Function at 0x14010c000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rbp + 0x1a0], rbx
mov rsi, rcx
xor r12d, r12d
mov dword [rbp + 0x30], r12d
mov word [rbp], 0x6573
mov dword [rbp + 5], 0x2e697061
mov word [rbp + 3], 0x7075
mov word [rbp + 0xa], 0x6c6c
mov byte [rbp + 0xc], r12b
mov byte [rbp + 9], 0x64
mov byte [rbp + 2], reloc.WS2_32.dll_WSACleanup
mov dword [rbp + 0x20], 0x706f7250
mov dword [rbp + 0x13], 0x69447075
mov dword [rbp + 0x1b], 0x63697665
mov dword [rbp + 0x17], 0x44746547
mov word [rbp + 0x27], 0x5779
mov word [rbp + 0x24], 0x7265
mov word [rbp + 0x11], 0x7465
mov byte [rbp + 0x29], r12b
mov byte [rbp + 0x10], 0x53
mov byte [rbp + 0x1f], 0x65
mov byte [rbp + 0x26], reloc.WS2_32.dll_WSACleanup
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14010c0b9
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140181578], rax
jmp 0x14010c0c0
mov rax, qword [0x140181578]
test rax, rax
jne 0x14010c0d9
lea rdx, [0x14015b600]
mov rcx, rsi
call fcn.14001f150
jmp 0x14010c3cc
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x60]
call fcn.14009c0b0
call fcn.140020290
mov rcx, rax
test rax, rax
jne 0x14010c102
mov ecx, 0x80004005
call fcn.14001fe40
int3
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
lea r8, vtable.ATL::CAtlStringMgr.0
cmp rax, r8
jne 0x14010c11f
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
jmp 0x14010c121
call rdx
add rax, 0x18
mov qword [rbp + 0x1b8], rax
mov r9d, 0xa
xor r8d, r8d
xor edx, edx
lea rcx, [0x140144880]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov r14, rax
mov r15d, r12d
or rdi, 0xffffffffffffffff
movabs r13, 0xffffffffffffff0
nop dword [rax + rax]
xor eax, eax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x38], reloc.WLDAP32.dll_Ordinal_32
lea r8, [rbp + 0x38]
mov edx, r15d
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14010c19e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x14010c369
mov dword [rbp + 0x1a8], r12d
mov dword [rsp + 0x38], r12d
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x100
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1b0]
lea r8, [0x14015b880]
lea rdx, [rbp + 0x38]
mov rcx, r14
call qword [0x140181578]
mov eax, dword [rbp + 0x1a8]
mov word [rbp + rax*2 + 0x60], r12w
inc r15d
mov rax, qword [rbp + 0x1b8]
cmp dword [rax - 0x10], 0
jne 0x14010c2a9
lea rax, [rbp + 0x60]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14010c210
inc ecx
cmp ecx, 0x3fffffff
jg 0x14010c28c
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14010c236
mov rdx, r13
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14006ea10
sub rsp, rdx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14010c28c
mov byte [rbx], 0
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [rbp + 0x60]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14010c28c
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x14010c281
jmp 0x14010c292
mov rbx, r12
mov eax, r12d
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x1b8]
call fcn.14001f7c0
jmp 0x14010c160
mov r8d, 2
lea rdx, [0x14015b870]
lea rcx, [rbp + 0x1b8]
call fcn.140020490
lea rax, [rbp + 0x60]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14010c2d0
inc ecx
cmp ecx, 0x3fffffff
jg 0x14010c34c
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14010c2f6
mov rdx, r13
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14006ea10
sub rsp, rdx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14010c34c
mov byte [rbx], 0
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [rbp + 0x60]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14010c34c
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x14010c341
jmp 0x14010c352
mov rbx, r12
mov eax, r12d
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x1b8]
call fcn.140020490
jmp 0x14010c160
test r14, r14
je 0x14010c377
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rbx, qword [rbp + 0x1b8]
add rbx, 0xffffffffffffffe8
mov rcx, rbx
call fcn.14001f3e0
add rax, 0x18
mov qword [rsi], rax
lock xadd dword [rbx + 0x10], edi
sub edi, 1
jg 0x14010c3cc
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rdx, vtable.ATL::CAtlStringMgr.0
cmp rax, rdx
jne 0x14010c3c6
mov rcx, qword [rcx + 8]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14010c3cc
mov rdx, rbx
call r8
mov rax, rsi
mov rbx, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x160]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret