Function at 0x100008630
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xac8
mov rax, qword [0x100019110]
xor rax, rsp
mov qword [rsp + 0xab0], rax
or qword [rsp + 0x78], 0xffffffffffffffff
xor edi, edi
mov r15d, r9d
mov ebx, edi
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov dword [rsp + 0x84], edi
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], edi
call qword [sym.imp.SETUPAPI.dll_SetupGetThreadLogToken]
lea r8, [rsp + 0x920]
mov r9d, 0xc8
mov rdx, rsi
mov rcx, rbp
mov byte [rsp + 0x49], dil
mov r13, rax
mov byte [rsp + 0x48], dil
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x4c], edi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
cmp eax, edi
jne 0x1000086e5
mov word [rsp + 0x920], di
mov rdx, rsi
mov rcx, rbp
call fcn.10000c028
mov ecx, 1
mov r12d, 0x1000000
cmp eax, edi
jne 0x100008856
mov edx, ecx
lea r8, [0x100002780]
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateMutexW]
mov rdi, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x100008751
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
lea r9, [0x1000027f8]
mov edi, eax
mov r14d, 1
mov edx, r12d
mov rcx, r13
mov r8d, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
jmp 0x100008a58
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0xb7
jne 0x100008854
movabs rdx, 0x1000000000000002
cmp dword [0x10001979c], ebx
je 0x1000087b9
mov al, byte [0x1000197a0]
cmp al, 4
jae 0x100008782
test al, al
jne 0x1000087b9
test qword [0x100019788], rdx
je 0x1000087b9
mov rcx, qword [0x100019790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000087b9
mov rcx, qword [0x100019770]
lea rdx, [0x100001920]
call fcn.100006d54
jmp 0x1000087b9
cmp eax, 0x80
je 0x1000087f4
lea r9, [0x100002828]
mov r8d, 0x10004
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
xor r8d, r8d
mov edx, 0xea60
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x1000087b2
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
xor edi, edi
cmp dword [0x10001979c], edi
je 0x100008856
mov al, byte [0x1000197a0]
cmp al, 4
jae 0x10000881a
cmp al, dil
jne 0x100008856
movabs rdx, 0x1000000000000002
test qword [0x100019788], rdx
je 0x100008856
mov rcx, qword [0x100019790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100008856
mov rcx, qword [0x100019770]
lea rdx, [0x100001930]
call fcn.100006d54
jmp 0x100008856
xor edi, edi
lea r9, [0x100002860]
mov r8d, 0x30004
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp dword [0x10001979c], edi
je 0x1000088be
mov al, byte [0x1000197a0]
cmp al, 4
jae 0x100008886
cmp al, dil
jne 0x1000088be
movabs rdx, 0x1001000000000001
test qword [0x100019788], rdx
je 0x1000088be
mov rcx, qword [0x100019790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000088be
mov rcx, qword [0x100019770]
lea rdx, [0x100001900]
call fcn.100006d54
lea rcx, [0x1000022f8]
mov edx, 0x20800
mov r8d, 1
call sub.ntdll.dll_WinSqmStartSession
mov rdx, rsi
mov rcx, rbp
mov qword [0x1000197c0], rax
call fcn.100007354
mov r8d, r15d
mov rdx, rsi
mov rcx, rbp
call fcn.100006e60
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 1]
mov rcx, rbp
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp rax, 0xffffffffffffffff
je 0x10000892f
mov rcx, rax
mov dword [rsp + 0x6c], 1
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov r9d, r15d
mov r8, rsi
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.10000d648
cmp eax, edi
jne 0x100008b7c
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
cmp eax, 0xe0000248
jne 0x1000089d8
cmp dword [0x10001979c], ebx
je 0x1000089b7
mov al, byte [0x1000197a0]
cmp al, 4
jae 0x100008977
test al, al
jne 0x1000089b7
movabs rdx, 0x8000000000000000
test qword [0x100019788], rdx
je 0x1000089b7
mov rcx, qword [0x100019790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000089b7
mov rcx, qword [0x100019770]
lea r8, [rsp + 0x920]
lea rdx, [0x1000018b0]
call fcn.100006ce8
mov r14d, 1
lea r9, [0x100002878]
mov edx, r12d
mov r8d, r14d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
jmp 0x100008a58
cmp eax, 0xe0000203
jne 0x100008b70
cmp dword [0x10001979c], ebx
je 0x100008a39
mov al, byte [0x1000197a0]
cmp al, 4
jae 0x1000089f9
test al, al
jne 0x100008a39
movabs rdx, 0x8000000000000000
test qword [0x100019788], rdx
je 0x100008a39
mov rcx, qword [0x100019790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100008a39
mov rcx, qword [0x100019770]
lea r8, [rsp + 0x920]
lea rdx, [0x1000018c0]
call fcn.100006ce8
lea r9, [0x1000028b0]
mov r8d, 2
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r14d, 1
lea r9, [0x100002bf0]
mov r8d, 4
mov edx, r12d
mov rcx, r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
lea r9, [0x100002c10]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
lea rcx, [0x100002478]
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetModuleHandleW]
lea rdx, [0x100002550]
mov rcx, rax
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetProcAddress]
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x100008ac1
mov rcx, rax
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
test rbx, rbx
je 0x100008acf
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupTermDefaultQueueCallback]
mov rbx, qword [rsp + 0x78]
cmp rbx, 0xffffffffffffffff
je 0x100008b3d
test edi, edi
je 0x100008aec
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupUninstallNewlyCopiedInfs]
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0xb0], 0x248
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x100008b34
and dword [rsp + 0xb4], 0xfffffff7
or qword [rsp + 0xd8], 0xffffffffffffffff
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupCloseFileQueue]
mov eax, dword [rsp + 0x6c]
mov r9d, dword [rsp + 0x54]
xor ebx, ebx
mov dword [rsp + 0x28], edi
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x84], ebx
je 0x100009565
lea r8, [rsp + 0x300]
jmp 0x100009568
lea r9, [0x1000028f8]
jmp 0x100008733
lea rcx, [rsp + 0x300]
xor edx, edx
mov r8d, 0x620
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x300]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x300], 0x620
call qword [sym.imp.SETUPAPI.dll_SetupDiGetSelectedDriverW]
mov dword [rsp + 0x84], eax
cmp eax, edi
jne 0x100008c13
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
cmp eax, 0xe0000203
jne 0x100008a52
bt r15d, 9
jb 0x100008be6
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call sub.SETUPAPI.dll_SetupDiReportDriverNotFoundError
mov r9d, r15d
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call fcn.10000b184
test eax, eax
jne 0x100008a52
test r15b, 0x20
je 0x100008a52
mov r14d, ebx
xor edi, edi
jmp 0x100009376
mov rdx, rsi
mov rcx, rbp
call fcn.10000bc78
cmp eax, edi
jne 0x100008c3d
lea r9, [0x100002930]
mov edx, 0x800000
mov r8d, 2
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
test r15b, 1
jne 0x100008c64
lea r8, [rsp + 0x300]
mov rdx, rsi
mov rcx, rbp
call fcn.10000b9b8
cmp eax, edi
je 0x100008c64
mov edi, 0x5b3
jmp 0x100008a52
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
lea r8, [rsp + 0x300]
mov rdx, rsi
mov rcx, rbp
call fcn.100007fa4
mov edi, eax
test eax, eax
jne 0x100008a52
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
lea ecx, [rdi + 0x18]
mov r8, rsi
mov rdx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
jne 0x100008cc1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
cmp eax, 0xe000020e
jne 0x100008a52
mov rdx, rsi
mov rcx, rbp
call fcn.100007c50
test eax, eax
jne 0x100008cd4
or r15d, 4
test r15b, 4
jne 0x100008d83
and dword [rsp + 0x38], ebx
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], ebx
and qword [rsp + 0x20], rbx
lea r8, [0x100002248]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
jne 0x100008d83
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x100008d83
cmp dword [rsp + 0x50], 0x12
jne 0x100008d83
mov edx, dword [rsp + 0x68]
lea ecx, [rax - 0x3a]
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x100008d83
mov ecx, dword [rsp + 0x68]
and dword [rsp + 0x38], ebx
and qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ecx
lea r9, [rsp + 0x50]
lea r8, [0x100002248]
mov rcx, rbp
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
jne 0x100008d83
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
and qword [rsp + 0x90], rbx
and qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x60]
lea rcx, [0x100003cc0]
call sub.API_MS_Win_Security_SDDL_L1_1_0.dll_ConvertStringSidToSidW
test eax, eax
je 0x100008e35
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_IsValidSid]
test eax, eax
je 0x100008dbf
mov rdx, qword [rsp + 0x60]
mov rcx, r14
call fcn.10000cfb4
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x100008dcf
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
test ebx, ebx
je 0x100008e3a
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
lea rdx, [0x100003a50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100008e3a
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x100008e14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea r9, [0x100002970]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r14d, 1
jmp 0x100008e3f
mov r14d, ebx
jmp 0x100008e3f
mov r14d, dword [rsp + 0x58]
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
lea r8, [0x100002218]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
je 0x100008e7f
cmp dword [rsp + 0x50], 7
je 0x100008e84
and dword [rsp + 0x4c], 0
mov rdx, qword [rsi + 4]
lea rcx, [0x1000020c0]
mov edi, 8
cmp rdx, qword [rcx]
jne 0x100008ea8
mov rdx, qword [rsi + rdi + 4]
cmp rdx, qword [rcx + rdi]
jne 0x100008ea8
xor eax, eax
jmp 0x100008ead
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100008f81
call qword [sym.imp.SETUPAPI.dll_SetupOpenFileQueue]
mov rbx, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x100008ed9
mov rbx, qword [rsp + 0x40]
mov r14d, 1
jmp 0x100008a58
test r14d, r14d
jne 0x100008eeb
test byte [rsp + 0x4c], 2
jne 0x100008eeb
test r15b, 0x40
je 0x100008f20
lea r9, [0x1000029b0]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r8d, edi
mov edx, edi
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupSetFileQueueFlags]
test eax, eax
jne 0x100008f20
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x100008ec9
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x248
call sub.msvcrt.dll_memset
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0xb0], 0x248
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x100008f16
or dword [rsp + 0xb4], edi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0xd8], rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
test eax, eax
jne 0x100008faf
jmp 0x100008f16
test r15b, 0x40
je 0x100008faa
lea r9, [0x1000029e0]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov edi, 0x57
jmp 0x100008ec9
mov rbx, qword [rsp + 0x78]
lea r9, [0x100002a00]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
mov r8, rsi
mov rdx, rbp
mov ecx, 0x15
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x100008f16
cmp rbx, 0xffffffffffffffff
je 0x100009137
lea r9, [0x100002a18]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rcx, qword [rsp + 0x78]
mov ebx, r15d
and ebx, edi
mov eax, ebx
neg eax
lea rax, [rsp + 0x80]
sbb edx, edx
mov qword [rsp + 0x28], rax
xor edi, edi
and edx, 0xfffff9e1
xor r9d, r9d
xor r8d, r8d
add edx, 0x620
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupScanFileQueueW]
cmp ebx, edi
je 0x100009065
cmp dword [rsp + 0x80], 1
je 0x100009065
mov edi, 5
jmp 0x100008ec9
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupInitDefaultQueueCallbackEx]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, rdi
jne 0x100009096
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x100008ece
lea r9, [0x100002a30]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r9, rbx
mov rbx, qword [rsp + 0x78]
lea r8, [0x100008280]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupCommitFileQueueW]
cmp eax, edi
je 0x100008f16
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call qword [sym.imp.SETUPAPI.dll_SetupPromptReboot]
mov ecx, edi
mov dword [rsp + 0x30], edi
cmp eax, edi
mov eax, 1
lea r8, [0x100002260]
cmovne ecx, eax
mov rdx, rsi
mov dword [rsp + 0x54], ecx
mov rcx, qword [rsp + 0x90]
cmp rcx, rdi
je 0x100009129
mov eax, dword [rsp + 0x68]
mov r9d, 0x12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDevicePropertyW]
jmp 0x100009139
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
jmp 0x10000911e
xor edi, edi
test r15b, 0x40
je 0x100009193
mov rcx, qword [0x1000197c0]
xor r8d, r8d
mov edx, 0x668
call sub.ntdll.dll_WinSqmSetDWORD
mov rcx, qword [0x1000197c0]
xor r8d, r8d
mov edx, 0x4c8
call sub.ntdll.dll_WinSqmSetDWORD
mov rcx, qword [0x1000197c0]
xor r8d, r8d
mov edx, 0x4c7
call sub.ntdll.dll_WinSqmSetDWORD
lea r8, [rsp + 0x300]
mov rdx, rsi
mov rcx, rbp
call fcn.100008418
jmp 0x100008f1c
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x248
call sub.msvcrt.dll_memset
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0xb0], 0x248
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
cmp eax, edi
je 0x100008f16
cmp rbx, 0xffffffffffffffff
je 0x1000091fd
lea rdx, [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupGetFileQueueFlags]
cmp eax, edi
je 0x1000091fd
test byte [rsp + 0x98], 4
jne 0x1000091fd
bts dword [rsp + 0xb8], 0x1d
mov eax, dword [rsp + 0xb4]
bts eax, 0x18
mov dword [rsp + 0xb4], eax
cmp r14d, edi
je 0x100009240
or eax, 0x20100
lea r9, [0x100002a50]
mov r8d, 2
mov edx, r12d
mov rcx, r13
mov dword [rsp + 0xb4], eax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov eax, dword [rsp + 0xb4]
test byte [rsp + 0x4c], 2
je 0x10000926b
bts eax, 8
lea r9, [0x100002aa8]
mov r8d, 2
mov edx, r12d
mov rcx, r13
mov dword [rsp + 0xb4], eax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
cmp eax, edi
je 0x100008f16
lea r9, [0x100002ae0]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
mov r8, rsi
mov rdx, rbp
mov ecx, 0x22
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
cmp eax, edi
je 0x100008f16
lea r9, [0x100002b00]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
mov r8, rsi
mov rdx, rbp
mov ecx, 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
cmp eax, edi
je 0x100008f16
lea r9, [0x100002b20]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
mov r8, rsi
mov rdx, rbp
mov ecx, 2
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
cmp eax, edi
jne 0x100009372
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov r14d, 1
lea r9, [0x100002b38]
mov r8d, r14d
mov edx, r12d
mov rcx, r13
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rbx, qword [rsp + 0x40]
jmp 0x100008a58
mov ebx, dword [rsp + 0x54]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x248
call sub.msvcrt.dll_memset
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0xb0], 0x248
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
cmp eax, edi
je 0x1000093c5
test dword [rsp + 0xb4], 0x180
mov eax, 1
cmovne ebx, eax
mov dword [rsp + 0x54], ebx
cmp ebx, edi
je 0x10000940a
mov ecx, dword [rsi + 0x14]
mov ebx, 1
lea edx, [rbx + 0xd]
mov r8d, ebx
call qword [sym.imp.SETUPAPI.dll_CM_Set_DevNode_Problem]
mov rcx, qword [0x1000197c0]
mov r8d, ebx
mov edx, 0x668
call sub.ntdll.dll_WinSqmSetDWORD
lea r9, [0x100002b58]
lea r8d, [rbx + 3]
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
jmp 0x100009423
mov rcx, qword [0x1000197c0]
xor r8d, r8d
mov edx, 0x668
call sub.ntdll.dll_WinSqmSetDWORD
mov ebx, 1
mov r8d, r15d
mov rdx, rsi
mov rcx, rbp
call fcn.10000791c
mov rcx, qword [0x1000197c8]
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
mov rdx, rsi
mov rcx, rbp
call fcn.10000b804
cmp eax, edi
je 0x10000948e
test r15b, 0x10
jne 0x100009470
cmp r14d, edi
jne 0x100009470
test byte [rsp + 0x4c], 2
jne 0x100009470
mov r8d, 0x10000
mov rdx, rsi
mov rcx, rbp
call fcn.10000b754
lea r9, [0x100002b70]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r8d, ebx
jmp 0x100009491
xor r8d, r8d
mov rcx, qword [0x1000197c0]
mov edx, 0x4c8
call sub.ntdll.dll_WinSqmSetDWORD
mov rdx, rsi
mov rcx, rbp
call fcn.10000b8f8
cmp eax, edi
je 0x100009509
test r15b, 0x10
jne 0x1000094d4
cmp r14d, edi
jne 0x1000094d4
test byte [rsp + 0x4c], 2
jne 0x1000094d4
mov r8d, 0x20000
mov rdx, rsi
mov rcx, rbp
call fcn.10000b754
lea r9, [0x100002bb0]
mov r8d, 4
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rcx, qword [0x1000197c0]
mov r14d, 1
mov r8d, r14d
mov edx, 0x4c7
call sub.ntdll.dll_WinSqmSetDWORD
jmp 0x100009523
mov rcx, qword [0x1000197c0]
xor r8d, r8d
mov edx, 0x4c7
call sub.ntdll.dll_WinSqmSetDWORD
mov r14d, 1
cmp dword [rsp + 0x4c], edi
je 0x100009368
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x30], edi
lea r8, [0x100002218]
mov r9d, 7
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x4c], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDevicePropertyW]
jmp 0x100009368
xor r8d, r8d
call sub.SETUPAPI.dll_pSetupDiCrimsonLogDeviceInstall
cmp edi, ebx
jne 0x100009766
mov r8d, dword [rsi + 0x14]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x70]
xor r9d, r9d
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, ebx
jne 0x1000095ee
bt dword [rsp + 0x70], 8
jb 0x1000095ee
bt dword [rsp + 0x70], 0xa
jae 0x1000095ee
mov eax, dword [rsp + 0x88]
cmp eax, ebx
je 0x1000095ee
cmp eax, 0xe
je 0x1000095ee
cmp eax, 0x1c
je 0x1000095ee
lea r9, [0x100002c40]
mov r8d, 2
mov edx, r12d
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
bt r15d, 9
jb 0x1000095ee
mov r8d, dword [rsp + 0x88]
mov r9d, r14d
mov rdx, rsi
mov rcx, rbp
call sub.SETUPAPI.dll_SetupDiReportPnPDeviceProblem
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x49]
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x50]
lea r8, [0x1000021b8]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
cmp eax, ebx
je 0x1000096a8
cmp dword [rsp + 0x50], 0x11
jne 0x1000096a8
cmp byte [rsp + 0x49], 0xff
jne 0x1000096a8
lea r9, [0x100004800]
lea r8, [0x100004850]
lea rdx, [0x100003d90]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.100010a8c
mov r8d, 5
mov edx, r12d
mov rcx, r13
cmp eax, r14d
je 0x10000969b
bt r15d, 9
jb 0x100009692
lea r9, [0x100002c80]
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r8d, r14d
mov rdx, rsi
mov rcx, rbp
call sub.SETUPAPI.dll_SetupDiReportGenericDriverInstalled
jmp 0x1000096a8
lea r9, [0x100002cc0]
jmp 0x1000096a2
lea r9, [0x100002d40]
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x50]
lea r8, [0x1000021d0]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
cmp eax, ebx
je 0x10000977f
cmp dword [rsp + 0x50], 0x11
jne 0x10000977f
cmp byte [rsp + 0x48], 0xff
jne 0x10000977f
lea r9, [0x100004870]
lea r8, [0x100004850]
lea rdx, [0x100003d90]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.100010a8c
mov r8d, 5
cmp eax, r14d
je 0x10000975d
bt r15d, 9
mov edx, r12d
mov rcx, r13
jb 0x100009754
lea r9, [0x100002d90]
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r8d, r14d
mov rdx, rsi
mov rcx, rbp
call sub.SETUPAPI.dll_SetupDiReportAdditionalSoftwareRequested
jmp 0x10000977f
lea r9, [0x100002de0]
jmp 0x100009779
lea r9, [0x100002e70]
jmp 0x100009773
lea r9, [0x100002ec0]
mov r8d, 2
mov rcx, r13
mov edx, r12d
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x10000979e
mov rcx, rbx
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
cmp dword [0x10001979c], 0
je 0x1000097ed
mov al, byte [0x1000197a0]
cmp al, 4
jae 0x1000097b5
test al, al
jne 0x1000097ed
movabs rdx, 0x1001000000000000
test qword [0x100019788], rdx
je 0x1000097ed
mov rcx, qword [0x100019790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000097ed
mov rcx, qword [0x100019770]
lea rdx, [0x100001910]
call fcn.100006d54
mov rcx, qword [0x1000197c0]
call sub.ntdll.dll_WinSqmEndSession
and qword [0x1000197c0], 0
lea r9, [0x100002f00]
mov r8d, 0x50004
mov edx, r12d
mov rcx, r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov eax, edi
mov rcx, qword [rsp + 0xab0]
xor rcx, rsp
call fcn.100014800
add rsp, 0xac8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret