Function at 0x10036e4
Capabilities:
Create thread
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x01007100]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov dword [rsp + 0x40], ecx
xor r14d, r14d
mov r15, rdx
mov rsi, rdx
mov qword [rsp + 0x30], r14
lea rcx, [0x01001e78]
or r13, 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x01007420], rax
cmp rax, r13
jne 0x1003784
lea rcx, [0x01001e98]
call qword [sym.imp.msvcrt.dll_printf]
lea rcx, [0x01001ed0]
call qword [sym.imp.msvcrt.dll_printf]
lea eax, [r14 - 0xc]
jmp 0x1003d5f
call fcn.010022e0
mov edi, 2
cmp eax, r14d
je 0x10037a9
lea rcx, [0x01001f28]
call fcn.010024fc
mov edi, 0xfffffff5
jmp 0x1003c9a
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rax, qword [0x01008008]
cmp rax, r14
je 0x10038af
lea rcx, [rsp + 0x50]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
mov r9d, 1
call rax
movsxd rcx, dword [rsp + 0x40]
mov edx, 8
call qword [sym.imp.msvcrt.dll_calloc]
mov ecx, dword [rsp + 0x40]
mov r12d, r14d
cmp ecx, r14d
mov rsi, rax
jle 0x10038bf
mov rbx, r14
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov r13, qword [rbx + rcx]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov r8, r13
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbp, eax
cmp ebp, 1
jle 0x100388d
mov rcx, rbp
mov edx, 1
call qword [sym.imp.msvcrt.dll_calloc]
mov rdi, rax
cmp rax, r14
je 0x100388d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
mov r8, r13
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebp
je 0x1003890
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rdi, r14
mov qword [rbx + rsi], rdi
mov ecx, dword [rsp + 0x40]
inc r12d
add rbx, 8
cmp r12d, ecx
jl 0x100380a
mov edi, 2
jmp 0x10038bf
lea rcx, [0x01001f40]
call fcn.010024fc
mov ecx, dword [rsp + 0x40]
cmp ecx, edi
jge 0x10038df
mov rdx, qword [rsi]
lea rcx, [0x01001f70]
call qword [sym.imp.msvcrt.dll_printf]
lea rcx, [0x01001f88]
call fcn.010024fc
mov rbp, qword [rsi + 8]
lea rcx, [0x01001fa8]
mov rdx, rbp
call fcn.010024fc
lea rcx, [0x01001fbc]
call fcn.01002138
mov rdx, rdi
mov edi, 0x200
mov rcx, rdi
mov r12, rax
call qword [sym.imp.msvcrt.dll_calloc]
lea r9, [rsp + 0x60]
mov edx, edi
mov r8, rax
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp edi, r14d
je 0x1003978
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp eax, r14d
jne 0x1003978
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp rbx, r14
je 0x1003986
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
cmp r12, r14
je 0x1003994
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, r14d
je 0x1003c84
cmp edi, 0x200
ja 0x1003c84
xor eax, eax
or r12, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
lea r13d, [rax + 1]
mov rcx, r12
mov ebx, 0x1ff
repne scasb al, byte [rdi]
lea eax, [r12 + 3]
mov r8, rbx
not rcx
lea rdx, [0x01001ff8]
sub rcx, r13
sub r8, rcx
lea rcx, [rsp + 0x70]
cmp r8, rax
cmova r8, rax
call qword [sym.imp.msvcrt.dll_strncat]
cmp rbp, r14
jne 0x10039ff
mov rdx, r14
jmp 0x1003a12
xor eax, eax
mov rcx, r12
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
sub rcx, r13
mov rdx, rcx
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, r12
repne scasb al, byte [rdi]
lea rax, [rdx + 1]
not rcx
sub rcx, r13
sub rbx, rcx
cmp rax, rbx
jae 0x1003a4e
cmp rbp, r14
jne 0x1003a3a
mov rcx, r14
jmp 0x1003a4a
xor eax, eax
mov rcx, r12
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
sub rcx, r13
lea rbx, [rcx + 1]
lea rcx, [rsp + 0x70]
mov r8, rbx
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_strncat]
mov ecx, 2
call fcn.0100273c
mov ecx, 3
mov r12, rax
call fcn.0100273c
mov ecx, 4
mov rbx, rax
call fcn.0100273c
lea rdx, [0x01008010]
mov rcx, rax
call sub.ADVAPI32.dll_ConvertStringSidToSidA
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
mov qword [0x01007428], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [0x01002a8c]
xor r8d, r8d
xor edx, edx
mov qword [0x01007430], rax
call qword [sym.imp.msvcrt.dll__beginthread]
mov r13, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x1003af9
mov rcx, qword [0x01007428]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, r14d
je 0x1003b12
lea rcx, [0x01002000]
call fcn.010024fc
mov rcx, qword [0x01007430]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 1
call fcn.0100324c
mov cl, 5
call fcn.010025a8
cmp rbx, r14
je 0x1003bed
lea rcx, [0x01002028]
mov rdx, rbx
call fcn.010024fc
mov rcx, rbx
call fcn.01002138
lea rcx, [rsp + 0x70]
mov rbp, rax
call fcn.01002138
mov r9d, 1
mov rdx, rbp
xor ecx, ecx
mov r8, rax
mov rdi, rax
mov qword [rsp + 0x20], r14
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesW
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rbp, rbp
je 0x1003b85
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
test rdi, rdi
je 0x1003b93
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov cl, 6
call fcn.010025a8
cmp r13d, 1
jne 0x1003bc8
lea rcx, [0x01002058]
call fcn.010024fc
mov rcx, r12
call fcn.0100280c
xor r14d, r14d
mov edi, r14d
jmp 0x1003c95
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x70]
mov ecx, eax
call fcn.01003074
xor r14d, r14d
mov edi, eax
cmp eax, r14d
jne 0x1003c95
mov r13, qword [rsp + 0x48]
lea rcx, [0x01002070]
call fcn.010024fc
mov cl, 5
call fcn.010025a8
mov qword [rsp + 0x38], r14
xor r9d, r9d
lea rax, [rsp + 0x270]
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x70]
lea r8d, [r9 + 1]
xor edx, edx
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call fcn.010021d0
mov cl, 6
mov edi, eax
call fcn.010025a8
cmp edi, r14d
je 0x1003c61
lea rdx, [rsp + 0x270]
lea rcx, [0x010020b8]
call fcn.010024fc
mov rcx, r12
mov edi, r14d
call fcn.0100280c
jmp 0x1003c9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x70]
mov ecx, eax
call fcn.01003074
mov edi, eax
cmp eax, r14d
jne 0x1003c9a
mov rcx, rbx
call fcn.010028a4
jmp 0x1003c9a
lea rcx, [0x01001fc0]
call fcn.010024fc
mov edi, 0xfffffffd
mov r13, qword [rsp + 0x48]
mov cl, 8
call fcn.010025a8
mov rcx, qword [0x01007420]
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov r8d, 2
mov byte [rsp + 0x44], 7
mov byte [rsp + 0x45], dil
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
call fcn.0100324c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x01007430]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp rsi, r15
je 0x1003d2d
mov eax, dword [rsp + 0x40]
mov ebp, r14d
cmp eax, r14d
jle 0x1003d1f
mov rbx, rsi
mov rcx, qword [rbx]
cmp rcx, r14
je 0x1003d15
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx], r14
mov eax, dword [rsp + 0x40]
inc ebp
add rbx, 8
cmp ebp, eax
jl 0x1003d00
cmp rsi, r14
je 0x1003d2d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x01007428]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x01007430]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x01007420]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.010040a0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret