Function at 0x140002b60
Capabilities:
Accept command line arguments
Move file

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov r14, rcx
call fcn.1400307d0
mov dword [0x1400b5104], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.PopUpReboot
call fcn.1400380f8
test rax, rax
je 0x140002bcf
call fcn.14000a5a0
test eax, eax
je 0x140002bbd
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1400b5104], 7
jge 0x140002bbd
call fcn.1400203e0
call fcn.140008b50
xor eax, eax
add rsp, 0x2c8
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.UninstallPciFilter
call fcn.1400380f8
test rax, rax
je 0x140002c09
call fcn.14000a530
test eax, eax
je 0x140002bf7
call fcn.14002ae60
call fcn.140008b40
xor eax, eax
add rsp, 0x2c8
pop r14
pop rbp
ret
mov qword [rsp + 0x2e0], rbx
mov qword [rsp + 0x2f0], rdi
mov qword [rsp + 0x2c0], r15
xor r15d, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea edx, [r15 + 0x20]
mov rdi, rax
call fcn.140037f20
test rax, rax
je 0x140002d86
lea rcx, [rax + 1]
mov qword [rsp + 0x2e8], rsi
mov byte [rax], bl
call fcn.14004528c
lea rdx, str.Rescan
mov rcx, rdi
mov rsi, rax
call fcn.1400380f8
test rax, rax
je 0x140002d76
call fcn.14000a620
test eax, eax
je 0x140002d6c
xor eax, eax
lea r9d, [r15 + 6]
mov qword [rsp + 0x60], rax
xor r8d, r8d
movzx eax, sil
xor edx, edx
mov dword [rsp + 0x68], eax
xor ecx, ecx
mov eax, esi
shr esi, 0x10
shr eax, 8
movzx eax, al
mov dword [rsp + 0x64], eax
movzx eax, sil
mov dword [rsp + 0x60], eax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
xor edx, edx
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.14001bb60
cmp eax, 2
je 0x140002cf0
nop dword [rax + rax]
test eax, eax
je 0x140002d2e
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14001bb60
cmp eax, 2
jne 0x140002cd0
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x200
call fcn.140038310
mov r8d, 0x200
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
lea rcx, [rbp - 0x40]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
call fcn.140030e80
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14001b2d0
test eax, eax
jne 0x140002d6c
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140002d6c
lea r8, str.FindAndPnPStartStopAudioController:__fail_to_start_HD_audio_controller._n
mov edx, 0x200
call fcn.14002ffd0
call fcn.140008b70
mov ebx, 1
mov rsi, qword [rsp + 0x2e8]
test ebx, ebx
jne 0x14000306a
call fcn.140009d40
test eax, eax
je 0x140003065
movdqa xmm1, xmmword [0x140089ff0]
lea rax, [0x140002240]
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
lea rdi, str.AMD_EEU_Client
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], rdi
mov rbx, r15
mov dword [rsp + 0x70], r15d
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r14
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x140002e51
mov qword [rsp + 0x58], r15
mov r9d, 0x80000000
mov qword [rsp + 0x50], r14
mov r8, rdi
mov qword [rsp + 0x48], r15
mov rdx, rdi
mov qword [rsp + 0x40], r15
mov ecx, 0x80
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
test rax, rax
je 0x140002e3c
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x140002e74
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140002e74
lea r9, str.CreateWindowEx_failed.
jmp 0x140002e64
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140002e74
lea r9, str.RegisterClass_failed.
mov r8d, 1
mov edx, 0x60004002
call fcn.14002fdb0
mov qword [0x1400b5028], rbx
test rbx, rbx
je 0x140003065
xor edx, edx
mov rcx, rbx
mov edi, 1
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
test eax, eax
jne 0x140002eba
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140002eb7
lea r9, str.WTSRegisterSessionNotification_failed.
mov edx, 0x60004002
mov r8d, edi
call fcn.14002fdb0
mov edi, r15d
movups xmm0, xmmword [0x140086b30]
lea r8, [0x1400b5038]
mov rcx, rbx
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x60], xmm0
call fcn.140030550
test eax, eax
jne 0x140002f01
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140002efe
lea r9, str.RegisterDeviceInterface_Monitor_failed_n
xor r8d, r8d
mov edx, 0x60004002
call fcn.14002fdb0
mov edi, r15d
movups xmm0, xmmword [0x140086b40]
lea r8, [0x1400b5040]
mov rcx, rbx
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x60], xmm0
call fcn.140030550
test eax, eax
jne 0x140002f48
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140002f45
lea r9, str.RegisterDeviceInterface_Adapter_failed_n
xor r8d, r8d
mov edx, 0x60004002
call fcn.14002fdb0
mov edi, r15d
mov rcx, rbx
call fcn.140031d90
mov dword [0x1400b5030], eax
call fcn.14002bc60
test eax, eax
jne 0x140002f7f
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140002f7f
lea r9, str.HookWindowEvents_failed_n
xor r8d, r8d
mov edx, 0x60004002
call fcn.14002fdb0
test edi, edi
je 0x140003065
mov edx, 1
mov ecx, 0x460
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, 0x461
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, 0x462
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov rcx, qword [0x1400b5028]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
lea rcx, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140003012
nop word [rax + rax]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
lea rcx, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140002ff0
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x14000302f
lea r8, str.Client_exiting.
mov edx, 0x100
call fcn.14002ffd0
mov rcx, qword [0x1400b5038]
call fcn.140030710
mov rcx, qword [0x1400b5040]
call fcn.140030710
call fcn.14002bd60
mov rcx, qword [0x1400b5058]
test rcx, rcx
je 0x140003065
call qword [sym.imp.USER32.dll_UnregisterPowerSettingNotification]
mov qword [0x1400b5058], r15
call fcn.1400089e0
mov rdi, qword [rsp + 0x2f0]
xor eax, eax
mov rbx, qword [rsp + 0x2e0]
mov r15, qword [rsp + 0x2c0]
add rsp, 0x2c8
pop r14
pop rbp
ret