cmove ebx, r11d
mov dword [rsp + 0x100], ebx
cmp r14d, r11d
je 0x140039498
cmp rbp, r11
je 0x140039498
or dword [rsp + 0xc08], 0xffffffff
lea rdx, [rsp + 0xc08]
lea rcx, [rsp + 0x128]
mov qword [rsp + 0x128], rbp
call fcn.1400664c0
mov r11d, dword [rsp + 0xc08]
mov edx, dword [rsp + 0x11c]
lea ecx, [r11 - 1]
movzx eax, r11b
cmp ecx, 0x12
movzx edx, dl
cmovbe edx, eax
xor r11d, r11d
mov dword [rsp + 0x11c], edx
mov al, byte [rsp + 0x4c]
mov ebp, dword [rsp + 0x64]
mov ecx, 1
cmp al, cl
jne 0x140039525
cmp r13b, r11b
jne 0x140039525
cmp byte [rsp + 0x198], r11b
jne 0x140039525
movsx ecx, byte [rsp + 0x19d]
movsx r9d, byte [rsp + 0x19c]
mov r8d, dword [rsp + 0x2a8]
movsx eax, bpl
lea rdx, str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x4f0]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_wsprintfW]
mov r12, qword [rsp + 0xbf0]
lea r8, [rsp + 0x4f0]
lea rdx, [0x1400f5b70]
mov rcx, r12
call fcn.14001662c
mov al, byte [rsp + 0x4c]
mov ecx, 1
jmp 0x14003952d
mov r12, qword [rsp + 0xbf0]
mov esi, dword [rsp + 0x48]
xor r14d, r14d
cmp bpl, r14b
jge 0x140039576
cmp esi, r14d
jne 0x140039611
cmp bpl, 0xf0
jl 0x140039602
cmp byte [rsp + 0x19c], r14b
je 0x140039602
cmp edi, r14d
jne 0x140039568
cmp r15d, r14d
je 0x140039602
cmp byte [rsp + 0x19d], r14b
jne 0x140039602
cmp al, cl
jne 0x140039590
lea r8, [0x1400f04f4]
lea rdx, [0x1400f5b58]
mov rcx, r12
call fcn.14001662c
mov r15d, 0x11
lea rdx, str.rescan__BEGIN
xor r8d, r8d
mov rcx, r12
mov r9d, r15d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140026bb4
movsx ecx, bpl
and ecx, 7
call fcn.14001dd2c
lea edx, [r15 + 0x21]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0xf8], rax
call fcn.14001c418
lea rdx, str.rescan__END
mov r9d, r15d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140026bb4
cmp esi, r14d
jne 0x140039611
mov rax, qword [rsp + 0x40]
cmp word [rax], r14w
je 0x14003a9f6
lea rcx, [rsp + 0xa0]
call fcn.140058038
mov rcx, qword [rsp + 0x40]
call fcn.140019058
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1400c18dc
mov r9d, r14d
mov qword [rsp + 0x40], rax
cmp esi, r14d
je 0x14003965a
bt esi, 9
mov eax, 2
cmovae r9d, eax
or r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x14010dd10]
mov qword [rsp + 0xb0], rax
cmp rax, 0xffffffffffffffff
jne 0x14003968a
mov qword [rsp + 0xb0], r14
cmp edi, r14d
je 0x14003aa01
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x128], r14
call fcn.140058038
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
movzx r9d, dil
mov dword [rsp + 0xf0], r9d
cmp r10, r11
je 0x1400396d7
mov rcx, r10
call fcn.14001ae58
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
mov r9d, dword [rsp + 0xf0]
and edi, 0xffffff00
mov r15, r11
mov qword [rsp + 0x130], r11
or edi, r9d
movzx r14d, r11w
mov word [rsp + 0xc08], r11w
mov dword [rsp + 0x48], edi
cmp r10, r11
je 0x14003985d
cmp r13b, r11b
je 0x14003985d
mov eax, 0x22
movzx ebp, r11w
mov rsi, r10
lea r13d, [rax + 5]
cmp ax, word [r10]
je 0x14003972a
cmp r13w, word [r10]
jne 0x140039732
mov bp, word [r10]
lea rsi, [r10 + 2]
mov rcx, rsi
call fcn.14001dda4
mov r12d, r9d
cmp eax, r11d
cmovge r12d, eax
cmp eax, r11d
jl 0x14003977e
lea rcx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 4]
mov rcx, rsi
movsxd r8, eax
lea r8, [r8 + r8 + 2]
call fcn.14001aa2c
mov r9d, dword [rsp + 0xf0]
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
cmp bp, r11w
je 0x140039850
mov r10d, 2
jmp 0x140039798
add rsi, r10
cmp bp, ax
je 0x1400397a3
movzx eax, word [rsi]
cmp ax, r11w
jne 0x140039790
jmp 0x1400397a6
mov r15, rsi
mov ebx, 0x22
movzx ebp, word [rsi]
cmp bx, bp
je 0x1400397b9
cmp r13w, bp
jne 0x14003981e
add rsi, r10
mov rcx, rsi
call fcn.14001dda4
mov ecx, r9d
cmp eax, r11d
cmovge ecx, eax
cmp ecx, r12d
jne 0x14003981e
cmp eax, r11d
jl 0x14003980e
lea rcx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 4]
mov rcx, rsi
movsxd r8, eax
lea r8, [r8 + r8 + 2]
call fcn.14001aa2c
mov r9d, dword [rsp + 0xf0]
xor r11d, r11d
lea r10d, [r11 + 2]
jmp 0x14003980e
add rsi, r10
cmp bp, ax
je 0x140039819
movzx eax, word [rsi]
cmp ax, r11w
jne 0x140039806
jmp 0x1400397ab
mov r15, rsi
jmp 0x1400397ab
mov r14w, word [r15]
mov ebx, dword [rsp + 0x100]
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
mov qword [rsp + 0x130], r15
mov word [rsp + 0xc08], r14w
cmp r14w, r11w
je 0x140039850
mov word [r15], r11w
and edi, 0xffffff00
or edi, r12d
mov dword [rsp + 0x48], edi
mov cl, byte [rsp + 0xc00]
mov eax, edi
mov r8d, r11d
and eax, 0x806
cmp eax, 0x802
sete r8b
cmp eax, 0x800
jne 0x14003988e
cmp cl, r11b
jne 0x14003988e
mov r9d, 1
mov edx, r9d
jmp 0x140039897
mov edx, r11d
mov r9d, 1
mov eax, edi
and eax, 0x1006
cmp eax, 0x1004
jne 0x1400398ad
cmp cl, r11b
mov ecx, r9d
je 0x1400398b0
mov ecx, r11d
mov esi, r11d
mov eax, edi
and eax, 0x2002
cmp eax, 0x2000
sete sil
or ecx, edx
neg ecx
mov dword [rsp + 0x1e4], esi
sbb r13w, r13w
mov word [rsp + 0x64], r13w
test dil, 4
jne 0x1400398e6
mov ebp, r9d
cmp r8d, r11d
je 0x1400398eb
mov ebp, 2
mov dword [rsp + 0xe0], ebp
cmp r10, r11
je 0x140039914
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r11d, r11d
movsxd rdi, eax
mov qword [rsp + 0x2b0], rdi
mov edi, dword [rsp + 0x48]
jmp 0x14003991c
mov qword [rsp + 0x2b0], r11
mov r12d, 0xfe
lea rcx, [rsp + 0x3f2]
xor edx, edx
mov r8, r12
mov word [rsp + 0x3f0], r11w
call fcn.1400d3e60
xor eax, eax
lea rcx, [rsp + 0x2f2]
mov r8, r12
xor edx, edx
mov word [rsp + 0x2f0], ax
call fcn.1400d3e60
xor ecx, ecx
mov eax, 0x20
mov dword [rsp + 0x280], eax
cmp byte [rsp + 0x98], cl
je 0x14003a0a6
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
add r12, 2
lea r9d, [rax - 0xf]
lea rdx, str.DEVI_ID__BEGIN
mov qword [r12], rcx
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.140026bb4
xor r11d, r11d
cmp byte [rsp + 0x198], r11b
jne 0x140039eee
mov r9, qword [rsp + 0xb0]
cmp r9, r11
je 0x140039eee
mov r14, qword [rsp + 0x58]
mov ecx, r11d
mov rax, r12
mov dword [rsp + 0x120], ecx
sub rax, r14
cmp rax, 0x400000
jge 0x140039edd
mov edx, ecx
lea r8, [rsp + 0x280]
mov rcx, r9
call qword [0x14010dd38]
xor r11d, r11d
cmp eax, r11d
je 0x140039edd
cmp edi, r11d
je 0x140039a6e
cmp qword [rsp + 0x168], r11
je 0x140039a60
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x284]
xor r9d, r9d
mov r8d, 0x80
mov qword [rsp + 0x3f0], r11
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
jne 0x140039eb3
mov eax, 2
test al, dil
jne 0x140039de1
mov rax, qword [0x14010dd58]
mov dword [rsp + 0x270], r11d
cmp rax, r11
je 0x140039ab9
mov r8d, dword [rsp + 0x294]
mov ecx, 0x20
lea rdx, [rsp + 0x270]
mov dword [rsp + 0x280], ecx
lea rcx, [rsp + 0x1f8]
xor r9d, r9d
mov dword [rsp + 0x1f8], 0x400
call rax
xor r11d, r11d
movsxd rsi, esi
movsx r15d, r13w
mov r14d, ebp
mov rdi, r12
mov qword [rsp + 0x1f8], r12
mov r13d, 1
mov qword [rsp + 0x278], rsi
mov ecx, dword [rsp + 0x58]
lea rbp, [r12 + 0x1fffc]
mov eax, 0xfffe
sub ecx, r12d
mov qword [rsp + 0x30], r11
mov qword [r12], r11
add ecx, 0x3f0002
lea rdx, [rsp + 0x280]
mov r8d, r14d
cmp ecx, eax
mov qword [rsp + 0x2b8], rbp
cmovg ecx, eax
mov eax, 0x20
xor r9d, r9d
mov dword [rsp + 0x280], eax
movsxd rax, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + rbp], r11
mov qword [rsp + 0x20], rbp
mov qword [rbp], r11
call qword [0x14010dd18]
xor r11d, r11d
mov ecx, 0x20
mov dword [rsp + 0x280], ecx
cmp eax, r11d
je 0x140039eaa
cmp byte [rsp + 0x118], r11b
je 0x140039c48
mov rcx, qword [rsp + 0xc0]
cmp rcx, r11
je 0x140039bd3
mov eax, dword [rsp + 0x48]
and eax, 2
cmp al, r11b
jne 0x140039bd3
cmp r13d, r11d
je 0x140039bd3
mov r8d, dword [rsp + 0x2b0]
mov r9d, 0x100
mov rdx, rbp
call fcn.1400290b0
xor r11d, r11d
cmp rax, r11
jne 0x140039bca
test byte [rsp + 0x48], 8
je 0x140039eaa
lea eax, [r11 + 2]
cmp r14d, eax
je 0x140039eaa
mov r14d, eax
jmp 0x140039adc
cmp rsi, r11
jne 0x140039dcb
movsxd rdi, r15d
cmp word [rbp], r11w
je 0x140039c11
cmp rdi, r11
jl 0x140039c11
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x78]
call fcn.14001afe0
xor r11d, r11d
bt dword [rsp + 0x48], 0xa
jae 0x140039c11
mov rbp, qword [rsp + 0x2b8]
jmp 0x140039bd6
movsx eax, byte [rsp + 0xc00]
cmp r15d, eax
jge 0x140039eaa
mov rdi, qword [rsp + 0x1f8]
mov ecx, 1
mov eax, r11d
add r15d, ecx
cmp r14d, 2
mov r13d, r11d
setne al
lea r14d, [rcx + rax]
jmp 0x140039adc
lea rdx, str.ACPI
mov r8d, 4
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r11d, r11d
cmp eax, r11d
je 0x140039eaa
lea edx, [r11 + 1]
cmp r13d, edx
jne 0x140039c9a
mov r8d, dword [rsp + 0x120]
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0xbf0]
mov r9, rbp
call fcn.14001662c
xor r11d, r11d
lea edx, [r11 + 1]
movzx eax, word [rbp]
movzx esi, r11w
mov ecx, r11d
cmp ax, r11w
je 0x140039d9f
mov r8d, 0x26
cmp ax, r8w
jne 0x140039cc9
movsx eax, byte [rsp + 0x11c]
add ecx, edx
cmp ecx, eax
jge 0x140039cda
add si, dx
movzx eax, si
mov ax, word [rbp + rax*2]
cmp ax, r11w
jne 0x140039cb5
cmp si, r11w
jbe 0x140039d9f
cmp qword [rsp + 0x1f8], r12
jae 0x140039d1a
cmp word [rdi - 2], si
jne 0x140039d0c
movzx r8d, si
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r11d, r11d
cmp eax, r11d
je 0x140039d71
movzx eax, word [rdi - 4]
lea rdi, [rdi + rax*2 + 6]
cmp rdi, r12
jb 0x140039cee
mov rcx, r12
mov word [r12 - 2], si
cmp rbp, r12
jne 0x140039d51
movzx eax, si
lea r12, [r12 + rax*2]
jmp 0x140039d35
add r12, 2
cmp word [r12], r11w
jne 0x140039d31
mov rbp, r12
jmp 0x140039d60
mov word [r12], ax
mov eax, 2
add r12, rax
add rbp, rax
movzx eax, word [rbp]
cmp ax, r11w
jne 0x140039d41
mov word [r12], r11w
mov rax, r12
sub rax, rcx
sar rax, 1
add r12, 6
mov word [rcx - 4], ax
mov esi, 2
cmp word [rbp], r11w
je 0x140039d82
add rbp, rsi
jmp 0x140039d76
mov rdi, qword [rsp + 0x1f8]
add rbp, rsi
mov edx, 1
cmp word [rbp], r11w
jne 0x140039c9a
jmp 0x140039da4
mov esi, 2
cmp byte [rsp + 0xc00], r11b
je 0x140039e9f
cmp r14d, esi
je 0x140039e9f
mov r14d, esi
mov rsi, qword [rsp + 0x278]
jmp 0x140039adc
mov esi, dword [rsp + 0x1e4]
movzx r13d, word [rsp + 0x64]
mov edi, dword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xb0]
lea r8, [rsp + 0x2f0]
lea rdx, [rsp + 0x280]
mov r9d, 0x80
mov qword [rsp + 0x2f0], r11
mov qword [rsp + 0x20], r11
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
mov rax, qword [rsp + 0xc0]
xor r11d, r11d
cmp rax, r11
je 0x140039e3f
cmp esi, r11d
jne 0x140039e3f
lea rcx, [rsp + 0x2f0]
mov rdx, rax
call fcn.140029198
xor r11d, r11d
cmp eax, r11d
je 0x140039eb3
bt edi, 0xa
jb 0x140039e4b
bt edi, 0xd
jb 0x140039e5b
mov ebp, dword [rsp + 0xe0]
cmp esi, r11d
je 0x140039a6e
mov ebp, dword [rsp + 0xe0]
cmp byte [rsp + 0x118], r11b
je 0x140039a6e
lea rax, [rsp + 0x2f0]
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x278], rax
call fcn.14001afe0
xor r11d, r11d
jmp 0x140039eb3
mov edi, dword [rsp + 0x48]
test sil, dil
jne 0x140039f1e
jmp 0x140039eae
mov edi, dword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x120]
mov esi, dword [rsp + 0x1e4]
mov ebp, dword [rsp + 0xe0]
mov r13w, word [rsp + 0x64]
mov r9, qword [rsp + 0xb0]
inc ecx
jmp 0x1400399d0
mov r15, qword [rsp + 0x130]
mov r14w, word [rsp + 0xc08]
mov r13d, dword [rsp + 0x118]
cmp r13b, r11b
je 0x140039f19
cmp r14w, r11w
je 0x14003aa25
mov word [r15], r14w
mov r10, r15
mov qword [rsp + 0xc0], r15
jmp 0x1400396cf
mov esi, 2
mov ebp, dword [rsp + 0xa8]
cmp ebp, r11d
je 0x140039f3c
test sil, dil
je 0x140039f3c
mov dword [rsp + 0x1e8], 1
jmp 0x140039f9e
mov rdi, qword [rsp + 0x250]
mov dword [rsp + 0x1e8], r11d
cmp rdi, r11
je 0x140039f9e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
mov word [rcx], ax
lea r12, [rcx + 2]
mov word [r12], ax
add r12, rsi
inc eax
movsxd r10, eax
mov rcx, r12
add r10, r10
mov r8, r10
call fcn.14001aa74
xor r11d, r11d
add r12, r10
mov word [r12], r11w
add r12, rsi
mov word [r12], r11w
add r12, rsi
mov qword [r12], r11
mov r13, qword [rsp + 0xbf0]
mov qword [rsp + 0x28], r11
lea rdx, str.DEVI_ID__END
mov r9d, 0x11
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], r11
call fcn.140026bb4
xor r14d, r14d
mov word [r12 - 2], r14w
mov r12, qword [rsp + 0x1c8]
cmp r12, r14
je 0x14003a0b8
lea rcx, [0x14010ee78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], r14
call fcn.140016218
lea edx, [r14 + 0x26]
mov rdi, r12
mov rcx, rax
cmp dx, word [r12]
jne 0x14003a02a
lea eax, [rdx - 0x24]
add rdi, rax
cmp dx, word [rdi]
je 0x14003a022
cmp rcx, r14
jne 0x14003a054
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rsi
mov rdx, rdi
mov rcx, r13
movsxd r9, eax
mov qword [rsp + 0x20], 0x400032
call fcn.14001b4b8
jmp 0x14003a097
mov dl, byte [rcx + 0x1f]
and dl, 0xc0
cmp dl, 0xc0
jne 0x14003a078
mov rax, qword [rcx + 0x18]
movabs r8, 0x3fffffffffffffff
and rax, r8
cmp rax, 0x400032
jb 0x14003a097
cmp dl, r14b
je 0x14003a081
mov qword [rcx + 8], r14
lea rdx, [rcx + 0x18]
mov r9d, 0x400032
mov r8, rsi
add rcx, 8
call fcn.14005a988
lea rcx, [0x14010ee78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003a0b8
mov ebp, dword [rsp + 0xa8]
mov r13, qword [rsp + 0xbf0]
xor r14d, r14d
mov rsi, qword [rsp + 0xb0]
mov rcx, rsi
call qword [0x14010dd20]
cmp byte [rsp + 0x198], r14b
jne 0x14003a0e9
lea r8, [0x1400f04f4]
lea rdx, [0x1400f3af0]
mov rcx, r13
call fcn.14001662c
mov rax, qword [rsp + 0x70]
movsxd r12, dword [rsp + 0x1d0]
mov r14d, 8
lea rdx, [0x1400f5ac8]
lea rcx, [rax + r12*2]
mov r8, r14
call fcn.14001aa74
xor r13d, r13d
cmp ebp, r13d
jne 0x14003ac0f
cmp rsi, r13
je 0x14003ac05
mov dl, byte [rsp + 0x198]
cmp dl, r13b
jne 0x14003a15b
mov rax, qword [rsp + 0x58]
cmp word [rax], r13w
je 0x14003ab52
cmp dword [rsp + 0x258], r13d
jne 0x14003aab7
cmp dword [rsp + 0x1e0], r13d
je 0x14003aab7
mov rax, qword [rsp + 0x150]
cmp rax, r13
je 0x14003a176
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14003a2af
mov esi, dword [rsp + 0x60]
mov cl, byte [rsp + 0x19c]
cmp esi, r13d
je 0x14003a195
cmp cl, r13b
jne 0x14003a19e
cmp byte [rsp + 0x1a0], r13b
jne 0x14003a19e
cmp cl, r13b
jne 0x14003a2bd
lea rcx, [rsp + 0x110]
call fcn.140058038
lea r11, [0x1400f5ac0]
lea r9, str.devi
lea rcx, [rsp + 0x110]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r11
call fcn.140007060
lea rcx, [rsp + 0x228]
mov edx, 0x105
call fcn.1400580ac
mov rdx, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x110]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov r11, qword [rsp + 0x228]
cmp word [r11], r13w
je 0x14003a224
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x110], r11
mov qword [rsp + 0x228], rax
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0x110]
call fcn.140058174
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x208]
call fcn.140017280
cmp byte [rsp + 0x19c], r13b
jne 0x14003a27c
cmp byte [rsp + 0x1a0], r13b
jne 0x14003a27c
mov rcx, rax
mov qword [rsp + 0x158], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [rsp + 0x196], ax
jmp 0x14003a284
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x228]
call fcn.140050424
lea rcx, [rsp + 0x110]
call fcn.140050424
mov dl, byte [rsp + 0x198]
mov rax, qword [rsp + 0x150]
jmp 0x14003a2b3
mov esi, dword [rsp + 0x60]
cmp byte [rsp + 0x19c], r13b
je 0x14003a2e1
cmp dl, r13b
jne 0x14003a2e1
cmp rax, r13
je 0x14003a2e1
mov cl, byte [rsp + 0x19d]
mov r14d, 1
cmp cl, r13b
cmove esi, r14d
mov dword [rsp + 0x60], esi
jmp 0x14003a2ee
mov cl, byte [rsp + 0x19d]
mov r14d, 1
cmp byte [rsp + 0x51], r13b
mov rbp, qword [rsp + 0x80]
cmovne rax, r13
mov qword [rsp + 0x150], rax
cmp cl, r13b
je 0x14003a31c
cmp rax, r13
je 0x14003a31c
cmp rbp, r13
cmovne esi, r13d
mov dword [rsp + 0x60], esi
neg rax
movzx eax, word [rsp + 0x194]
mov edi, 0xa
sbb r15d, r15d
shl eax, 0x10
lea rdx, str.INF_
not r15d
mov r8, rdi
and r15d, 3
or r15d, eax
mov rax, qword [rsp + 0x70]
lea rcx, [rax + r12*2]
call fcn.14001aa74
lea rcx, [rsp + 0x230]
mov edx, 0x1040
call fcn.1400580ac
lea rcx, [rsp + 0x744]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x740], r13d
call fcn.1400d3e60
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x740]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0xd0], r13
call fcn.1400d342c
cmp qword [rsp + 0xd0], r13
je 0x14003abf0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.14006252c
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xd8]
call fcn.140068e48
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0xd8]
call fcn.140058174
lea rdx, str.DefaultInstall_132
lea rcx, [rsp + 0xe8]
call fcn.14006252c
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xd8]
mov r12d, eax
mov dword [rsp + 0xc00], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xd8]
movsxd rbx, eax
mov word [rcx + rbx*2], r13w
mov dword [rsp + 0xc08], ebx
cmp esi, r13d
jne 0x14003a44b
cmp byte [rsp + 0x198], r13b
je 0x14003a44e
mov r14d, r13d
mov rax, qword [rsp + 0x150]
neg rax
sbb ecx, ecx
and ecx, 0x20000
add ecx, 0x10000
or r15d, ecx
mov rdx, qword [rsp + 0x230]
lea rcx, [rsp + 0x140]
call fcn.14001704c
test byte [rsp + 0x740], 0x10
jne 0x14003a8a1
mov rax, qword [rsp + 0xd8]
movsxd rcx, ebx
lea rdx, [rsp + 0x76c]
mov word [rax + rcx*2], r13w
lea rcx, [rsp + 0xd8]
call fcn.140058174
mov rcx, qword [rsp + 0xd8]
lea r9, [rsp + 0x140]
lea r8, [0x140037bdc]
xor edx, edx
call qword [0x14010dd40]
cmp esi, r13d
je 0x14003a68b
mov r13, qword [rsp + 0x178]
mov bl, byte [rsp + 0x4c]
cmp r13, qword [rsp + 0x170]
jae 0x14003a66c
add r13, rdi
mov rbp, r13
movzx r12d, word [r13 - 2]
lea eax, [r12 + 2]
movsxd rcx, eax
lea rsi, [r13 + rcx*2]
mov ecx, 1
movzx eax, word [rsi - 2]
lea r13, [rsi + rax*2 + 2]
cmp bl, cl
jbe 0x14003a53e
lea rcx, [rsp + 0x140]
or r8d, 0xffffffff
mov rdx, rbp
call fcn.14001711c
xor ecx, ecx
cmp rax, rcx
jne 0x14003a561
mov ecx, 1
xor eax, eax
mov edi, 4
cmp byte [rsp + 0x1a0], al
je 0x14003a573
lea rcx, [rsp + 0x140]
mov r8d, r15d
mov rdx, rsi
call fcn.14002dc4c
mov r12d, dword [rsp + 0xc00]
mov edi, 0xa
jmp 0x14003a4e6
mov edx, 3
cmp byte [rsp + 0x19c], dl
je 0x14003a58a
cmp byte [rsp + 0x19e], al
je 0x14003a5df
or edi, ecx
cmp byte [rsp + 0x19e], al
je 0x14003a5b0
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov r8, rbp
mov rdx, rsi
call fcn.14002e5f8
mov r14, rax
jmp 0x14003a5d2
cmp byte [rsp + 0x19c], dl
jne 0x14003a5d4
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov r8, rbp
mov rdx, rsi
call fcn.14002e774
mov r14d, eax
xor eax, eax
cmp r14d, eax
je 0x14003a561
test dil, 2
jne 0x14003a61f
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x140]
mov r9d, r15d
mov r8, rsi
mov rdx, rbp
or edi, 2
mov dword [rsp + 0x20], r12d
call fcn.14002da98
mov r14d, eax
xor eax, eax
cmp r14d, eax
je 0x14003a561
lea ecx, [rax + 1]
lea edx, [rax + 3]
test cl, dil
je 0x14003a58a
test dil, 4
jne 0x14003a561
mov rax, qword [rsp + 0xe8]
movsxd r12, dword [rsp + 0xc00]
xor edx, edx
mov word [rax + r12*2], dx
lea rcx, [rsp + 0xe8]
mov rdx, rsi
call fcn.140058174
mov r8, qword [rsp + 0xe8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.14002e978
jmp 0x14003a569
mov esi, dword [rsp + 0x60]
mov ebx, dword [rsp + 0xc08]
xor r13d, r13d
cmp esi, r13d
jne 0x14003a8a1
mov rbp, qword [rsp + 0x80]
cmp byte [rsp + 0x19d], r13b
je 0x14003a8a1
cmp rbp, r13
je 0x14003a8a1
mov rdx, qword [rsp + 0x150]
cmp rdx, r13
je 0x14003a8a1
lea rcx, [rsp + 0x108]
call fcn.14006252c
lea rcx, [rsp + 0x108]
mov rdx, rbp
call fcn.140058174
lea rcx, [rsp + 0x240]
mov edx, 0x2800
call fcn.1400580ac
mov r9, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x240]
lea r8, str.:_6R
mov edx, 0x27ff
call fcn.1400d5188
mov rdx, qword [rsp + 0x240]
lea rcx, [0x14010df00]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026bb4
lea rcx, [rsp + 0x240]
call fcn.140050424
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.14002d79c
mov edi, 4
lea rbp, [0x1400f04f4]
cmp rax, r13
lea ecx, [rdi - 1]
mov rsi, rax
cmovne rbp, rax
lea eax, [rdi - 2]
cmp byte [rsp + 0x19c], cl
je 0x14003a77e
cmp byte [rsp + 0x19e], r13b
je 0x14003a7ee
or edi, 1
cmp byte [rsp + 0x19e], r13b
je 0x14003a7a9
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e5f8
jmp 0x14003a7ce
cmp byte [rsp + 0x19c], cl
jne 0x14003a7d6
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e774
mov r14d, eax
mov eax, 2
inc edi
cmp edi, eax
jge 0x14003a882
cmp r14d, r13d
je 0x14003a882
test al, dil
jne 0x14003a840
or edi, eax
cmp rsi, r13
je 0x14003a822
mov r8, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
mov r9d, r15d
mov rdx, rsi
mov qword [rsp + 0x28], r13
or dword [rsp + 0x20], 0xffffffff
call fcn.14002da98
mov r14d, eax
mov eax, 2
inc edi
cmp edi, eax
jge 0x14003a882
cmp rsi, r13
je 0x14003a832
cmp r14d, r13d
je 0x14003a882
mov ecx, 3
test al, dil
je 0x14003a77e
test dil, 4
jne 0x14003a882
mov rax, qword [rsp + 0xe8]
movsxd rcx, r12d
mov word [rax + rcx*2], r13w
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xe8]
call fcn.140058174
mov r8, qword [rsp + 0xe8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.14002e978
cmp rsi, r13
je 0x14003a88b
mov word [rsi], r13w
lea rcx, [rsp + 0x108]
call fcn.140050424
mov esi, dword [rsp + 0x60]
mov edi, 0xa
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rbp, qword [rsp + 0x80]
cmp eax, r13d
jne 0x14003a46a
mov rcx, qword [rsp + 0xd0]
mov ebx, dword [rsp + 0x100]
cmp rcx, r13
je 0x14003a8e8
cmp rcx, 0xffffffffffffffff
je 0x14003a8e8
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x1f0]
cmp r14d, r13d
cmove rdi, r13
mov ecx, 0x5f
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xf8], rdi
mov word [rax], cx
cmp esi, r13d
je 0x14003ab5c
cmp qword [rsp + 0x150], r13
je 0x14003ab5c
lea r14d, [rcx - 0x5e]
cmp byte [rsp + 0x19c], r14b
jne 0x14003ab5c
cmp byte [rsp + 0x51], r13b
jne 0x14003ab5c
mov rax, rbp
cmp rax, r13
jne 0x14003ab5c
cmp byte [rsp + 0x88], r13b
jne 0x14003ab5c
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x51], r14b
call fcn.140050424
lea rcx, [rsp + 0xd8]
call fcn.140050424
mov rcx, qword [rsp + 0xd0]
cmp rcx, r13
je 0x14003a9a5
cmp rcx, 0xffffffffffffffff
je 0x14003a9a5
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x230]
mov qword [rsp + 0xd0], r13
call fcn.140050424
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
mov dil, byte [rsp + 0x4c]
mov r12, qword [rsp + 0xbf8]
jmp 0x140037e8d
mov rbp, 0xffffffff80070057
jmp 0x14003aa1d
xor r13d, r13d
mov rbp, r13
jmp 0x14003ad86
lea rcx, [rsp + 0xa0]
mov ebp, 1
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
xor r13d, r13d
jmp 0x14003ad90
mov r12b, byte [rsp + 0x4f]
mov r8, qword [rsp + 0x78]
cmp r12b, r11b
je 0x14003aa74
cmp word [r8], r11w
je 0x14003aa74
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xd
movsxd rcx, eax
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], dx
mov rax, qword [rsp + 0x78]
mov edx, 0xa
mov word [rax + rcx*2 + 2], dx
mov rax, qword [rsp + 0x78]
xor edx, edx
mov word [rax + rcx*2 + 4], dx
mov r8, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xbf0]
mov rdx, qword [rsp + 0x268]
mov rcx, rbx
call fcn.140057714
xor eax, eax
lea rcx, [rsp + 0x78]
mov rbp, rax
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
jmp 0x14003b293
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
sub eax, r9d
cmp eax, r9d
jl 0x14003aaf6
mov rdx, qword [rsp + 0x40]
lea r8d, [r9 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2]
je 0x14003aaee
lea r8d, [r9 + 0x2e]
cmp r8w, word [rdx + rcx*2]
jne 0x14003aaf6
mov word [rdx + rcx*2], r13w
sub eax, r9d
cmp eax, r13d
jge 0x14003ab07
mov rbp, 0xffffffff80070057
jmp 0x14003ad6f
mov rdx, qword [rsp + 0xc8]
cmp rdx, r13
je 0x14003ab20
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and rdx, rcx
mov rcx, qword [rsp + 0x248]
mov r9b, byte [rsp + 0x50]
mov r8, rdx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x140]
or r9b, 0x10
call fcn.140037260
mov ebp, eax
jmp 0x14003ad6f
mov ebp, 0x491
jmp 0x14003ad6f
mov rcx, qword [rsp + 0xbf0]
lea r8, [0x1400f04f4]
lea rdx, [0x1400f3af0]
mov qword [rsp + 0x150], r13
call fcn.14001662c
lea rcx, [rsp + 0xe8]
call fcn.140050424
lea rcx, [rsp + 0xd8]
call fcn.140050424
mov rcx, qword [rsp + 0xd0]
cmp rcx, r13
je 0x14003abb2
cmp rcx, 0xffffffffffffffff
je 0x14003abb2
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x230]
mov qword [rsp + 0xd0], r13
call fcn.140050424
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
mov rbp, rdi
jmp 0x14003ad90
mov qword [rsp + 0xd0], r13
lea rcx, [rsp + 0x230]
jmp 0x14003ad65
mov ebp, 1
jmp 0x14003ad6f
mov esi, r13d
cmp dword [rsp + 0x60], r13d
jne 0x14003ac59
mov rax, qword [rsp + 0x58]
cmp word [rax], r13w
jne 0x14003ac59
cmp byte [rsp + 0x19d], r13b
jne 0x14003ac59
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
mov ebp, 0x491
jmp 0x14003b68d
lea r15d, [r12 + 4]
lea rcx, [rsp + 0xf8]
lea eax, [r15 + 0x3c]
movsxd rdx, eax
call fcn.1400580ac
mov rax, qword [rsp + 0x70]
lea rdx, str.System32DRIVERS
lea rcx, [rax + r12*2]
mov r8d, 0x22
mov rdi, r12
call fcn.14001aa74
mov rcx, qword [rsp + 0x70]
call fcn.1400d33a8
cmp eax, r13d
jne 0x14003acac
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x70]
lea rdx, [0x1400f5ac8]
mov r8, r14
lea rcx, [rax + r12*2]
call fcn.14001aa74
mov rcx, qword [rsp + 0x70]
call fcn.1400d33a8
cmp eax, r13d
jne 0x14003ace0
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x70]
lea rdx, str.INF_
mov r8d, 0xa
lea rcx, [rax + r12*2]
call fcn.14001aa74
movzx r12d, word [rsp + 0x194]
lea rcx, [rsp + 0x4f4]
xor edx, edx
mov r8d, 0x24c
shl r12d, 0x10
mov dword [rsp + 0x4f0], r13d
call fcn.1400d3e60
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0xb0], r13
call fcn.1400d342c
cmp qword [rsp + 0xb0], r13
jne 0x14003add7
mov qword [rsp + 0xb0], r13
lea rcx, [rsp + 0xf8]
mov ebp, 2
call fcn.140050424
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
cmp ebx, r13d
jle 0x14003adb8
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov ecx, ebx
call fcn.1400c0e90
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x208]
call fcn.14002e91c
lea rcx, [rsp + 0x218]
call fcn.14002e91c
jmp 0x14003b28b
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.14006252c
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140068e48
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0x58]
call fcn.140058174
mov rbx, qword [rsp + 0xb8]
cmp rbx, r13
je 0x14003ae19
cmp word [rbx], r13w
jne 0x14003ae20
lea rbx, [0x1400f5a40]
mov rdx, qword [rsp + 0xc8]
cmp rdx, r13
je 0x14003ae33
cmp word [rdx], r13w
jne 0x14003ae3a
lea rdx, str.DefaultInstall
lea rcx, [rsp + 0x80]
call fcn.14006252c
lea rdx, [0x1400f1058]
lea rcx, [rsp + 0x80]
call fcn.140058174
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.140058174
lea rdx, [0x1400f1058]
lea rcx, [rsp + 0x80]
call fcn.140058174
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0xc00], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0xc08], eax
test byte [rsp + 0x4f0], 0x10
jne 0x14003b1cb
mov rcx, qword [rsp + 0x58]
movsxd rdx, eax
mov word [rcx + rdx*2], r13w
lea rdx, [rsp + 0x51c]
lea rcx, [rsp + 0x58]
call fcn.140058174
mov r14, qword [rsp + 0x58]
lea rcx, [rsp + 0xb8]
mov dil, r13b
call fcn.140058038
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x128], r13
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0xb8]
mov rcx, r14
mov word [rax], r13w
call fcn.1400c18dc
mov rcx, qword [rsp + 0x128]
mov rdx, qword [rsp + 0xb8]
sub rcx, rdx
mov qword [rsp + 0x40], rax
movsxd rax, r15d
sar rcx, 1
cmp rax, rcx
jne 0x14003af54
mov rcx, qword [rsp + 0x70]
mov r8d, r15d
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
movzx edi, r13b
cmp eax, r13d
mov eax, 1
cmove edi, eax
cmp dword [rsp + 0x1e8], r13d
je 0x14003af6b
mov rax, qword [rsp + 0xc0]
cmp rax, r13
jne 0x14003af80
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.14002d79c
mov rbx, rax
cmp byte [rsp + 0x19d], r13b
jne 0x14003afac
mov eax, dword [rsp + 0x60]
cmp eax, r13d
jne 0x14003b014
cmp byte [rsp + 0x4d], r13b
je 0x14003afa2
cmp dil, r13b
jne 0x14003b014
cmp rbx, r13
jne 0x14003b019
jmp 0x14003b1be
lea rcx, [rsp + 0xc8]
mov edx, 0x2800
call fcn.1400580ac
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc8]
lea r8, str.:_6R
mov edx, 0x27ff
call fcn.1400d5188
mov rdx, qword [rsp + 0xc8]
lea rcx, [0x14010df00]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026bb4
lea rcx, [rsp + 0xc8]
call fcn.140050424
mov eax, dword [rsp + 0x60]
cmp rbx, r13
je 0x14003b01e
movzx r13d, word [rbx - 4]
xor edx, edx
lea rbp, [0x1400f04f4]
cmp rbx, rdx
lea edi, [rdx + 4]
cmovne rbp, rbx
cmp eax, edx
jne 0x14003b118
cmp byte [rsp + 0x1a0], dl
jne 0x14003b121
lea ecx, [rdx + 3]
cmp byte [rsp + 0x19c], cl
je 0x14003b05b
cmp byte [rsp + 0x19e], dl
je 0x14003b0c3
mov eax, 1
or edi, eax
cmp byte [rsp + 0x19e], dl
je 0x14003b089
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e5f8
mov rsi, rax
jmp 0x14003b0ad
cmp byte [rsp + 0x19c], cl
jne 0x14003b0af
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e774
mov esi, eax
xor edx, edx
cmp esi, edx
je 0x14003b19e
mov eax, 2
test al, dil
jne 0x14003b10e
jmp 0x14003b0c8
mov eax, 2
or edi, eax
cmp rbx, rdx
je 0x14003b0fd
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
or dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov rdx, rbx
call fcn.14002da98
xor edx, edx
mov esi, eax
cmp eax, edx
je 0x14003b19e
mov eax, 1
lea ecx, [rax + 2]
test al, dil
je 0x14003b060
test dil, 4
jne 0x14003b19e
cmp byte [rsp + 0x1a0], dl
je 0x14003b138
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
mov r8d, r12d
call fcn.14002dc4c
jmp 0x14003b19e
cmp byte [rsp + 0x19f], dl
jne 0x14003b19e
movsxd rcx, dword [rsp + 0xc00]
mov rax, qword [rsp + 0x80]
mov word [rax + rcx*2], dx
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140058174
mov r8, qword [rsp + 0x80]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call fcn.14002e978
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x14003b19e
cmp qword [rsp + 0x160], rax
je 0x14003b19e
lea rcx, [rsp + 0x140]
mov r8d, r13d
mov rdx, rbp
call fcn.140017148
xor r13d, r13d
cmp rbx, r13
je 0x14003b1aa
mov word [rbx], r13w
mov rcx, qword [rsp + 0xf8]
cmp word [rcx], r13w
je 0x14003b1be
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xb8]
call fcn.140050424
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
mov eax, dword [rsp + 0xc08]
jne 0x14003aea6
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0x58]
call fcn.140050424
mov rcx, qword [rsp + 0xb0]
movsxd rbx, esi
cmp rcx, r13
je 0x14003b224
cmp rcx, 0xffffffffffffffff
je 0x14003b224
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0xb0], r13
call fcn.140050424
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
mov rbp, rbx
jmp 0x14003b68d
movsx edx, bpl
xor ecx, ecx
and edx, 0x12
call fcn.1400c0e90
xor eax, eax
mov rbp, rax
jmp 0x14003b68d
cmp qword [rsp + 0x90], r8
jne 0x14003b2a5
mov rbp, 0xffffffff80070057
mov rbx, qword [rsp + 0xbf0]
lea rsi, str.__DEVI.REBOOT
mov r15d, 0x40
jmp 0x14003b5be
mov ebp, 2
lea rcx, [rsp + 0xc08]
mov rdx, rbp
call fcn.1400580ac
mov rax, qword [rsp + 0xc08]
xor r13d, r13d
mov word [rax], r13w
mov r10, qword [rsp + 0x90]
lea r14d, [rbp + 0x38]
mov qword [rsp + 0x250], r10
cmp dil, 0x12
je 0x14003b2ec
lea eax, [rbp + 0x24]
cmp ax, word [r10]
jne 0x14003b331
mov rsi, r10
jmp 0x14003b30c
cmp r14w, ax
je 0x14003b318
mov ecx, 0x3d
cmp cx, ax
je 0x14003b318
add r10, rbp
mov qword [rsp + 0x90], r10
movzx eax, word [r10]
cmp ax, r13w
jne 0x14003b2f1
jmp 0x14003b338
mov word [r10], r13w
mov r10, qword [rsp + 0x90]
add r10, rbp
mov qword [rsp + 0x90], r10
jmp 0x14003b338
lea rsi, str.__DEVI.REBOOT
mov r12b, byte [rsp + 0x4f]
mov ebx, 1
lea r15d, [rbx + 0x3f]
jmp 0x14003b34d
mov ebp, 2
mov r8d, 0x22
cmp r8w, word [r10]
je 0x14003b374
lea edx, [r8 + 5]
cmp dx, word [r10]
je 0x14003b374
lea rax, [0x1400f04f4]
mov qword [rsp + 0x90], rax
jmp 0x14003b3c4
movsx eax, byte [r10]
lea rcx, [rsp + 0x90]
add r10, 2
movzx edx, ax
mov qword [rsp + 0x90], r10
call fcn.140009210
mov rcx, qword [rsp + 0x90]
cmp word [rcx], r13w
je 0x14003b3ae
mov word [rcx], r13w
add qword [rsp + 0x90], rbp
lea rcx, [rsp + 0x90]
call fcn.140014d28
mov edx, 0x27
lea r8d, [rdx - 5]
movzx eax, word [r10]
mov ecx, 0x68
mov r9d, r13d
or ax, 0x20
cmp cx, ax
jne 0x14003b3e8
cmp r14w, word [r10 + 2]
jne 0x14003b3e8
mov r9d, 0x200
jmp 0x14003b428
mov ecx, 0x63
cmp cx, ax
jne 0x14003b401
cmp r14w, word [r10 + 2]
jne 0x14003b401
mov r9d, 0x400
jmp 0x14003b428
mov eax, 0x2b
cmp ax, word [r10]
jne 0x14003b41b
cmp r14w, word [r10 + 2]
jne 0x14003b41b
mov r9d, 0x600
jmp 0x14003b428
cmp r15w, word [r10]
jne 0x14003b42c
cmp r14w, word [r10 + 2]
jne 0x14003b42c
add r10, 4
cmp r8w, word [r10]
je 0x14003b438
cmp dx, word [r10]
jne 0x14003b46f
movsx edx, byte [r10]
lea rcx, [rsp + 0xc00]
add r10, rbp
mov qword [rsp + 0xc00], r10
call fcn.140009210
mov rcx, qword [rsp + 0xc00]
mov edx, 0x27
lea r8d, [rdx - 5]
cmp word [rcx], r13w
je 0x14003b46f
mov word [rcx], r13w
cmp dil, 0x11
jne 0x14003b52c
mov rax, r10
mov r11, r13
mov qword [rsp + 0xc00], rax
cmp r8w, word [r10]
je 0x14003b493
cmp dx, word [r10]
jne 0x14003b4dd
movsx edx, byte [r10]
lea rcx, [rsp + 0xc00]
add r10, 2
mov qword [rsp + 0xc00], r10
call fcn.140009210
mov rcx, qword [rsp + 0xc00]
cmp word [rcx], r13w
je 0x14003b4ff
mov word [rcx], r13w
mov rax, qword [rsp + 0xc00]
jmp 0x14003b4d2
cmp r14w, cx
je 0x14003b4e8
add rax, rbp
mov qword [rsp + 0xc00], rax
movzx ecx, word [rax]
cmp cx, r13w
jne 0x14003b4cc
jmp 0x14003b4ff
mov word [rax], r13w
mov r11, qword [rsp + 0xc00]
add r11, rbp
mov qword [rsp + 0xc00], r11
lea rax, [rsp + 0x19a]
lea rcx, [rsp + 0x140]
mov r9d, ebx
mov qword [rsp + 0x28], rax
mov r8, r11
mov rdx, r10
mov dword [rsp + 0x20], 0xfffffff0
call fcn.14002da98
jmp 0x14003b569
mov al, r12b
mov r8d, 0x100
mov rdx, r10
neg al
movsx eax, dil
sbb ecx, ecx
and ecx, 0x10000
or ecx, eax
lea rax, [rsp + 0x19a]
or ecx, r9d
lea r9, [rsp + 0xc08]
mov qword [rsp + 0x20], rax
bts ecx, 0xb
call fcn.140064c10
mov r10, qword [rsp + 0x90]
movsxd rbp, eax
cmp word [r10], r13w
jne 0x14003b348
mov rbx, qword [rsp + 0x250]
cmp dil, 0x12
jne 0x14003b5a9
mov r8, qword [rsp + 0xc08]
mov rdx, rbx
mov rbx, qword [rsp + 0xbf0]
mov rcx, rbx
call fcn.140057714
jmp 0x14003b5b1
mov rbx, qword [rsp + 0xbf0]
lea rcx, [rsp + 0xc08]
call fcn.140050424
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x2d8]
call fcn.1400172a0
lea rax, [rsp + 0x19a]
cmp word [rax], r15w
je 0x14003b5f6
movzx edx, word [rax]
lea r9, str.0x_X
mov r8, rsi
mov rcx, rbx
call fcn.14005b02c
xor edx, edx
mov rcx, rbx
call fcn.1400860fc
jmp 0x14003b68d
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0xc08]
xor edx, edx
mov r8d, 0x1e5
mov qword [rsp + 0xc08], rax
call fcn.140024200
mov rbx, qword [rsp + 0xc08]
mov qword [rsp + 0x40], rax
xor eax, eax
cmp word [rbx], ax
jne 0x14003b644
mov rbp, 0xffffffff80070057
jmp 0x14003b68d
lea rdx, str.35:INDATABuildInfCache
lea rcx, [rsp + 0xc00]
call fcn.14006252c
lea rcx, [rsp + 0xc00]
mov rdx, rbx
call fcn.140058174
mov rdx, qword [rsp + 0xc00]
mov rcx, qword [rsp + 0xbf0]
call fcn.14004392c
lea rcx, [rsp + 0xc00]
mov rbp, rax
call fcn.140050424
lea rcx, [rsp + 0x1c0]
call fcn.140050424
lea rcx, [rsp + 0x70]
call fcn.140050424
lea rcx, [rsp + 0x218]
call fcn.140050424
lea rcx, [rsp + 0x208]
call fcn.140050424
lea rcx, [rsp + 0x260]
call fcn.140050424
lea rcx, [rsp + 0x1f0]
call fcn.140050424
lea rcx, [rsp + 0x210]
call fcn.140050424
mov rax, rbp
add rsp, 0xba8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret