Function at 0x140039248
Capabilities:
Create directory
Delete file
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xba8
xor r13d, r13d
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x1c8], r13
cmp qword [0x140117d78], r13
jne 0x14003929e
lea rcx, [0x140118098]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.140016198
lea rcx, [0x140118098]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x140]
mov rdx, rsi
call fcn.140017c94
mov rcx, qword [0x1401179a0]
lea r8, [rsp + 0x990]
mov r9d, 0x104
mov edx, 0x2711
mov qword [rsp + 0x248], r13
call fcn.1400526f0
lea rdx, [0x1400ff280]
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x210], r13
call fcn.140064d14
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x2c8], r13
call fcn.14005a150
lea rcx, [rsp + 0x208]
mov ebx, 0x80000000
mov qword [rsp + 0x2c0], r13
mov dword [rsp + 0x100], ebx
call fcn.14005a150
lea rcx, [rsp + 0x218]
call fcn.14005a150
lea rax, [rsp + 0x2c0]
lea r11, [rsp + 0x2c8]
mov qword [rsp + 0x2e0], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x2d8], r11
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x2e8], r13
call fcn.1400555c8
shr rax, 0x10
mov byte [rsp + 0x51], r13b
lea ecx, [rax - 0x60000]
cmp eax, 0x60000
mov qword [rsp + 0x2a8], rax
setae byte [rsp + 0x4d]
cmp ecx, 0xffff
lea rcx, [rsp + 0x70]
setbe dil
mov byte [rsp + 0x4e], dil
call fcn.14005a150
mov rcx, qword [str._SystemRoot__]
mov rax, qword [0x1400ff268]
lea r11, [rsp + 0x280]
lea r8, [rsp + 0x70]
mov qword [r11], rcx
mov qword [r11 + 8], rax
mov rax, qword [0x1400ff270]
mov qword [r11 + 0x10], rax
mov eax, dword [0x1400ff278]
lea rdx, [rsp + 0x280]
mov dword [r11 + 0x18], eax
xor eax, eax
xor r9d, r9d
lea r14d, [rax + 1]
mov rcx, rsi
mov dword [rsp + 0x29c], eax
mov dword [rsp + 0x2a0], eax
mov dword [rsp + 0x2a4], eax
mov byte [rsp + 0x20], r14b
call fcn.14006d030
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x1d0], eax
lea ecx, [rax + 0x1e]
movsxd rdx, ecx
lea rcx, [rsp + 0x70]
call fcn.14005a250
cmp dil, r13b
lea esi, [r14 + 2]
jl 0x140039495
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xc00]
call fcn.140064d14
lea rdx, str.System32Drvload.exe
lea rcx, [rsp + 0xc00]
call fcn.14005a28c
mov rcx, qword [rsp + 0xc00]
call fcn.1400dcf68
lea rcx, [rsp + 0xc00]
neg eax
sbb dil, dil
and dil, sil
mov byte [rsp + 0x4e], dil
call fcn.140052160
lea rcx, [rsp + 0x1c0]
mov edx, 0x400032
mov rbp, r14
mov qword [rsp + 0xf8], r14
mov dil, r13b
mov byte [rsp + 0x4c], r13b
call fcn.140059ed8
mov rcx, qword [rsp + 0x1c0]
lea rdx, [0x1400ff220]
mov r8d, 0xa
call fcn.14001b7a8
mov rcx, qword [rsp + 0x1c0]
mov qword [rcx + 0xa], r13
mov rax, qword [rsp + 0x1c0]
add rax, 0x12
mov qword [rsp + 0x58], rax
mov esi, 2
cmp dil, 0xff
jae 0x140039504
add dil, r14b
mov byte [rsp + 0x4c], dil
lea rcx, [rsp + 0x210]
mov rdx, r12
mov r14b, r13b
call fcn.140064e2c
mov r11, qword [rsp + 0x210]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], r11
mov bpl, r13b
mov dword [rsp + 0x190], r13d
mov qword [rsp + 0x168], r13
mov byte [rsp + 0x11c], sil
mov byte [rsp + 0x4f], r13b
call fcn.1400157dc
mov rdx, qword [rsp + 0x40]
xor eax, eax
lea r8d, [rax + 8]
mov byte [rsp + 0x50], r13b
mov r12d, r13d
mov dword [rsp + 0x48], r13d
lea rcx, str.listdev:
mov r13b, 0xf0
mov byte [rsp + 0xc08], sil
mov byte [rsp + 0x198], al
mov byte [rsp + 0x19d], al
mov dword [rsp + 0x64], r13d
mov r15, rax
mov qword [rsp + 0xc0], rax
mov rdi, rax
mov qword [rsp + 0x268], rax
call fcn.140053674
xor r8d, r8d
cmp al, r8b
je 0x1400396af
mov rax, qword [rsp + 0x40]
mov r12d, pe_nt_image_headers64
add rax, 0x10
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140039637
lea edx, [rdi + 9]
lea r9d, [rdi + 0xd]
cmp dx, cx
ja 0x1400395e6
cmp cx, r9w
jbe 0x1400395fe
mov r10d, 0x20
cmp r10w, cx
cmovne rdi, rax
mov qword [rsp + 0x268], rdi
jmp 0x140039604
mov r10d, 0x20
cmp dx, cx
ja 0x14003960f
cmp cx, r9w
jbe 0x140039628
cmp r10w, cx
je 0x140039628
add rax, rsi
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140039637
jmp 0x140039604
cmp word [rax], r8w
je 0x140039637
mov word [rax], r8w
add qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.1400157dc
cmp word [rdi], r8w
jne 0x1400396d2
lea rcx, [rsp + 0x1c0]
call fcn.140052160
lea rcx, [rsp + 0x70]
call fcn.140052160
lea rcx, [rsp + 0x218]
call fcn.140052160
lea rcx, [rsp + 0x208]
call fcn.140052160
lea rcx, [rsp + 0x260]
call fcn.140052160
lea rcx, [rsp + 0x1f0]
call fcn.140052160
lea rcx, [rsp + 0x210]
call fcn.140052160
mov rax, 0xffffffff80070057
jmp 0x14003cd4c
lea rdx, [rsp + 0x40]
lea rcx, str.buildcache:
mov r8d, 0xa
call fcn.14005ca04
xor r8d, r8d
cmp al, r8b
jne 0x14003cc69
cmp dword [rsp + 0x2a8], 0x60000
movzx esi, byte [rsp + 0x4e]
mov eax, 3
cmovae esi, eax
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
mov dl, r8b
mov qword [rsp + 0x90], r8
mov word [rsp + 0x194], r8w
mov byte [rsp + 0x1a0], r8b
mov dil, 0xff
mov byte [rsp + 0xc00], dl
cmp cx, word [rax]
jne 0x14003a30c
mov bl, byte [rsp + 0x4e]
lea rdx, [rsp + 0x40]
lea rcx, str.extract
mov r8d, 8
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039760
lea eax, [r8 + 1]
mov byte [rsp + 0x198], al
mov byte [rsp + 0xc08], al
mov r14b, al
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.cab
mov r8d, 4
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039787
mov r14b, 1
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.nocheck
mov r8d, 8
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x1400397b6
lea eax, [r8 + 1]
mov byte [rsp + 0x19d], al
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.devcon
mov r8d, 7
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x1400397e5
lea eax, [r8 + 1]
mov byte [rsp + 0x19e], al
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.rescan
mov r8d, 7
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039811
mov r13b, r8b
mov dword [rsp + 0x64], r13d
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.norescan
mov r8d, 9
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039835
mov r13b, 0xc0
jmp 0x140039807
mov rdx, qword [rsp + 0x40]
lea rcx, str.rescan:
mov r8d, 8
call fcn.140053674
xor edx, edx
cmp al, dl
je 0x140039893
add qword [rsp + 0x40], 0x10
movsx eax, r13b
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0xa8], eax
call fcn.14005e4b0
mov r13d, dword [rsp + 0xa8]
xor r8d, r8d
cmp r13b, r8b
mov dword [rsp + 0x64], r13d
jge 0x14003a2bb
jmp 0x140039804
lea rdx, [rsp + 0x40]
lea rcx, str.dummy
mov r8d, 6
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x1400398c2
lea eax, [r8 + 1]
mov byte [rsp + 0x19f], al
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.sub
mov r8d, 4
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x1400398eb
mov byte [rsp + 0x50], 1
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.self
mov r8d, 5
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039914
mov byte [rsp + 0x50], 2
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.7pe
mov r8d, 4
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x14003993b
mov sil, 3
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.7pe_
mov r8d, 4
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039962
mov sil, bl
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.drvload
mov r8d, 8
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
jne 0x14003995a
lea rdx, [rsp + 0x40]
lea rcx, str.inner
mov r8d, 6
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x1400399a8
mov sil, 0xc0
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.nnverify
mov r8d, 9
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x1400399d4
mov byte [rsp + 0xc08], 1
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.rverify
mov r8d, 8
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039a00
mov byte [rsp + 0xc08], r8b
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.listdevi
mov r8d, 0xa
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039a2f
and r12d, 0xff00
or r12d, 2
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.listdevc
mov r8d, 0xa
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039a5e
and r12d, 0xff00
or r12d, 4
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.listdev
mov r8d, 0xa
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039a8d
and r12d, 0xff00
or r12d, 8
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.comp
mov r8d, 6
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039abe
lea eax, [r8 + 1]
mov dl, al
mov byte [rsp + 0xc00], al
jmp 0x14003a2c2
lea rdx, [rsp + 0x40]
lea rcx, str.hwid
mov r8d, 5
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039ae7
bts r12d, 0xc
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, [0x1400ff0fc]
mov r8d, 5
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039b10
bts r12d, 0xb
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.inst
mov r8d, 5
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039b39
bts r12d, 0xd
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.All
mov r8d, 4
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039b62
bts r12d, 9
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, [0x1400ff0e4]
mov r8d, 5
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039b8b
bts r12d, 0xa
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.auto
mov r8d, 5
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039bbb
lea eax, [r8 + 3]
mov word [rsp + 0x194], ax
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.sys
mov r8d, 4
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039bea
lea eax, [r8 + 1]
mov byte [rsp + 0x1a0], al
jmp 0x14003a2bb
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xa
inc rcx
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039c15
or bpl, 1
jmp 0x14003a2bb
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xb
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039c3d
or bpl, 3
jmp 0x14003a2bb
mov rcx, qword [str.AutoDisverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xe
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x140039c65
or bpl, 0x10
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.sysdir:
mov r8d, 7
call fcn.14005ca04
xor edx, edx
cmp al, dl
je 0x140039caf
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x1cd
mov qword [rsp + 0x1b0], rax
call fcn.1400256a8
xor r8d, r8d
mov qword [rsp + 0x40], rax
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, [0x1400ff0c0]
mov r8d, 4
call fcn.14005ca04
xor r8d, r8d
cmp al, r8b
je 0x140039d74
mov rax, qword [rsp + 0x40]
cmp word [rax], r8w
je 0x14003a2b1
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rax]
ja 0x140039cf5
cmp word [rax], r10w
jbe 0x140039d1b
mov r11d, 0x20
cmp r11w, word [rax]
je 0x140039d21
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x1a8], rcx
jmp 0x140039d21
mov r11d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x14003a2b1
mov edx, 2
cmp r9w, cx
ja 0x140039d3f
cmp cx, r10w
jbe 0x140039d5c
cmp r11w, cx
je 0x140039d5c
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x14003a2b1
jmp 0x140039d33
cmp word [rax], r8w
je 0x14003a2b1
mov word [rax], r8w
add qword [rsp + 0x40], rdx
jmp 0x14003a2b1
lea rdx, [rsp + 0x40]
lea rcx, str.IdCah:
mov r8d, 6
call fcn.14005ca04
xor r8d, r8d
cmp al, r8b
je 0x140039e41
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x140039e18
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, ax
ja 0x140039db9
cmp ax, r10w
jbe 0x140039dd9
mov rdx, qword [rsp + 0x1c8]
mov r11d, 0x20
cmp r11w, ax
cmovne rdx, rcx
mov qword [rsp + 0x1c8], rdx
jmp 0x140039ddf
mov r11d, 0x20
mov edx, 2
cmp r9w, ax
ja 0x140039df0
cmp ax, r10w
jbe 0x140039e09
cmp r11w, ax
je 0x140039e09
add rcx, rdx
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
je 0x140039e18
jmp 0x140039de4
cmp word [rcx], r8w
je 0x140039e18
mov word [rcx], r8w
add qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.1400157dc
mov rax, qword [rsp + 0x1c8]
cmp word [rax], r8w
jne 0x14003a2bb
mov qword [rsp + 0x1c8], r8
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.retid:
mov r8d, 6
call fcn.14005ca04
xor r8d, r8d
cmp al, r8b
je 0x140039ef6
mov rax, qword [rsp + 0x40]
cmp word [rax], r8w
je 0x14003a2b1
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rax]
ja 0x140039e87
cmp word [rax], r10w
jbe 0x140039ead
mov r11d, 0x20
cmp r11w, word [rax]
je 0x140039eb3
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x2c8], rax
mov qword [rsp + 0x160], rcx
jmp 0x140039eb3
mov r11d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x14003a2b1
mov edx, 2
cmp r9w, cx
ja 0x140039ed5
cmp cx, r10w
jbe 0x140039d5c
cmp r11w, cx
je 0x140039d5c
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x14003a2b1
jmp 0x140039ec5
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevClass:
mov r8d, 0xa
call fcn.140053674
xor r8d, r8d
cmp al, r8b
je 0x140039fb9
mov rcx, qword [rsp + 0x40]
add rcx, 0x14
mov qword [rsp + 0x40], rcx
cmp word [rcx], r8w
je 0x14003a2b1
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rcx]
ja 0x140039f45
cmp word [rcx], r10w
jbe 0x140039f65
mov rax, qword [rsp + 0x168]
mov r11d, 0x20
cmp r11w, word [rcx]
cmovne rax, rcx
mov qword [rsp + 0x168], rax
jmp 0x140039f6b
mov r11d, 0x20
movzx eax, word [rcx]
cmp ax, r8w
je 0x14003a2b1
mov edx, 2
cmp r9w, ax
ja 0x140039f89
cmp ax, r10w
jbe 0x140039fa6
cmp r11w, ax
je 0x140039fa6
add rcx, rdx
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
je 0x14003a2b1
jmp 0x140039f7d
cmp word [rcx], r8w
je 0x14003a2b1
mov word [rcx], r8w
jmp 0x140039d6a
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevID:
mov r8d, 7
call fcn.140053674
xor ecx, ecx
cmp al, cl
je 0x14003a08a
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
cmp word [rax], cx
je 0x14003a009
lea edx, [rcx + 9]
cmp dx, word [rax]
ja 0x140039ffd
lea ecx, [rdx + 4]
cmp word [rax], cx
jbe 0x14003a009
mov ecx, 0x20
cmp cx, word [rax]
cmovne r15, rax
lea rcx, [rsp + 0x40]
mov edx, 0x27
call fcn.14001bf28
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
cmp word [rcx], r8w
je 0x14003a033
lea eax, [r8 + 2]
mov word [rcx], r8w
add qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.1400157dc
cmp r15, r8
je 0x14003a2bb
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rcx, eax
cmp rcx, r8
jle 0x14003a079
lea edx, [r8 + 1]
lea r9d, [r8 + 0x26]
cmp r9w, word [r15 + rcx*2 - 2]
jne 0x14003a079
mov word [r15 + rcx*2], r8w
sub rcx, rdx
sub eax, edx
cmp rcx, r8
jg 0x14003a062
cmp eax, r8d
jg 0x14003a2bb
mov r15, r8
jmp 0x14003a2bb
lea rdx, [rsp + 0x40]
lea rcx, str.infcache:
mov r8d, 0xa
call fcn.14005ca60
xor ecx, ecx
cmp al, cl
je 0x14003a110
mov rax, qword [rsp + 0x40]
cmp word [rax], cx
je 0x14003a0dd
lea edx, [rcx + 9]
cmp dx, word [rax]
ja 0x14003a0c1
lea ecx, [rdx + 4]
cmp word [rax], cx
jbe 0x14003a0dd
mov rcx, qword [rsp + 0x248]
mov edx, 0x20
cmp dx, word [rax]
cmovne rcx, rax
mov qword [rsp + 0x248], rcx
lea rcx, [rsp + 0x40]
mov edx, 0x27
call fcn.14001bf28
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
cmp word [rcx], r8w
je 0x14003a2b1
lea eax, [r8 + 2]
mov word [rcx], r8w
add qword [rsp + 0x40], rax
jmp 0x14003a2b1
mov rdx, qword [rsp + 0x40]
lea rcx, str.disable:
mov r8d, 9
call fcn.140053674
xor edx, edx
cmp al, dl
je 0x14003a140
mov rcx, qword [rsp + 0x40]
lea eax, [rdx + 2]
add rcx, rax
mov dil, al
jmp 0x14003a1f6
mov rdx, qword [rsp + 0x40]
lea rcx, str.enable:
mov r8d, 8
call fcn.140053674
xor ecx, ecx
cmp al, cl
je 0x14003a162
mov dil, 1
jmp 0x14003a182
mov rdx, qword [rsp + 0x40]
lea rcx, str.remove:
mov r8d, 8
call fcn.140053674
xor ecx, ecx
cmp al, cl
je 0x14003a189
mov dil, 5
mov rcx, qword [rsp + 0x40]
jmp 0x14003a1f6
mov rdx, qword [rsp + 0x40]
lea rcx, str.update:
mov r8d, 8
call fcn.140053674
xor ecx, ecx
cmp al, cl
je 0x14003a1ab
mov dil, 0x11
jmp 0x14003a182
mov rdx, qword [rsp + 0x40]
lea rcx, str.status:
mov r8d, 8
call fcn.140053674
xor ecx, ecx
cmp al, cl
je 0x14003a1cd
mov dil, 0x12
jmp 0x14003a182
mov rdx, qword [rsp + 0x40]
lea rcx, str.restart:
mov r8d, 9
call fcn.140053674
xor ecx, ecx
cmp al, cl
je 0x14003a243
mov rcx, qword [rsp + 0x40]
mov dil, 3
add rcx, 2
add rcx, 0x10
xor eax, eax
mov qword [rsp + 0x40], rcx
cmp word [rcx], ax
je 0x14003a0dd
mov eax, 9
cmp ax, word [rcx]
ja 0x14003a222
mov eax, 0xd
cmp word [rcx], ax
jbe 0x14003a0dd
mov rax, qword [rsp + 0x90]
mov edx, 0x20
cmp dx, word [rcx]
cmovne rax, rcx
mov qword [rsp + 0x90], rax
jmp 0x14003a0dd
lea rdx, [rsp + 0x40]
lea rcx, [0x1400ff024]
mov r8d, 3
call fcn.14005c928
xor r8d, r8d
cmp al, r8b
je 0x14003a269
mov byte [rsp + 0x4f], 1
jmp 0x14003a2bb
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x14003a2b1
mov edx, 9
lea ebx, [rdx + 4]
lea r13d, [rdx - 7]
lea r9d, [rdx + 0x17]
cmp dx, ax
ja 0x14003a291
cmp ax, bx
jbe 0x14003a2a8
cmp r9w, ax
je 0x14003a2a8
add rcx, r13
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
jne 0x14003a287
mov r13d, dword [rsp + 0x64]
mov bl, byte [rsp + 0x4e]
lea rcx, [rsp + 0x40]
call fcn.1400157dc
mov dl, byte [rsp + 0xc00]
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
je 0x140039727
mov ebx, dword [rsp + 0x100]
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0xc0], r15
mov dword [rsp + 0x48], r12d
movzx eax, byte [rsp + 0x198]
cmp r13b, 0xf0
mov r13d, r12d
setl byte [rsp + 0x88]
shr r13d, 8
mov r9d, 1
and r13b, r9b
cmovne eax, r8d
mov dword [rsp + 0x118], r13d
mov byte [rsp + 0x198], al
cmp r12d, r8d
je 0x14003a35a
mov al, r13b
neg al
sbb cl, cl
and cl, dl
mov dl, cl
mov byte [rsp + 0xc00], cl
bt r12d, 0xd
jae 0x14003a372
bt r12d, 0xa
jae 0x14003a372
btr r12d, 0xa
mov dword [rsp + 0x48], r12d
cmp r13b, r8b
je 0x14003a3ac
mov eax, 2
test al, r12b
je 0x14003a399
test r12d, 0x3c00
jne 0x14003a399
cmp dl, r8b
jne 0x14003a399
bts r12d, 0xd
mov dword [rsp + 0x48], r12d
cmp r13b, r8b
je 0x14003a3ac
cmp qword [rsp + 0x268], r8
je 0x14003c051
cmp dil, r8b
jge 0x14003c8de
cmp bpl, r8b
jne 0x14003c8c6
mov rdi, qword [rsp + 0xbf0]
cmp sil, r8b
mov ecx, r8d
movzx eax, sil
cmovge ecx, eax
or byte [rsp + 0x4d], cl
mov byte [rsp + 0x19c], cl
cmp r13b, r8b
jne 0x14003a3fc
mov rax, qword [rsp + 0x2e8]
cmp byte [rsp + 0x4c], r9b
cmove rax, rdi
mov qword [rsp + 0x2e8], rax
mov r12, qword [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x250], r15
mov qword [r12], r8
lea r8d, [rdx + 0x20]
lea rcx, [r12 + 0x400000]
call fcn.1400dd9e0
mov rbp, qword [rsp + 0x1c8]
xor r15d, r15d
mov rsi, r15
cmp rbp, r15
je 0x14003a4c1
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.140016e9c
mov rdi, rax
cmp rax, r15
je 0x14003a4b4
mov rdx, qword [rax + 8]
cmp rdx, r15
je 0x14003a4b4
mov rcx, qword [rax + 0x18]
movabs rax, 0x3fffffffffffffff
and rcx, rax
cmp rcx, 0x400032
jb 0x14003a4b4
lea r8d, [r15 + 0xa]
lea rcx, [0x1400ff220]
call fcn.140052190
cmp eax, r15d
jne 0x14003a4b4
mov rsi, qword [rdi + 8]
mov r8d, 0x400020
mov rcx, r12
add rsi, 0x12
mov rdx, rsi
call fcn.14001b7a8
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rsi, r15
mov ecx, r15d
mov eax, 0x20
sete byte [rsp + 0x98]
mov dword [rsp + 0x280], eax
xor eax, eax
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x140], r12
mov dword [rsp + 0x284], r15d
cmp word [rax], 0x24
mov esi, r15d
mov edi, 2
sete cl
mov dword [rsp + 0x60], ecx
cmp ecx, r15d
je 0x14003a543
add rax, rdi
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
jne 0x14003a543
lea ecx, [rdi - 1]
add rax, rdi
add esi, ecx
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
je 0x14003a533
lea rcx, [rsp + 0x40]
call fcn.1400157dc
mov rcx, qword [rsp + 0x40]
mov edx, 0x2c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r12, r15
mov qword [rsp + 0xb8], r15
mov rbp, rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x80], r15
cmp rax, r15
je 0x14003a5fe
lea rcx, [rsp + 0xc8]
add rbp, rdi
mov word [rax], r15w
mov qword [rsp + 0xc8], rbp
call fcn.1400157dc
mov rbp, qword [rsp + 0xc8]
mov rcx, rbp
mov edx, 0x2c
mov qword [rsp + 0xc8], rbp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r12, rax
mov qword [rsp + 0xb8], rax
cmp rax, r15
je 0x14003a5f6
add r12, rdi
lea rcx, [rsp + 0xb8]
mov word [rax], r15w
mov qword [rsp + 0xb8], r12
call fcn.1400157dc
mov r12, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], r12
mov rcx, rbp
call fcn.140017094
mov rcx, qword [rsp + 0x40]
call fcn.140017094
cmp r12, r15
je 0x14003a668
mov edx, 0x2c
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, r15
je 0x14003a660
lea rcx, [rsp + 0x130]
add rdi, 2
mov word [rax], r15w
mov qword [rsp + 0x130], rdi
call fcn.1400157dc
mov rdi, qword [rsp + 0x130]
mov rcx, rdi
mov qword [rsp + 0x80], rdi
call fcn.140017094
mov rcx, r12
call fcn.140017094
mov rax, qword [rsp + 0x40]
cmp word [rax], r15w
je 0x14003a76a
lea rcx, [rsp + 0x40]
mov edx, 1
call fcn.14006cd5c
cmp rax, r15
je 0x14003a76a
mov ecx, 0x23
cmp cx, word [rax]
jne 0x14003a76a
lea rcx, [rsp + 0x200]
call fcn.14005a150
lea r11, str..tmp.cab
lea r9, str.devi
lea rdx, [rsp + 0x200]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call fcn.140007428
lea rdx, str.__dd__len16M___
lea rcx, [rsp + 0x1d8]
call fcn.140064d14
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x1d8]
call fcn.14005a28c
lea rdx, [0x1400fefc8]
lea rcx, [rsp + 0x1d8]
call fcn.14005a28c
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x1d8]
call fcn.14005a28c
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.1400951dc
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x218]
call fcn.140017f24
lea rcx, [rsp + 0x1d8]
mov qword [rsp + 0x40], rax
call fcn.140052160
lea rcx, [rsp + 0x200]
call fcn.140052160
mov rcx, qword [rsp + 0x40]
call fcn.1400dce2c
mov rcx, qword [rsp + 0x40]
mov r15d, eax
mov dword [rsp + 0x258], eax
call fcn.1400ddf70
xor r11d, r11d
mov rdi, rax
cmp r14b, r11b
jne 0x14003a7cf
cmp r15d, r11d
jne 0x14003a7bf
cmp eax, 4
jle 0x14003a7bf
mov rcx, qword [rsp + 0x40]
movsxd rdx, eax
lea rcx, [rcx + rdx*2 - 8]
lea rdx, str..CAB
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
je 0x14003a7cf
mov r14d, r11d
mov dword [rsp + 0x1e0], r11d
jmp 0x14003a89e
movsxd r10, dword [rsp + 0x1d0]
mov ecx, 1
lea rax, str.SysWow64
cmp byte [0x140115008], cl
lea rdx, str.System32
mov r14d, ecx
cmove rdx, rax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x1e0], ecx
lea rcx, [rax + r10*2]
mov r8d, 0x10
call fcn.14001b7a8
mov rax, qword [rsp + 0x70]
lea ecx, [r10 + 8]
movsxd rdx, ecx
mov r8d, 0x1a
lea rcx, [rax + rdx*2]
lea rdx, str.cabinet.dll
call fcn.14001b7a8
cmp r13b, r11b
jne 0x14003a89e
mov rcx, qword [rsp + 0x70]
call fcn.1400dcf68
xor r11d, r11d
cmp eax, r11d
jne 0x14003a89e
lea edx, [r11 + 0x63]
lea rcx, [rsp + 0x238]
call fcn.14005a1c4
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x238]
lea rdx, str.__dd__bs1M__s_0__._33INDATA
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.1400951dc
lea rcx, [rsp + 0x238]
call fcn.140052160
xor r11d, r11d
cmp r12, r11
je 0x14003a8b9
mov eax, 0x2a
cmp ax, word [r12]
cmove r12, r11
mov qword [rsp + 0xb8], r12
cmp edi, 4
jle 0x14003a8e8
mov rax, qword [rsp + 0x40]
movsxd rcx, edi
lea rdx, [0x1400fdeb8]
lea rcx, [rax + rcx*2 - 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
jne 0x14003a8e8
lea ecx, [r11 + 1]
mov eax, ecx
jmp 0x14003a8f0
mov eax, r11d
mov ecx, 1
cmp r15d, r11d
jne 0x14003a8fc
mov edi, ecx
cmp eax, r11d
jne 0x14003a8ff
mov edi, r11d
mov r15d, dword [rsp + 0x60]
cmp esi, ecx
je 0x14003a926
cmp eax, r11d
je 0x14003a917
cmp r15d, r11d
je 0x14003a917
cmp r12, r11
jne 0x14003a926
cmp edi, r11d
je 0x14003a921
cmp r15d, r11d
jne 0x14003a926
mov al, r11b
jmp 0x14003a928
mov al, cl
cmp edi, r11d
jne 0x14003a935
cmp al, r11b
mov eax, r11d
je 0x14003a937
mov eax, ecx
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x150], r11
mov qword [rsp + 0x158], r11
mov word [rsp + 0x196], r11w
cmp r13b, r11b
jne 0x14003aa41
cmp r12, r11
je 0x14003aa41
cmp word [r12], r11w
je 0x14003aa41
cmp eax, r11d
jne 0x14003aa41
lea rcx, [rsp + 0x68]
mov rdx, r12
call fcn.140064e2c
mov rcx, qword [rsp + 0x68]
call fcn.14001c0f4
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x220]
mov edx, 0x105
call fcn.14005a1c4
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov rcx, qword [rsp + 0x220]
xor eax, eax
cmp word [rcx], ax
je 0x14003a9f4
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x220], rax
jmp 0x14003a9f9
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov eax, 0x5c
cmp word [r12 + rcx*2 - 2], ax
je 0x14003aa20
lea rdx, [0x1400f9ae8]
lea rcx, [rsp + 0x68]
call fcn.14005a28c
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x150], rax
call fcn.140052160
xor r11d, r11d
lea ecx, [r11 + 1]
cmp r15d, r11d
jne 0x14003aa57
cmp byte [rsp + 0x4d], r11b
je 0x14003aa88
cmp byte [rsp + 0x198], r11b
jne 0x14003aa88
mov sil, byte [rsp + 0xc08]
cmp byte [rsp + 0x1a0], r11b
jne 0x14003aa90
cmp r13b, r11b
jne 0x14003aa90
cmp sil, cl
je 0x14003aa90
cmp ebx, r11d
je 0x14003aa90
xor edx, edx
xor ecx, ecx
call fcn.1400c5ff8
xor r11d, r11d
mov ebx, eax
jmp 0x14003aa90
mov sil, byte [rsp + 0xc08]
mov eax, 2
cmp sil, al
cmove ebx, r11d
mov dword [rsp + 0x100], ebx
cmp r14d, r11d
je 0x14003aafc
cmp rbp, r11
je 0x14003aafc
or dword [rsp + 0xc08], 0xffffffff
lea rdx, [rsp + 0xc08]
lea rcx, [rsp + 0x128]
mov qword [rsp + 0x128], rbp
call fcn.140068dd4
mov r11d, dword [rsp + 0xc08]
mov edx, dword [rsp + 0x11c]
lea ecx, [r11 - 1]
movzx eax, r11b
cmp ecx, 0x12
movzx edx, dl
cmovbe edx, eax
xor r11d, r11d
mov dword [rsp + 0x11c], edx
mov al, byte [rsp + 0x4c]
mov ebp, dword [rsp + 0x64]
mov ecx, 1
cmp al, cl
jne 0x14003ab89
cmp r13b, r11b
jne 0x14003ab89
cmp byte [rsp + 0x198], r11b
jne 0x14003ab89
movsx ecx, byte [rsp + 0x19d]
movsx r9d, byte [rsp + 0x19c]
mov r8d, dword [rsp + 0x2a8]
movsx eax, bpl
lea rdx, str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x4f0]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_wsprintfW]
mov r12, qword [rsp + 0xbf0]
lea r8, [rsp + 0x4f0]
lea rdx, [0x1400fee90]
mov rcx, r12
call fcn.1400172b0
mov al, byte [rsp + 0x4c]
mov ecx, 1
jmp 0x14003ab91
mov r12, qword [rsp + 0xbf0]
mov esi, dword [rsp + 0x48]
xor r14d, r14d
cmp bpl, r14b
jge 0x14003abda
cmp esi, r14d
jne 0x14003ac75
cmp bpl, 0xf0
jl 0x14003ac66
cmp byte [rsp + 0x19c], r14b
je 0x14003ac66
cmp edi, r14d
jne 0x14003abcc
cmp r15d, r14d
je 0x14003ac66
cmp byte [rsp + 0x19d], r14b
jne 0x14003ac66
cmp al, cl
jne 0x14003abf4
lea r8, [0x1400f9548]
lea rdx, [0x1400fee78]
mov rcx, r12
call fcn.1400172b0
mov r15d, 0x11
lea rdx, str.rescan__BEGIN
xor r8d, r8d
mov rcx, r12
mov r9d, r15d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.1400281e8
movsx ecx, bpl
and ecx, 7
call fcn.14001f15c
lea edx, [r15 + 0x21]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0xf8], rax
call fcn.14001d848
lea rdx, str.rescan__END
mov r9d, r15d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.1400281e8
cmp esi, r14d
jne 0x14003ac75
mov rax, qword [rsp + 0x40]
cmp word [rax], r14w
je 0x14003c05a
lea rcx, [rsp + 0xa0]
call fcn.14005a150
mov rcx, qword [rsp + 0x40]
call fcn.140019d38
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1400c6a44
mov r9d, r14d
mov qword [rsp + 0x40], rax
cmp esi, r14d
je 0x14003acbe
bt esi, 9
mov eax, 2
cmovae r9d, eax
or r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x140117d80]
mov qword [rsp + 0xb0], rax
cmp rax, 0xffffffffffffffff
jne 0x14003acee
mov qword [rsp + 0xb0], r14
cmp edi, r14d
je 0x14003c065
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x128], r14
call fcn.14005a150
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
movzx r9d, dil
mov dword [rsp + 0xf0], r9d
cmp r10, r11
je 0x14003ad3b
mov rcx, r10
call fcn.14001be68
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
mov r9d, dword [rsp + 0xf0]
and edi, 0xffffff00
mov r15, r11
mov qword [rsp + 0x130], r11
or edi, r9d
movzx r14d, r11w
mov word [rsp + 0xc08], r11w
mov dword [rsp + 0x48], edi
cmp r10, r11
je 0x14003aec1
cmp r13b, r11b
je 0x14003aec1
mov eax, 0x22
movzx ebp, r11w
mov rsi, r10
lea r13d, [rax + 5]
cmp ax, word [r10]
je 0x14003ad8e
cmp r13w, word [r10]
jne 0x14003ad96
mov bp, word [r10]
lea rsi, [r10 + 2]
mov rcx, rsi
call fcn.14001f1d4
mov r12d, r9d
cmp eax, r11d
cmovge r12d, eax
cmp eax, r11d
jl 0x14003ade2
lea rcx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 4]
mov rcx, rsi
movsxd r8, eax
lea r8, [r8 + r8 + 2]
call fcn.14001b760
mov r9d, dword [rsp + 0xf0]
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
cmp bp, r11w
je 0x14003aeb4
mov r10d, 2
jmp 0x14003adfc
add rsi, r10
cmp bp, ax
je 0x14003ae07
movzx eax, word [rsi]
cmp ax, r11w
jne 0x14003adf4
jmp 0x14003ae0a
mov r15, rsi
mov ebx, 0x22
movzx ebp, word [rsi]
cmp bx, bp
je 0x14003ae1d
cmp r13w, bp
jne 0x14003ae82
add rsi, r10
mov rcx, rsi
call fcn.14001f1d4
mov ecx, r9d
cmp eax, r11d
cmovge ecx, eax
cmp ecx, r12d
jne 0x14003ae82
cmp eax, r11d
jl 0x14003ae72
lea rcx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 4]
mov rcx, rsi
movsxd r8, eax
lea r8, [r8 + r8 + 2]
call fcn.14001b760
mov r9d, dword [rsp + 0xf0]
xor r11d, r11d
lea r10d, [r11 + 2]
jmp 0x14003ae72
add rsi, r10
cmp bp, ax
je 0x14003ae7d
movzx eax, word [rsi]
cmp ax, r11w
jne 0x14003ae6a
jmp 0x14003ae0f
mov r15, rsi
jmp 0x14003ae0f
mov r14w, word [r15]
mov ebx, dword [rsp + 0x100]
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
mov qword [rsp + 0x130], r15
mov word [rsp + 0xc08], r14w
cmp r14w, r11w
je 0x14003aeb4
mov word [r15], r11w
and edi, 0xffffff00
or edi, r12d
mov dword [rsp + 0x48], edi
mov cl, byte [rsp + 0xc00]
mov eax, edi
mov r8d, r11d
and eax, 0x806
cmp eax, 0x802
sete r8b
cmp eax, 0x800
jne 0x14003aef2
cmp cl, r11b
jne 0x14003aef2
mov r9d, 1
mov edx, r9d
jmp 0x14003aefb
mov edx, r11d
mov r9d, 1
mov eax, edi
and eax, 0x1006
cmp eax, 0x1004
jne 0x14003af11
cmp cl, r11b
mov ecx, r9d
je 0x14003af14
mov ecx, r11d
mov esi, r11d
mov eax, edi
and eax, 0x2002
cmp eax, 0x2000
sete sil
or ecx, edx
neg ecx
mov dword [rsp + 0x1e4], esi
sbb r13w, r13w
mov word [rsp + 0x64], r13w
test dil, 4
jne 0x14003af4a
mov ebp, r9d
cmp r8d, r11d
je 0x14003af4f
mov ebp, 2
mov dword [rsp + 0xe0], ebp
cmp r10, r11
je 0x14003af78
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r11d, r11d
movsxd rdi, eax
mov qword [rsp + 0x2b0], rdi
mov edi, dword [rsp + 0x48]
jmp 0x14003af80
mov qword [rsp + 0x2b0], r11
mov r12d, 0xfe
lea rcx, [rsp + 0x3f2]
xor edx, edx
mov r8, r12
mov word [rsp + 0x3f0], r11w
call fcn.1400dd9e0
xor eax, eax
lea rcx, [rsp + 0x2f2]
mov r8, r12
xor edx, edx
mov word [rsp + 0x2f0], ax
call fcn.1400dd9e0
xor ecx, ecx
mov eax, 0x20
mov dword [rsp + 0x280], eax
cmp byte [rsp + 0x98], cl
je 0x14003b70a
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
add r12, 2
lea r9d, [rax - 0xf]
lea rdx, str.DEVI_ID__BEGIN
mov qword [r12], rcx
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.1400281e8
xor r11d, r11d
cmp byte [rsp + 0x198], r11b
jne 0x14003b552
mov r9, qword [rsp + 0xb0]
cmp r9, r11
je 0x14003b552
mov r14, qword [rsp + 0x58]
mov ecx, r11d
mov rax, r12
mov dword [rsp + 0x120], ecx
sub rax, r14
cmp rax, 0x400000
jge 0x14003b541
mov edx, ecx
lea r8, [rsp + 0x280]
mov rcx, r9
call qword [0x140117da8]
xor r11d, r11d
cmp eax, r11d
je 0x14003b541
cmp edi, r11d
je 0x14003b0d2
cmp qword [rsp + 0x168], r11
je 0x14003b0c4
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x284]
xor r9d, r9d
mov r8d, 0x80
mov qword [rsp + 0x3f0], r11
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
jne 0x14003b517
mov eax, 2
test al, dil
jne 0x14003b445
mov rax, qword [0x140117dc8]
mov dword [rsp + 0x270], r11d
cmp rax, r11
je 0x14003b11d
mov r8d, dword [rsp + 0x294]
mov ecx, 0x20
lea rdx, [rsp + 0x270]
mov dword [rsp + 0x280], ecx
lea rcx, [rsp + 0x1f8]
xor r9d, r9d
mov dword [rsp + 0x1f8], 0x400
call rax
xor r11d, r11d
movsxd rsi, esi
movsx r15d, r13w
mov r14d, ebp
mov rdi, r12
mov qword [rsp + 0x1f8], r12
mov r13d, 1
mov qword [rsp + 0x278], rsi
mov ecx, dword [rsp + 0x58]
lea rbp, [r12 + 0x1fffc]
mov eax, 0xfffe
sub ecx, r12d
mov qword [rsp + 0x30], r11
mov qword [r12], r11
add ecx, 0x3f0002
lea rdx, [rsp + 0x280]
mov r8d, r14d
cmp ecx, eax
mov qword [rsp + 0x2b8], rbp
cmovg ecx, eax
mov eax, 0x20
xor r9d, r9d
mov dword [rsp + 0x280], eax
movsxd rax, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + rbp], r11
mov qword [rsp + 0x20], rbp
mov qword [rbp], r11
call qword [0x140117d88]
xor r11d, r11d
mov ecx, 0x20
mov dword [rsp + 0x280], ecx
cmp eax, r11d
je 0x14003b50e
cmp byte [rsp + 0x118], r11b
je 0x14003b2ac
mov rcx, qword [rsp + 0xc0]
cmp rcx, r11
je 0x14003b237
mov eax, dword [rsp + 0x48]
and eax, 2
cmp al, r11b
jne 0x14003b237
cmp r13d, r11d
je 0x14003b237
mov r8d, dword [rsp + 0x2b0]
mov r9d, pe_nt_image_headers64
mov rdx, rbp
call fcn.14002a6f4
xor r11d, r11d
cmp rax, r11
jne 0x14003b22e
test byte [rsp + 0x48], 8
je 0x14003b50e
lea eax, [r11 + 2]
cmp r14d, eax
je 0x14003b50e
mov r14d, eax
jmp 0x14003b140
cmp rsi, r11
jne 0x14003b42f
movsxd rdi, r15d
cmp word [rbp], r11w
je 0x14003b275
cmp rdi, r11
jl 0x14003b275
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x78]
call fcn.14001bff0
xor r11d, r11d
bt dword [rsp + 0x48], 0xa
jae 0x14003b275
mov rbp, qword [rsp + 0x2b8]
jmp 0x14003b23a
movsx eax, byte [rsp + 0xc00]
cmp r15d, eax
jge 0x14003b50e
mov rdi, qword [rsp + 0x1f8]
mov ecx, 1
mov eax, r11d
add r15d, ecx
cmp r14d, 2
mov r13d, r11d
setne al
lea r14d, [rcx + rax]
jmp 0x14003b140
lea rdx, str.ACPI
mov r8d, 4
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r11d, r11d
cmp eax, r11d
je 0x14003b50e
lea edx, [r11 + 1]
cmp r13d, edx
jne 0x14003b2fe
mov r8d, dword [rsp + 0x120]
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0xbf0]
mov r9, rbp
call fcn.1400172b0
xor r11d, r11d
lea edx, [r11 + 1]
movzx eax, word [rbp]
movzx esi, r11w
mov ecx, r11d
cmp ax, r11w
je 0x14003b403
mov r8d, 0x26
cmp ax, r8w
jne 0x14003b32d
movsx eax, byte [rsp + 0x11c]
add ecx, edx
cmp ecx, eax
jge 0x14003b33e
add si, dx
movzx eax, si
mov ax, word [rbp + rax*2]
cmp ax, r11w
jne 0x14003b319
cmp si, r11w
jbe 0x14003b403
cmp qword [rsp + 0x1f8], r12
jae 0x14003b37e
cmp word [rdi - 2], si
jne 0x14003b370
movzx r8d, si
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r11d, r11d
cmp eax, r11d
je 0x14003b3d5
movzx eax, word [rdi - 4]
lea rdi, [rdi + rax*2 + 6]
cmp rdi, r12
jb 0x14003b352
mov rcx, r12
mov word [r12 - 2], si
cmp rbp, r12
jne 0x14003b3b5
movzx eax, si
lea r12, [r12 + rax*2]
jmp 0x14003b399
add r12, 2
cmp word [r12], r11w
jne 0x14003b395
mov rbp, r12
jmp 0x14003b3c4
mov word [r12], ax
mov eax, 2
add r12, rax
add rbp, rax
movzx eax, word [rbp]
cmp ax, r11w
jne 0x14003b3a5
mov word [r12], r11w
mov rax, r12
sub rax, rcx
sar rax, 1
add r12, 6
mov word [rcx - 4], ax
mov esi, 2
cmp word [rbp], r11w
je 0x14003b3e6
add rbp, rsi
jmp 0x14003b3da
mov rdi, qword [rsp + 0x1f8]
add rbp, rsi
mov edx, 1
cmp word [rbp], r11w
jne 0x14003b2fe
jmp 0x14003b408
mov esi, 2
cmp byte [rsp + 0xc00], r11b
je 0x14003b503
cmp r14d, esi
je 0x14003b503
mov r14d, esi
mov rsi, qword [rsp + 0x278]
jmp 0x14003b140
mov esi, dword [rsp + 0x1e4]
movzx r13d, word [rsp + 0x64]
mov edi, dword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xb0]
lea r8, [rsp + 0x2f0]
lea rdx, [rsp + 0x280]
mov r9d, 0x80
mov qword [rsp + 0x2f0], r11
mov qword [rsp + 0x20], r11
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
mov rax, qword [rsp + 0xc0]
xor r11d, r11d
cmp rax, r11
je 0x14003b4a3
cmp esi, r11d
jne 0x14003b4a3
lea rcx, [rsp + 0x2f0]
mov rdx, rax
call fcn.14002a7f0
xor r11d, r11d
cmp eax, r11d
je 0x14003b517
bt edi, 0xa
jb 0x14003b4af
bt edi, 0xd
jb 0x14003b4bf
mov ebp, dword [rsp + 0xe0]
cmp esi, r11d
je 0x14003b0d2
mov ebp, dword [rsp + 0xe0]
cmp byte [rsp + 0x118], r11b
je 0x14003b0d2
lea rax, [rsp + 0x2f0]
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x278], rax
call fcn.14001bff0
xor r11d, r11d
jmp 0x14003b517
mov edi, dword [rsp + 0x48]
test sil, dil
jne 0x14003b582
jmp 0x14003b512
mov edi, dword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x120]
mov esi, dword [rsp + 0x1e4]
mov ebp, dword [rsp + 0xe0]
mov r13w, word [rsp + 0x64]
mov r9, qword [rsp + 0xb0]
inc ecx
jmp 0x14003b034
mov r15, qword [rsp + 0x130]
mov r14w, word [rsp + 0xc08]
mov r13d, dword [rsp + 0x118]
cmp r13b, r11b
je 0x14003b57d
cmp r14w, r11w
je 0x14003c089
mov word [r15], r14w
mov r10, r15
mov qword [rsp + 0xc0], r15
jmp 0x14003ad33
mov esi, 2
mov ebp, dword [rsp + 0xa8]
cmp ebp, r11d
je 0x14003b5a0
test sil, dil
je 0x14003b5a0
mov dword [rsp + 0x1e8], 1
jmp 0x14003b602
mov rdi, qword [rsp + 0x250]
mov dword [rsp + 0x1e8], r11d
cmp rdi, r11
je 0x14003b602
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
mov word [rcx], ax
lea r12, [rcx + 2]
mov word [r12], ax
add r12, rsi
inc eax
movsxd r10, eax
mov rcx, r12
add r10, r10
mov r8, r10
call fcn.14001b7a8
xor r11d, r11d
add r12, r10
mov word [r12], r11w
add r12, rsi
mov word [r12], r11w
add r12, rsi
mov qword [r12], r11
mov r13, qword [rsp + 0xbf0]
mov qword [rsp + 0x28], r11
lea rdx, str.DEVI_ID__END
mov r9d, 0x11
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], r11
call fcn.1400281e8
xor r14d, r14d
mov word [r12 - 2], r14w
mov r12, qword [rsp + 0x1c8]
cmp r12, r14
je 0x14003b71c
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], r14
call fcn.140016e9c
lea edx, [r14 + 0x26]
mov rdi, r12
mov rcx, rax
cmp dx, word [r12]
jne 0x14003b68e
lea eax, [rdx - 0x24]
add rdi, rax
cmp dx, word [rdi]
je 0x14003b686
cmp rcx, r14
jne 0x14003b6b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rsi
mov rdx, rdi
mov rcx, r13
movsxd r9, eax
mov qword [rsp + 0x20], 0x400032
call fcn.14001c4f8
jmp 0x14003b6fb
mov dl, byte [rcx + 0x1f]
and dl, 0xc0
cmp dl, 0xc0
jne 0x14003b6dc
mov rax, qword [rcx + 0x18]
movabs r8, 0x3fffffffffffffff
and rax, r8
cmp rax, 0x400032
jb 0x14003b6fb
cmp dl, r14b
je 0x14003b6e5
mov qword [rcx + 8], r14
lea rdx, [rcx + 0x18]
mov r9d, 0x400032
mov r8, rsi
add rcx, 8
call fcn.14005caa0
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003b71c
mov ebp, dword [rsp + 0xa8]
mov r13, qword [rsp + 0xbf0]
xor r14d, r14d
mov rsi, qword [rsp + 0xb0]
mov rcx, rsi
call qword [0x140117d90]
cmp byte [rsp + 0x198], r14b
jne 0x14003b74d
lea r8, [0x1400f9548]
lea rdx, [0x1400fcdf0]
mov rcx, r13
call fcn.1400172b0
mov rax, qword [rsp + 0x70]
movsxd r12, dword [rsp + 0x1d0]
mov r14d, 8
lea rdx, [0x1400fede8]
lea rcx, [rax + r12*2]
mov r8, r14
call fcn.14001b7a8
xor r13d, r13d
cmp ebp, r13d
jne 0x14003c273
cmp rsi, r13
je 0x14003c269
mov dl, byte [rsp + 0x198]
cmp dl, r13b
jne 0x14003b7bf
mov rax, qword [rsp + 0x58]
cmp word [rax], r13w
je 0x14003c1b6
cmp dword [rsp + 0x258], r13d
jne 0x14003c11b
cmp dword [rsp + 0x1e0], r13d
je 0x14003c11b
mov rax, qword [rsp + 0x150]
cmp rax, r13
je 0x14003b7da
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14003b913
mov esi, dword [rsp + 0x60]
mov cl, byte [rsp + 0x19c]
cmp esi, r13d
je 0x14003b7f9
cmp cl, r13b
jne 0x14003b802
cmp byte [rsp + 0x1a0], r13b
jne 0x14003b802
cmp cl, r13b
jne 0x14003b921
lea rcx, [rsp + 0x110]
call fcn.14005a150
lea r11, [0x1400fede0]
lea r9, str.devi
lea rcx, [rsp + 0x110]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r11
call fcn.140007428
lea rcx, [rsp + 0x228]
mov edx, 0x105
call fcn.14005a1c4
mov rdx, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x110]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov r11, qword [rsp + 0x228]
cmp word [r11], r13w
je 0x14003b888
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x110], r11
mov qword [rsp + 0x228], rax
lea rdx, [0x1400f9ae8]
lea rcx, [rsp + 0x110]
call fcn.14005a28c
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x208]
call fcn.140017f24
cmp byte [rsp + 0x19c], r13b
jne 0x14003b8e0
cmp byte [rsp + 0x1a0], r13b
jne 0x14003b8e0
mov rcx, rax
mov qword [rsp + 0x158], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [rsp + 0x196], ax
jmp 0x14003b8e8
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x228]
call fcn.140052160
lea rcx, [rsp + 0x110]
call fcn.140052160
mov dl, byte [rsp + 0x198]
mov rax, qword [rsp + 0x150]
jmp 0x14003b917
mov esi, dword [rsp + 0x60]
cmp byte [rsp + 0x19c], r13b
je 0x14003b945
cmp dl, r13b
jne 0x14003b945
cmp rax, r13
je 0x14003b945
mov cl, byte [rsp + 0x19d]
mov r14d, 1
cmp cl, r13b
cmove esi, r14d
mov dword [rsp + 0x60], esi
jmp 0x14003b952
mov cl, byte [rsp + 0x19d]
mov r14d, 1
cmp byte [rsp + 0x51], r13b
mov rbp, qword [rsp + 0x80]
cmovne rax, r13
mov qword [rsp + 0x150], rax
cmp cl, r13b
je 0x14003b980
cmp rax, r13
je 0x14003b980
cmp rbp, r13
cmovne esi, r13d
mov dword [rsp + 0x60], esi
neg rax
movzx eax, word [rsp + 0x194]
mov edi, 0xa
sbb r15d, r15d
shl eax, 0x10
lea rdx, str.INF_
not r15d
mov r8, rdi
and r15d, 3
or r15d, eax
mov rax, qword [rsp + 0x70]
lea rcx, [rax + r12*2]
call fcn.14001b7a8
lea rcx, [rsp + 0x230]
mov edx, 0x1040
call fcn.14005a1c4
lea rcx, [rsp + 0x744]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x740], r13d
call fcn.1400dd9e0
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x740]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0xd0], r13
call fcn.1400dceb0
cmp qword [rsp + 0xd0], r13
je 0x14003c254
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.140064d14
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xd8]
call fcn.14006bb5c
lea rdx, [0x1400f9ae8]
lea rcx, [rsp + 0xd8]
call fcn.14005a28c
lea rdx, str.DefaultInstall_132
lea rcx, [rsp + 0xe8]
call fcn.140064d14
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xd8]
mov r12d, eax
mov dword [rsp + 0xc00], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xd8]
movsxd rbx, eax
mov word [rcx + rbx*2], r13w
mov dword [rsp + 0xc08], ebx
cmp esi, r13d
jne 0x14003baaf
cmp byte [rsp + 0x198], r13b
je 0x14003bab2
mov r14d, r13d
mov rax, qword [rsp + 0x150]
neg rax
sbb ecx, ecx
and ecx, 0x20000
add ecx, 0x10000
or r15d, ecx
mov rdx, qword [rsp + 0x230]
lea rcx, [rsp + 0x140]
call fcn.140017cf0
test byte [rsp + 0x740], 0x10
jne 0x14003bf05
mov rax, qword [rsp + 0xd8]
movsxd rcx, ebx
lea rdx, [rsp + 0x76c]
mov word [rax + rcx*2], r13w
lea rcx, [rsp + 0xd8]
call fcn.14005a28c
mov rcx, qword [rsp + 0xd8]
lea r9, [rsp + 0x140]
lea r8, [0x140039240]
xor edx, edx
call qword [0x140117db0]
cmp esi, r13d
je 0x14003bcef
mov r13, qword [rsp + 0x178]
mov bl, byte [rsp + 0x4c]
cmp r13, qword [rsp + 0x170]
jae 0x14003bcd0
add r13, rdi
mov rbp, r13
movzx r12d, word [r13 - 2]
lea eax, [r12 + 2]
movsxd rcx, eax
lea rsi, [r13 + rcx*2]
mov ecx, 1
movzx eax, word [rsi - 2]
lea r13, [rsi + rax*2 + 2]
cmp bl, cl
jbe 0x14003bba2
lea rcx, [rsp + 0x140]
or r8d, 0xffffffff
mov rdx, rbp
call fcn.140017dc0
xor ecx, ecx
cmp rax, rcx
jne 0x14003bbc5
mov ecx, 1
xor eax, eax
mov edi, 4
cmp byte [rsp + 0x1a0], al
je 0x14003bbd7
lea rcx, [rsp + 0x140]
mov r8d, r15d
mov rdx, rsi
call fcn.14002f3b0
mov r12d, dword [rsp + 0xc00]
mov edi, 0xa
jmp 0x14003bb4a
mov edx, 3
cmp byte [rsp + 0x19c], dl
je 0x14003bbee
cmp byte [rsp + 0x19e], al
je 0x14003bc43
or edi, ecx
cmp byte [rsp + 0x19e], al
je 0x14003bc14
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov r8, rbp
mov rdx, rsi
call fcn.14002fd5c
mov r14, rax
jmp 0x14003bc36
cmp byte [rsp + 0x19c], dl
jne 0x14003bc38
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov r8, rbp
mov rdx, rsi
call fcn.14002fed8
mov r14d, eax
xor eax, eax
cmp r14d, eax
je 0x14003bbc5
test dil, 2
jne 0x14003bc83
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x140]
mov r9d, r15d
mov r8, rsi
mov rdx, rbp
or edi, 2
mov dword [rsp + 0x20], r12d
call fcn.14002f1fc
mov r14d, eax
xor eax, eax
cmp r14d, eax
je 0x14003bbc5
lea ecx, [rax + 1]
lea edx, [rax + 3]
test cl, dil
je 0x14003bbee
test dil, 4
jne 0x14003bbc5
mov rax, qword [rsp + 0xe8]
movsxd r12, dword [rsp + 0xc00]
xor edx, edx
mov word [rax + r12*2], dx
lea rcx, [rsp + 0xe8]
mov rdx, rsi
call fcn.14005a28c
mov r8, qword [rsp + 0xe8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.1400300dc
jmp 0x14003bbcd
mov esi, dword [rsp + 0x60]
mov ebx, dword [rsp + 0xc08]
xor r13d, r13d
cmp esi, r13d
jne 0x14003bf05
mov rbp, qword [rsp + 0x80]
cmp byte [rsp + 0x19d], r13b
je 0x14003bf05
cmp rbp, r13
je 0x14003bf05
mov rdx, qword [rsp + 0x150]
cmp rdx, r13
je 0x14003bf05
lea rcx, [rsp + 0x108]
call fcn.140064d14
lea rcx, [rsp + 0x108]
mov rdx, rbp
call fcn.14005a28c
lea rcx, [rsp + 0x240]
mov edx, 0x2800
call fcn.14005a1c4
mov r9, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x240]
lea r8, str.:_6R
mov edx, 0x27ff
call fcn.1400ded08
mov rdx, qword [rsp + 0x240]
lea rcx, [0x140117fa0]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400281e8
lea rcx, [rsp + 0x240]
call fcn.140052160
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.14002ef00
mov edi, 4
lea rbp, [0x1400f9548]
cmp rax, r13
lea ecx, [rdi - 1]
mov rsi, rax
cmovne rbp, rax
lea eax, [rdi - 2]
cmp byte [rsp + 0x19c], cl
je 0x14003bde2
cmp byte [rsp + 0x19e], r13b
je 0x14003be52
or edi, 1
cmp byte [rsp + 0x19e], r13b
je 0x14003be0d
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002fd5c
jmp 0x14003be32
cmp byte [rsp + 0x19c], cl
jne 0x14003be3a
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002fed8
mov r14d, eax
mov eax, 2
inc edi
cmp edi, eax
jge 0x14003bee6
cmp r14d, r13d
je 0x14003bee6
test al, dil
jne 0x14003bea4
or edi, eax
cmp rsi, r13
je 0x14003be86
mov r8, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
mov r9d, r15d
mov rdx, rsi
mov qword [rsp + 0x28], r13
or dword [rsp + 0x20], 0xffffffff
call fcn.14002f1fc
mov r14d, eax
mov eax, 2
inc edi
cmp edi, eax
jge 0x14003bee6
cmp rsi, r13
je 0x14003be96
cmp r14d, r13d
je 0x14003bee6
mov ecx, 3
test al, dil
je 0x14003bde2
test dil, 4
jne 0x14003bee6
mov rax, qword [rsp + 0xe8]
movsxd rcx, r12d
mov word [rax + rcx*2], r13w
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xe8]
call fcn.14005a28c
mov r8, qword [rsp + 0xe8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.1400300dc
cmp rsi, r13
je 0x14003beef
mov word [rsi], r13w
lea rcx, [rsp + 0x108]
call fcn.140052160
mov esi, dword [rsp + 0x60]
mov edi, 0xa
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rbp, qword [rsp + 0x80]
cmp eax, r13d
jne 0x14003bace
mov rcx, qword [rsp + 0xd0]
mov ebx, dword [rsp + 0x100]
cmp rcx, r13
je 0x14003bf4c
cmp rcx, 0xffffffffffffffff
je 0x14003bf4c
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x1f0]
cmp r14d, r13d
cmove rdi, r13
mov ecx, 0x5f
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xf8], rdi
mov word [rax], cx
cmp esi, r13d
je 0x14003c1c0
cmp qword [rsp + 0x150], r13
je 0x14003c1c0
lea r14d, [rcx - 0x5e]
cmp byte [rsp + 0x19c], r14b
jne 0x14003c1c0
cmp byte [rsp + 0x51], r13b
jne 0x14003c1c0
mov rax, rbp
cmp rax, r13
jne 0x14003c1c0
cmp byte [rsp + 0x88], r13b
jne 0x14003c1c0
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x51], r14b
call fcn.140052160
lea rcx, [rsp + 0xd8]
call fcn.140052160
mov rcx, qword [rsp + 0xd0]
cmp rcx, r13
je 0x14003c009
cmp rcx, 0xffffffffffffffff
je 0x14003c009
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x230]
mov qword [rsp + 0xd0], r13
call fcn.140052160
lea rcx, [rsp + 0x78]
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
mov dil, byte [rsp + 0x4c]
mov r12, qword [rsp + 0xbf8]
jmp 0x1400394f1
mov rbp, 0xffffffff80070057
jmp 0x14003c081
xor r13d, r13d
mov rbp, r13
jmp 0x14003c3ea
lea rcx, [rsp + 0xa0]
mov ebp, 1
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
xor r13d, r13d
jmp 0x14003c3f4
mov r12b, byte [rsp + 0x4f]
mov r8, qword [rsp + 0x78]
cmp r12b, r11b
je 0x14003c0d8
cmp word [r8], r11w
je 0x14003c0d8
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xd
movsxd rcx, eax
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], dx
mov rax, qword [rsp + 0x78]
mov edx, 0xa
mov word [rax + rcx*2 + 2], dx
mov rax, qword [rsp + 0x78]
xor edx, edx
mov word [rax + rcx*2 + 4], dx
mov r8, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xbf0]
mov rdx, qword [rsp + 0x268]
mov rcx, rbx
call fcn.1400596c4
xor eax, eax
lea rcx, [rsp + 0x78]
mov rbp, rax
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
jmp 0x14003c8f7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
sub eax, r9d
cmp eax, r9d
jl 0x14003c15a
mov rdx, qword [rsp + 0x40]
lea r8d, [r9 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2]
je 0x14003c152
lea r8d, [r9 + 0x2e]
cmp r8w, word [rdx + rcx*2]
jne 0x14003c15a
mov word [rdx + rcx*2], r13w
sub eax, r9d
cmp eax, r13d
jge 0x14003c16b
mov rbp, 0xffffffff80070057
jmp 0x14003c3d3
mov rdx, qword [rsp + 0xc8]
cmp rdx, r13
je 0x14003c184
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and rdx, rcx
mov rcx, qword [rsp + 0x248]
mov r9b, byte [rsp + 0x50]
mov r8, rdx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x140]
or r9b, 0x10
call fcn.1400388c4
mov ebp, eax
jmp 0x14003c3d3
mov ebp, 0x491
jmp 0x14003c3d3
mov rcx, qword [rsp + 0xbf0]
lea r8, [0x1400f9548]
lea rdx, [0x1400fcdf0]
mov qword [rsp + 0x150], r13
call fcn.1400172b0
lea rcx, [rsp + 0xe8]
call fcn.140052160
lea rcx, [rsp + 0xd8]
call fcn.140052160
mov rcx, qword [rsp + 0xd0]
cmp rcx, r13
je 0x14003c216
cmp rcx, 0xffffffffffffffff
je 0x14003c216
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x230]
mov qword [rsp + 0xd0], r13
call fcn.140052160
lea rcx, [rsp + 0x78]
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
mov rbp, rdi
jmp 0x14003c3f4
mov qword [rsp + 0xd0], r13
lea rcx, [rsp + 0x230]
jmp 0x14003c3c9
mov ebp, 1
jmp 0x14003c3d3
mov esi, r13d
cmp dword [rsp + 0x60], r13d
jne 0x14003c2bd
mov rax, qword [rsp + 0x58]
cmp word [rax], r13w
jne 0x14003c2bd
cmp byte [rsp + 0x19d], r13b
jne 0x14003c2bd
lea rcx, [rsp + 0x78]
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
mov ebp, 0x491
jmp 0x14003ccf1
lea r15d, [r12 + 4]
lea rcx, [rsp + 0xf8]
lea eax, [r15 + 0x3c]
movsxd rdx, eax
call fcn.14005a1c4
mov rax, qword [rsp + 0x70]
lea rdx, str.System32DRIVERS
lea rcx, [rax + r12*2]
mov r8d, 0x22
mov rdi, r12
call fcn.14001b7a8
mov rcx, qword [rsp + 0x70]
call fcn.1400dce2c
cmp eax, r13d
jne 0x14003c310
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x70]
lea rdx, [0x1400fede8]
mov r8, r14
lea rcx, [rax + r12*2]
call fcn.14001b7a8
mov rcx, qword [rsp + 0x70]
call fcn.1400dce2c
cmp eax, r13d
jne 0x14003c344
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x70]
lea rdx, str.INF_
mov r8d, 0xa
lea rcx, [rax + r12*2]
call fcn.14001b7a8
movzx r12d, word [rsp + 0x194]
lea rcx, [rsp + 0x4f4]
xor edx, edx
mov r8d, 0x24c
shl r12d, 0x10
mov dword [rsp + 0x4f0], r13d
call fcn.1400dd9e0
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0xb0], r13
call fcn.1400dceb0
cmp qword [rsp + 0xb0], r13
jne 0x14003c43b
mov qword [rsp + 0xb0], r13
lea rcx, [rsp + 0xf8]
mov ebp, 2
call fcn.140052160
lea rcx, [rsp + 0x78]
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
cmp ebx, r13d
jle 0x14003c41c
lea rcx, [0x140118098]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov ecx, ebx
call fcn.1400c5ff8
lea rcx, [0x140118098]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x208]
call fcn.140030080
lea rcx, [rsp + 0x218]
call fcn.140030080
jmp 0x14003c8ef
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140064d14
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.14006bb5c
lea rdx, [0x1400f9ae8]
lea rcx, [rsp + 0x58]
call fcn.14005a28c
mov rbx, qword [rsp + 0xb8]
cmp rbx, r13
je 0x14003c47d
cmp word [rbx], r13w
jne 0x14003c484
lea rbx, [0x1400fed60]
mov rdx, qword [rsp + 0xc8]
cmp rdx, r13
je 0x14003c497
cmp word [rdx], r13w
jne 0x14003c49e
lea rdx, str.DefaultInstall
lea rcx, [rsp + 0x80]
call fcn.140064d14
lea rdx, [0x1400fa108]
lea rcx, [rsp + 0x80]
call fcn.14005a28c
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.14005a28c
lea rdx, [0x1400fa108]
lea rcx, [rsp + 0x80]
call fcn.14005a28c
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0xc00], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0xc08], eax
test byte [rsp + 0x4f0], 0x10
jne 0x14003c82f
mov rcx, qword [rsp + 0x58]
movsxd rdx, eax
mov word [rcx + rdx*2], r13w
lea rdx, [rsp + 0x51c]
lea rcx, [rsp + 0x58]
call fcn.14005a28c
mov r14, qword [rsp + 0x58]
lea rcx, [rsp + 0xb8]
mov dil, r13b
call fcn.14005a150
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x128], r13
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0xb8]
mov rcx, r14
mov word [rax], r13w
call fcn.1400c6a44
mov rcx, qword [rsp + 0x128]
mov rdx, qword [rsp + 0xb8]
sub rcx, rdx
mov qword [rsp + 0x40], rax
movsxd rax, r15d
sar rcx, 1
cmp rax, rcx
jne 0x14003c5b8
mov rcx, qword [rsp + 0x70]
mov r8d, r15d
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
movzx edi, r13b
cmp eax, r13d
mov eax, 1
cmove edi, eax
cmp dword [rsp + 0x1e8], r13d
je 0x14003c5cf
mov rax, qword [rsp + 0xc0]
cmp rax, r13
jne 0x14003c5e4
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.14002ef00
mov rbx, rax
cmp byte [rsp + 0x19d], r13b
jne 0x14003c610
mov eax, dword [rsp + 0x60]
cmp eax, r13d
jne 0x14003c678
cmp byte [rsp + 0x4d], r13b
je 0x14003c606
cmp dil, r13b
jne 0x14003c678
cmp rbx, r13
jne 0x14003c67d
jmp 0x14003c822
lea rcx, [rsp + 0xc8]
mov edx, 0x2800
call fcn.14005a1c4
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc8]
lea r8, str.:_6R
mov edx, 0x27ff
call fcn.1400ded08
mov rdx, qword [rsp + 0xc8]
lea rcx, [0x140117fa0]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400281e8
lea rcx, [rsp + 0xc8]
call fcn.140052160
mov eax, dword [rsp + 0x60]
cmp rbx, r13
je 0x14003c682
movzx r13d, word [rbx - 4]
xor edx, edx
lea rbp, [0x1400f9548]
cmp rbx, rdx
lea edi, [rdx + 4]
cmovne rbp, rbx
cmp eax, edx
jne 0x14003c77c
cmp byte [rsp + 0x1a0], dl
jne 0x14003c785
lea ecx, [rdx + 3]
cmp byte [rsp + 0x19c], cl
je 0x14003c6bf
cmp byte [rsp + 0x19e], dl
je 0x14003c727
mov eax, 1
or edi, eax
cmp byte [rsp + 0x19e], dl
je 0x14003c6ed
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002fd5c
mov rsi, rax
jmp 0x14003c711
cmp byte [rsp + 0x19c], cl
jne 0x14003c713
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002fed8
mov esi, eax
xor edx, edx
cmp esi, edx
je 0x14003c802
mov eax, 2
test al, dil
jne 0x14003c772
jmp 0x14003c72c
mov eax, 2
or edi, eax
cmp rbx, rdx
je 0x14003c761
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
or dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov rdx, rbx
call fcn.14002f1fc
xor edx, edx
mov esi, eax
cmp eax, edx
je 0x14003c802
mov eax, 1
lea ecx, [rax + 2]
test al, dil
je 0x14003c6c4
test dil, 4
jne 0x14003c802
cmp byte [rsp + 0x1a0], dl
je 0x14003c79c
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
mov r8d, r12d
call fcn.14002f3b0
jmp 0x14003c802
cmp byte [rsp + 0x19f], dl
jne 0x14003c802
movsxd rcx, dword [rsp + 0xc00]
mov rax, qword [rsp + 0x80]
mov word [rax + rcx*2], dx
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.14005a28c
mov r8, qword [rsp + 0x80]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call fcn.1400300dc
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x14003c802
cmp qword [rsp + 0x160], rax
je 0x14003c802
lea rcx, [rsp + 0x140]
mov r8d, r13d
mov rdx, rbp
call fcn.140017dec
xor r13d, r13d
cmp rbx, r13
je 0x14003c80e
mov word [rbx], r13w
mov rcx, qword [rsp + 0xf8]
cmp word [rcx], r13w
je 0x14003c822
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xb8]
call fcn.140052160
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
mov eax, dword [rsp + 0xc08]
jne 0x14003c50a
lea rcx, [rsp + 0x80]
call fcn.140052160
lea rcx, [rsp + 0x58]
call fcn.140052160
mov rcx, qword [rsp + 0xb0]
movsxd rbx, esi
cmp rcx, r13
je 0x14003c888
cmp rcx, 0xffffffffffffffff
je 0x14003c888
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0xb0], r13
call fcn.140052160
lea rcx, [rsp + 0x78]
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
mov rbp, rbx
jmp 0x14003ccf1
movsx edx, bpl
xor ecx, ecx
and edx, 0x12
call fcn.1400c5ff8
xor eax, eax
mov rbp, rax
jmp 0x14003ccf1
cmp qword [rsp + 0x90], r8
jne 0x14003c909
mov rbp, 0xffffffff80070057
mov rbx, qword [rsp + 0xbf0]
lea rsi, str.__DEVI.REBOOT
mov r15d, 0x40
jmp 0x14003cc22
mov ebp, 2
lea rcx, [rsp + 0xc08]
mov rdx, rbp
call fcn.14005a1c4
mov rax, qword [rsp + 0xc08]
xor r13d, r13d
mov word [rax], r13w
mov r10, qword [rsp + 0x90]
lea r14d, [rbp + 0x38]
mov qword [rsp + 0x250], r10
cmp dil, 0x12
je 0x14003c950
lea eax, [rbp + 0x24]
cmp ax, word [r10]
jne 0x14003c995
mov rsi, r10
jmp 0x14003c970
cmp r14w, ax
je 0x14003c97c
mov ecx, 0x3d
cmp cx, ax
je 0x14003c97c
add r10, rbp
mov qword [rsp + 0x90], r10
movzx eax, word [r10]
cmp ax, r13w
jne 0x14003c955
jmp 0x14003c99c
mov word [r10], r13w
mov r10, qword [rsp + 0x90]
add r10, rbp
mov qword [rsp + 0x90], r10
jmp 0x14003c99c
lea rsi, str.__DEVI.REBOOT
mov r12b, byte [rsp + 0x4f]
mov ebx, 1
lea r15d, [rbx + 0x3f]
jmp 0x14003c9b1
mov ebp, 2
mov r8d, 0x22
cmp r8w, word [r10]
je 0x14003c9d8
lea edx, [r8 + 5]
cmp dx, word [r10]
je 0x14003c9d8
lea rax, [0x1400f9548]
mov qword [rsp + 0x90], rax
jmp 0x14003ca28
movsx eax, byte [r10]
lea rcx, [rsp + 0x90]
add r10, 2
movzx edx, ax
mov qword [rsp + 0x90], r10
call fcn.1400cb7a8
mov rcx, qword [rsp + 0x90]
cmp word [rcx], r13w
je 0x14003ca12
mov word [rcx], r13w
add qword [rsp + 0x90], rbp
lea rcx, [rsp + 0x90]
call fcn.1400157dc
mov edx, 0x27
lea r8d, [rdx - 5]
movzx eax, word [r10]
mov ecx, 0x68
mov r9d, r13d
or ax, 0x20
cmp cx, ax
jne 0x14003ca4c
cmp r14w, word [r10 + 2]
jne 0x14003ca4c
mov r9d, 0x200
jmp 0x14003ca8c
mov ecx, 0x63
cmp cx, ax
jne 0x14003ca65
cmp r14w, word [r10 + 2]
jne 0x14003ca65
mov r9d, 0x400
jmp 0x14003ca8c
mov eax, 0x2b
cmp ax, word [r10]
jne 0x14003ca7f
cmp r14w, word [r10 + 2]
jne 0x14003ca7f
mov r9d, 0x600
jmp 0x14003ca8c
cmp r15w, word [r10]
jne 0x14003ca90
cmp r14w, word [r10 + 2]
jne 0x14003ca90
add r10, 4
cmp r8w, word [r10]
je 0x14003ca9c
cmp dx, word [r10]
jne 0x14003cad3
movsx edx, byte [r10]
lea rcx, [rsp + 0xc00]
add r10, rbp
mov qword [rsp + 0xc00], r10
call fcn.1400cb7a8
mov rcx, qword [rsp + 0xc00]
mov edx, 0x27
lea r8d, [rdx - 5]
cmp word [rcx], r13w
je 0x14003cad3
mov word [rcx], r13w
cmp dil, 0x11
jne 0x14003cb90
mov rax, r10
mov r11, r13
mov qword [rsp + 0xc00], rax
cmp r8w, word [r10]
je 0x14003caf7
cmp dx, word [r10]
jne 0x14003cb41
movsx edx, byte [r10]
lea rcx, [rsp + 0xc00]
add r10, 2
mov qword [rsp + 0xc00], r10
call fcn.1400cb7a8
mov rcx, qword [rsp + 0xc00]
cmp word [rcx], r13w
je 0x14003cb63
mov word [rcx], r13w
mov rax, qword [rsp + 0xc00]
jmp 0x14003cb36
cmp r14w, cx
je 0x14003cb4c
add rax, rbp
mov qword [rsp + 0xc00], rax
movzx ecx, word [rax]
cmp cx, r13w
jne 0x14003cb30
jmp 0x14003cb63
mov word [rax], r13w
mov r11, qword [rsp + 0xc00]
add r11, rbp
mov qword [rsp + 0xc00], r11
lea rax, [rsp + 0x19a]
lea rcx, [rsp + 0x140]
mov r9d, ebx
mov qword [rsp + 0x28], rax
mov r8, r11
mov rdx, r10
mov dword [rsp + 0x20], 0xfffffff0
call fcn.14002f1fc
jmp 0x14003cbcd
mov al, r12b
mov r8d, pe_nt_image_headers64
mov rdx, r10
neg al
movsx eax, dil
sbb ecx, ecx
and ecx, 0x10000
or ecx, eax
lea rax, [rsp + 0x19a]
or ecx, r9d
lea r9, [rsp + 0xc08]
mov qword [rsp + 0x20], rax
bts ecx, 0xb
call fcn.1400673dc
mov r10, qword [rsp + 0x90]
movsxd rbp, eax
cmp word [r10], r13w
jne 0x14003c9ac
mov rbx, qword [rsp + 0x250]
cmp dil, 0x12
jne 0x14003cc0d
mov r8, qword [rsp + 0xc08]
mov rdx, rbx
mov rbx, qword [rsp + 0xbf0]
mov rcx, rbx
call fcn.1400596c4
jmp 0x14003cc15
mov rbx, qword [rsp + 0xbf0]
lea rcx, [rsp + 0xc08]
call fcn.140052160
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x2d8]
call fcn.140017f44
lea rax, [rsp + 0x19a]
cmp word [rax], r15w
je 0x14003cc5a
movzx edx, word [rax]
lea r9, str.0x_X
mov r8, rsi
mov rcx, rbx
call fcn.14005d144
xor edx, edx
mov rcx, rbx
call fcn.14008df1c
jmp 0x14003ccf1
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0xc08]
xor edx, edx
mov r8d, 0x1e5
mov qword [rsp + 0xc08], rax
call fcn.1400256a8
mov rbx, qword [rsp + 0xc08]
mov qword [rsp + 0x40], rax
xor eax, eax
cmp word [rbx], ax
jne 0x14003cca8
mov rbp, 0xffffffff80070057
jmp 0x14003ccf1
lea rdx, str.35:INDATABuildInfCache
lea rcx, [rsp + 0xc00]
call fcn.140064d14
lea rcx, [rsp + 0xc00]
mov rdx, rbx
call fcn.14005a28c
mov rdx, qword [rsp + 0xc00]
mov rcx, qword [rsp + 0xbf0]
call fcn.140045210
lea rcx, [rsp + 0xc00]
mov rbp, rax
call fcn.140052160
lea rcx, [rsp + 0x1c0]
call fcn.140052160
lea rcx, [rsp + 0x70]
call fcn.140052160
lea rcx, [rsp + 0x218]
call fcn.140052160
lea rcx, [rsp + 0x208]
call fcn.140052160
lea rcx, [rsp + 0x260]
call fcn.140052160
lea rcx, [rsp + 0x1f0]
call fcn.140052160
lea rcx, [rsp + 0x210]
call fcn.140052160
mov rax, rbp
add rsp, 0xba8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret