Function at 0x140032808
Capabilities:
Create directory
Delete file
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa78
mov rdi, rcx
lea rcx, [0x1400f2c58]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.1400121e0
mov rcx, qword [0x1400f1ca0]
lea r8, [rsp + 0x860]
xor r14d, r14d
mov r9d, 0x104
mov edx, 0x2711
mov byte [0x1400f1d52], r14b
call fcn.140045194
lea rcx, [rsp + 0x98]
mov ebx, 0x80000000
mov qword [0x1400f1d40], r14
mov qword [0x1400f1d48], r14
mov dword [rsp + 0xb0], ebx
mov qword [rsp + 0x1a8], rax
call fcn.14004be6c
lea rcx, [rsp + 0xa0]
call fcn.14004be6c
lea rdx, [0x1400dafd8]
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0xf0], r14
call fcn.140058920
lea rax, [rsp + 0x198]
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x158], rdi
mov byte [0x1400f1cb4], r14b
mov qword [0x1400f1d38], r14
mov qword [0x1400f1d30], rax
call fcn.140013e20
mov byte [rsp + 0x4f], r14b
shr rax, 0x10
mov byte [0x1400f1d53], r14b
lea ecx, [rax - 0x60000]
cmp eax, 0x60000
mov qword [rsp + 0x1a0], rax
setae byte [rsp + 0x4d]
cmp ecx, 0xffff
lea rcx, [rsp + 0x58]
setbe r15b
mov byte [rsp + 0x60], r15b
call fcn.14004be6c
mov rax, qword [str._SystemRoot__]
lea r11, [rsp + 0x170]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x170]
mov qword [r11], rax
mov rax, qword [0x1400dafc0]
xor r9d, r9d
mov qword [r11 + 8], rax
mov rax, qword [0x1400dafc8]
mov rcx, rdi
mov qword [r11 + 0x10], rax
mov eax, dword [0x1400dafd0]
mov dword [r11 + 0x18], eax
xor eax, eax
lea ebp, [rax + 1]
mov dword [rsp + 0x18c], eax
mov dword [rsp + 0x190], eax
mov byte [rsp + 0x20], bpl
mov dword [rsp + 0x194], eax
call fcn.140054c4c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x58]
lea edx, [rax + 0x1e]
mov dword [rsp + 0x108], eax
call fcn.14004bf70
cmp r15b, r14b
lea edi, [rbp + 2]
jl 0x140032a1e
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xad0]
call fcn.140058920
lea rdx, str.System32Drvload.exe
lea rcx, [rsp + 0xad0]
call fcn.14004bfa8
mov rcx, qword [rsp + 0xad0]
call fcn.1400b8b5c
lea rcx, [rsp + 0xad0]
neg eax
sbb r15b, r15b
and r15b, dil
mov byte [rsp + 0x60], r15b
call fcn.140044f24
mov byte [rsp + 0x48], r15b
mov dword [rsp + 0x130], ebp
mov al, r14b
add al, bpl
lea rcx, [rsp + 0xf0]
mov rdx, rsi
mov byte [0x1400f1cb5], r14b
mov byte [rsp + 0x51], r14b
mov byte [rsp + 0x4c], al
call fcn.140058a38
mov r11, qword [rsp + 0xf0]
lea rcx, [rsp + 0x40]
mov esi, 2
mov qword [rsp + 0x40], r11
mov dil, r14b
mov dword [0x1400f1d68], r14d
mov qword [0x1400f1d38], r14
mov byte [rsp + 0xfc], sil
call fcn.140011910
mov rdx, qword [rsp + 0x40]
lea r8d, [rsi + 6]
lea rcx, str.listdev:
mov byte [rsp + 0x52], r14b
mov byte [rsp + 0xad8], sil
mov r12b, r14b
mov byte [rsp + 0xad0], r14b
mov byte [rsp + 0x4e], r14b
mov byte [0x1400f1cb7], r14b
mov byte [0x1400f1d56], r14b
mov r13, r14
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x168], r14
call fcn.140045fc8
xor r8d, r8d
cmp al, r8b
je 0x140032b78
mov rax, qword [rsp + 0x40]
mov r12b, 0x10
add rax, 0x10
mov byte [rsp + 0xad0], r12b
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140032b64
lea r9d, [rsi + 7]
cmp r9w, cx
ja 0x140032b16
cmp cx, 0xd
jbe 0x140032b2c
mov edx, 0x20
cmp dx, cx
cmovne r14, rax
mov qword [rsp + 0x168], r14
jmp 0x140032b31
mov edx, 0x20
cmp r9w, cx
ja 0x140032b3d
cmp cx, 0xd
jbe 0x140032b55
cmp dx, cx
je 0x140032b55
add rax, rsi
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140032b64
jmp 0x140032b31
cmp word [rax], r8w
je 0x140032b64
mov word [rax], r8w
add qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.140011910
cmp word [r14], r8w
je 0x140034761
mov edx, dword [rsp + 0x48]
cmp dword [rsp + 0x1a0], 0x60000
mov eax, 3
movzx edx, dl
mov ecx, 0x2a
mov bpl, 0xff
cmovae edx, eax
mov rax, qword [rsp + 0x40]
mov rsi, r8
mov word [0x1400f1d50], r8w
mov byte [0x1400f1cb6], r8b
mov dword [rsp + 0x48], edx
cmp cx, word [rax]
jne 0x14003334f
lea ebx, [rcx - 0xa]
lea r14d, [rcx - 0x29]
lea rdx, [rsp + 0x40]
lea rcx, str.extract
mov r8d, 8
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032bfd
mov byte [0x1400f1cb7], r14b
mov byte [rsp + 0xad8], r14b
mov byte [rsp + 0x51], r14b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.cab
mov r8d, 4
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
jne 0x140032bf3
lea rdx, [rsp + 0x40]
lea rcx, str.nocheck
mov r8d, 8
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032c47
mov byte [0x1400f1d56], r14b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.rescan
mov r8d, 7
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032c70
mov byte [rsp + 0x4e], r14b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.devcon
mov r8d, 7
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032c9b
mov byte [0x1400f1d52], r14b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.norescan
mov r8d, 9
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032cc4
mov byte [rsp + 0x4e], 0xff
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.dummy
mov r8d, 6
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032cef
mov byte [0x1400f1cb4], r14b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.sub
mov r8d, 4
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032d18
mov byte [rsp + 0x52], r14b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.self
mov r8d, 5
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032d41
mov byte [rsp + 0x52], 2
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.7pe
mov r8d, 4
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032d64
mov dl, 3
jmp 0x140032dcc
lea rdx, [rsp + 0x40]
lea rcx, str.7pe_
mov r8d, 4
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
jne 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.drvload
mov r8d, 8
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032dab
mov dl, r15b
jmp 0x140032dcc
lea rdx, [rsp + 0x40]
lea rcx, str.inner
mov r8d, 6
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032dd5
mov dl, 0xc0
mov dword [rsp + 0x48], edx
jmp 0x140033314
lea rdx, [rsp + 0x40]
lea rcx, str.nnverify
mov r8d, 9
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032e01
mov byte [rsp + 0xad8], r14b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.rverify
mov r8d, 8
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032e2d
mov byte [rsp + 0xad8], r8b
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.listdevi
mov r8d, 0xa
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032e59
and r12b, 0xf2
or r12b, 2
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.listdevc
mov r8d, 0xa
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032e85
and r12b, 0xf4
or r12b, 4
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.All
mov r8d, 4
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032eac
or r12b, bl
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.auto
mov r8d, 5
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032edb
lea eax, [r8 + 3]
mov word [0x1400f1d50], ax
jmp 0x140033310
lea rdx, [rsp + 0x40]
lea rcx, str.sys
mov r8d, 4
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032f06
mov byte [0x1400f1cb6], r14b
jmp 0x140033310
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xa
inc rcx
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032f30
or dil, r14b
jmp 0x140033310
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xb
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032f58
or dil, 3
jmp 0x140033310
mov rcx, qword [str.AutoDisverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xe
call fcn.14004e558
xor r8d, r8d
cmp al, r8b
je 0x140032f80
or dil, 0x10
jmp 0x140033310
mov rdx, qword [rsp + 0x40]
lea rcx, str.retid:
mov r8d, 7
call fcn.140045fc8
xor r8d, r8d
cmp al, r8b
je 0x14003304e
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
cmp word [rax], r8w
je 0x140033306
lea r10d, [r8 + 9]
cmp r10w, word [rax]
ja 0x140032fcb
cmp word [rax], 0xd
jbe 0x140032ff0
mov r9d, 0x20
cmp r9w, word [rax]
je 0x140032ff6
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x198], rax
mov qword [0x1400f1d30], rcx
jmp 0x140032ff6
mov r9d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x140033027
mov edx, 2
cmp r10w, cx
ja 0x140033010
cmp cx, 0xd
jbe 0x140033031
cmp r9w, cx
je 0x140033031
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x140033004
mov ebx, 0x20
jmp 0x140033306
mov ebx, 0x20
cmp word [rax], r8w
je 0x140033306
mov word [rax], r8w
add qword [rsp + 0x40], rdx
jmp 0x140033306
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevClass:
mov r8d, 0xa
call fcn.140045fc8
xor r8d, r8d
cmp al, r8b
je 0x14003310b
mov rcx, qword [rsp + 0x40]
add rcx, 0x14
mov qword [rsp + 0x40], rcx
movzx edx, word [rcx]
cmp dx, r8w
je 0x140033306
lea r10d, [r8 + 9]
cmp r10w, dx
ja 0x14003309c
cmp dx, 0xd
jbe 0x1400330ba
mov rax, qword [0x1400f1d38]
mov r9d, 0x20
cmp r9w, dx
cmovne rax, rcx
mov qword [0x1400f1d38], rax
jmp 0x1400330c0
mov r9d, 0x20
mov eax, 2
cmp r10w, dx
ja 0x1400330d1
cmp dx, 0xd
jbe 0x1400330ee
cmp r9w, dx
je 0x1400330ee
add rcx, rax
mov qword [rsp + 0x40], rcx
mov dx, word [rcx]
cmp dx, r8w
je 0x140033027
jmp 0x1400330c5
mov ebx, 0x20
cmp word [rcx], r8w
je 0x140033306
mov word [rcx], r8w
add qword [rsp + 0x40], rax
jmp 0x140033306
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevID:
mov r8d, 7
call fcn.140045fc8
xor r8d, r8d
cmp al, r8b
je 0x140033207
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140033198
lea r10d, [r8 + 9]
cmp r10w, cx
ja 0x140033155
cmp cx, 0xd
jbe 0x140033165
mov r9d, 0x20
cmp r9w, cx
cmovne r13, rax
jmp 0x14003316b
mov r9d, 0x20
mov edx, 2
cmp r10w, cx
ja 0x14003317c
cmp cx, 0xd
jbe 0x1400331f1
cmp r9w, cx
je 0x1400331f1
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x140033170
mov ebx, 0x20
lea rcx, [rsp + 0x40]
call fcn.140011910
cmp r13, r8
je 0x140033310
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rcx, eax
cmp rcx, r8
jle 0x1400331dc
lea edx, [r8 + 0x26]
cmp dx, word [r13 + rcx*2 - 2]
jne 0x1400331dc
mov word [r13 + rcx*2], r8w
sub rcx, r14
sub eax, r14d
cmp rcx, r8
jg 0x1400331c3
cmp eax, r8d
mov edx, dword [rsp + 0x48]
jg 0x140033314
mov r13, r8
jmp 0x140033314
mov ebx, 0x20
cmp word [rax], r8w
je 0x140033198
mov word [rax], r8w
add qword [rsp + 0x40], rdx
jmp 0x140033198
mov rdx, qword [rsp + 0x40]
lea rcx, str.disable:
mov r8d, 9
call fcn.140045fc8
xor r8d, r8d
cmp al, r8b
je 0x140033237
mov rax, qword [rsp + 0x40]
lea edx, [r8 + 2]
mov bpl, r8b
add rax, rdx
jmp 0x140033262
mov rdx, qword [rsp + 0x40]
lea rcx, str.enable:
mov r8d, 8
call fcn.140045fc8
xor r8d, r8d
cmp al, r8b
je 0x1400332d1
mov rax, qword [rsp + 0x40]
mov bpl, r14b
lea edx, [r8 + 2]
add rax, 0x10
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140033306
mov r10d, 9
cmp r10w, cx
ja 0x14003328a
cmp cx, 0xd
jbe 0x14003329a
mov r9d, 0x20
cmp r9w, cx
cmovne rsi, rax
jmp 0x1400332a0
mov r9d, 0x20
cmp r10w, cx
ja 0x1400332b0
cmp cx, 0xd
jbe 0x140033031
cmp r9w, cx
je 0x140033031
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140033027
jmp 0x1400332a0
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x140033306
mov edx, 9
cmp dx, ax
ja 0x1400332ef
cmp ax, 0xd
jbe 0x140033306
cmp bx, ax
je 0x140033306
add rcx, 2
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
jne 0x1400332e4
lea rcx, [rsp + 0x40]
call fcn.140011910
mov edx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
je 0x140032bc5
mov ebx, dword [rsp + 0xb0]
mov r14, qword [rsp + 0x168]
mov qword [rsp + 0x128], r13
mov byte [rsp + 0xad0], r12b
cmp dil, r8b
jne 0x1400347df
movzx eax, dl
cmp dl, r8b
mov ecx, r8d
cmovge ecx, eax
mov al, r12b
or byte [rsp + 0x4d], cl
and al, 0x10
mov byte [0x1400f1d53], cl
mov byte [rsp + 0x50], al
je 0x140033379
cmp r14, r8
je 0x140034868
cmp bpl, r8b
jl 0x140033387
cmp rsi, r8
jne 0x14003486f
cmp r13, r8
lea rcx, [rsp + 0x90]
mov edx, 0x200010
setne byte [0x1400f1cb5]
call fcn.14004bc80
mov rcx, qword [rsp + 0x90]
xor edx, edx
add rcx, 0x200000
lea r8d, [rdx + 8]
call fcn.1400b93b0
mov rax, qword [rsp + 0x90]
xor ebp, ebp
mov word [rax + 4], bp
mov word [rax + 2], bp
lea r13, [rax + 2]
mov qword [rsp + 0xe0], rax
mov ecx, ebp
lea eax, [rbp + 0x20]
mov dword [rsp + 0x170], eax
xor eax, eax
mov dword [rsp + 0x174], ebp
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x40]
mov esi, ebp
lea edi, [rbp + 2]
cmp word [rax], 0x24
lea r15d, [rbp + 1]
sete cl
mov dword [rsp + 0x54], ecx
cmp ecx, ebp
je 0x140033438
add rax, rdi
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
jne 0x140033438
add esi, r15d
jmp 0x140033425
lea rcx, [rsp + 0x40]
call fcn.140011910
mov rcx, qword [rsp + 0x40]
mov edx, 0x2c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r14, rbp
mov qword [rsp + 0xb8], rbp
mov r12, rax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x88], rbp
cmp rax, rbp
je 0x1400334f1
lea rcx, [rsp + 0xb8]
add r12, rdi
mov word [rax], bp
mov qword [rsp + 0xb8], r12
call fcn.140011910
mov r12, qword [rsp + 0xb8]
mov rcx, r12
mov edx, 0x2c
mov qword [rsp + 0x120], r12
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r14, rax
mov qword [rsp + 0xb8], rax
cmp rax, rbp
je 0x1400334e9
add r14, rdi
lea rcx, [rsp + 0xb8]
mov word [rax], bp
mov qword [rsp + 0xb8], r14
call fcn.140011910
mov r14, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], r14
mov rcx, r12
call fcn.140012d94
mov rcx, qword [rsp + 0x40]
call fcn.140012d94
cmp r14, rbp
je 0x14003355a
mov edx, 0x2c
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rdi, rax
mov qword [rsp + 0x88], rax
cmp rax, rbp
je 0x140033552
lea rcx, [rsp + 0x88]
add rdi, 2
mov word [rax], bp
mov qword [rsp + 0x88], rdi
call fcn.140011910
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
mov qword [rsp + 0x88], rdi
call fcn.140012d94
mov rcx, r14
call fcn.140012d94
mov rax, qword [rsp + 0x40]
cmp word [rax], bp
je 0x140033659
lea rcx, [rsp + 0x40]
mov edx, r15d
call fcn.1400631e4
cmp rax, rbp
je 0x140033659
mov ecx, 0x23
cmp cx, word [rax]
jne 0x140033659
lea rcx, [rsp + 0x148]
call fcn.14004be6c
lea r11, str..tmp.cab
lea r9, str.devi
lea rdx, [rsp + 0x148]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call fcn.140005c7c
lea rdx, str.__dd__len16M___
lea rcx, [rsp + 0x110]
call fcn.140058920
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x110]
call fcn.14004bfa8
lea rdx, [0x1400dadf8]
lea rcx, [rsp + 0x110]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x110]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xac0]
xor r8d, r8d
call fcn.14008863c
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0xa0]
call fcn.14001415c
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x40], rax
call fcn.140044f24
lea rcx, [rsp + 0x148]
call fcn.140044f24
mov rcx, qword [rsp + 0x40]
call fcn.1400b8a34
mov rcx, qword [rsp + 0x40]
mov r15d, eax
mov dword [rsp + 0xf8], eax
call fcn.1400b9a24
xor edx, edx
mov rdi, rax
cmp byte [rsp + 0x51], dl
jne 0x1400336ba
cmp r15d, edx
jne 0x1400336ac
cmp eax, 4
jle 0x1400336ac
mov rcx, qword [rsp + 0x40]
movsxd rdx, eax
lea rcx, [rcx + rdx*2 - 8]
lea rdx, str..CAB
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
je 0x1400336ba
mov ebp, edx
mov dword [rsp + 0x10c], edx
jmp 0x140033781
movsxd r10, dword [rsp + 0x108]
mov ecx, 1
lea rax, str.SysWow64
cmp byte [0x1400ef008], cl
lea rdx, str.System32
mov ebp, ecx
cmove rdx, rax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x10c], ecx
lea rcx, [rax + r10*2]
mov r8d, 0x10
call fcn.1400177f8
mov rax, qword [rsp + 0x58]
lea ecx, [r10 + 8]
movsxd rdx, ecx
mov r8d, 0x1a
lea rcx, [rax + rdx*2]
lea rdx, str.cabinet.dll
call fcn.1400177f8
mov rcx, qword [rsp + 0x58]
call fcn.1400b8b5c
xor edx, edx
cmp eax, edx
jne 0x140033781
lea rcx, [rsp + 0x160]
mov edx, 0x63
call fcn.14004bedc
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x160]
lea rdx, str.__dd__bs1M__s_0__._33INDATA
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0xac0]
xor r8d, r8d
call fcn.14008863c
lea rcx, [rsp + 0x160]
call fcn.140044f24
xor edx, edx
cmp r14, rdx
je 0x14003379b
mov eax, 0x2a
cmp ax, word [r14]
cmove r14, rdx
mov qword [rsp + 0xb8], r14
cmp edi, 4
jle 0x1400337c7
mov rax, qword [rsp + 0x40]
movsxd rcx, edi
lea rdx, [0x1400d90b0]
lea rcx, [rax + rcx*2 - 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
jne 0x1400337c7
lea ecx, [rdx + 1]
mov eax, ecx
jmp 0x1400337ce
mov eax, edx
mov ecx, 1
cmp r15d, edx
jne 0x1400337d9
mov edi, ecx
cmp eax, edx
jne 0x1400337db
mov edi, edx
cmp esi, ecx
mov esi, dword [rsp + 0x54]
je 0x1400337fc
cmp eax, edx
je 0x1400337f0
cmp esi, edx
je 0x1400337f0
cmp r14, rdx
jne 0x1400337fc
cmp edi, edx
je 0x1400337f8
cmp esi, edx
jne 0x1400337fc
mov al, dl
jmp 0x1400337fe
mov al, cl
cmp edi, edx
jne 0x140033809
mov r15d, edx
cmp al, dl
je 0x14003380c
mov r15d, ecx
mov dword [rsp + 0x118], r15d
mov qword [rsp + 0x68], rdx
mov qword [0x1400f1d58], rdx
mov qword [0x1400f1d60], rdx
mov word [0x1400f1d54], dx
cmp r14, rdx
je 0x140033906
cmp word [r14], dx
je 0x140033906
cmp r15d, edx
jne 0x140033906
lea rcx, [rsp + 0x68]
mov rdx, r14
call fcn.140058a38
mov rcx, qword [rsp + 0x68]
call fcn.1400178ec
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x138]
mov edx, 0x105
call fcn.14004bedc
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov rcx, qword [rsp + 0x138]
xor edx, edx
cmp word [rcx], dx
je 0x1400338bc
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x138], rax
jmp 0x1400338c1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov eax, 0x5c
cmp word [r14 + rcx*2 - 2], ax
je 0x1400338e8
lea rdx, [0x1400d6778]
lea rcx, [rsp + 0x68]
call fcn.14004bfa8
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x138]
mov qword [0x1400f1d58], rax
call fcn.140044f24
xor edx, edx
lea ecx, [rdx + 1]
cmp esi, edx
jne 0x140033918
cmp byte [rsp + 0x4d], dl
je 0x140033942
cmp byte [0x1400f1cb7], dl
jne 0x140033942
mov al, byte [rsp + 0xad8]
cmp byte [0x1400f1cb6], dl
jne 0x140033949
cmp byte [rsp + 0x50], dl
jne 0x140033949
cmp al, cl
je 0x140033949
cmp ebx, edx
je 0x140033949
xor edx, edx
xor ecx, ecx
call fcn.1400a64fc
xor edx, edx
mov ebx, eax
mov al, byte [rsp + 0xad8]
cmp al, 2
cmove ebx, edx
mov dword [rsp + 0xb0], ebx
cmp ebp, edx
je 0x1400339ac
cmp r12, rdx
je 0x1400339ac
or dword [rsp + 0xad8], 0xffffffff
lea rdx, [rsp + 0xad8]
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x1b0], r12
call fcn.14004fc04
mov edx, dword [rsp + 0xfc]
mov r11d, dword [rsp + 0xad8]
movzx edx, dl
lea ecx, [r11 - 1]
movzx eax, r11b
cmp ecx, 0x12
cmovbe edx, eax
mov dword [rsp + 0xfc], edx
xor edx, edx
mov cl, byte [rsp + 0x4c]
mov r8d, 1
cmp cl, r8b
jne 0x140033a2a
cmp byte [0x1400f1cb7], dl
jne 0x140033a2a
movsx ecx, byte [0x1400f1d56]
movsx eax, byte [rsp + 0x4e]
movsx r9d, byte [0x1400f1d53]
mov r8d, dword [rsp + 0x1a0]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x3c0]
lea rdx, str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0xac0]
lea r8, [rsp + 0x3c0]
lea rdx, [0x1400dacc8]
call fcn.140012fac
mov cl, byte [rsp + 0x4c]
mov r8d, 1
mov al, byte [rsp + 0x4e]
mov bpl, byte [rsp + 0xad0]
xor edx, edx
cmp al, dl
jg 0x140033a5d
cmp bpl, dl
jne 0x140033aab
cmp al, dl
jl 0x140033a9d
cmp byte [0x1400f1d53], dl
je 0x140033a9d
cmp edi, edx
jne 0x140033a55
cmp esi, edx
je 0x140033a9d
cmp byte [0x1400f1d56], dl
jne 0x140033a9d
cmp cl, r8b
jne 0x140033a7d
mov rcx, qword [rsp + 0xac0]
lea r8, [0x1400d63f4]
lea rdx, [0x1400dacb0]
call fcn.140012fac
call fcn.1400140d8
mov rcx, qword [rsp + 0xac0]
xor r8d, r8d
lea edx, [r8 + 0x32]
call fcn.140013908
xor edx, edx
cmp bpl, dl
jne 0x140033aab
mov rax, qword [rsp + 0x40]
cmp word [rax], dx
je 0x1400348b7
lea rcx, [rsp + 0xa8]
call fcn.14004be6c
mov rcx, qword [rsp + 0x40]
call fcn.140015cb4
lea rdx, [rsp + 0xa8]
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1400a6f3c
xor esi, esi
mov qword [rsp + 0x40], rax
mov r9d, esi
cmp bpl, sil
je 0x140033af6
lea eax, [rsi + 0x20]
test al, bpl
lea eax, [rsi + 2]
cmove r9d, eax
or r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x1400f1c20]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140033b1b
mov rbp, rsi
cmp edi, esi
je 0x1400348c2
mov dil, byte [rsp + 0xad0]
lea rcx, [rsp + 0x70]
mov al, dil
and al, 4
neg al
sbb esi, esi
neg esi
call fcn.14004be6c
xor edx, edx
lea rcx, [rsp + 0x2c2]
mov r8d, 0xfe
mov word [rsp + 0x2c0], dx
call fcn.1400b93b0
xor eax, eax
lea rcx, [rsp + 0x1c2]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x1c0], ax
call fcn.1400b93b0
xor r8d, r8d
mov eax, 0x20
mov dword [rsp + 0x170], eax
cmp byte [0x1400f1cb7], r8b
jne 0x140033eb4
cmp rbp, r8
je 0x140033eb4
mov eax, r13d
mov edi, r8d
sub eax, dword [rsp + 0xe0]
cmp eax, 0x200000
jge 0x140033eac
mov bl, byte [rsp + 0x50]
mov r15b, byte [rsp + 0xad0]
mov r12, qword [rsp + 0xe0]
mov r14, qword [rsp + 0x128]
lea r8, [rsp + 0x170]
mov edx, edi
mov rcx, rbp
call qword [0x1400f1c48]
xor r8d, r8d
cmp eax, r8d
je 0x140033e8d
cmp r15b, r8b
je 0x140033cce
cmp qword [0x1400f1d38], r8
je 0x140033c3e
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x174]
xor r9d, r9d
mov r8d, 0x80
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
mov rdx, qword [0x1400f1d38]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r8d, r8d
cmp eax, r8d
jne 0x140033e7a
mov eax, 2
test al, r15b
je 0x140033cce
mov qword [rsp + 0x20], r8
lea r9d, [rax + 0x7e]
lea rdx, [rsp + 0x170]
lea r8, [rsp + 0x1c0]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
xor r8d, r8d
cmp bl, r8b
je 0x140033cac
mov rax, qword [rsp + 0x70]
cmp word [rax], r8w
je 0x140033c92
lea rdx, [0x1400d91e8]
lea rcx, [rsp + 0x70]
call fcn.14004bfa8
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x70]
call fcn.14004bfa8
xor r8d, r8d
jmp 0x140033e7a
cmp r14, r8
je 0x140033cce
lea rdx, [rsp + 0x1c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor r8d, r8d
cmp eax, r8d
jne 0x140033e7a
mov rax, qword [0x1400f1c68]
xor ecx, ecx
mov dword [rsp + 0x80], ecx
cmp rax, rcx
je 0x140033d18
mov r8d, dword [rsp + 0x184]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xad8]
xor r9d, r9d
mov dword [rsp + 0x170], 0x20
mov dword [rsp + 0xad8], 0x400
call rax
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov edx, 0x800
mov word [r13 + 2], cx
mov word [r13], cx
mov eax, r12d
lea r8d, [rsi + 1]
sub eax, r13d
mov rcx, rbp
mov dword [rsp + 0x170], 0x20
add eax, 0x200000
cmp eax, edx
cmovg eax, edx
lea rdx, [rsp + 0x170]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call qword [0x1400f1c28]
xor r8d, r8d
mov dword [rsp + 0x170], 0x20
cmp eax, r8d
je 0x140033e7a
cmp bl, r8b
je 0x140033da8
mov rax, qword [rsp + 0x70]
cmp word [rax], r8w
je 0x140033da0
lea rdx, [0x1400d91e8]
lea rcx, [rsp + 0x70]
call fcn.14004bfa8
mov rdx, r13
jmp 0x140033c9a
lea rdx, str.ACPI
mov r8d, 4
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r8d, r8d
cmp eax, r8d
je 0x140033e7a
lea r9d, [r8 + 1]
cmp byte [rsp + 0x4c], r9b
jne 0x140033df7
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0xac0]
mov r9, r13
mov r8d, edi
call fcn.140012fac
xor r8d, r8d
lea r9d, [r8 + 1]
movzx eax, word [r13]
movzx ecx, r8w
mov edx, r8d
cmp ax, r8w
je 0x140033e70
mov r15d, dword [rsp + 0xfc]
mov r10d, 0x26
cmp ax, r10w
jne 0x140033e28
add edx, r9d
movsx eax, r15b
cmp edx, eax
jge 0x140033e3b
add cx, r9w
movzx eax, cx
mov ax, word [r13 + rax*2]
cmp ax, r8w
jne 0x140033e17
mov r15b, byte [rsp + 0xad0]
cmp cx, r8w
jbe 0x140033e70
mov word [r13 - 2], cx
movzx eax, cx
lea r13, [r13 + rax*2]
cmp word [r13], r8w
je 0x140033e6c
mov eax, 2
add r13, rax
cmp word [r13], r8w
jne 0x140033e62
add r13, 4
mov eax, 2
test al, r15b
jne 0x140033e8d
mov eax, r13d
inc edi
sub eax, r12d
cmp eax, 0x200000
jl 0x140033bcd
mov ebx, dword [rsp + 0xb0]
mov r12, qword [rsp + 0x120]
mov r14, qword [rsp + 0xb8]
mov r15d, dword [rsp + 0x118]
mov dil, byte [rsp + 0xad0]
cmp byte [rsp + 0x50], r8b
jne 0x14003504e
cmp r15d, r8d
je 0x140033ede
mov eax, 2
test al, dil
je 0x140033ede
mov eax, 1
mov esi, eax
mov dword [rsp + 0xad0], eax
jmp 0x140033f3d
mov rdi, qword [rsp + 0x128]
mov esi, r8d
mov dword [rsp + 0xad0], r8d
cmp rdi, r8
je 0x140033f3d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xe0]
mov rdx, rdi
mov word [rcx], ax
inc eax
lea r13, [rcx + 2]
movsxd r10, eax
mov rcx, r13
add r10, r10
mov r8, r10
call fcn.1400177f8
xor r8d, r8d
add r13, r10
mov word [r13], r8w
add r13, 2
mov word [r13 + 4], r8w
mov word [r13 + 2], r8w
mov rcx, rbp
mov word [r13 - 2], r8w
call qword [0x1400f1c30]
mov r11b, byte [0x1400f1cb7]
xor eax, eax
cmp r11b, al
jne 0x140033f7b
mov rcx, qword [rsp + 0xac0]
lea r8, [0x1400d63f4]
lea rdx, [0x1400d91e8]
call fcn.140012fac
mov r11b, byte [0x1400f1cb7]
movsxd r13, dword [rsp + 0x108]
mov rax, qword [rsp + 0x58]
lea rdx, [0x1400dac98]
lea rcx, [rax + r13*2]
mov r8d, 8
mov rdi, r13
call fcn.1400177f8
xor ecx, ecx
cmp r15d, ecx
jne 0x1400349fe
xor r14d, r14d
cmp rbp, r14
je 0x1400349f4
mov rsi, qword [rsp + 0xe0]
cmp r11b, r14b
jne 0x140033feb
cmp word [rsi], r14w
je 0x140034974
cmp dword [rsp + 0xf8], r14d
jne 0x1400348f3
cmp dword [rsp + 0x10c], r14d
je 0x1400348f3
mov rax, qword [0x1400f1d58]
cmp rax, r14
je 0x140034005
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x140034136
mov ebp, dword [rsp + 0x54]
mov cl, byte [0x1400f1d53]
cmp ebp, r14d
je 0x140034022
cmp cl, r14b
jne 0x14003402b
cmp byte [0x1400f1cb6], r14b
jne 0x14003402b
cmp cl, r14b
jne 0x140034143
lea rcx, [rsp + 0x100]
call fcn.14004be6c
lea r11, [0x1400dac90]
lea r9, str.devi
lea rcx, [rsp + 0x100]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r11
call fcn.140005c7c
lea rcx, [rsp + 0xd0]
mov edx, 0x105
call fcn.14004bedc
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x100]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov r11, qword [rsp + 0xd0]
cmp word [r11], r14w
je 0x1400340b1
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x100], r11
mov qword [rsp + 0xd0], rax
lea rdx, [0x1400d6778]
lea rcx, [rsp + 0x100]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x98]
call fcn.14001415c
cmp byte [0x1400f1d53], r14b
jne 0x140034105
cmp byte [0x1400f1cb6], r14b
jne 0x140034105
mov rcx, rax
mov qword [0x1400f1d60], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x1400f1d54], ax
jmp 0x14003410c
mov qword [0x1400f1d58], rax
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
mov r11b, byte [0x1400f1cb7]
mov rax, qword [0x1400f1d58]
jmp 0x14003413a
mov ebp, dword [rsp + 0x54]
cmp byte [0x1400f1d53], r14b
je 0x140034166
cmp r11b, r14b
jne 0x140034166
cmp rax, r14
je 0x140034166
mov cl, byte [0x1400f1d56]
mov r12d, 1
cmp cl, r14b
cmove ebp, r12d
mov dword [rsp + 0x54], ebp
jmp 0x140034172
mov cl, byte [0x1400f1d56]
mov r12d, 1
cmp byte [rsp + 0x4f], r14b
cmovne rax, r14
mov qword [0x1400f1d58], rax
cmp cl, r14b
je 0x14003419c
cmp rax, r14
je 0x14003419c
cmp qword [rsp + 0x88], r14
cmovne ebp, r14d
mov dword [rsp + 0x54], ebp
neg rax
movzx eax, word [0x1400f1d50]
lea rdx, str.INF_
sbb r13d, r13d
shl eax, 0x10
mov r8d, 0xa
not r13d
and r13d, 3
or r13d, eax
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rdi*2]
call fcn.1400177f8
lea rcx, [rsp + 0x140]
mov edx, 0x1040
call fcn.14004bedc
lea rcx, [rsp + 0x614]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x610], r14d
call fcn.1400b93b0
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x610]
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0xc0], r14
call fcn.1400b8aa4
cmp qword [rsp + 0xc0], r14
je 0x1400349ed
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xe8]
call fcn.140058920
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xe8]
call fcn.140060848
lea rdx, [0x1400d6778]
lea rcx, [rsp + 0xe8]
call fcn.14004bfa8
lea rdx, str.DefaultInstall_132
lea rcx, [rsp + 0xc8]
call fcn.140058920
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xe8]
movsxd r14, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xe8]
xor edi, edi
movsxd r15, eax
mov word [rcx + r15*2], di
cmp ebp, edi
jne 0x1400342ba
cmp byte [0x1400f1cb7], dil
je 0x1400342bd
mov r12d, edi
mov rax, qword [0x1400f1d58]
mov rbx, qword [rsp + 0x88]
neg rax
sbb ecx, ecx
and ecx, 0x20000
add ecx, 0x10000
or r13d, ecx
mov rcx, qword [rsp + 0x140]
call fcn.140014284
test byte [rsp + 0x610], 0x10
jne 0x140034614
mov rax, qword [rsp + 0xe8]
lea rdx, [rsp + 0x63c]
lea rcx, [rsp + 0xe8]
mov word [rax + r15*2], di
call fcn.14004bfa8
mov rcx, qword [rsp + 0xe8]
lea r8, [0x140028adc]
mov r9, rsi
xor edx, edx
call qword [0x1400f1c50]
cmp ebp, edi
je 0x1400344a7
mov rdi, qword [0x1400f1c80]
mov bl, byte [rsp + 0x4c]
cmp rdi, qword [0x1400f1c78]
jae 0x140034489
add rdi, 8
mov rcx, rdi
call fcn.1400b9a24
mov edx, 1
add eax, edx
cmp bl, dl
lea rbp, [rdi + rax*2]
jle 0x1400343a8
or edx, 0xffffffff
mov rcx, rdi
call fcn.140013cc4
xor ecx, ecx
cmp rax, rcx
jne 0x140034440
lea edx, [rcx + 1]
mov esi, 4
cmp byte [0x1400f1cb6], cl
je 0x1400343ac
mov edx, r13d
mov rcx, rbp
call fcn.14001ad00
jmp 0x140034440
xor ecx, ecx
jmp 0x14003438b
mov al, byte [0x1400f1d53]
mov r8d, 3
cmp al, r8b
je 0x1400343c9
cmp byte [0x1400f1d52], cl
je 0x140034454
or esi, edx
cmp byte [0x1400f1d52], cl
je 0x1400343e0
mov rdx, rdi
mov rcx, rbp
call fcn.140013e84
jmp 0x1400343f0
cmp al, r8b
jne 0x1400343f5
mov rdx, rdi
mov rcx, rbp
call fcn.140013f9c
xor ecx, ecx
mov r12d, eax
cmp r12d, ecx
je 0x140034440
mov eax, 2
test al, sil
je 0x140034459
test sil, 4
jne 0x140034440
mov rax, qword [rsp + 0xc8]
xor edx, edx
lea rcx, [rsp + 0xc8]
mov word [rax + r14*2], dx
mov rdx, rbp
call fcn.14004bfa8
mov r8, qword [rsp + 0xc8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.14001417c
mov rcx, rbp
call fcn.1400b9a24
inc eax
lea rdi, [rbp + rax*2]
jmp 0x14003434a
mov eax, 2
mov r8d, r13d
mov rdx, rbp
mov rcx, rdi
or esi, eax
call fcn.14001abd8
xor ecx, ecx
mov r12d, eax
cmp eax, ecx
je 0x140034440
lea edx, [rcx + 1]
test dl, sil
jne 0x140034404
mov al, byte [0x1400f1d53]
lea r8d, [rcx + 3]
jmp 0x1400343c9
mov ebp, dword [rsp + 0x54]
mov rbx, qword [rsp + 0x88]
xor edi, edi
cmp ebp, edi
jne 0x140034614
mov rsi, qword [rsp + 0xe0]
cmp byte [0x1400f1d56], dil
je 0x140034614
cmp rbx, rdi
je 0x140034614
mov rdx, qword [0x1400f1d58]
cmp rdx, rdi
je 0x140034614
lea rcx, [rsp + 0x78]
call fcn.140058920
lea rcx, [rsp + 0x78]
mov rdx, rbx
call fcn.14004bfa8
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xac0]
lea rdx, [0x1400dac38]
call fcn.140012fac
mov rdx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.140028370
xor edx, edx
lea rbp, [0x1400d63f4]
cmp rax, rdx
lea ecx, [rdx + 3]
mov rsi, rax
cmovne rbp, rax
lea edi, [rdx + 4]
lea eax, [rdx + 2]
cmp byte [0x1400f1d53], cl
je 0x140034536
cmp byte [0x1400f1d52], dl
je 0x140034583
or edi, 1
cmp byte [0x1400f1d52], dl
je 0x140034550
mov rcx, qword [rsp + 0x78]
mov rdx, rbp
call fcn.140013e84
jmp 0x140034565
cmp byte [0x1400f1d53], cl
jne 0x14003456f
mov rcx, qword [rsp + 0x78]
mov rdx, rbp
call fcn.140013f9c
mov r12d, eax
xor edx, edx
mov eax, 2
inc edi
cmp edi, eax
jge 0x1400345fc
cmp r12d, edx
je 0x1400345fc
test al, dil
jne 0x1400345c0
or edi, eax
cmp rsi, rdx
je 0x1400345a2
mov rdx, qword [rsp + 0x78]
mov r8d, r13d
mov rcx, rsi
call fcn.14001abd8
xor edx, edx
mov r12d, eax
lea eax, [rdx + 2]
inc edi
cmp edi, eax
jge 0x1400345fc
cmp rsi, rdx
je 0x1400345b2
cmp r12d, edx
je 0x1400345fc
mov ecx, 3
test al, dil
je 0x140034536
test dil, 4
jne 0x1400345fc
mov rax, qword [rsp + 0xc8]
lea rcx, [rsp + 0xc8]
mov word [rax + r14*2], dx
mov rdx, qword [rsp + 0x78]
call fcn.14004bfa8
mov r8, qword [rsp + 0xc8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.14001417c
xor edi, edi
cmp rsi, rdi
je 0x140034606
mov word [rsi], di
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov ebp, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x610]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rsi, qword [rsp + 0xe0]
cmp eax, edi
jne 0x1400342e0
mov rcx, qword [rsp + 0xc0]
mov ebx, dword [rsp + 0xb0]
xor r14d, r14d
cmp rcx, r14
je 0x14003465d
cmp rcx, 0xffffffffffffffff
je 0x14003465d
call qword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [rsp + 0x130]
mov rax, qword [rsp + 0xd8]
cmp r12d, r14d
cmove esi, r14d
mov ecx, 0x5f
mov qword [rsp + 0xc0], r14
mov dword [rsp + 0x130], esi
mov word [rax], cx
cmp ebp, r14d
je 0x14003497e
cmp qword [0x1400f1d58], r14
je 0x14003497e
lea ebp, [rcx - 0x5e]
cmp byte [0x1400f1d53], bpl
jne 0x14003497e
cmp byte [rsp + 0x4f], r14b
jne 0x14003497e
cmp qword [rsp + 0x88], r14
jne 0x14003497e
lea rcx, [rsp + 0xc8]
mov qword [0x1400f1d58], r14
mov byte [rsp + 0x4f], bpl
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
mov rcx, qword [rsp + 0xc0]
cmp rcx, r14
je 0x140034708
cmp rcx, 0xffffffffffffffff
je 0x140034708
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0xc0], r14
call fcn.140044f24
lea rcx, [rsp + 0x70]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
mov r15b, byte [rsp + 0x60]
mov al, byte [rsp + 0x4c]
mov rsi, qword [rsp + 0xac8]
jmp 0x140032a2d
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.1400141fc
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140028ea4
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140028ea4
lea rcx, [rsp + 0x98]
call fcn.140044f24
xor eax, eax
cmp ebx, eax
jle 0x1400347d5
xor edx, edx
mov ecx, ebx
call fcn.1400a64fc
mov esi, 0x80070057
jmp 0x14003511e
movsx edx, dil
xor ecx, ecx
and edx, 0x12
call fcn.1400a64fc
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.1400141fc
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140028ea4
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140028ea4
lea rcx, [rsp + 0x98]
call fcn.140044f24
xor edi, edi
cmp ebx, edi
jle 0x140034861
xor edx, edx
mov ecx, ebx
call fcn.1400a64fc
mov esi, edi
jmp 0x14003511e
mov esi, 0x80070057
jmp 0x1400348eb
or r9d, 0xffffffff
mov qword [rsp + 0xac0], r8
lea rcx, [rsp + 0xac0]
or r8d, r9d
mov rdx, rsi
call fcn.14004bdac
mov rdx, qword [rsp + 0xac0]
movsx ecx, bpl
mov r8d, pe_nt_image_headers64
call fcn.14004645c
lea rcx, [rsp + 0xac0]
call fcn.140044f24
jmp 0x1400347ed
xor r14d, r14d
mov esi, r14d
jmp 0x140035085
lea rcx, [rsp + 0xa8]
mov esi, 1
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
xor r14d, r14d
jmp 0x14003509c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
sub eax, r9d
cmp eax, r9d
jl 0x140034932
mov rdx, qword [rsp + 0x40]
lea r8d, [r9 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2]
je 0x14003492a
lea r8d, [r9 + 0x2e]
cmp r8w, word [rdx + rcx*2]
jne 0x140034932
mov word [rdx + rcx*2], r14w
sub eax, r9d
cmp eax, r14d
jge 0x140034941
mov esi, 0x80070057
jmp 0x14003506e
cmp r12, r14
je 0x140034954
movzx eax, word [r12]
neg ax
sbb rcx, rcx
and r12, rcx
mov r9b, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x40]
mov r8, r12
or r9b, 0x10
mov rdx, rsi
call fcn.140028670
mov esi, eax
jmp 0x14003506e
mov esi, 0x491
jmp 0x14003506e
mov rcx, qword [rsp + 0xac0]
lea r8, [0x1400d63f4]
lea rdx, [0x1400d91e8]
mov qword [0x1400f1d58], r14
call fcn.140012fac
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
mov rcx, qword [rsp + 0xc0]
cmp rcx, r14
je 0x1400349d3
cmp rcx, 0xffffffffffffffff
je 0x1400349d3
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0xc0], r14
lea rcx, [rsp + 0x140]
call fcn.140044f24
jmp 0x14003506e
mov esi, 2
jmp 0x1400349d3
mov esi, 1
jmp 0x14003506e
mov ebp, ecx
cmp dword [rsp + 0x54], ecx
jne 0x140034ad3
mov rax, qword [rsp + 0xe0]
cmp word [rax], cx
jne 0x140034ad3
cmp byte [0x1400f1d56], cl
jne 0x140034ad3
lea rcx, [rsp + 0x70]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.1400141fc
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140028ea4
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140028ea4
lea rcx, [rsp + 0x98]
call fcn.140044f24
xor eax, eax
cmp ebx, eax
jle 0x140034ac9
xor edx, edx
mov ecx, ebx
call fcn.1400a64fc
mov esi, 0x491
jmp 0x14003511e
lea r15d, [r13 + 4]
lea rcx, [rsp + 0xd0]
lea edx, [r15 + 0x3c]
call fcn.14004bedc
mov rax, qword [rsp + 0x58]
lea rdx, str.System32DRIVERS
lea rcx, [rax + r13*2]
mov r8d, 0x22
call fcn.1400177f8
mov rcx, qword [rsp + 0x58]
call fcn.1400b8a34
xor r13d, r13d
cmp eax, r13d
jne 0x140034b22
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x58]
lea rdx, [0x1400dac98]
mov r8d, 8
lea rcx, [rax + rdi*2]
call fcn.1400177f8
mov rcx, qword [rsp + 0x58]
call fcn.1400b8a34
cmp eax, r13d
jne 0x140034b59
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x58]
lea rdx, str.INF_
mov r8d, 0xa
lea rcx, [rax + rdi*2]
call fcn.1400177f8
movzx r13d, word [0x1400f1d50]
lea rcx, [rsp + 0x3c4]
xor edi, edi
xor edx, edx
mov r8d, 0x24c
shl r13d, 0x10
mov dword [rsp + 0x3c0], edi
call fcn.1400b93b0
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x3c0]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.1400b8aa4
cmp qword [rsp + 0x88], rdi
jne 0x140034be5
xor r14d, r14d
lea esi, [rdi + 2]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x88], r14
jmp 0x1400349e3
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140058920
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x80]
call fcn.140060848
lea rdx, [0x1400d6778]
lea rcx, [rsp + 0x80]
call fcn.14004bfa8
cmp r14, rdi
je 0x140034c28
cmp word [r14], di
jne 0x140034c2f
lea r14, [0x1400dac08]
cmp r12, rdi
je 0x140034c3b
cmp word [r12], di
jne 0x140034c42
lea r12, str.DefaultInstall
lea rcx, [rsp + 0x78]
mov rdx, r12
call fcn.140058920
lea rdx, [0x1400d6d20]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
lea rcx, [rsp + 0x78]
mov rdx, r14
call fcn.14004bfa8
lea rdx, [0x1400d6d20]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0xad8], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, dword [rsp + 0xad8]
mov dword [rsp + 0xf8], eax
xor r12d, r12d
test byte [rsp + 0x3c0], 0x10
jne 0x140034f2d
mov rcx, qword [rsp + 0x80]
movsxd rdx, eax
mov word [rcx + rdx*2], r12w
lea rdx, [rsp + 0x3ec]
lea rcx, [rsp + 0x80]
call fcn.14004bfa8
mov r14, qword [rsp + 0x80]
lea rcx, [rsp + 0xad8]
mov dil, r12b
call fcn.14004be6c
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x120], r12
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0xad8]
mov rcx, r14
mov word [rax], r12w
call fcn.1400a6f3c
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0xad8]
sub rcx, rdx
mov qword [rsp + 0x40], rax
movsxd rax, r15d
sar rcx, 1
cmp rax, rcx
jne 0x140034d67
mov rcx, qword [rsp + 0x58]
mov r8d, r15d
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
movzx edi, r12b
cmp eax, r12d
mov eax, 1
cmove edi, eax
cmp esi, r12d
je 0x140034d79
mov rax, qword [rsp + 0x128]
cmp rax, r12
jne 0x140034d8e
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xe0]
call fcn.140028370
mov rsi, rax
cmp byte [0x1400f1d56], r12b
jne 0x140034db9
mov eax, dword [rsp + 0x54]
cmp eax, r12d
jne 0x140034dd9
cmp byte [rsp + 0x4d], r12b
je 0x140034daf
cmp dil, r12b
jne 0x140034dd9
cmp rsi, r12
jne 0x140034dd9
jmp 0x140034f20
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xac0]
lea rdx, [0x1400dac38]
call fcn.140012fac
mov eax, dword [rsp + 0x54]
xor edx, edx
lea r12, [0x1400d63f4]
cmp rsi, rdx
lea edi, [rdx + 4]
cmovne r12, rsi
cmp eax, edx
jne 0x140034e9e
cmp byte [0x1400f1cb6], dl
jne 0x140034ea6
lea ecx, [rdx + 3]
cmp byte [0x1400f1d53], cl
je 0x140034e13
cmp byte [0x1400f1d52], dl
je 0x140034e64
mov eax, 1
or edi, eax
cmp byte [0x1400f1d52], dl
je 0x140034e34
mov rcx, qword [rsp + 0x80]
mov rdx, r12
call fcn.140013e84
jmp 0x140034e4c
cmp byte [0x1400f1d53], cl
jne 0x140034e50
mov rcx, qword [rsp + 0x80]
mov rdx, r12
call fcn.140013f9c
xor edx, edx
mov ebp, eax
cmp ebp, edx
je 0x140034f00
mov eax, 2
test al, dil
jne 0x140034e98
jmp 0x140034e69
mov eax, 2
or edi, eax
cmp rsi, rdx
je 0x140034e8b
mov rdx, qword [rsp + 0x80]
mov r8d, r13d
mov rcx, rsi
call fcn.14001abd8
xor edx, edx
mov ebp, eax
cmp eax, edx
je 0x140034f00
mov eax, 1
lea ecx, [rax + 2]
test al, dil
je 0x140034e18
test dil, 4
jne 0x140034f00
cmp byte [0x1400f1cb6], dl
je 0x140034eb8
mov rcx, qword [rsp + 0x80]
mov edx, r13d
call fcn.14001ad00
jmp 0x140034f00
cmp byte [0x1400f1cb4], dl
jne 0x140034f00
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
mov word [rax + rbx*2], dx
mov rdx, r14
call fcn.14004bfa8
mov r8, qword [rsp + 0x78]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call fcn.14001417c
mov ebp, eax
xor eax, eax
cmp ebp, eax
jne 0x140034f00
cmp qword [0x1400f1d30], rax
je 0x140034f00
mov rcx, r12
call fcn.140013cf4
xor r12d, r12d
cmp rsi, r12
je 0x140034f0c
mov word [rsi], r12w
mov rcx, qword [rsp + 0xd0]
cmp word [rcx], r12w
je 0x140034f20
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xad8]
call fcn.140044f24
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [rsp + 0xad0]
cmp eax, r12d
mov eax, dword [rsp + 0xf8]
jne 0x140034cb0
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x80]
call fcn.140044f24
mov rcx, qword [rsp + 0x88]
mov ebx, dword [rsp + 0xb0]
cmp rcx, r12
je 0x140034f91
cmp rcx, 0xffffffffffffffff
je 0x140034f91
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x88], r12
call fcn.140044f24
lea rcx, [rsp + 0x70]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.1400141fc
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140028ea4
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140028ea4
lea rcx, [rsp + 0x98]
call fcn.140044f24
cmp ebx, r12d
jle 0x140035047
xor edx, edx
mov ecx, ebx
call fcn.1400a64fc
mov esi, ebp
jmp 0x14003511e
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0xac0]
call fcn.14004b578
xor r14d, r14d
mov esi, r14d
lea rcx, [rsp + 0x70]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
mov rcx, qword [rsp + 0xac0]
xor edx, edx
call fcn.1400620e4
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.1400141fc
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140028ea4
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140028ea4
lea rcx, [rsp + 0x98]
call fcn.140044f24
cmp ebx, r14d
jle 0x14003511e
xor edx, edx
mov ecx, ebx
call fcn.1400a64fc
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
add rsp, 0xa78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret