Function at 0x14004aba4
Capabilities:
Create directory
Delete file
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa90
mov qword [rsp + 0x178], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov r12, rdx
mov qword [rsp + 0x160], rdx
mov rbp, rcx
mov qword [rsp + 0xa8], rcx
lea rdi, [0x14019cf50]
mov qword [rsp + 0x170], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
call fcn.14002a53c
mov r9d, 0x104
lea r8, [rsp + 0x870]
mov edx, 0x2711
xor ecx, ecx
call fcn.14005b7c0
mov qword [rsp + 0x168], rax
xor r15d, r15d
mov qword [0x14019c0b0], r15
mov qword [0x14019c0b8], r15
mov ebx, 0x80000000
mov dword [rsp + 0xb0], ebx
lea rcx, [rsp + 0x90]
call fcn.140063500
nop
mov qword [rsp + 0xf0], r15
lea rdx, [0x14014b780]
lea rcx, [rsp + 0xd0]
call fcn.140071240
nop
mov qword [rsp + 0x158], r15
lea rax, [rsp + 0x158]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbp
lea rax, [rsp + 0xd0]
mov qword [0x14019c0a0], rax
mov byte [0x14019c056], r15b
mov qword [0x14019c0a8], r15
call fcn.14002c054
mov dword [rsp + 0x138], eax
cmp eax, 0x60000
setae byte [rsp + 0x4d]
lea ecx, [rax - 0x60000]
cmp ecx, 0xffff
setbe sil
mov byte [rsp + 0x5d], sil
mov byte [rsp + 0x4f], r15b
mov byte [0x14019c0cc], r15b
lea rcx, [rsp + 0x60]
call fcn.140063500
nop
lea rdx, [rsp + 0x620]
mov rcx, qword [str._SystemRoot__]
mov qword [rdx], rcx
mov rax, qword [0x14014b768]
mov qword [rdx + 8], rax
mov rax, qword [0x14014b770]
mov qword [rdx + 0x10], rax
mov eax, dword [0x14014b778]
mov dword [rdx + 0x18], eax
xor eax, eax
mov dword [rsp + 0x63c], eax
mov dword [rsp + 0x640], eax
mov dword [rsp + 0x644], eax
lea r13d, [r15 + 1]
mov byte [rsp + 0x20], r13b
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x620]
mov rcx, rbp
call fcn.14006bc40
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x118], eax
lea edx, [rax + 0x1e]
lea rcx, [rsp + 0x60]
call fcn.1400635c0
cmp sil, r15b
jl 0x14004adc8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140071240
nop
lea rdx, str.System32Drvload.exe
lea rcx, [rsp + 0x68]
call fcn.140063600
mov rcx, qword [rsp + 0x68]
call fcn.1400cf470
neg eax
sbb sil, sil
and sil, 3
mov byte [rsp + 0x5d], sil
lea rcx, [rsp + 0x68]
call fcn.14005b520
mov byte [rsp + 0x4c], sil
mov dword [rsp + 0x12c], r13d
mov al, r15b
mov ebp, 2
add al, r13b
mov byte [rsp + 0x4a], al
mov byte [0x14019c057], r15b
mov rdx, r12
lea rcx, [rsp + 0xf0]
call fcn.140071480
mov r11, qword [rsp + 0xf0]
mov qword [rsp + 0x40], r11
mov sil, r15b
mov dword [0x14019c0c8], r15d
mov qword [0x14019c0a8], r15
mov byte [rsp + 0x100], bpl
lea rcx, [rsp + 0x40]
call fcn.140029d28
mov byte [rsp + 0x4e], r15b
mov r13b, bpl
mov r14b, r15b
mov byte [rsp + 0x48], r15b
mov byte [rsp + 0x4b], r15b
mov byte [rsp + 0x49], r15b
mov byte [0x14019c0cd], r15b
mov qword [rsp + 0xe8], r15
xor eax, eax
mov rbp, rax
mov qword [rsp + 0x150], rax
lea r8d, [rax + 8]
mov rdx, qword [rsp + 0x40]
lea rcx, str.listdev:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14004af1d
mov r14b, 0x10
mov byte [rsp + 0x48], r14b
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x14004af08
lea r10d, [rbp + 9]
cmp r10w, cx
ja 0x14004aeb1
cmp cx, 0xd
jbe 0x14004aec9
mov r9d, 0x20
cmp r9w, cx
cmovne rbp, rax
mov qword [rsp + 0x150], rbp
jmp 0x14004aecf
mov r9d, 0x20
mov edx, 2
cmp r10w, cx
ja 0x14004aee0
cmp cx, 0xd
jbe 0x14004aef9
cmp r9w, cx
je 0x14004aef9
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x14004af08
jmp 0x14004aed4
cmp word [rax], r8w
je 0x14004af08
mov word [rax], r8w
add qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.140029d28
cmp word [rbp], r8w
je 0x14004c87c
mov r12b, 0xff
mov rbp, r8
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14004b71c
mov dil, byte [rsp + 0x5d]
lea ebx, [rcx - 0x29]
mov r8d, 8
lea rdx, [rsp + 0x40]
lea rcx, str.extract
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004af6d
mov byte [rsp + 0x49], bl
mov r13b, bl
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 8
lea rdx, [rsp + 0x40]
lea rcx, str.nocheck
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004af9b
mov byte [0x14019c0cd], bl
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 7
lea rdx, [rsp + 0x40]
lea rcx, str.rescan
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004afc7
mov byte [rsp + 0x4b], bl
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 9
lea rdx, [rsp + 0x40]
lea rcx, str.norescan
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004aff4
mov byte [rsp + 0x4b], 0xff
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 6
lea rdx, [rsp + 0x40]
lea rcx, str.dummy
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b022
mov byte [0x14019c056], bl
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, str.sub
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b04e
mov byte [rsp + 0x4e], bl
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 5
lea rdx, [rsp + 0x40]
lea rcx, str.self
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b07b
lea r9d, [r8 + 2]
mov byte [rsp + 0x4e], r9b
jmp 0x14004b6e5
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, str.7pe
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b0a8
mov byte [rsp + 0x4c], 3
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 8
lea rdx, [rsp + 0x40]
lea rcx, str.drvload
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b0d5
mov byte [rsp + 0x4c], dil
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 6
lea rdx, [rsp + 0x40]
lea rcx, str.inner
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b102
mov byte [rsp + 0x4c], 0xc0
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 9
lea rdx, [rsp + 0x40]
lea rcx, str.nnverify
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b12d
mov r13b, bl
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 8
lea rdx, [rsp + 0x40]
lea rcx, str.rverify
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b158
mov r13b, r8b
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 0xa
lea rdx, [rsp + 0x40]
lea rcx, str.listdevi
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b187
and r14b, 0xf2
lea r9d, [r8 + 2]
or r14b, r9b
jmp 0x14004b6e5
mov r8d, 0xa
lea rdx, [rsp + 0x40]
lea rcx, str.listdevc
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b1b7
and r14b, 0xf4
or r14b, 4
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, str.All
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b1e3
or r14b, 0x20
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 0xa
lea rdx, [rsp + 0x40]
lea rcx, [0x14014b659]
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b20e
mov sil, bl
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, VariantTimeToDosDateTime
lea rdx, [rsp + 0x40]
lea rcx, str.disverify
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14004b239
mov sil, 3
lea r9d, [r8 + 2]
jmp 0x14004b6e5
mov r8d, 7
mov rdx, qword [rsp + 0x40]
lea rcx, str.retid:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14004b302
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
cmp word [rax], r8w
je 0x14004b2ed
lea r10d, [r8 + 9]
cmp r10w, word [rax]
ja 0x14004b280
cmp word [rax], 0xd
jbe 0x14004b2a5
mov r9d, 0x20
cmp r9w, word [rax]
je 0x14004b2ab
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0xd0]
mov qword [0x14019c0a0], rcx
jmp 0x14004b2ab
mov r9d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x14004b2ed
mov edx, 2
cmp r10w, cx
ja 0x14004b2c5
cmp cx, 0xd
jbe 0x14004b2de
cmp r9w, cx
je 0x14004b2de
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x14004b2ed
jmp 0x14004b2b9
cmp word [rax], r8w
je 0x14004b2ed
mov word [rax], r8w
add qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.140029d28
mov r9d, 2
jmp 0x14004b6e5
mov r8d, 0xa
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevClass:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14004b3be
mov rcx, qword [rsp + 0x40]
add rcx, 0x14
mov qword [rsp + 0x40], rcx
movzx edx, word [rcx]
cmp dx, r8w
je 0x14004b3a9
lea r10d, [r8 + 9]
cmp r10w, dx
ja 0x14004b34c
cmp dx, 0xd
jbe 0x14004b36a
mov rax, qword [0x14019c0a8]
mov r9d, 0x20
cmp r9w, dx
cmovne rax, rcx
mov qword [0x14019c0a8], rax
jmp 0x14004b370
mov r9d, 0x20
mov eax, 2
cmp r10w, dx
ja 0x14004b381
cmp dx, 0xd
jbe 0x14004b39a
cmp r9w, dx
je 0x14004b39a
add rcx, rax
mov qword [rsp + 0x40], rcx
mov dx, word [rcx]
cmp dx, r8w
je 0x14004b3a9
jmp 0x14004b375
cmp word [rcx], r8w
je 0x14004b3a9
mov word [rcx], r8w
add qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.140029d28
mov r9d, 2
jmp 0x14004b6e5
mov r8d, 7
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevID:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14004b4b0
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x14004b457
lea r10d, [r8 + 9]
cmp r10w, cx
ja 0x14004b408
cmp cx, 0xd
jbe 0x14004b418
mov r9d, 0x20
cmp r9w, cx
cmovne r15, rax
jmp 0x14004b41e
mov r9d, 0x20
mov edx, 2
cmp r10w, cx
ja 0x14004b42f
cmp cx, 0xd
jbe 0x14004b448
cmp r9w, cx
je 0x14004b448
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x14004b457
jmp 0x14004b423
cmp word [rax], r8w
je 0x14004b457
mov word [rax], r8w
add qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.140029d28
cmp r15, r8
je 0x14004b6d7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
xor r8d, r8d
cmp rcx, r8
jle 0x14004b499
lea edx, [r8 + 0x26]
cmp dx, word [r15 + rcx*2 - 2]
jne 0x14004b499
mov word [r15 + rcx*2], r8w
sub eax, ebx
sub rcx, rbx
cmp rcx, r8
jg 0x14004b482
cmp eax, r8d
jg 0x14004b6df
mov r15, r8
mov r9d, 2
jmp 0x14004b6e5
mov r8d, 7
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevID:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14004b5a2
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x14004b549
lea r10d, [r8 + 9]
cmp r10w, cx
ja 0x14004b4fa
cmp cx, 0xd
jbe 0x14004b50a
mov r9d, 0x20
cmp r9w, cx
cmovne r15, rax
jmp 0x14004b510
mov r9d, 0x20
mov edx, 2
cmp r10w, cx
ja 0x14004b521
cmp cx, 0xd
jbe 0x14004b53a
cmp r9w, cx
je 0x14004b53a
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x14004b549
jmp 0x14004b515
cmp word [rax], r8w
je 0x14004b549
mov word [rax], r8w
add qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.140029d28
cmp r15, r8
je 0x14004b6c7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
xor r8d, r8d
cmp rcx, r8
jle 0x14004b58b
lea edx, [r8 + 0x26]
cmp dx, word [r15 + rcx*2 - 2]
jne 0x14004b58b
mov word [r15 + rcx*2], r8w
sub eax, ebx
sub rcx, rbx
cmp rcx, r8
jg 0x14004b574
cmp eax, r8d
jg 0x14004b6cf
mov r15, r8
mov r9d, 2
jmp 0x14004b6e5
mov r8d, 9
mov rdx, qword [rsp + 0x40]
lea rcx, str.disable:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14004b5d2
mov rax, qword [rsp + 0x40]
lea r9d, [r8 + 2]
add rax, r9
mov r12b, r8b
jmp 0x14004b601
mov r8d, 8
mov rdx, qword [rsp + 0x40]
lea rcx, str.enable:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14004b677
mov r12b, bl
mov rax, qword [rsp + 0x40]
lea r9d, [r8 + 2]
add rax, 0x10
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x14004b66b
mov r10d, 9
cmp r10w, cx
ja 0x14004b625
cmp cx, 0xd
jbe 0x14004b633
mov edx, 0x20
cmp dx, cx
cmovne rbp, rax
jmp 0x14004b638
mov edx, 0x20
cmp r10w, cx
ja 0x14004b644
cmp cx, 0xd
jbe 0x14004b65c
cmp dx, cx
je 0x14004b65c
add rax, r9
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x14004b66b
jmp 0x14004b638
cmp word [rax], r8w
je 0x14004b66b
mov word [rax], r8w
add qword [rsp + 0x40], r9
lea rcx, [rsp + 0x40]
call fcn.140029d28
jmp 0x14004b6e5
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x14004b6b5
mov edx, 2
lea r9d, [rdx + 0x1e]
lea r10d, [rdx + 7]
cmp r10w, ax
ja 0x14004b69e
cmp ax, 0xd
jbe 0x14004b6b5
cmp r9w, ax
je 0x14004b6b5
add rcx, rdx
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
jne 0x14004b692
lea rcx, [rsp + 0x40]
call fcn.140029d28
mov r9d, 2
jmp 0x14004b6e5
mov r9d, 2
jmp 0x14004b6e5
mov r9d, 2
jmp 0x14004b6e5
mov r9d, 2
jmp 0x14004b6e5
mov r9d, 2
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
je 0x14004af3e
mov qword [rsp + 0xe8], r15
mov byte [rsp + 0x48], r14b
mov ebx, dword [rsp + 0xb0]
lea rdi, [0x14019cf50]
cmp sil, r8b
jne 0x14004c8e7
mov ecx, r8d
movzx edx, byte [rsp + 0x4c]
cmp dl, r8b
cmovge ecx, edx
mov byte [0x14019c0cc], cl
or byte [rsp + 0x4d], cl
mov sil, r14b
and sil, 0x10
mov byte [rsp + 0x5c], sil
je 0x14004b750
cmp qword [rsp + 0x150], r8
je 0x14004c95e
cmp r12b, r8b
jl 0x14004b75e
cmp rbp, r8
jne 0x14004c96b
cmp r15, r8
setne byte [0x14019c057]
mov edx, 0x200010
lea rcx, [rsp + 0x88]
call fcn.1400632b0
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0x200000
xor edx, edx
lea r8d, [rdx + 8]
call fcn.14010c6c0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xc8], rax
add rax, 2
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov word [rax + 2], bp
mov word [rax], bp
lea eax, [rbp + 0x20]
mov dword [rsp + 0x620], eax
mov dword [rsp + 0x624], ebp
xor eax, eax
mov qword [rsp + 0x628], rax
mov qword [rsp + 0x630], rax
mov qword [rsp + 0x638], rax
cmp sil, bpl
jne 0x14004b803
lea edx, [rbp + 1]
cmp r13b, dl
je 0x14004b808
cmp ebx, ebp
je 0x14004b808
xor edx, edx
xor ecx, ecx
call fcn.1400613a0
mov ebx, eax
lea edx, [rbp + 1]
jmp 0x14004b808
mov edx, 1
mov esi, 2
cmp r13b, sil
cmove ebx, ebp
mov dword [rsp + 0xb0], ebx
mov r12d, ebp
mov ecx, ebp
mov rax, qword [rsp + 0x40]
cmp word [rax], 0x24
sete cl
mov dword [rsp + 0x58], ecx
cmp ecx, ebp
je 0x14004b852
add rax, rsi
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
jne 0x14004b852
add r12d, edx
add rax, rsi
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
je 0x14004b841
lea rcx, [rsp + 0x40]
call fcn.140029d28
mov r13d, 0x2c
mov edx, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r14, rax
mov qword [rsp + 0x130], rax
mov r15, rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x80], rbp
cmp rax, rbp
je 0x14004b8f2
mov word [rax], bp
add r14, rsi
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x68]
call fcn.140029d28
mov edx, r13d
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x130], r14
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r15, rax
mov qword [rsp + 0x68], rax
cmp rax, rbp
je 0x14004b8ea
mov word [rax], bp
add r15, rsi
mov qword [rsp + 0x68], r15
lea rcx, [rsp + 0x68]
call fcn.140029d28
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x68], r15
mov rcx, r14
call fcn.14002b47c
mov rcx, qword [rsp + 0x40]
call fcn.14002b47c
cmp r15, rbp
je 0x14004b95d
mov edx, r13d
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rbp, rax
mov qword [rsp + 0x80], rax
xor eax, eax
cmp rbp, rax
je 0x14004b953
mov word [rbp], ax
add rbp, rsi
mov qword [rsp + 0x80], rbp
lea rcx, [rsp + 0x80]
call fcn.140029d28
mov rbp, qword [rsp + 0x80]
mov qword [rsp + 0x80], rbp
mov rcx, rbp
call fcn.14002b47c
mov rcx, r15
call fcn.14002b47c
xor ebp, ebp
mov rcx, qword [rsp + 0x40]
call fcn.1400cf330
mov r13d, eax
mov dword [rsp + 0x11c], eax
mov rcx, qword [rsp + 0x40]
call fcn.14010d9c8
mov rsi, rax
cmp eax, 4
jle 0x14004b9aa
movsxd rdx, eax
mov rcx, qword [rsp + 0x40]
lea rcx, [rcx + rdx*2 - 8]
lea rdx, str..INF
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebp
jne 0x14004b9aa
mov eax, 1
mov ebp, eax
jmp 0x14004b9af
mov eax, 1
xor edx, edx
cmp r13d, edx
jne 0x14004b9bf
cmp ebp, edx
je 0x14004b9bf
mov r13d, eax
jmp 0x14004b9cb
mov r13d, edx
cmp dword [rsp + 0x11c], edx
jne 0x14004ba00
cmp esi, 4
jle 0x14004ba00
movsxd rcx, esi
mov rax, qword [rsp + 0x40]
lea rcx, [rax + rcx*2 - 8]
lea rdx, str..CAB
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
jne 0x14004ba00
lea r8d, [rdx + 1]
mov eax, r8d
mov dword [rsp + 0x128], eax
jmp 0x14004ba0f
mov eax, edx
mov dword [rsp + 0x128], edx
mov r8d, 1
cmp r12d, r8d
je 0x14004ba39
cmp ebp, edx
je 0x14004ba27
mov ebp, dword [rsp + 0x58]
cmp ebp, edx
je 0x14004ba2b
cmp r15, rdx
jne 0x14004ba3d
jmp 0x14004ba2b
mov ebp, dword [rsp + 0x58]
cmp r13d, edx
je 0x14004ba34
cmp ebp, edx
jne 0x14004ba3d
mov sil, dl
jmp 0x14004ba40
mov ebp, dword [rsp + 0x58]
mov sil, r8b
cmp eax, edx
je 0x14004ba92
cmp r14, rdx
je 0x14004ba92
mov qword [rsp + 0x120], r14
or dword [rsp + 0x78], 0xffffffff
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x120]
call fcn.140066e40
mov r11d, dword [rsp + 0x78]
lea ecx, [r11 - 1]
mov edx, dword [rsp + 0x100]
movzx edx, dl
movzx eax, r11b
cmp ecx, 0x12
cmovbe edx, eax
mov dword [rsp + 0x100], edx
xor edx, edx
lea r8d, [rdx + 1]
mov cl, byte [rsp + 0x4a]
cmp cl, r8b
jne 0x14004bb09
cmp byte [rsp + 0x49], dl
jne 0x14004bb09
movsx eax, byte [rsp + 0x4b]
movsx ecx, byte [0x14019c0cd]
movsx r9d, byte [0x14019c0cc]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r13d
mov r8d, dword [rsp + 0x138]
lea rdx, str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
lea rcx, [rsp + 0x180]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x180]
lea rdx, [0x14014b570]
mov rcx, qword [rsp + 0xa8]
call fcn.14002b694
mov cl, byte [rsp + 0x4a]
mov r8d, 1
mov al, byte [rsp + 0x4b]
xor edx, edx
cmp al, dl
jg 0x14004bb3c
mov r12b, byte [rsp + 0x48]
cmp r12b, dl
jne 0x14004bb8d
cmp al, dl
jl 0x14004bb7f
cmp byte [0x14019c0cc], dl
je 0x14004bb7f
cmp r13d, edx
jne 0x14004bb32
cmp ebp, edx
je 0x14004bb7f
cmp byte [0x14019c0cd], dl
jne 0x14004bb7f
jmp 0x14004bb41
mov r12b, byte [rsp + 0x48]
cmp cl, r8b
jne 0x14004bb61
lea r8, [0x14014f7a8]
lea rdx, [0x14014b558]
mov rcx, qword [rsp + 0xa8]
call fcn.14002b694
call fcn.14002c1fc
mov edx, 0x32
mov rcx, qword [rsp + 0xa8]
call fcn.14002bb1c
xor edx, edx
cmp r12b, dl
jne 0x14004bb8d
mov rax, qword [rsp + 0x40]
cmp word [rax], dx
je 0x14004ca17
lea rcx, [rsp + 0x98]
call fcn.140063500
nop
mov rcx, qword [rsp + 0x40]
call fcn.14002e004
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rdx, [rsp + 0x98]
mov rcx, rax
call fcn.14006f2b0
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9d, eax
cmp r12b, al
je 0x14004bbdb
mov eax, 0x20
test al, r12b
lea edx, [rax - 0x1e]
cmove r9d, edx
or r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x14019bfd8]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14004bc05
xor ecx, ecx
mov r12, rcx
cmp r13d, ecx
je 0x14004ca2f
jmp 0x14004bc07
xor ecx, ecx
mov al, byte [rsp + 0x48]
and al, 4
neg al
sbb ebp, ebp
neg ebp
mov eax, 1
add ebp, eax
cmp r13d, ecx
jne 0x14004bc2d
cmp sil, cl
jne 0x14004bc2d
mov r13d, ecx
mov dword [rsp + 0x78], ecx
jmp 0x14004bc34
mov r13d, eax
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x70]
call fcn.140063500
nop
xor esi, esi
mov word [rsp + 0x770], si
xor edx, edx
mov r8d, 0xfe
lea rcx, [rsp + 0x772]
call fcn.14010c6c0
mov word [rsp + 0x670], si
xor edx, edx
mov r8d, 0xfe
lea rcx, [rsp + 0x672]
call fcn.14010c6c0
lea eax, [rsi + 0x20]
mov dword [rsp + 0x620], eax
xor r9d, r9d
cmp byte [rsp + 0x49], r9b
jne 0x14004bff0
cmp r12, r9
je 0x14004bff7
mov r8, qword [rsp + 0x50]
mov eax, r8d
sub eax, dword [rsp + 0xc8]
cmp eax, 0x200000
jge 0x14004bffc
mov dil, byte [rsp + 0x5c]
mov r15, qword [rsp + 0xc8]
mov bl, byte [rsp + 0x48]
mov r14, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xa8]
lea r8, [rsp + 0x620]
mov edx, esi
mov rcx, r12
call qword [0x14019c000]
xor r9d, r9d
cmp eax, r9d
je 0x14004bfc9
cmp bl, r9b
je 0x14004bdd9
cmp qword [0x14019c0a8], r9
je 0x14004bd45
mov r8d, 0x80
lea rdx, [rsp + 0x770]
lea rcx, [rsp + 0x624]
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
mov rdx, qword [0x14019c0a8]
lea rcx, [rsp + 0x770]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r9d, r9d
cmp eax, r9d
jne 0x14004bfaf
mov eax, 2
test al, bl
je 0x14004bdd9
mov qword [rsp + 0x20], r9
lea r9d, [rax + 0x7e]
lea r8, [rsp + 0x670]
lea rdx, [rsp + 0x620]
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
xor r9d, r9d
cmp dil, r9b
je 0x14004bdb7
mov rax, qword [rsp + 0x70]
cmp word [rax], r9w
je 0x14004bd98
lea rdx, [0x140149368]
lea rcx, [rsp + 0x70]
call fcn.140063600
lea rdx, [rsp + 0x670]
lea rcx, [rsp + 0x70]
call fcn.140063600
mov r8, qword [rsp + 0x50]
xor r9d, r9d
jmp 0x14004bfb4
cmp r14, r9
je 0x14004bdd9
lea rdx, [rsp + 0x670]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor r9d, r9d
cmp eax, r9d
jne 0x14004bfa8
xor edx, edx
mov dword [rsp + 0xb8], edx
mov rax, qword [0x14019c020]
cmp rax, rdx
je 0x14004be22
lea ecx, [rdx + 0x20]
mov dword [rsp + 0x620], ecx
mov dword [rsp + 0x120], 0x400
xor r9d, r9d
mov r8d, dword [rsp + 0x634]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x120]
call rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov word [rcx + 2], dx
mov word [rcx], dx
mov eax, r15d
sub eax, ecx
add eax, 0x200000
mov r8d, 0x800
cmp eax, r8d
cmovg eax, r8d
mov r8d, 0x20
mov dword [rsp + 0x620], r8d
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, ebp
lea rdx, [rsp + 0x620]
mov rcx, r12
call qword [0x14019bfe0]
mov ecx, 0x20
mov dword [rsp + 0x620], ecx
xor r9d, r9d
cmp eax, r9d
je 0x14004bfa1
cmp dil, r9b
je 0x14004becd
mov rax, qword [rsp + 0x70]
cmp word [rax], r9w
je 0x14004beb1
lea rdx, [0x140149368]
lea rcx, [rsp + 0x70]
call fcn.140063600
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140063600
mov r8, qword [rsp + 0x50]
xor r9d, r9d
jmp 0x14004bfb4
mov r8d, 4
lea rdx, str.ACPI
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r9d, r9d
cmp eax, r9d
je 0x14004bf9a
lea r10d, [r9 + 1]
cmp byte [rsp + 0x4a], r10b
jne 0x14004bf1b
mov r9, qword [rsp + 0x50]
mov r8d, esi
mov rdx, qword [rsp + 0x168]
mov rcx, r13
call fcn.14002b694
xor r9d, r9d
lea r10d, [r9 + 1]
movzx ecx, r9w
mov edx, r9d
mov r8, qword [rsp + 0x50]
movzx eax, word [r8]
cmp ax, r9w
je 0x14004bf64
mov ebx, dword [rsp + 0x100]
mov r11d, 0x26
cmp ax, r11w
jne 0x14004bf4e
add edx, r10d
movsx eax, bl
cmp edx, eax
jge 0x14004bf60
add cx, r10w
movzx eax, cx
mov ax, word [r8 + rax*2]
cmp ax, r9w
jne 0x14004bf3e
mov bl, byte [rsp + 0x48]
mov word [r8 - 2], cx
movzx eax, cx
lea r8, [r8 + rax*2]
cmp word [r8], r9w
je 0x14004bf86
mov eax, 2
add r8, rax
cmp word [r8], r9w
jne 0x14004bf7b
jmp 0x14004bf8b
mov eax, 2
add r8, 4
mov qword [rsp + 0x50], r8
test al, bl
jne 0x14004bfce
jmp 0x14004bfb4
mov r8, qword [rsp + 0x50]
jmp 0x14004bfb4
mov r8, qword [rsp + 0x50]
jmp 0x14004bfb4
mov r8, qword [rsp + 0x50]
jmp 0x14004bfb4
mov r8, qword [rsp + 0x50]
inc esi
mov eax, r8d
sub eax, r15d
cmp eax, 0x200000
jl 0x14004bcd7
jmp 0x14004bfce
mov r8, qword [rsp + 0x50]
mov ebx, dword [rsp + 0xb0]
lea rdi, [0x14019cf50]
mov r14, qword [rsp + 0x130]
mov r13d, dword [rsp + 0x78]
mov r15, qword [rsp + 0x68]
jmp 0x14004bffc
mov r8, qword [rsp + 0x50]
jmp 0x14004bffc
mov r8, qword [rsp + 0x50]
cmp byte [rsp + 0x5c], r9b
jne 0x14004d29e
cmp r13d, r9d
je 0x14004c024
mov eax, 2
test byte [rsp + 0x48], al
je 0x14004c024
mov eax, 1
mov ebp, eax
mov dword [rsp + 0x78], eax
jmp 0x14004c08b
mov ebp, r9d
mov dword [rsp + 0x78], r9d
mov rax, qword [rsp + 0xe8]
cmp rax, r9
je 0x14004c08b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0xc8]
mov word [rdx], ax
lea rcx, [rdx + 2]
mov qword [rsp + 0x50], rcx
inc eax
movsxd rsi, eax
add rsi, rsi
mov r8, rsi
mov rdx, qword [rsp + 0xe8]
call fcn.14010cd30
mov r8, qword [rsp + 0x50]
add r8, rsi
xor r9d, r9d
mov word [r8], r9w
add r8, 2
mov word [r8 + 4], r9w
mov word [r8 + 2], r9w
mov word [r8 - 2], r9w
mov rcx, r12
call qword [0x14019bfe8]
xor eax, eax
cmp byte [rsp + 0x49], al
jne 0x14004c0bc
lea r8, [0x14014f7a8]
lea rdx, [0x140149368]
mov rcx, qword [rsp + 0xa8]
call fcn.14002b694
movsxd rsi, dword [rsp + 0x118]
mov rax, qword [rsp + 0x60]
lea rcx, [rax + rsi*2]
mov r8d, 8
lea rdx, [0x14014b540]
call fcn.14010cd30
xor ecx, ecx
cmp r13d, ecx
jne 0x14004cc91
cmp r12, rcx
je 0x14004cc5e
mov r13b, byte [rsp + 0x49]
cmp r13b, cl
jne 0x14004c12b
mov rbp, qword [rsp + 0xc8]
cmp word [rbp], cx
je 0x14004cb30
cmp dword [rsp + 0x11c], ecx
jne 0x14004ca57
cmp dword [rsp + 0x128], ecx
je 0x14004ca57
jmp 0x14004c133
mov rbp, qword [rsp + 0xc8]
mov qword [rsp + 0xf8], rcx
cmp r15, rcx
je 0x14004c199
cmp word [r15], cx
je 0x14004c199
mov rdx, r15
lea rcx, [rsp + 0xf8]
call fcn.140071480
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov eax, 0x5c
cmp word [r15 + rcx*2 - 2], ax
je 0x14004c188
lea rdx, [0x14013fc88]
lea rcx, [rsp + 0xf8]
call fcn.140063600
mov rax, qword [rsp + 0xf8]
mov qword [0x14019c0c0], rax
jmp 0x14004c1a0
mov rax, qword [0x14019c0c0]
mov cl, byte [0x14019c0cc]
xor r15d, r15d
cmp cl, r15b
je 0x14004c29b
mov r12d, dword [rsp + 0x58]
cmp r12d, r15d
je 0x14004c272
cmp rax, r15
jne 0x14004c26a
movdqu xmm0, xmmword [str._TEMP__]
movdqu xmmword [rsp + 0x648], xmm0
xor eax, eax
mov qword [rsp + 0x658], rax
mov qword [rsp + 0x660], rax
mov qword [rsp + 0x668], rax
lea rcx, [rsp + 0x108]
call fcn.140063500
nop
lea r14d, [r15 + 1]
mov byte [rsp + 0x20], r14b
xor r9d, r9d
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0x648]
mov rcx, qword [rsp + 0xa8]
call fcn.14006bc40
mov rdx, qword [rsp + 0x108]
mov qword [0x14019c0c0], rdx
lea rcx, [rsp + 0x90]
call fcn.14003e510
mov qword [0x14019c0c0], rax
lea rcx, [rsp + 0x108]
call fcn.14005b520
mov cl, byte [0x14019c0cc]
mov rax, qword [0x14019c0c0]
jmp 0x14004c278
mov r14d, 1
jmp 0x14004c278
mov r14d, 1
cmp cl, r15b
je 0x14004c2a0
cmp r13b, r15b
jne 0x14004c2a0
cmp rax, r15
je 0x14004c2a0
mov cl, byte [0x14019c0cd]
cmp cl, r15b
cmove r12d, r14d
mov dword [rsp + 0x58], r12d
jmp 0x14004c2a6
mov r12d, dword [rsp + 0x58]
mov cl, byte [0x14019c0cd]
cmp byte [rsp + 0x4f], r15b
cmovne rax, r15
mov qword [0x14019c0c0], rax
cmp cl, r15b
je 0x14004c2d1
cmp rax, r15
je 0x14004c2d1
cmp qword [rsp + 0x80], r15
cmovne r12d, r15d
mov dword [rsp + 0x58], r12d
neg rax
sbb r14d, r14d
not r14d
and r14d, 3
mov rax, qword [rsp + 0x60]
lea rcx, [rax + rsi*2]
mov r8d, 0xa
lea rdx, str.INF_
call fcn.14010cd30
mov edx, 0x1040
lea rcx, [rsp + 0x110]
call fcn.140063580
nop
mov dword [rsp + 0x3d0], r15d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x3d4]
call fcn.14010c6c0
mov qword [rsp + 0xc0], r15
lea r8, [rsp + 0x3d0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.1400cf3b0
cmp qword [rsp + 0xc0], r15
je 0x14004cc0a
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.140071240
nop
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x40]
call fcn.14007ab70
lea rdx, [0x14013fc88]
lea rcx, [rsp + 0xe0]
call fcn.140063600
lea rdx, str.DefaultInstall_132
lea rcx, [rsp + 0xd8]
call fcn.140071240
nop
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
mov rcx, qword [rsp + 0xe0]
xor esi, esi
mov word [rcx + rdi*2], si
cmp r12d, esi
jne 0x14004c3e7
cmp r13b, sil
jne 0x14004c3e7
lea r13d, [rsi + 1]
jmp 0x14004c3ea
mov r13d, esi
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x110]
call fcn.14002c398
test byte [rsp + 0x3d0], 0x10
jne 0x14004c71e
mov rax, qword [rsp + 0xe0]
mov word [rax + rdi*2], si
lea rdx, [rsp + 0x3fc]
lea rcx, [rsp + 0xe0]
call fcn.140063600
mov r9, rbp
lea r8, [0x14003e2ec]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [0x14019c008]
cmp r12d, esi
je 0x14004c589
mov rbp, qword [rsp + 0x110]
mov bl, byte [rsp + 0x4a]
cmp rbp, qword [0x14019c028]
jae 0x14004c56b
mov rcx, rbp
call fcn.14010d9c8
mov ecx, 1
add eax, ecx
lea r12, [rbp + rax*2]
cmp bl, cl
jle 0x14004c49b
or edx, 0xffffffff
mov rcx, rbp
call fcn.14002bdbc
cmp rax, rsi
jne 0x14004c558
mov ecx, 1
mov esi, 4
mov al, byte [0x14019c0cc]
cmp al, 3
jne 0x14004c4d5
or esi, ecx
cmp al, 3
jne 0x14004c4be
mov rdx, rbp
mov rcx, r12
call fcn.14002c0b8
mov r13d, eax
xor eax, eax
cmp r13d, eax
je 0x14004c54a
mov eax, 2
test al, sil
jne 0x14004c50c
jmp 0x14004c4da
mov eax, 2
or esi, eax
mov r8d, r14d
mov rdx, r12
mov rcx, rbp
call fcn.14002be7c
mov r13d, eax
xor eax, eax
cmp r13d, eax
je 0x14004c552
lea ecx, [rax + 1]
test cl, sil
jne 0x14004c504
mov al, byte [0x14019c0cc]
jmp 0x14004c4aa
test sil, 4
jne 0x14004c54e
jmp 0x14004c512
test sil, 4
jne 0x14004c556
mov rax, qword [rsp + 0xd8]
xor esi, esi
mov word [rax + r15*2], si
mov rdx, r12
lea rcx, [rsp + 0xd8]
call fcn.140063600
mov r9d, 0x100000
mov r8, qword [rsp + 0xd8]
xor edx, edx
xor ecx, ecx
call fcn.14002c278
jmp 0x14004c558
xor esi, esi
jmp 0x14004c558
xor esi, esi
jmp 0x14004c558
xor esi, esi
jmp 0x14004c558
xor esi, esi
mov rcx, r12
call fcn.14010d9c8
inc eax
lea rbp, [r12 + rax*2]
jmp 0x14004c45d
mov r12d, dword [rsp + 0x58]
cmp r12d, esi
mov rbx, qword [rsp + 0x80]
jne 0x14004c71e
mov rbp, qword [rsp + 0xc8]
cmp byte [0x14019c0cd], sil
je 0x14004c71e
cmp rbx, rsi
je 0x14004c71e
mov rdx, qword [0x14019c0c0]
cmp rdx, rsi
je 0x14004c71e
lea rcx, [rsp + 0xa0]
call fcn.140071240
nop
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.140063600
mov r8, qword [rsp + 0xa0]
lea rdx, [0x14014b4d8]
mov rcx, qword [rsp + 0xa8]
call fcn.14002b694
mov rdx, qword [rsp + 0xa0]
mov rcx, rbp
call fcn.14003db88
mov rbp, rax
lea r12, [0x14014f7a8]
cmp rax, rsi
cmovne r12, rax
mov esi, 4
cmp byte [0x14019c0cc], 3
jne 0x14004c662
lea ecx, [rsi - 2]
mov eax, 1
or esi, eax
cmp byte [0x14019c0cc], 3
jne 0x14004c646
mov rdx, r12
mov rcx, qword [rsp + 0xa0]
call fcn.14002c0b8
mov r13d, eax
mov eax, 1
lea ecx, [rax + 1]
add esi, eax
cmp esi, ecx
jge 0x14004c6f1
xor eax, eax
cmp r13d, eax
je 0x14004c6ed
test cl, sil
jne 0x14004c6aa
jmp 0x14004c667
xor eax, eax
lea ecx, [rax + 2]
or esi, ecx
cmp rbp, rax
je 0x14004c689
mov r8d, r14d
mov rdx, qword [rsp + 0xa0]
mov rcx, rbp
call fcn.14002be7c
mov r13d, eax
xor eax, eax
lea ecx, [rax + 2]
inc esi
cmp esi, ecx
jge 0x14004c6f9
cmp rbp, rax
je 0x14004c699
cmp r13d, eax
je 0x14004c6f5
test cl, sil
je 0x14004c61b
test sil, 4
jne 0x14004c6fd
jmp 0x14004c6b0
test sil, 4
jne 0x14004c701
mov rax, qword [rsp + 0xd8]
xor esi, esi
mov word [rax + r15*2], si
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0xd8]
call fcn.140063600
mov r9d, 0x100000
mov r8, qword [rsp + 0xd8]
xor edx, edx
xor ecx, ecx
call fcn.14002c278
jmp 0x14004c703
xor esi, esi
jmp 0x14004c703
xor esi, esi
jmp 0x14004c703
xor esi, esi
jmp 0x14004c703
xor esi, esi
jmp 0x14004c703
xor esi, esi
jmp 0x14004c703
xor esi, esi
cmp rbp, rsi
je 0x14004c70c
mov word [rbp], si
lea rcx, [rsp + 0xa0]
call fcn.14005b520
mov r12d, dword [rsp + 0x58]
lea rdx, [rsp + 0x3d0]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
mov rbp, qword [rsp + 0xc8]
jne 0x14004c3f2
mov rcx, qword [rsp + 0xc0]
xor r15d, r15d
cmp rcx, r15
mov ebx, dword [rsp + 0xb0]
lea rdi, [0x14019cf50]
je 0x14004c76e
cmp rcx, 0xffffffffffffffff
je 0x14004c76e
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0xc0], r15
mov ecx, 0x5f
mov rax, qword [rsp + 0xd0]
mov word [rax], cx
mov esi, dword [rsp + 0x12c]
cmp r13d, r15d
cmove esi, r15d
mov dword [rsp + 0x12c], esi
cmp r12d, r15d
je 0x14004cb63
cmp qword [0x14019c0c0], r15
je 0x14004cb63
lea r13d, [rcx - 0x5e]
cmp byte [0x14019c0cc], r13b
jne 0x14004cb63
cmp byte [rsp + 0x4f], r15b
jne 0x14004cb63
cmp qword [rsp + 0x80], r15
jne 0x14004cb63
mov qword [0x14019c0c0], r15
mov byte [rsp + 0x4f], r13b
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xc0]
cmp rcx, r15
je 0x14004c81c
cmp rcx, 0xffffffffffffffff
je 0x14004c81c
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0xc0], r15
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
mov al, byte [rsp + 0x4a]
mov r12, qword [rsp + 0x160]
mov ebp, 2
jmp 0x14004addd
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14002c310
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x90]
call fcn.14004a938
nop
lea rcx, [rsp + 0x90]
call fcn.14005b520
nop
xor eax, eax
cmp ebx, eax
jle 0x14004c8dd
xor edx, edx
mov ecx, ebx
call fcn.1400613a0
nop
mov esi, 0x80070057
jmp 0x14004d354
movsx edx, sil
and edx, r9d
shr edx, 1
xor ecx, ecx
call fcn.1400613a0
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14002c310
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x90]
call fcn.14004a938
nop
lea rcx, [rsp + 0x90]
call fcn.14005b520
nop
xor esi, esi
cmp ebx, esi
jle 0x14004c959
xor edx, edx
mov ecx, ebx
call fcn.1400613a0
nop
jmp 0x14004d354
mov esi, 0x80070057
xor r15d, r15d
jmp 0x14004d2e4
mov qword [rsp + 0x108], r8
or r9d, 0xffffffff
or r8d, r9d
mov rdx, rbp
lea rcx, [rsp + 0x108]
call fcn.140063440
nop
movsx ecx, r12b
mov r8d, 0x100
mov rdx, qword [rsp + 0x108]
call fcn.14005ca10
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14002c310
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x90]
call fcn.14004a938
nop
lea rcx, [rsp + 0x90]
call fcn.14005b520
nop
xor esi, esi
cmp ebx, esi
jle 0x14004ca12
xor edx, edx
mov ecx, ebx
call fcn.1400613a0
nop
jmp 0x14004d354
xor r15d, r15d
mov esi, r15d
lea rcx, [rsp + 0x88]
call fcn.14005b520
jmp 0x14004d2e4
mov esi, 1
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
xor r15d, r15d
jmp 0x14004d2e4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
sub eax, r9d
cmp eax, r9d
jl 0x14004caa0
movsxd rcx, eax
mov rdx, qword [rsp + 0x40]
lea r8d, [r9 + 0x5b]
cmp r8w, word [rdx + rcx*2]
je 0x14004ca8e
lea r8d, [r9 + 0x2e]
cmp r8w, word [rdx + rcx*2]
jne 0x14004ca9b
xor r15d, r15d
mov word [rdx + rcx*2], r15w
sub eax, r9d
jmp 0x14004caa3
xor r15d, r15d
jmp 0x14004caa3
xor r15d, r15d
cmp eax, r15d
jge 0x14004cad8
mov esi, 0x80070057
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
jmp 0x14004d2e4
cmp r14, r15
je 0x14004caea
movzx eax, word [r14]
neg ax
sbb rcx, rcx
and r14, rcx
mov r9b, byte [rsp + 0x4e]
or r9b, 0x10
mov r8, r14
mov rdx, rbp
mov rcx, qword [rsp + 0x40]
call fcn.14003de9c
mov esi, eax
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
jmp 0x14004d2e4
mov esi, 0x491
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
xor r15d, r15d
jmp 0x14004d2e4
mov qword [0x14019c0c0], r15
lea r8, [0x14014f7a8]
lea rdx, [0x140149368]
mov rcx, qword [rsp + 0xa8]
call fcn.14002b694
nop
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xc0]
cmp rcx, r15
je 0x14004cbbb
cmp rcx, 0xffffffffffffffff
je 0x14004cbbb
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0xc0], r15
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
jmp 0x14004d2e4
mov esi, 2
mov qword [rsp + 0xc0], r15
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
jmp 0x14004d2e4
mov esi, 1
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
xor r15d, r15d
jmp 0x14004d2e4
mov r12d, ecx
mov r13d, dword [rsp + 0x58]
cmp r13d, ecx
jne 0x14004cd51
mov rax, qword [rsp + 0xc8]
cmp word [rax], cx
jne 0x14004cd51
cmp byte [0x14019c0cd], cl
jne 0x14004cd51
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14002c310
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x90]
call fcn.14004a938
nop
lea rcx, [rsp + 0x90]
call fcn.14005b520
nop
xor eax, eax
cmp ebx, eax
jle 0x14004cd47
xor edx, edx
mov ecx, ebx
call fcn.1400613a0
nop
mov esi, 0x491
jmp 0x14004d354
movsxd rsi, dword [rsp + 0x118]
lea r15d, [rsi + 4]
lea edx, [r15 + 0x3c]
lea rcx, [rsp + 0xa0]
call fcn.140063580
nop
mov rax, qword [rsp + 0x60]
lea rcx, [rax + rsi*2]
mov r8d, 0x22
lea rdx, str.System32DRIVERS
call fcn.14010cd30
mov rcx, qword [rsp + 0x60]
call fcn.1400cf330
test eax, eax
jne 0x14004cda5
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x60]
lea rcx, [rax + rsi*2]
mov r8d, 8
lea rdx, [0x14014b540]
call fcn.14010cd30
mov rcx, qword [rsp + 0x60]
call fcn.1400cf330
test eax, eax
jne 0x14004cddb
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x60]
lea rcx, [rax + rsi*2]
mov r8d, 0xa
lea rdx, str.INF_
call fcn.14010cd30
xor esi, esi
mov dword [rsp + 0x180], esi
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x184]
call fcn.14010c6c0
mov qword [rsp + 0x80], rsi
lea r8, [rsp + 0x180]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.1400cf3b0
cmp qword [rsp + 0x80], rsi
jne 0x14004ce89
mov esi, 2
xor r15d, r15d
mov qword [rsp + 0x80], r15
lea rcx, [rsp + 0xa0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
jmp 0x14004d2e4
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140071240
nop
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call fcn.14007ab70
lea rdx, [0x14013fc88]
lea rcx, [rsp + 0x50]
call fcn.140063600
mov rsi, qword [rsp + 0x68]
xor eax, eax
cmp rsi, rax
je 0x14004ceca
cmp word [rsi], ax
jne 0x14004ced1
lea rsi, [0x14014b4a8]
cmp r14, rax
je 0x14004cedc
cmp word [r14], ax
jne 0x14004cee3
lea r14, str.DefaultInstall
mov rdx, r14
lea rcx, [rsp + 0xb8]
call fcn.140071240
nop
lea rdx, [0x140146d20]
lea rcx, [rsp + 0xb8]
call fcn.140063600
mov rdx, rsi
lea rcx, [rsp + 0xb8]
call fcn.140063600
lea rdx, [0x140146d20]
lea rcx, [rsp + 0xb8]
call fcn.140063600
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x120], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
movsxd rdi, dword [rsp + 0x120]
xor esi, esi
test byte [rsp + 0x180], 0x10
jne 0x14004d198
mov rcx, qword [rsp + 0x50]
mov word [rcx + rbx*2], si
lea rdx, [rsp + 0x1ac]
lea rcx, [rsp + 0x50]
call fcn.140063600
mov r14, qword [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.140063500
nop
xor ecx, ecx
mov qword [rsp + 0x130], rcx
mov rax, qword [rsp + 0xa0]
mov word [rax], cx
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.14006f2b0
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x68]
sub rcx, rdx
sar rcx, 1
movsxd rax, r15d
cmp rax, rcx
jne 0x14004cffa
mov r8d, r15d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
movzx esi, sil
xor edx, edx
cmp eax, edx
lea eax, [rdx + 1]
cmove esi, eax
jmp 0x14004cffc
xor edx, edx
cmp ebp, edx
je 0x14004d012
mov rax, qword [rsp + 0xe8]
cmp rax, rdx
je 0x14004d012
mov rbp, rax
jmp 0x14004d029
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc8]
call fcn.14003db88
mov rbp, rax
xor edx, edx
cmp byte [0x14019c0cd], dl
jne 0x14004d057
cmp r13d, edx
jne 0x14004d072
cmp byte [rsp + 0x4d], dl
je 0x14004d041
cmp sil, dl
jne 0x14004d072
cmp rbp, rdx
jne 0x14004d072
lea rcx, [rsp + 0x68]
call fcn.14005b520
xor esi, esi
jmp 0x14004d198
mov r8, qword [rsp + 0x50]
lea rdx, [0x14014b4d8]
mov rcx, qword [rsp + 0xa8]
call fcn.14002b694
xor edx, edx
lea r13, [0x14014f7a8]
cmp rbp, rdx
cmovne r13, rbp
mov esi, 4
cmp dword [rsp + 0x58], edx
jne 0x14004d106
cmp byte [0x14019c0cc], 3
jne 0x14004d0c9
lea eax, [rsi - 3]
or esi, eax
cmp byte [0x14019c0cc], 3
jne 0x14004d0b4
mov rdx, r13
mov rcx, qword [rsp + 0x50]
call fcn.14002c0b8
mov r12d, eax
xor edx, edx
cmp r12d, edx
je 0x14004d15e
mov eax, 2
test al, sil
jne 0x14004d100
jmp 0x14004d0ce
mov eax, 2
or esi, eax
cmp rbp, rdx
je 0x14004d0ee
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, rbp
call fcn.14002be7c
mov r12d, eax
xor edx, edx
cmp eax, edx
je 0x14004d162
mov eax, 1
test al, sil
je 0x14004d097
test sil, 4
jne 0x14004d15a
jmp 0x14004d106
test sil, 4
jne 0x14004d16a
cmp byte [0x14019c056], dl
jne 0x14004d166
mov rax, qword [rsp + 0xb8]
mov word [rax + rdi*2], dx
mov rdx, r14
lea rcx, [rsp + 0xb8]
call fcn.140063600
xor r9d, r9d
mov r8, qword [rsp + 0xb8]
xor edx, edx
xor ecx, ecx
call fcn.14002c278
mov r12d, eax
xor esi, esi
cmp eax, esi
jne 0x14004d16c
cmp qword [0x14019c0a0], rsi
je 0x14004d16c
mov rcx, r13
call fcn.14002bdec
jmp 0x14004d16c
xor esi, esi
jmp 0x14004d16c
xor esi, esi
jmp 0x14004d16c
xor esi, esi
jmp 0x14004d16c
xor esi, esi
jmp 0x14004d16c
xor esi, esi
cmp rbp, rsi
je 0x14004d175
mov word [rbp], si
mov rcx, qword [rsp + 0xa0]
cmp word [rcx], si
je 0x14004d189
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
mov r13d, dword [rsp + 0x58]
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
mov ebp, dword [rsp + 0x78]
jne 0x14004cf59
lea rcx, [rsp + 0xb8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
mov ebx, dword [rsp + 0xb0]
lea rdi, [0x14019cf50]
je 0x14004d1fa
cmp rcx, 0xffffffffffffffff
je 0x14004d1fa
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x80], rsi
lea rcx, [rsp + 0xa0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14002c310
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x90]
call fcn.14004a938
nop
lea rcx, [rsp + 0x90]
call fcn.14005b520
nop
cmp ebx, esi
jle 0x14004d296
xor edx, edx
mov ecx, ebx
call fcn.1400613a0
nop
mov esi, r12d
jmp 0x14004d354
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0xa8]
call fcn.140061290
xor r15d, r15d
mov esi, r15d
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.14009aae0
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14002c310
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x90]
call fcn.14004a938
nop
lea rcx, [rsp + 0x90]
call fcn.14005b520
nop
cmp ebx, r15d
jle 0x14004d354
xor edx, edx
mov ecx, ebx
call fcn.1400613a0
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0xae0]
add rsp, 0xa90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret