Function at 0x14000c684
Capabilities:
Enumerate disk volumes
Get disk information via ioctl
Parse pe header

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2e0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140045008]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov byte [rsp + 0x51], dl
mov r14, rcx
xor ebx, ebx
mov byte [rsp + 0x50], bl
cmp byte [rcx + 0xa5], bl
je 0x14000c923
mov esi, ebx
mov r15d, ebx
lea r13, [0x140045158]
lea edi, [rbx + 2]
lea r12d, [rbx + 1]
cmp byte [rcx + 0x2ba], bl
jne 0x14000c703
cmp byte [rcx + 0x2be], bl
je 0x14000c8ec
lea rbx, [rcx + 0x18]
mov qword [rsp + 0x58], rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockExclusive]
nop
xor ecx, ecx
cmp byte [r14 + 0x2ba], cl
je 0x14000c775
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c75e
test byte [rcx + 0x1c], r12b
je 0x14000c75e
cmp byte [rcx + 0x19], 4
jb 0x14000c75e
lea r9, [r14 + 0x2a0]
mov edx, 0x32
mov qword [rsp + 0x28], r14
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a874
xor ecx, ecx
mov byte [r14 + 0x2ba], cl
mov rsi, qword [r14 + 0x2c8]
mov qword [r14 + 0x2c8], rcx
cmp byte [r14 + 0x2be], cl
je 0x14000c7d2
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c7bb
test byte [rcx + 0x1c], r12b
je 0x14000c7bb
cmp byte [rcx + 0x19], 4
jb 0x14000c7bb
lea r9, [r14 + 0x288]
mov edx, 0x33
mov qword [rsp + 0x28], r14
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a874
xor ecx, ecx
mov byte [r14 + 0x2be], cl
mov r15, qword [r14 + 0x2d0]
mov qword [r14 + 0x2d0], rcx
test rbx, rbx
je 0x14000c7e0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
lea rbx, [0x14003cbb0]
test rsi, rsi
je 0x14000c862
mov rcx, rsi
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Unregister_Notification]
mov r9d, eax
test eax, eax
je 0x14000c832
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c869
test byte [rcx + 0x1c], r12b
je 0x14000c869
cmp byte [rcx + 0x19], dil
jb 0x14000c869
mov edx, 0x34
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov r8, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
jmp 0x14000c862
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c869
test byte [rcx + 0x1c], r12b
je 0x14000c869
cmp byte [rcx + 0x19], 5
jb 0x14000c869
mov edx, 0x35
mov r9d, dword [r14 + 0x80]
mov r8, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400014c8
mov rcx, qword [0x140045158]
test r15, r15
je 0x14000c8f3
mov rcx, r15
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Unregister_Notification]
mov r9d, eax
test eax, eax
je 0x14000c8bc
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c919
test byte [rcx + 0x1c], r12b
je 0x14000c8f3
cmp byte [rcx + 0x19], dil
jb 0x14000c8f3
mov edx, 0x36
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov r8, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
jmp 0x14000c8ec
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c919
test byte [rcx + 0x1c], r12b
je 0x14000c8f3
cmp byte [rcx + 0x19], 5
jb 0x14000c8f3
mov edx, 0x37
mov r9d, dword [r14 + 0x80]
mov r8, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400014c8
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c919
test byte [rcx + 0x1c], r12b
je 0x14000c919
cmp byte [rcx + 0x19], dil
jb 0x14000c919
mov qword [rsp + 0x20], r14
mov r9d, dword [r14 + 0x80]
mov rcx, qword [rcx + 0x10]
call fcn.14000a5c8
mov eax, 0x80830001
jmp 0x14000e5bf
lea rsi, [rcx + 0x18]
mov qword [rbp - 0x80], rsi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockExclusive]
nop
lea rdi, [0x14003cbb0]
lea r13, [0x140045158]
mov r12d, 1
mov r15d, 0x102
cmp byte [r14 + 0xa4], bl
je 0x14000ca1e
cmp byte [r14 + 0xa5], bl
jne 0x14000c9ee
cmp byte [r14 + 0xa6], bl
jne 0x14000c9ee
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000c9ee
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000c9ee
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000c9d5
test byte [rcx + 0x1c], r12b
je 0x14000c9d5
cmp byte [rcx + 0x19], 3
jb 0x14000c9d5
mov edx, 0x39
mov qword [rsp + 0x20], r14
mov r9d, dword [r14 + 0x80]
mov rcx, qword [rcx + 0x10]
call fcn.14000a510
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockExclusive]
jmp 0x14000c94f
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000ca25
test byte [rcx + 0x1c], r12b
je 0x14000ca25
cmp byte [rcx + 0x19], 5
jb 0x14000ca25
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
mov ebx, 2
xor eax, eax
cmp byte [r14 + 0x2c0], al
je 0x14000cb38
mov r15d, eax
mov byte [rsp + 0x50], r12b
mov byte [r14 + 0x2c0], al
cmp byte [r14 + 0x2be], al
je 0x14000caa3
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000ca8e
test byte [rcx + 0x1c], r12b
je 0x14000ca8e
cmp byte [rcx + 0x19], 4
jb 0x14000ca8e
lea r9, [r14 + 0x288]
lea edx, [rbx + 0x38]
mov qword [rsp + 0x28], r14
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a874
xor eax, eax
mov byte [r14 + 0x2be], al
mov r15, qword [r14 + 0x2d0]
mov qword [r14 + 0x2d0], rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
test r15, r15
je 0x14000cb26
mov rcx, r15
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Unregister_Notification]
mov r9d, eax
test eax, eax
je 0x14000caf6
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000cb26
test byte [rcx + 0x1c], r12b
je 0x14000cb26
cmp byte [rcx + 0x19], bl
jb 0x14000cb26
mov edx, 0x3b
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
jmp 0x14000cb26
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000cb26
test byte [rcx + 0x1c], r12b
je 0x14000cb26
cmp byte [rcx + 0x19], 5
jb 0x14000cb26
mov edx, 0x3c
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400014c8
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockExclusive]
mov rcx, qword [0x140045158]
xor eax, eax
mov r15d, 0x80830002
cmp byte [r14 + 0xa5], al
jne 0x14000e54b
cmp byte [r14 + 0xa6], al
jne 0x14000e54b
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000e544
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000e544
xor ecx, ecx
cmp byte [r14 + 0x2b9], cl
jne 0x14000cd71
cmp byte [r14 + 0x438], cl
jne 0x14000cbb1
cmp byte [r14 + 0x448], cl
je 0x14000cc83
xor r9d, r9d
mov r8b, r12b
xor edx, edx
mov rcx, r14
call fcn.14000f8b8
mov byte [r14 + 0xa4], r12b
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
lea rcx, [r14 + 0x4f8]
call fcn.140015f30
test eax, eax
jns 0x14000cc14
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000cc14
test byte [rcx + 0x1c], r12b
je 0x14000cc14
cmp byte [rcx + 0x19], bl
jb 0x14000cc14
mov edx, 0x3e
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
lea rcx, [r14 + 0x458]
call fcn.140015f30
test eax, eax
jns 0x14000cc57
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000cc57
test byte [rcx + 0x1c], r12b
je 0x14000cc57
cmp byte [rcx + 0x19], bl
jb 0x14000cc57
mov edx, 0x3f
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockExclusive]
xor eax, eax
mov byte [r14 + 0xa4], al
mov dl, r12b
mov rcx, r14
call fcn.140012384
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14000f994
xor ecx, ecx
cmp byte [r14 + 0xa5], cl
jne 0x14000cd10
cmp byte [r14 + 0xa6], cl
jne 0x14000cd10
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000cd10
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000cd10
mov rcx, r14
call fcn.14000f500
mov r15d, eax
xor ecx, ecx
test eax, eax
jns 0x14000cd07
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e5a8
cmp byte [rcx + 0x19], bl
jb 0x14000e5a8
mov edx, 0x41
mov dword [rsp + 0x20], eax
jmp 0x14000e595
mov byte [r14 + 0x2b9], r12b
jmp 0x14000cd71
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000cd4b
cmp byte [rcx + 0x19], 5
jb 0x14000cd4b
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e5a8
cmp byte [rcx + 0x19], bl
jb 0x14000e5a8
mov edx, 0x40
jmp 0x14000e590
mov r15d, 0x80830002
cmp dword [r14 + 0x308], 0xffffffff
je 0x14000d5c0
mov rax, qword [r14 + 0x2a8]
cmp rax, qword [r14 + 0x98]
je 0x14000cd9e
test rax, rax
jne 0x14000d388
mov word [rsp + 0x68], cx
xor eax, eax
mov qword [rsp + 0x6a], rax
mov dword [rsp + 0x72], eax
mov word [rsp + 0x76], ax
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindFirstVolumeW]
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov byte [rsp + 0x40], cl
cmp rax, 0xffffffffffffffff
je 0x14000d05a
or qword [rsp + 0x60], 0xffffffffffffffff
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, 0x5c
cmp word [rbp - 0x40], ax
jne 0x14000cf75
cmp word [rbp - 0x3e], ax
jne 0x14000cf75
lea ecx, [rax - 0x1d]
cmp word [rbp - 0x3c], cx
jne 0x14000cf75
cmp word [rbp - 0x3a], ax
jne 0x14000cf75
mov eax, 0xfffe
add word [rsp + 0x68], ax
mov word [rbp - 0x3e], cx
xor eax, eax
cmp byte [r14 + 0xa5], al
jne 0x14000cf93
cmp byte [r14 + 0xa6], al
jne 0x14000cf93
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000cf93
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000cf93
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov cl, r12b
call fcn.1400092dc
xor ecx, ecx
test eax, eax
js 0x14000cf75
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_io_l1_1_1.dll_DeviceIoControl]
test eax, eax
je 0x14000cf5e
mov eax, dword [rbp - 0x68]
mov r9d, dword [rbp - 0x6c]
cmp dword [r14 + 0x308], r9d
jne 0x14000cf27
cmp dword [r14 + 0x30c], eax
jne 0x14000cf27
mov byte [rsp + 0x40], r12b
add word [rsp + 0x68], bx
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000cf5e
test byte [rcx + 0x1c], r12b
je 0x14000cf5e
cmp byte [rcx + 0x19], 4
jb 0x14000cf5e
mov edx, 0x43
lea r9, [rsp + 0x68]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
jmp 0x14000cf5e
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000cf5e
test byte [rcx + 0x1c], r12b
je 0x14000cf5e
cmp byte [rcx + 0x19], 5
jb 0x14000cf5e
mov edx, 0x44
lea r8, [rsp + 0x68]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], eax
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a16c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
cmp byte [rsp + 0x40], al
jne 0x14000d04f
mov r8d, 0x104
lea rdx, [rbp - 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindNextVolumeW]
test eax, eax
je 0x14000cffb
jmp 0x14000cdd7
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000cfc3
test byte [rcx + 0x1c], r12b
je 0x14000cfc3
cmp byte [rcx + 0x19], 5
jb 0x14000cfc3
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindVolumeClose]
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e5a8
cmp byte [rcx + 0x19], bl
jb 0x14000e5a8
mov edx, 0x42
jmp 0x14000e590
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x12
je 0x14000d04f
mov rax, qword [0x140045158]
cmp rax, r13
je 0x14000d04f
test byte [rax + 0x1c], r12b
je 0x14000d04f
cmp byte [rax + 0x19], bl
jb 0x14000d04f
lea rbx, [r14 + 0x90]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r9d, eax
mov edx, 0x45
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rcx, qword [0x140045158]
mov rcx, qword [rcx + 0x10]
call fcn.14000a288
mov ebx, 2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindVolumeClose]
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d0a8
test byte [rcx + 0x1c], r12b
je 0x14000d0a8
cmp byte [rcx + 0x19], 4
jb 0x14000d0a8
lea rax, [r14 + 0x90]
mov edx, 0x46
mov qword [rsp + 0x28], rax
mov eax, dword [r14 + 0x30c]
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x308]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a16c
mov rcx, qword [0x140045158]
xor edx, edx
cmp byte [rsp + 0x40], dl
jne 0x14000d0f4
mov r15d, 0x80830005
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e5a8
cmp byte [rcx + 0x19], bl
jb 0x14000e5a8
lea r9, [r14 + 0x288]
mov edx, 0x47
mov dword [rsp + 0x20], r15d
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
jmp 0x14000e5a8
lea rax, [r14 + 0x2a0]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [0x140045ca0]
movdqu xmmword [rax], xmm0
lea rax, [r14 + 0x298]
cmp qword [rax], rdx
je 0x14000d129
mov rcx, qword [rax]
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
mov qword [r14 + 0x298], rax
movzx ecx, word [rsp + 0x68]
add rcx, rbx
call qword [sym.imp.msvcrt.dll_malloc]
lea rcx, [r14 + 0x298]
mov qword [rcx], rax
test rax, rax
jne 0x14000d177
mov r15d, 0x8007000e
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e5a8
cmp byte [rcx + 0x19], bl
jb 0x14000e5a8
lea edx, [rax + 0x48]
jmp 0x14000e590
mov qword [rsp + 0x20], rcx
lea r9, [r14 + 0x2a0]
xor r8d, r8d
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.140009800
mov dword [rsp + 0x48], eax
test byte [0x140045c80], r12b
je 0x14000d1d5
movzx ecx, word [r14 + 0x2a0]
shr cx, 1
movzx r8d, word [r14 + 0x288]
shr r8w, 1
mov rax, qword [r14 + 0x2a8]
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], cx
mov r9, qword [r14 + 0x290]
call fcn.140009f74
jmp 0x14000d1d7
xor eax, eax
mov r9d, eax
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d21f
test byte [rcx + 0x1c], r12b
je 0x14000d21f
cmp byte [rcx + 0x19], 4
jb 0x14000d21f
lea rax, [r14 + 0x288]
mov edx, 0x49
lea r8, [r14 + 0x2a0]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
mov rcx, qword [0x140045158]
mov eax, dword [rsp + 0x48]
test eax, eax
jns 0x14000d269
cmp rcx, r13
je 0x14000d253
test byte [rcx + 0x1c], r12b
je 0x14000d253
cmp byte [rcx + 0x19], bl
jb 0x14000d253
lea r9, [r14 + 0x90]
mov edx, 0x4a
mov dword [rsp + 0x20], eax
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
movups xmm0, xmmword [r14 + 0x90]
movdqu xmmword [r14 + 0x2a0], xmm0
jmp 0x14000d346
cmp rcx, r13
je 0x14000d2ae
test byte [rcx + 0x1c], r12b
je 0x14000d2ae
cmp byte [rcx + 0x19], 4
jb 0x14000d2ae
lea rax, [r14 + 0x90]
mov edx, 0x4b
mov qword [rsp + 0x28], rax
lea rax, [r14 + 0x2a0]
mov qword [rsp + 0x20], rax
mov r9d, dword [r14 + 0x80]
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
mov rcx, qword [0x140045158]
xor eax, eax
cmp byte [r14 + 0xa5], al
jne 0x14000d566
cmp byte [r14 + 0xa6], al
jne 0x14000d566
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000d55f
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000d55f
lea rdx, [r14 + 0x2a0]
mov rcx, r14
call fcn.14000c084
mov dword [rsp + 0x48], eax
test eax, eax
jns 0x14000d34f
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d346
test byte [rcx + 0x1c], r12b
je 0x14000d346
cmp byte [rcx + 0x19], bl
jb 0x14000d346
mov edx, 0x4d
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x58]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
mov eax, dword [rsp + 0x48]
jmp 0x14000e5ab
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d37f
test byte [rcx + 0x1c], r12b
je 0x14000d37f
cmp byte [rcx + 0x19], 4
jb 0x14000d37f
lea r9, [r14 + 0x288]
mov edx, 0x4e
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
xor ecx, ecx
mov byte [r14 + 0xa7], cl
cmp byte [rsp + 0x50], cl
je 0x14000d82d
cmp byte [r14 + 0xa5], cl
jne 0x14000d4e6
cmp byte [r14 + 0xa6], cl
jne 0x14000d4e6
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000d4e6
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000d4e6
xor edi, edi
mov qword [rsp + 0x58], rdi
lea rdx, [r14 + 0x2a0]
lea r8, [rsp + 0x58]
mov cl, r12b
call fcn.1400092dc
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x48], edi
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400098f0
mov dword [rsp + 0x48], eax
test rbx, rbx
je 0x14000d438
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov ebx, edi
mov qword [rsp + 0x58], rbx
mov eax, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
test eax, eax
js 0x14000d478
mov ecx, dword [rdi + 4]
cmp dword [rdi], ecx
jne 0x14000d478
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor r15d, r15d
mov qword [rsp + 0x60], r15
test rbx, rbx
je 0x14000d467
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
lea rdi, [0x14003cbb0]
mov ebx, 2
jmp 0x14000d830
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d4b4
test byte [rcx + 0x1c], r12b
je 0x14000d4b4
mov edx, 2
cmp byte [rcx + 0x19], dl
jb 0x14000d4b4
mov edx, 0x50
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x80]
lea r8, [0x14003cbb0]
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
xor edx, edx
mov rcx, r14
call fcn.14000ba9c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockExclusive]
nop
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
mov qword [rsp + 0x60], rax
jmp 0x14000df38
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000d521
cmp byte [rcx + 0x19], 5
jb 0x14000d521
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x4f
mov dword [rsp + 0x20], r15d
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
jmp 0x14000e5ae
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000d59a
cmp byte [rcx + 0x19], 5
jb 0x14000d59a
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e5a8
cmp byte [rcx + 0x19], bl
jb 0x14000e5a8
mov edx, 0x4c
jmp 0x14000e590
cmp byte [r14 + 0x2bf], cl
jne 0x14000d7ee
or qword [rsp + 0x58], 0xffffffffffffffff
cmp byte [r14 + 0xa5], cl
jne 0x14000d78d
cmp byte [r14 + 0xa6], cl
jne 0x14000d78d
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000d78d
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000d78d
lea r15, [r14 + 0x288]
lea r8, [rsp + 0x58]
mov rdx, r15
mov cl, r12b
call fcn.1400092dc
test eax, eax
js 0x14000d74b
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70214
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_io_l1_1_1.dll_DeviceIoControl]
test eax, eax
je 0x14000d6f6
mov al, 4
test byte [rbp - 0x58], al
je 0x14000d6c9
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d6bd
test byte [rcx + 0x1c], r12b
je 0x14000d6bd
cmp byte [rcx + 0x19], al
jb 0x14000d6bd
mov edx, 0x52
mov r9, r15
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov byte [r14 + 0xa7], r12b
xor r15d, r15d
jmp 0x14000d73e
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d734
test byte [rcx + 0x1c], r12b
je 0x14000d734
cmp byte [rcx + 0x19], al
jb 0x14000d734
mov edx, 0x53
mov r9, r15
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
jmp 0x14000d734
mov rax, qword [0x140045158]
cmp rax, r13
je 0x14000d734
test byte [rax + 0x1c], r12b
je 0x14000d734
cmp byte [rax + 0x19], 4
jb 0x14000d734
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r9d, eax
mov edx, 0x54
mov qword [rsp + 0x20], r15
mov r8, rdi
mov rcx, qword [0x140045158]
mov rcx, qword [rcx + 0x10]
call fcn.14000a288
xor r15d, r15d
mov byte [r14 + 0xa7], r15b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14000d784
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d77a
test byte [rcx + 0x1c], r12b
je 0x14000d77a
cmp byte [rcx + 0x19], bl
jb 0x14000d77a
mov edx, 0x55
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
xor r15d, r15d
mov byte [r14 + 0xa7], r15b
mov byte [r14 + 0x2bf], r12b
jmp 0x14000d7f1
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000d7c8
cmp byte [rcx + 0x19], 5
jb 0x14000d7c8
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x51
jmp 0x14000d542
xor r15d, r15d
cmp byte [r14 + 0xa7], r15b
je 0x14000d830
mov r15d, 0x80830005
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x56
jmp 0x14000dc97
xor r15d, r15d
cmp byte [r14 + 0x438], r15b
jne 0x14000d97d
cmp byte [r14 + 0xa5], r15b
jne 0x14000d916
cmp byte [r14 + 0xa6], r15b
jne 0x14000d916
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov r15d, 0x102
cmp eax, r15d
jne 0x14000d916
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000d916
lea r9, [r14 + 0x440]
xor r8d, r8d
mov rdx, qword [r14 + 0x270]
mov rcx, r14
call fcn.1400145a0
mov r15d, eax
test eax, eax
jns 0x14000d8da
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x58
jmp 0x14000dc97
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000d90a
test byte [rcx + 0x1c], r12b
je 0x14000d90a
cmp byte [rcx + 0x19], 4
jb 0x14000d90a
lea r9, [r14 + 0x288]
mov edx, 0x59
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov byte [r14 + 0x438], r12b
xor r15d, r15d
jmp 0x14000d97d
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000d957
cmp byte [rcx + 0x19], 5
jb 0x14000d957
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x57
jmp 0x14000d542
cmp byte [r14 + 0x448], r15b
jne 0x14000daca
cmp byte [r14 + 0xa5], r15b
jne 0x14000da63
cmp byte [r14 + 0xa6], r15b
jne 0x14000da63
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov r15d, 0x102
cmp eax, r15d
jne 0x14000da63
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000da63
lea r9, [r14 + 0x450]
mov r8d, r12d
mov rdx, qword [r14 + 0x258]
mov rcx, r14
call fcn.1400145a0
mov r15d, eax
test eax, eax
jns 0x14000da27
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x5b
jmp 0x14000dc97
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000da57
test byte [rcx + 0x1c], r12b
je 0x14000da57
cmp byte [rcx + 0x19], 4
jb 0x14000da57
lea r9, [r14 + 0x288]
mov edx, 0x5c
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov byte [r14 + 0x448], r12b
xor r15d, r15d
jmp 0x14000daca
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000daa4
cmp byte [rcx + 0x19], 5
jb 0x14000daa4
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x5a
jmp 0x14000d542
cmp byte [r14 + 0x4f4], r15b
jne 0x14000dbe6
cmp byte [r14 + 0xa5], r15b
jne 0x14000db7c
cmp byte [r14 + 0xa6], r15b
jne 0x14000db7c
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov r15d, 0x102
cmp eax, r15d
jne 0x14000db7c
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000db7c
lea rax, [r14 + 0x450]
lea rcx, [r14 + 0x458]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, qword [r14 + 0x348]
mov rdx, r14
call fcn.140015ad4
mov r15d, eax
test eax, eax
jns 0x14000dbe3
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x5e
jmp 0x14000dc97
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000dbbd
cmp byte [rcx + 0x19], 5
jb 0x14000dbbd
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x5d
jmp 0x14000d542
xor r15d, r15d
cmp byte [r14 + 0x594], r15b
jne 0x14000dd1e
cmp byte [r14 + 0xa5], r15b
jne 0x14000dcb4
cmp byte [r14 + 0xa6], r15b
jne 0x14000dcb4
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov r15d, 0x102
cmp eax, r15d
jne 0x14000dcb4
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000dcb4
lea rax, [r14 + 0x440]
lea rcx, [r14 + 0x4f8]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, qword [r14 + 0x328]
mov rdx, r14
call fcn.140015ad4
mov r15d, eax
test eax, eax
jns 0x14000dd1b
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x60
lea r9, [r14 + 0x288]
mov dword [rsp + 0x20], r15d
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
jmp 0x14000e5ae
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000dcf5
cmp byte [rcx + 0x19], 5
jb 0x14000dcf5
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], bl
jb 0x14000e5ae
mov edx, 0x5f
jmp 0x14000d542
xor r15d, r15d
cmp byte [r14 + 0x2ba], r15b
jne 0x14000df4f
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov rax, qword [r14 + 0x2a8]
mov qword [rsp + 0x70], rax
movzx eax, word [r14 + 0x2a2]
mov word [rsp + 0x6a], ax
movzx eax, word [r14 + 0x2a0]
sub ax, 2
mov word [rsp + 0x68], ax
cmp byte [r14 + 0xa5], r15b
jne 0x14000decc
cmp byte [r14 + 0xa6], r15b
jne 0x14000decc
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov r15d, 0x102
cmp eax, r15d
jne 0x14000decc
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000decc
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.1400092dc
mov r15d, eax
test eax, eax
jns 0x14000de01
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000ddf7
test byte [rcx + 0x1c], r12b
je 0x14000ddf7
cmp byte [rcx + 0x19], 2
jb 0x14000ddf7
mov edx, 0x62
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x68]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
mov rbx, qword [rsp + 0x48]
jmp 0x14000df38
mov ebx, 0x1a0
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x40]
call sub.msvcrt.dll_memset
mov qword [rbp - 0x40], rbx
xor r15d, r15d
mov dword [rbp - 0x38], r12d
mov rbx, qword [rsp + 0x48]
mov qword [rbp - 0x30], rbx
lea r9, [r14 + 0x2c8]
lea r8, [0x140012e60]
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Register_Notification]
test eax, eax
je 0x14000de98
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000de77
test byte [rcx + 0x1c], r12b
je 0x14000de77
cmp byte [rcx + 0x19], 2
jb 0x14000de77
lea r9, [r14 + 0x288]
lea edx, [r15 + 0x63]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a6f8
test rbx, rbx
je 0x14000de8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov r15d, 0x80004005
jmp 0x14000df38
test rbx, rbx
je 0x14000deae
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov byte [r14 + 0x2ba], r12b
test rbx, rbx
je 0x14000df4f
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14000df4f
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000df38
test byte [rcx + 0x1c], r12b
je 0x14000df09
cmp byte [rcx + 0x19], 5
jb 0x14000df09
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000df38
test byte [rcx + 0x1c], r12b
je 0x14000df38
cmp byte [rcx + 0x19], 2
jb 0x14000df38
mov edx, 0x61
mov dword [rsp + 0x20], r15d
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
nop
test rbx, rbx
je 0x14000e5ae
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14000e5ae
cmp byte [r14 + 0x2be], r15b
jne 0x14000e143
cmp dword [r14 + 0x308], 0xffffffff
je 0x14000e143
mov rax, qword [r14 + 0x98]
cmp qword [r14 + 0x2a8], rax
je 0x14000e143
mov rbx, r15
mov qword [rsp + 0x60], rbx
cmp byte [r14 + 0xa5], r15b
jne 0x14000e0d2
cmp byte [r14 + 0xa6], r15b
jne 0x14000e0d2
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov r15d, 0x102
cmp eax, r15d
jne 0x14000e0d2
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000e0d2
lea rbx, [r14 + 0x288]
lea r8, [rsp + 0x60]
mov rdx, rbx
xor ecx, ecx
call fcn.1400092dc
mov r15d, eax
test eax, eax
jns 0x14000e02d
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e023
test byte [rcx + 0x1c], r12b
je 0x14000e023
cmp byte [rcx + 0x19], 2
jb 0x14000e023
mov edx, 0x65
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
mov rbx, qword [rsp + 0x60]
jmp 0x14000e13e
mov ebx, 0x1a0
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x40]
call sub.msvcrt.dll_memset
mov qword [rbp - 0x40], rbx
xor r15d, r15d
mov dword [rbp - 0x38], r12d
mov rbx, qword [rsp + 0x60]
mov qword [rbp - 0x30], rbx
lea r9, [r14 + 0x2d0]
lea r8, [0x140012e30]
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Register_Notification]
test eax, eax
je 0x14000e0a5
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e0ac
test byte [rcx + 0x1c], r12b
je 0x14000e0ac
cmp byte [rcx + 0x19], 2
jb 0x14000e0ac
lea r9, [r14 + 0x2a0]
lea edx, [r15 + 0x66]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a6f8
jmp 0x14000e0ac
mov byte [r14 + 0x2be], r12b
test rbx, rbx
je 0x14000e0c2
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, r15
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x14000e143
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14000e143
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e13e
test byte [rcx + 0x1c], r12b
je 0x14000e10f
cmp byte [rcx + 0x19], 5
jb 0x14000e10f
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e13e
test byte [rcx + 0x1c], r12b
je 0x14000e13e
cmp byte [rcx + 0x19], 2
jb 0x14000e13e
mov edx, 0x64
mov dword [rsp + 0x20], r15d
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
nop
jmp 0x14000df38
cmp byte [r14 + 0x2bb], r15b
je 0x14000e15f
cmp byte [rsp + 0x51], r15b
jne 0x14000e15f
add dword [r14 + 0x2b0], r12d
jmp 0x14000e5ae
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e19e
test byte [rcx + 0x1c], r12b
je 0x14000e19e
cmp byte [rcx + 0x19], 4
jb 0x14000e19e
lea r9, [r14 + 0x288]
mov edx, 0x67
mov eax, dword [r14 + 0x2b0]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a6f8
mov rcx, qword [0x140045158]
cmp byte [r14 + 0xa5], r15b
jne 0x14000e4eb
cmp byte [r14 + 0xa6], r15b
jne 0x14000e4eb
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov ebx, 0x102
cmp eax, ebx
jne 0x14000e4e4
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x14000e4e4
mov qword [rsp + 0x48], r15
lea rbx, [r14 + 0x90]
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x48]
mov rdx, rbx
mov cl, r12b
call fcn.1400092dc
mov r15d, eax
test eax, eax
jns 0x14000e24d
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e243
test byte [rcx + 0x1c], r12b
je 0x14000e243
cmp byte [rcx + 0x19], 2
jb 0x14000e243
mov edx, 0x69
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
mov rbx, qword [rsp + 0x48]
jmp 0x14000e4df
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, r14
call fcn.14000f254
mov r15d, eax
test eax, eax
jns 0x14000e2a9
test rbx, rbx
je 0x14000e27b
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ebx, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e4df
test byte [rcx + 0x1c], r12b
je 0x14000e4df
cmp byte [rcx + 0x19], 2
jb 0x14000e4df
mov edx, 0x6a
jmp 0x14000e390
xor r15d, r15d
cmp byte [r14 + 0xa5], r15b
jne 0x14000e473
cmp byte [r14 + 0xa6], r15b
jne 0x14000e473
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000e473
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000e473
cmp qword [r14 + 0x5b8], 0xffffffffffffffff
jne 0x14000e416
cmp byte [r14 + 0xa5], r15b
jne 0x14000e3ab
cmp byte [r14 + 0xa6], r15b
jne 0x14000e3ab
xor edx, edx
mov rcx, qword [r14 + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
mov r15d, 0x102
cmp eax, r15d
jne 0x14000e3ab
xor edx, edx
mov rcx, qword [r14 + 0x2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r15d
jne 0x14000e3ab
lea rcx, [r14 + 0x5b0]
call fcn.14001833c
mov r15d, eax
test eax, eax
jns 0x14000e413
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e4df
test byte [rcx + 0x1c], r12b
je 0x14000e4df
cmp byte [rcx + 0x19], 2
jb 0x14000e4df
mov edx, 0x6d
mov dword [rsp + 0x20], r15d
mov r9, qword [rsp + 0x58]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140009248
jmp 0x14000e4df
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e4df
test byte [rcx + 0x1c], r12b
je 0x14000e3ec
cmp byte [rcx + 0x19], 5
jb 0x14000e3ec
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e4df
test byte [rcx + 0x1c], r12b
je 0x14000e4df
cmp byte [rcx + 0x19], 2
jb 0x14000e4df
mov edx, 0x6c
jmp 0x14000e4c6
xor r15d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000e798
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e44d
test byte [rcx + 0x1c], r12b
je 0x14000e44d
cmp byte [rcx + 0x19], 4
jb 0x14000e44d
mov edx, 0x6e
mov r9d, eax
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400014c8
test rbx, rbx
je 0x14000e463
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov byte [r14 + 0x2bb], r12b
add dword [r14 + 0x2b0], r12d
jmp 0x14000e4df
mov r15d, 0x80830002
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e4df
test byte [rcx + 0x1c], r12b
je 0x14000e4b0
cmp byte [rcx + 0x19], 5
jb 0x14000e4b0
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e4df
test byte [rcx + 0x1c], r12b
je 0x14000e4df
cmp byte [rcx + 0x19], 2
jb 0x14000e4df
mov edx, 0x6b
mov dword [rsp + 0x20], r15d
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
nop
jmp 0x14000df38
mov rcx, qword [0x140045158]
mov r15d, 0x80830002
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e525
cmp byte [rcx + 0x19], 5
jb 0x14000e525
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5ae
test byte [rcx + 0x1c], r12b
je 0x14000e5ae
cmp byte [rcx + 0x19], 2
jb 0x14000e5ae
mov edx, 0x68
jmp 0x14000d542
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e57b
cmp byte [rcx + 0x19], 5
jb 0x14000e57b
lea r9, [r14 + 0x288]
mov edx, 0xd7
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.14000a67c
mov rcx, qword [0x140045158]
cmp rcx, r13
je 0x14000e5a8
test byte [rcx + 0x1c], r12b
je 0x14000e5a8
cmp byte [rcx + 0x19], bl
jb 0x14000e5a8
mov edx, 0x3d
mov dword [rsp + 0x20], r15d
mov r9d, dword [r14 + 0x80]
mov r8, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400016d8
mov eax, r15d
mov r15d, eax
test rsi, rsi
je 0x14000e5bc
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
mov eax, r15d
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140039130
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret