Function at 0x1400094d0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rdx, str.advapi32.dll
add rcx, 0x90
call fcn.140009ca0
nop
lea rsi, [rdi + 0x98]
lea rdx, str.setupapi.dll
mov rcx, rsi
call fcn.140009ca0
nop
lea rdx, str.newdev.dll
lea rcx, [rdi + 0xa0]
call fcn.140009ca0
nop
lea rdx, str.cfgmgr32.dll
lea rcx, [rdi + 0xa8]
call fcn.140009ca0
nop
lea rdx, str.printui.dll
lea rcx, [rdi + 0xb0]
call fcn.140009ca0
nop
mov qword [rbp - 0x10], 0xf
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
lea r8d, [rbx + 0x10]
lea rdx, str.OpenProcessToken
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0x90]
test rcx, rcx
je 0x1400095ac
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400095af
mov rax, rbx
mov qword [rdi + 8], rax
cmp qword [rbp - 0x10], 0x10
jb 0x1400095c3
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x13
lea rdx, str.GetTokenInformation
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0x90]
test rcx, rcx
je 0x14000960a
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000960d
mov rax, rbx
mov qword [rdi], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009620
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x34
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0x90]
test rcx, rcx
je 0x140009667
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000966a
mov rax, rbx
mov qword [rdi + 0x10], rax
cmp qword [rbp - 0x10], 0x10
jb 0x14000967e
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x13
lea rdx, str.SetupDiGetINFClassW
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400096c1
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400096c4
mov rax, rbx
mov qword [rdi + 0x18], rax
cmp qword [rbp - 0x10], 0x10
jb 0x1400096d8
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x1b
lea rdx, str.SetupDiCreateDeviceInfoList
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000971b
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000971e
mov rax, rbx
mov qword [rdi + 0x20], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009732
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x18
lea rdx, str.SetupDiCreateDeviceInfoW
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009775
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140009778
mov rax, rbx
mov qword [rdi + 0x28], rax
cmp qword [rbp - 0x10], 0x10
jb 0x14000978c
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x21
lea rdx, str.SetupDiSetDeviceRegistryPropertyW
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400097cf
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400097d2
mov rax, rbx
mov qword [rdi + 0x30], rax
cmp qword [rbp - 0x10], 0x10
jb 0x1400097e6
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x19
lea rdx, [0x140037f10]
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009829
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000982c
mov rax, rbx
mov qword [rdi + 0x38], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009840
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x16
lea rdx, [0x140037f30]
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009883
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140009886
mov rax, rbx
mov qword [rdi + 0x40], rax
cmp qword [rbp - 0x10], 0x10
jb 0x14000989a
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x15
lea rdx, [0x140037f48]
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400098dd
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400098e0
mov rax, rbx
mov qword [rdi + 0x48], rax
cmp qword [rbp - 0x10], 0x10
jb 0x1400098f4
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x1f
lea rdx, [0x140037f60]
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009937
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000993a
mov rax, rbx
mov qword [rdi + 0x50], rax
cmp qword [rbp - 0x10], 0x10
jb 0x14000994e
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x21
lea rdx, [0x140037f80]
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009991
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140009994
mov rax, rbx
mov qword [rdi + 0x58], rax
cmp qword [rbp - 0x10], 0x10
jb 0x1400099a8
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x1d
lea rdx, [0x140037fa8]
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400099eb
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400099ee
mov rax, rbx
mov qword [rdi + 0x60], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009a02
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x22
lea rdx, str.UpdateDriverForPlugAndPlayDevicesW
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0xa0]
test rcx, rcx
je 0x140009a49
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140009a4c
mov rax, rbx
mov qword [rdi + 0x68], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009a60
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x14
lea rdx, [0x140037ff0]
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x140009aa7
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140009aaa
mov rax, rbx
mov qword [rdi + 0x70], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009abe
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x15
lea rdx, str.CM_Locate_DevNode_ExW
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x140009b05
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140009b08
mov rax, rbx
mov qword [rdi + 0x78], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009b1c
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0x19
lea rdx, str.CM_Reenumerate_DevNode_Ex
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x140009b63
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140009b66
mov rax, rbx
mov qword [rdi + 0x80], rax
cmp qword [rbp - 0x10], 0x10
jb 0x140009b7d
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
mov r8d, 0xd
lea rdx, str.PrintUIEntryW
lea rcx, [rbp - 0x28]
call fcn.140001e60
mov rcx, qword [rdi + 0xb0]
test rcx, rcx
je 0x140009bc5
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rdi + 0x88], rbx
cmp qword [rbp - 0x10], 0x10
jb 0x140009bdd
mov rcx, qword [rbp - 0x28]
call fcn.140018ca8
nop
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret