Function at 0x140002ada
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x728
lea rsi, str.USBSTOR
xor r9d, r9d
xor r8d, r8d
movabs rax, 0x525c4946455c3a3f
movabs rdx, 0x66746e5c73756675
mov qword [rsp + 0x10e], rax
lea rdi, [rsp + 0x288]
movabs rax, 0x5f7366746e5c7375
lea r12, [rsp + 0x288]
mov qword [rsp + 0x116], rdx
movabs rdx, 0x6966652e343678
lea rbp, [rsp + 0x1a0]
mov dword [rsp + 0x770], ecx
mov ecx, 0x10
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x22
mov qword [rsp + 0x118], rax
lea rdi, [rsp + 0x388]
xor eax, eax
lea rsi, [0x14007c0a0]
mov qword [rsp + 0x120], rdx
mov edx, 0x14b
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x10
lea rdi, [rsp + 0x2c8]
lea rsi, str.1q_b_
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xc
lea rdi, [rsp + 0x220]
lea rsi, str.mq_b_
rep movsd dword [rdi], dword [rsi]
mov ecx, 8
xor esi, esi
lea rdi, [rsp + 0x1a0]
rep stosd dword [rdi], eax
mov ecx, 8
lea rdi, [rsp + 0x1c0]
mov qword [rsp + 0xc8], rsi
rep stosd dword [rdi], eax
mov rax, qword [0x1400b6640]
mov qword [rsp + 0xd0], rsi
mov dword [rsp + 0xba], 0x3a3f2820
mov word [rsp + 0xbe], 0x29
mov rcx, qword [rax]
mov dword [rsp + 0xb6], 0x5c3a3f
call qword [0x14011d030]
call fcn.140002a72
lea rax, [rsp + 0xd8]
mov edx, pe_nt_image_headers64
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.140036cb3
mov rcx, qword [rsp + 0x58]
mov r8d, 1
lea rdx, [0x1400865ee]
call fcn.140036cf3
mov ecx, 0x104
call fcn.140079730
mov r15, rax
test rax, rax
lea rax, [rsp + 0x388]
mov qword [rsp + 0x68], rax
je 0x140004a82
xor r8d, r8d
xor edx, edx
mov r9d, 0x12
lea rcx, [0x1400871a0]
call qword [0x14011cce8]
mov qword [rsp + 0x50], rax
inc rax
je 0x140002f36
lea rdx, [rsp + 0xc8]
mov ecx, 0x101
call fcn.140035d81
test eax, eax
jne 0x140002cb6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SETUPAPI.dll_ParamsW]
jmp 0x140002f36
mov rax, qword [0x14011ccd8]
xor esi, esi
mov dword [rsp + 0x160], 0x20
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x160]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov edx, esi
mov r8, rbx
call rax
test eax, eax
je 0x140002ca6
mov rax, qword [0x1400b6b80]
inc esi
cmp dword [rax], 0
je 0x140002d08
mov edx, esi
lea rcx, str.Processing_Hub__d:
call fcn.140038472
lea rdi, [rsp + 0x180]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x20], rdi
lea r8, [0x1400871a0]
mov dword [rsp + 0x180], 0x20
call qword [0x14011cce0]
test eax, eax
je 0x140002ccf
xor ebx, ebx
lea r14, [rsp + 0xa4]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x20], r14
mov r13, qword [0x14011ccf8]
call r13
test eax, eax
jne 0x140002ccf
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp eax, 0x7a
jne 0x140002ccf
mov edx, dword [rsp + 0xa4]
mov ecx, 1
mov dword [rsp + 0x74], edx
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x140002ccf
xor r11d, r11d
mov dword [rax], 8
mov r8, rax
mov rdx, rdi
mov r9d, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r14
call r13
test eax, eax
jne 0x140002dd7
mov rcx, rbx
call fcn.1400796c8
jmp 0x140002ccf
lea r14, [rsp + 0xa0]
xor r8d, r8d
mov edx, dword [rsp + 0x174]
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_CM_Get_Child]
test eax, eax
jne 0x140002dca
mov byte [r15], 0
mov rcx, qword [rsp + 0x58]
lea r13, [rbx + 4]
mov r8d, 1
mov rdx, r13
call fcn.140036cf3
mov edi, eax
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x140002e30
mov r8, r13
mov edx, edi
lea rcx, str.__Hub__d____s
call fcn.140038472
test edi, edi
js 0x140002dca
xor r9d, r9d
mov ecx, dword [rsp + 0xa0]
mov r8d, 0x104
mov rdx, r15
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
test eax, eax
jne 0x140002dca
mov rcx, r15
call fcn.140001fe9
lea rdx, [rsp + 0xc8]
mov rcx, r15
call fcn.140035e71
mov edx, eax
test eax, eax
je 0x140002e88
mov eax, eax
movsxd rcx, edi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc8]
mov qword [rax + 0x10], rcx
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x140002ea3
mov r8, r15
lea rcx, str.__Found_ID__03d_:__s
call fcn.140038472
mov r13, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInSetupDiGetDeviceRegistSetupDiSetClassInstallParamsW]
xor r8d, r8d
mov edx, dword [rsp + 0xa0]
mov rcx, r14
call r13
test eax, eax
jne 0x140002dca
xor r9d, r9d
mov byte [r15], 0
mov r8d, 0x104
mov rdx, r15
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
test eax, eax
jne 0x140002eaa
mov rcx, r15
call fcn.140001fe9
lea rdx, [rsp + 0xc8]
mov rcx, r15
call fcn.140035e71
mov edx, eax
test eax, eax
je 0x140002f16
mov eax, eax
movsxd rcx, edi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc8]
mov qword [rax + 0x10], rcx
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x140002eaa
mov r8, r15
lea rcx, str.__Found_ID__03d_:__s
call fcn.140038472
jmp 0x140002eaa
mov rcx, r15
xor r13d, r13d
mov r15, rbp
xor r14d, r14d
call fcn.1400796c8
mov dword [rsp + 0x58], 8
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
lea rsi, str.UASPSTOR
mov rbx, qword [r12 + r13*8]
mov rdx, rsi
mov rcx, rbx
call fcn.1400797d0
mov r8d, 0x102
mov rdx, rbx
mov rcx, r15
test eax, eax
mov eax, dword [rsp + 0x58]
cmove eax, r13d
mov dword [rsp + 0x58], eax
call rdi
test eax, eax
je 0x140002f92
xor r10d, r10d
mov dword [r15], r10d
mov eax, dword [r15]
test eax, eax
je 0x140002f9e
lea r14d, [rax + r14 - 1]
inc r13
add r15, 4
cmp r13, 8
jne 0x140002f5d
mov dword [rsp + 0x74], 0x11
xor esi, esi
lea rbx, [0x140086674]
mov rax, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [rax + rsi*8]
call fcn.1400797d0
test eax, eax
mov eax, dword [rsp + 0x74]
cmove eax, esi
inc rsi
mov dword [rsp + 0x74], eax
cmp rsi, 0x11
jne 0x140002fbc
mov r15, qword [sym.imp.msvcrt.dll_clearerr]
mov r13d, 1
lea rsi, [rsp + 0x200]
mov edx, 0x20
mov dword [rsp + 0x20], r13d
or r8, 0xffffffffffffffff
mov rcx, rsi
lea r9, str.IgnoreUsb_02d
call r15
mov rax, qword [0x1400b67f0]
mov byte [rsp + 0x21f], 0
mov rdx, qword [rax]
test rdx, rdx
je 0x140003062
mov r8d, 1
mov rcx, rsi
xor ebx, ebx
call fcn.140023801
mov rdi, rax
test rax, rax
je 0x140003219
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140079830
mov rcx, rdi
mov ebx, eax
call fcn.1400796c8
jmp 0x140003219
xor eax, eax
lea rdi, [rsp + 0x61c]
xor r8d, r8d
xor r9d, r9d
mov ecx, 0x41
mov qword [rsp + 0x410], r8
rep stosd dword [rdi], eax
mov rcx, rsi
mov qword [rsp + 0x518], r8
lea rdi, [rsp + 0x61c]
mov dword [rsp + 0x250], 0xffffffff
mov dword [rsp + 0x308], 4
mov dword [rsp + 0x128], r9d
call fcn.1400797e8
mov rbx, rax
test rbx, rbx
je 0x140003126
cmp byte [rsi + rbx], 0x5c
je 0x1400030ca
dec rbx
jmp 0x1400030ba
lea r9, [rax + 1]
mov r8, rsi
mov edx, 0x104
mov rcx, rdi
call fcn.140001fb0
lea rax, [rsp + 0x518]
xor r8d, r8d
mov rdx, rdi
mov byte [rsp + rbx + 0x61c], 0
mov r9d, 0x20019
inc rbx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [0x14011c1f8]
test eax, eax
je 0x1400031b5
xor ecx, ecx
mov qword [rsp + 0x518], rcx
jmp 0x1400031ec
xor r8d, r8d
lea rax, [rsp + 0x410]
mov r9d, 0x2001d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, [0x140086685]
call qword [0x14011c1f8]
test eax, eax
je 0x140003163
xor edx, edx
mov qword [rsp + 0x410], rdx
jmp 0x1400031ec
lea rax, [rsp + 0x144]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 7
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x518]
mov rcx, qword [rsp + 0x410]
lea rdx, [0x14008668e]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [0x14011c1d0]
test eax, eax
jne 0x140003117
lea rax, [rsp + 0x308]
lea rdx, [rsi + rbx]
xor r8d, r8d
mov rcx, qword [rsp + 0x518]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x128]
lea r9, [rsp + 0x250]
mov qword [rsp + 0x20], rax
call qword [0x14011c208]
mov rcx, qword [rsp + 0x410]
test rcx, rcx
je 0x1400031ff
call qword [0x14011c1c8]
mov rcx, qword [rsp + 0x518]
test rcx, rcx
je 0x140003212
call qword [0x14011c1c8]
mov ebx, dword [rsp + 0x128]
mov dword [rsp + r13*4 + 0x1dc], ebx
inc r13
cmp r13, 9
jne 0x140002ff8
mov eax, dword [rsp + 0x58]
mov r8d, 0x249
lea rdx, str.dev.c
lea rcx, str._uasp_start___0____uasp_start___ARRAYSIZE_usbstor_name__
dec eax
cmp eax, 6
ja 0x14000326c
mov eax, dword [rsp + 0x74]
dec eax
cmp eax, 0xf
jbe 0x140003272
mov r8d, 0x24a
lea rdx, str.dev.c
lea rcx, str._card_start___0____card_start___ARRAYSIZE_genstor_name__
call qword [sym.imp.msvcrt.dll_memmove]
test r14d, r14d
je 0x140003371
lea ecx, [r14 + 1]
xor edi, edi
xor r14d, r14d
call fcn.140079730
mov r13, qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
mov r15, rax
test rax, rax
jne 0x1400032d4
lea rcx, str.Could_not_allocate_Device_ID_list
call fcn.140038472
jmp 0x140004a82
mov rsi, qword [r12 + rdi*2]
mov ebx, r14d
mov r9d, 0x102
add rbx, r15
mov rdx, rbx
mov rcx, rsi
call r13
test eax, eax
je 0x1400032e8
add rdi, 4
cmp rdi, 0x20
je 0x140003374
mov r8d, dword [rdi + rbp]
mov dword [rsp + rdi + 0x1c0], r14d
cmp r8d, 1
jbe 0x1400032c6
jmp 0x1400032a9
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
jne 0x140003306
add r14d, dword [rbp + rdi]
mov edx, r14d
lea r8d, [r14 - 2]
lea rax, [r15 + rdx]
jmp 0x140003352
mov rdx, rsi
lea rcx, str.Processing_IDs_belonging_to__s:
lea rsi, str.___s
call fcn.140038472
cmp byte [rbx], 0
je 0x1400032f4
mov rdx, rbx
mov rcx, rsi
call fcn.140038472
mov rcx, rbx
call fcn.1400797e8
lea rbx, [rbx + rax + 1]
jmp 0x14000331c
mov r9, rax
lea ecx, [r14 - 1]
sub r9, rdx
cmp byte [r9 + r8], 0
jne 0x14000335d
dec rax
mov r14d, ecx
cmp r14d, 2
ja 0x14000333b
jmp 0x1400032c6
mov r9d, ecx
cmp byte [r15 + r9], 0
jne 0x14000334c
cmp byte [rax], 0
jne 0x14000334c
jmp 0x1400032c6
xor r15d, r15d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1400b5e20]
mov r9d, 0x12
call qword [0x14011cce8]
mov qword [rsp + 0x50], rax
inc rax
jne 0x1400033af
call fcn.14003893c
lea rcx, str.SetupDiGetClassDevs__Interface__failed:__s
mov rdx, rax
call fcn.140038472
jmp 0x140004a82
mov dword [rsp + 0x160], 0x20
test r15, r15
setne byte [rsp + 0x8f]
xor eax, eax
xor r14d, r14d
mov dword [rsp + 0x88], eax
lea rsi, [rsp + 0x160]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x50]
mov r8, rsi
call qword [0x14011ccd8]
test eax, eax
je 0x1400048c6
lea rbx, [rsp + 0x410]
xor eax, eax
mov ecx, 0x41
xor r13d, r13d
lea rdx, [rsp + 0x144]
mov rdi, rbx
lea rbp, [rsp + 0xa4]
mov r8d, 0x16
rep stosd dword [rdi], eax
mov rdi, rdx
mov ecx, 7
mov rdx, rsi
rep stosd dword [rdi], eax
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
lea rdi, str.USBSTOR
mov qword [rsp + 0x20], rbx
call qword [0x14011cd00]
mov r12, qword [sym.imp.msvcrt.dll_fread]
test eax, eax
jne 0x140003484
call fcn.14003893c
lea rcx, str.SetupDiGetDeviceRegistryProperty__Enumerator_Name__failed:__s
mov rdx, rax
jmp 0x140004182
inc r13d
cmp r13d, 8
je 0x1400034af
mov rdx, rdi
mov rcx, rbx
call r12
test eax, eax
jne 0x14000347b
mov byte [rsp + 0x158], 1
test r13d, r13d
je 0x1400034af
mov eax, dword [rsp + 0x58]
cmp r13d, eax
jae 0x1400034af
mov byte [rsp + 0x15a], 1
mov r13, qword [sym.imp.msvcrt.dll_fread]
xor r12d, r12d
lea rdi, [0x140086377]
mov rdx, qword [rsp + r12*8 + 0x388]
mov rcx, rbx
test rdx, rdx
cmove rdx, rdi
call r13
test eax, eax
jne 0x1400034f4
mov eax, dword [rsp + 0x74]
mov byte [rsp + 0x159], 1
cmp r12d, eax
jb 0x1400034fd
mov byte [rsp + 0x15a], 1
jmp 0x1400034fd
inc r12
cmp r12, 0x11
jne 0x1400034c0
mov rdi, qword [0x1400b6b80]
cmp dword [rdi], 0
je 0x140003518
mov rdx, rbx
lea rcx, str.Processing__s_device:
call fcn.140038472
cmp word [rsp + 0x158], 0
jne 0x14000353d
cmp dword [rdi], 0
je 0x1400048ba
lea rcx, str.__Unsupported_or_disabled_by_policy
call fcn.140038472
jmp 0x1400048ba
xor eax, eax
mov ecx, 0x41
mov rdi, rbx
mov r8d, 1
rep stosd dword [rdi], eax
mov rdx, rsi
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
lea r9, [rsp + 0xa8]
lea rdi, [rsp + 0x410]
mov qword [rsp + 0x20], rbx
call qword [0x14011cd00]
test eax, eax
je 0x14000360a
lea rax, str.Arsenal_________Virtual_
lea rbx, [0x140086377]
mov qword [rsp + 0x250], rax
lea rax, str.KernSafeVirtual_________
mov qword [rsp + 0x258], rax
lea rax, str.Msft____Virtual_Disk____
mov qword [rsp + 0x260], rax
lea rax, str.VMware__VMware_Virtual_S
mov qword [rsp + 0x268], rax
mov rax, qword [0x1400b64e0]
cmp dword [rax], 1
sbb r12d, r12d
xor ebp, ebp
add r12d, 4
cmp r12d, ebp
jle 0x140003608
mov rdx, qword [rsp + rbp*8 + 0x250]
mov rcx, rdi
test rdx, rdx
cmove rdx, rbx
inc rbp
call fcn.140079820
test rax, rax
je 0x1400035dd
mov eax, 1
jmp 0x14000360a
xor eax, eax
cmp byte [rsp + 0x15a], 0
mov byte [rsp + 0x15c], al
jne 0x1400036eb
mov r8d, 7
lea rdx, str.SCSIDisk
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_freopen]
test eax, eax
jne 0x1400036eb
xor ebx, ebx
lea rdi, [rsp + 0xee]
lea rbp, [rsp + 0x410]
mov r8, qword [rsp + rbx*8 + 0x2c8]
mov r9d, 1
test r8, r8
je 0x140003678
mov rcx, r8
mov qword [rsp + 0x60], r8
call fcn.1400797e8
mov r8, qword [rsp + 0x60]
lea r9, [rax + 1]
mov edx, 0x10
mov rcx, rdi
call fcn.140001fb0
mov rdx, rdi
mov rcx, rbp
call fcn.140079820
test rax, rax
je 0x14000369f
mov byte [rsp + 0x15a], 1
jmp 0x1400036eb
mov rcx, rdi
call fcn.1400797e8
cmp rax, 1
ja 0x1400036c6
mov r8d, 0x2a1
lea rdx, str.dev.c
lea rcx, str.strlen_scsi_card_name_copy____1
jmp 0x14000326c
mov rdx, rdi
mov rcx, rbp
mov byte [rsp + rax + 0xed], 0x26
call fcn.140079820
test rax, rax
jne 0x140003695
inc rbx
cmp rbx, 8
jne 0x14000364f
mov rax, qword [0x1400b6b80]
lea rbx, [rsp + 0x410]
cmp dword [rax], 0
je 0x14000370e
mov rdx, rbx
lea rcx, str.__Hardware_ID:__s
call fcn.140038472
lea rdi, [rsp + 0x61c]
mov rcx, qword [rsp + 0x50]
mov r9d, 0x104
mov rdx, rsi
lea rax, [rsp + 0xa4]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [0x14011ccf0]
test eax, eax
jne 0x140003761
call fcn.14003893c
lea rcx, str.SetupDiGetDeviceInstanceId_failed:__s
mov rdx, rax
call fcn.140038472
lea rdx, str._N_A_
mov rcx, rdi
call fcn.1400797d8
xor eax, eax
mov ecx, 0x41
mov rdi, rbx
mov r8d, 0x1f
rep stosd dword [rdi], eax
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, qword [rsp + 0x50]
lea rbp, [rsp + 0xa4]
mov dword [rsp + 0x28], 0x104
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x30], rbp
call qword [0x14011cd00]
test eax, eax
je 0x1400037ba
mov eax, dword [rsp + 0x410]
sub eax, 2
cmp eax, 1
setbe al
movzx eax, al
mov byte [rsp + 0x15d], al
mov rdi, rbx
xor eax, eax
mov r9, rbx
mov ecx, 0x41
lea r8, [rsp + 0xa8]
mov rdx, rsi
rep stosd dword [rdi], eax
mov qword [rsp + 0x20], rbp
mov rcx, qword [rsp + 0x50]
call fcn.140002108
test eax, eax
jne 0x14000385b
call fcn.14003893c
lea rcx, str.SetupDiGetDeviceRegistryProperty__Friendly_Name__failed:__s
mov rdx, rax
call fcn.140038472
mov ecx, 0xbe5
call fcn.14001e8f5
mov r9d, 1
test rax, rax
je 0x14000382d
mov ecx, 0xbe5
call fcn.14001e8f5
mov rcx, rax
call fcn.1400797e8
lea r9, [rax + 1]
mov ecx, 0xbe5
mov qword [rsp + 0x60], r9
call fcn.14001e8f5
mov r9, qword [rsp + 0x60]
mov edx, 0x104
lea rcx, [rsp + 0x410]
mov r8, rax
call fcn.140001fb0
jmp 0x140003e16
cmp byte [rsp + 0x15c], 0
jne 0x140003e16
cmp byte [rsp + 0x8f], 0
je 0x140003e16
mov r13, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistSetupDiSetClassInstallParamsW]
mov r12, qword [sym.imp.SETUPAPI.dll_CM_Get_Child]
mov rbx, r15
mov rbp, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInSetupDiGetDeviceRegistSetupDiSetClassInstallParamsW]
cmp byte [rbx], 0
je 0x140003e16
xor r8d, r8d
lea rcx, [rsp + 0x98]
mov rdx, rbx
call r13
test eax, eax
je 0x1400038c9
mov rax, qword [0x1400b6b80]
mov rdx, rbx
lea rcx, str.Could_not_locate_device_node_for__s
cmp dword [rax], 0
je 0x140003e04
jmp 0x140003901
lea rsi, [rsp + 0xa0]
mov edx, dword [rsp + 0x98]
xor r8d, r8d
mov rcx, rsi
call r12
mov edi, eax
test eax, eax
je 0x14000390b
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x140003e04
mov rdx, rbx
lea rcx, str.Could_not_get_children_of__s
call fcn.140038472
jmp 0x140003e04
mov edx, dword [rsp + 0xa0]
cmp dword [rsp + 0x174], edx
jne 0x140003975
mov eax, dword [rsp + 0x58]
lea rdx, [rbx + 2]
mov rcx, rbx
mov eax, dword [rsp + rax*4 + 0x1c0]
add rax, r15
cmp rdx, rax
setae byte [rsp + 0x15b]
call fcn.140001fe9
lea rdx, [rsp + 0xc8]
mov rcx, rbx
call fcn.140035e71
mov esi, eax
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x1400039c9
mov r8, rbx
mov edx, esi
lea rcx, str.__Matched_with_ID__03d_:__s
call fcn.140038472
jmp 0x1400039c9
cmp ecx, edx
je 0x140003991
mov rcx, rsi
xor r8d, r8d
call rbp
mov ecx, dword [rsp + 0x174]
mov edx, dword [rsp + 0xa0]
test eax, eax
je 0x140003971
jmp 0x1400039b0
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x14000391b
mov rdx, rbx
lea rcx, str.NOTE:_Matched_instance_from_sibling_for__s
call fcn.140038472
mov eax, dword [rsp + 0xa0]
cmp dword [rsp + 0x174], eax
jne 0x140003e04
jmp 0x14000391b
xor r12d, r12d
xor ebp, ebp
mov rcx, rbx
mov r13d, edi
call fcn.1400797e8
cmp r13, rax
jae 0x140003a35
cmp r12d, 2
je 0x140003a35
mov al, byte [rbx + r13]
inc edi
cmp al, 0x5c
je 0x140003a26
test ebp, ebp
je 0x1400039ce
cmp al, 0x5f
jne 0x1400039ce
mov ecx, edi
mov r8d, 0x10
xor edx, edx
add rcx, rbx
call fcn.140079838
movzx eax, ax
mov dword [rsp + 0x148], eax
test r12d, r12d
jne 0x140003a2d
mov dword [rsp + 0x144], eax
mov r12d, 1
jmp 0x1400039ce
mov ebp, 1
jmp 0x1400039ce
mov r12d, 2
jmp 0x1400039ce
cmp dword [rsp + 0x144], 0
lea r12, str._ID_
jne 0x140003a4d
lea r12, [0x1400865ee]
mov eax, esi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc8]
cmp qword [rax + 0x10], 0
jne 0x140003ae8
xor r8d, r8d
mov edx, dword [rsp + 0x98]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDevicSetupDiGetDeviceInSetupDiGetDeviceRegistSetupDiSetClassInstallParamsW]
test eax, eax
jne 0x140003ae8
xor r9d, r9d
lea rdi, [rsp + 0x518]
mov ecx, dword [rsp + 0x9c]
mov r8d, 0x104
mov rdx, rdi
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
test eax, eax
jne 0x140003ae8
mov rcx, rdi
call fcn.140001fe9
lea rdx, [rsp + 0xc8]
mov rcx, rdi
call fcn.140035e71
mov esi, eax
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x140003ade
mov r8, rdi
mov edx, esi
lea rcx, str.__Matched_with__GP__ID__03d_:__s
call fcn.140038472
lea r12, str._GP_
mov rbx, rdi
imul rsi, rsi, 0x18
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rax + rsi + 0x10]
test rdx, rdx
je 0x140003b6a
mov rax, qword [0x1400b6b80]
cmp dword [rax], 0
je 0x140003b22
mov rax, qword [rsp + 0xd8]
lea rcx, str.__Matched_with_Hub__d_:__s
mov r8, qword [rax + rdx*8]
call fcn.140038472
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rax + rsi + 0x10]
mov rax, qword [rsp + 0xd8]
mov rdi, qword [rax + rdx*8]
test rdi, rdi
je 0x140003b6a
xor r8d, r8d
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistSetupDiSetClassInstallParamsW]
mov r8d, eax
test eax, eax
je 0x140003b76
mov rdx, rbx
lea rcx, str.Could_not_get_device_instance_handle_for__s:_CR_error__d
call fcn.140038472
xor eax, eax
mov qword [rsp + 0x78], rax
jmp 0x140003e25
xor r13d, r13d
xor eax, eax
mov ecx, dword [rsp + 0xb0]
xor r8d, r8d
mov dword [rsp + 0x154], r13d
lea r13, [rsp + 0xac]
mov edx, 0x1d
lea r9, [rsp + 0x154]
mov dword [rsp + 0xac], 4
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov rdx, rbx
lea rcx, str.Could_not_get_port_for__s:_CR_error__d
mov r8d, eax
test eax, eax
jne 0x140003b65
xor ebp, ebp
mov dword [rsp + 0x28], 0x40000000
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov r8d, 2
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_DeleteCriticalDeleteFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140003c20
call fcn.14003893c
mov rdx, rdi
lea rcx, str.Could_not_open_hub__s:__s
mov r8, rax
call fcn.140038472
jmp 0x140003b6a
lea rdx, [rsp + 0x254]
xor eax, eax
mov ecx, 0x1f
mov dword [rsp + 0xac], 0x23
mov rdi, rdx
lea r8, [rsp + 0x250]
mov edx, 0x220448
mov r9d, 0x23
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x154]
xor edi, edi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rdi
mov rcx, rbp
mov dword [rsp + 0x250], eax
mov dword [rsp + 0x28], 0x23
mov qword [rsp + 0x20], r8
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov edi, eax
test eax, eax
jne 0x140003c9f
call fcn.14003893c
mov rdx, rbx
lea rcx, str.Could_not_get_node_connection_information_for__s:__s
mov r8, rax
jmp 0x140003d79
movzx edx, word [rsp + 0x25c]
movzx eax, word [rsp + 0x25e]
xor edi, edi
mov ecx, edx
or cx, ax
je 0x140003cdc
mov dword [rsp + 0x148], eax
movzx eax, byte [rsp + 0x267]
mov edi, 1
mov dword [rsp + 0x144], edx
inc eax
mov dword [rsp + 0x14c], eax
mov eax, dword [rsp + 0x154]
xor r10d, r10d
xor r11d, r11d
mov rcx, rbp
mov edx, 0x40000001
mov qword [rsp + 0x38], r11
lea r8, [rsp + 0xfe]
mov r9d, 0x10
mov dword [rsp + 0xfe], eax
mov eax, 0xfffffffb
shl rdx, 4
mov qword [rsp + 0x106], r10
shl rax, 0x20
and rax, qword [rsp + 0x102]
or rax, rdx
mov qword [rsp + 0x20], r8
mov edx, 0x22045c
mov qword [rsp + 0x102], rax
lea rax, [rsp + 0xac]
mov dword [rsp + 0xac], 0x10
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
jne 0x140003d80
call fcn.14003893c
mov rdx, rbx
lea rcx, str.Could_not_get_node_connection_information__V2__for_device__s:__s
mov r8, rax
call fcn.140038472
jmp 0x140003dc9
mov al, byte [rsp + 0x10a]
test al, 4
je 0x140003d98
mov dword [rsp + 0x14c], 5
jmp 0x140003dc9
test al, 1
je 0x140003da9
mov dword [rsp + 0x14c], 4
jmp 0x140003dc9
test al, 8
je 0x140003dba
mov dword [rsp + 0x150], 2
jmp 0x140003dc9
test al, 2
je 0x140003dc9
mov dword [rsp + 0x150], 1
lea rax, [rbp - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140003ddc
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
test edi, edi
je 0x140003b6a
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rax + rsi + 0x10]
mov rax, qword [rsp + 0xd8]
mov rax, qword [rax + rdx*8]
mov qword [rsp + 0x78], rax
jmp 0x140003e1e
mov rcx, rbx
call fcn.1400797e8
lea rbx, [rbx + rax + 1]
jmp 0x14000388f
xor r9d, r9d
mov qword [rsp + 0x78], r9
lea r12, [0x1400865ee]
cmp byte [rsp + 0x15b], 0
je 0x140003eaa
lea rcx, [rsp + 0x410]
mov byte [rsp + 0x260], 0
movabs rax, 0x7369442049534353
movabs rdx, 0x656369766544206b
mov qword [rsp + 0x250], rax
movabs rax, 0x6976654420534155
mov qword [rsp + 0x258], rdx
lea rdx, [rsp + 0x250]
mov qword [rsp + 0xfe], rax
mov dword [rsp + 0x105], 0x656369
call fcn.140079820
test rax, rax
je 0x140003eaa
cmp byte [rax + 0x11], 0
jne 0x140003eaa
mov rdx, qword [rsp + 0xfe]
mov qword [rax], rdx
mov dword [rax + 7], 0x656369
cmp byte [rsp + 0x15c], 0
lea rdx, [rsp + 0x410]
lea rcx, str.Found_VHD_device__s
jne 0x140003ef6
cmp byte [rsp + 0x15a], 0
je 0x140003f00
cmp byte [rsp + 0x158], 0
je 0x140003ee7
mov eax, dword [rsp + 0x144]
or eax, dword [rsp + 0x148]
jne 0x140003f00
lea rdx, [rsp + 0x410]
lea rcx, str.Found_card_reader_device__s
call fcn.140038472
jmp 0x14000410d
test dword [rsp + 0x158], 0xff0000ff
jne 0x140003f5c
cmp byte [rsp + 0x15d], 0
je 0x140003f5c
mov rax, qword [0x1400b6860]
lea rdx, [rsp + 0x410]
cmp dword [rax], 0
jne 0x140003f53
lea rcx, str.Found_non_USB_removable_device__s___Eliminated
call fcn.140038472
mov rax, qword [0x1400b6b80]
lea rcx, str.If_you_REALLY_need__you_can_enable_listing_of_this_device_with__Ctrl__Alt__F_
cmp dword [rax], 0
je 0x1400048ba
jmp 0x140003533
lea rcx, str.Found_non_USB_removable_device__s
jmp 0x140003ef6
mov eax, dword [rsp + 0x144]
mov edx, dword [rsp + 0x148]
mov esi, eax
or esi, edx
jne 0x140003fc2
cmp byte [rsp + 0x158], 0
jne 0x140003f9e
mov rax, qword [0x1400b6b80]
lea rdx, [rsp + 0x410]
lea rcx, str.Found_non_USB_non_removable_device__s___Eliminated
cmp dword [rax], 0
je 0x1400048ba
jmp 0x140004182
lea rcx, [rsp + 0x518]
mov r9d, 0xa
mov edx, 0x104
lea r8, str.____:____
call fcn.140001fb0
jmp 0x140004085
lea rbx, [rsp + 0x518]
mov dword [rsp + 0x28], edx
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
mov dword [rsp + 0x20], eax
lea r9, str._04X:_04X
call qword [sym.imp.msvcrt.dll_clearerr]
mov rax, qword [0x1400b6840]
mov byte [rsp + 0x61b], 0
mov edx, dword [rsp + 0x144]
mov ecx, dword [rsp + 0x148]
cmp dword [rax], 0
je 0x140004041
cmp edx, 0x525
jne 0x14000401d
cmp ecx, 0x622b
jmp 0x14000403b
cmp edx, 0x781
jne 0x14000402d
cmp ecx, 0x75a0
jmp 0x14000403b
cmp edx, 0x10d6
jne 0x140004041
cmp ecx, 0x1101
je 0x1400048ba
xor eax, eax
mov r8d, dword [rsp + rax*4 + 0x1e0]
mov r9d, r8d
shr r9d, 0x10
cmp r9d, edx
jne 0x14000407c
movzx r8d, r8w
cmp r8d, ecx
jne 0x14000407c
lea rdx, [rsp + 0x410]
mov r8, rbx
lea rcx, str.Ignoring__s___s___per_user_settings
call fcn.140038472
jmp 0x1400048ba
inc rax
cmp rax, 8
jne 0x140004043
mov eax, dword [rsp + 0x14c]
cmp eax, 5
jbe 0x14000409e
xor r8d, r8d
xor eax, eax
mov dword [rsp + 0x14c], r8d
lea r9, [0x1400865ee]
cmp byte [rsp + 0x15b], 0
mov r8, qword [rsp + rax*8 + 0x220]
mov rdx, r9
je 0x1400040c8
lea r9, [0x1400865f9]
lea rdx, str.UAS__
lea rax, [rsp + 0x518]
mov qword [rsp + 0x30], r12
lea rcx, str.Found__s_s_s_device__s___s___s
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x410]
mov qword [rsp + 0x20], rax
call fcn.140038472
mov edx, dword [rsp + 0x150]
test edx, edx
je 0x14000410d
add edx, 0x2f
lea rcx, str.NOTE:_This_device_is_a_USB_3._c_device_operating_at_lower_speed...
call fcn.140038472
mov rax, qword [0x1400b5e20]
mov r12, qword [0x14011cce0]
xor ebp, ebp
xor ebx, ebx
mov dword [rsp + 0x180], 0x20
mov qword [rsp + 0x80], rax
mov rcx, rbx
lea rdi, [rsp + 0x180]
call fcn.1400796c8
mov qword [rsp + 0x20], rdi
mov r9d, ebp
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x160]
call r12
test eax, eax
jne 0x140004198
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp eax, 0x103
je 0x14000418c
call fcn.14003893c
lea rcx, str.SetupDiEnumDeviceInterfaces_failed:__s
mov rdx, rax
call fcn.140038472
jmp 0x1400048ba
lea rcx, str.A_device_was_eliminated_because_it_didnt_report_itself_as_a_disk
jmp 0x140003533
xor ecx, ecx
lea r13, [rsp + 0xa4]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], r13
call qword [0x14011ccf8]
mov esi, eax
test eax, eax
jne 0x140004259
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp eax, 0x7a
jne 0x14000423e
mov edx, dword [rsp + 0xa4]
mov ecx, 1
mov dword [rsp + 0x60], edx
call sub.msvcrt.dll_vfprintf
mov r9d, dword [rsp + 0x60]
lea rcx, str.Unable_to_allocate_data_for_SP_DEVICE_INTERFACE_DETAIL_DATA
test rax, rax
mov rbx, rax
je 0x140004260
xor edx, edx
mov dword [rax], 8
mov rcx, qword [rsp + 0x50]
mov r8, rax
mov qword [rsp + 0x28], rdx
mov rdx, rdi
mov qword [rsp + 0x20], r13
call qword [0x14011ccf8]
test eax, eax
jne 0x140004267
call fcn.14003893c
lea rcx, str.SetupDiGetDeviceInterfaceDetail__actual__failed:__s
mov rdx, rax
call fcn.140038472
jmp 0x1400048b3
call fcn.14003893c
lea rcx, str.SetupDiGetDeviceInterfaceDetail__dummy__failed:__s
mov rdx, rax
call fcn.140038472
xor ebx, ebx
jmp 0x1400048b3
lea rcx, str.SetupDiGetDeviceInterfaceDetail__dummy____no_data_was_allocated
call fcn.140038472
jmp 0x140004252
xor eax, eax
lea rdi, [rbx + 4]
xor r9d, r9d
mov r8d, 3
mov qword [rsp + 0x30], rax
mov edx, 0xc0000000
mov rcx, rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_DeleteCriticalDeleteFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x1400042be
call fcn.14003893c
mov rdx, rdi
lea rcx, [0x140086cfe]
mov r8, rax
call fcn.140038472
jmp 0x1400048b3
mov rdx, rdi
mov rcx, rax
call fcn.140008c26
mov rcx, r13
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
test edi, edi
js 0x1400048b3
lea eax, [rdi + 0x80]
mov ecx, eax
mov dword [rsp + 0x60], eax
call fcn.140009808
test eax, eax
jne 0x1400042fd
lea rcx, str.Device_eliminated_because_it_appears_to_contain_no_media
jmp 0x140004500
mov ecx, dword [rsp + 0x60]
call fcn.14000977c
mov qword [rsp + 0x68], rax
cmp rax, 0x7fffff
ja 0x140004336
xor edx, edx
xor r8d, r8d
mov ecx, 0x800000
call fcn.140038d8b
lea rcx, str.Device_eliminated_because_it_is_smaller_than__s
mov rdx, rax
call fcn.140038472
jmp 0x14000475f
mov ecx, dword [rsp + 0x60]
xor r9d, r9d
lea rdx, [rsp + 0x128]
lea r8, [rsp + 0xc0]
call fcn.140009423
test eax, eax
je 0x1400048b3
cmp byte [rsp + 0x159], 0
je 0x1400043d7
mov al, byte [rsp + 0x15b]
or al, byte [rsp + 0x15c]
jne 0x1400043d7
cmp byte [rsp + 0x15d], 0
je 0x14000475f
mov rax, qword [0x1400b6860]
cmp dword [rax], 0
jne 0x1400043d7
mov r12, qword [sym.imp.KERNEL32.DLL_K32GetModuleFileLCIDToLocaleName]
lea r13, [rsp + 0x128]
lea rbp, [rsp + 0xb6]
mov al, byte [r13]
test al, al
je 0x1400043bf
mov byte [rsp + 0xb6], al
mov rcx, rbp
call r12
cmp eax, 2
je 0x1400043d2
cmp byte [r13], 0
je 0x1400043d7
lea rcx, str.Device_eliminated_because_it_contains_a_mounted_partition_that_is_set_as_non_removable
jmp 0x140004500
inc r13
jmp 0x1400043a5
mov rbp, qword [0x1400b6460]
cmp dword [rbp], 0
jne 0x1400044a1
mov al, byte [rsp + 0x15a]
or al, byte [rsp + 0x15c]
je 0x140004442
cmp byte [rsp + 0x15a], 0
je 0x1400044a1
mov ecx, 0x7d
mov rax, qword [rsp + 0x68]
shl rcx, 0x20
cmp rcx, rax
jae 0x1400044a1
xor r8d, r8d
xor edx, edx
call fcn.140038d8b
lea rcx, str.Device_eliminated_because_it_was_detected_as_a_card_larger_than__s
mov rdx, rax
call fcn.140038472
lea rcx, str.To_use_such_a_card__check_List_USB_Hard_Drives_under_advanced_drive_properties
jmp 0x140004500
movzx edx, word [rsp + 0x144]
mov ecx, dword [rsp + 0x60]
lea r9, [rsp + 0x410]
movzx r8d, word [rsp + 0x148]
call fcn.140035270
mov edx, eax
test eax, eax
jle 0x140004497
lea rcx, str.Device_eliminated_because_it_was_detected_as_a_Hard_Drive__score__d___0_
call fcn.140038472
mov rax, qword [0x1400b6860]
cmp dword [rax], 0
jne 0x14000448e
lea rcx, str.If_this_device_is_not_a_Hard_Drive__please_e_mail_the_author_of_this_application
call fcn.140038472
lea rcx, str.NOTE:_You_can_enable_the_listing_of_Hard_Drives_under_advanced_drive_properties
jmp 0x140004500
cmp dword [rbp], 0
je 0x1400043f8
cmp byte [rsp + 0x15c], 0
je 0x1400044bf
mov ecx, dword [rsp + 0x60]
call fcn.14000c1db
lea rcx, str.Device_eliminated_because_it_was_detected_as_a_Microsoft_Dev_Drive
test eax, eax
jne 0x140004500
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1400044e3
lea rdx, str.PortableBaseLayer
call fcn.1400797d0
lea rcx, str.Device_eliminated_because_it_is_a_Windows_Sandbox_VHD
test eax, eax
je 0x140004500
cmp byte [rsp + 0x15c], 0
je 0x14000450a
mov rax, qword [str._F_b_]
cmp dword [rax], 0
jne 0x14000450a
lea rcx, str.Device_eliminated_because_listing_of_VHDs_is_disabled__Alt_G_
call fcn.140038472
jmp 0x14000475f
cmp byte [rsp + 0x128], 0
jne 0x14000454a
mov rax, qword [0x1400b6b90]
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r8d, dword [rax]
call fcn.140038d8b
mov rdx, qword [rsp + 0xc0]
mov r8d, edi
mov ecx, 0xbe6
mov r9, rax
call fcn.14001e8f5
mov r12, rax
jmp 0x1400047e8
mov rbp, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor r12d, r12d
lea rdi, [rsp + 0x10e]
mov eax, r12d
mov al, byte [rsp + rax + 0x128]
test al, al
je 0x1400045a7
mov byte [rsp + 0x10e], al
mov rcx, rdi
call rbp
test eax, eax
je 0x1400045a2
mov eax, r12d
mov edx, eax
cmp byte [rsp + rdx + 0x128], 0
je 0x14000459f
lea ecx, [rax + 1]
mov rax, rcx
mov cl, byte [rsp + rcx + 0x128]
mov byte [rsp + rdx + 0x128], cl
jmp 0x14000457d
dec r12d
inc r12d
jmp 0x14000455c
cmp byte [rsp + 0x128], 0
je 0x1400045ca
cmp byte [rsp + 0x129], 0
je 0x1400045ca
mov ecx, 0xbe7
call fcn.14001e8f5
test rax, rax
jmp 0x1400045d3
cmp qword [rsp + 0xc0], 0
sete al
mov r9d, 1
test al, al
jne 0x140004614
cmp byte [rsp + 0x128], 0
je 0x140004603
cmp byte [rsp + 0x129], 0
je 0x140004603
mov ecx, 0xbe7
call fcn.14001e8f5
mov rcx, rax
jmp 0x14000460b
mov rcx, qword [rsp + 0xc0]
call fcn.1400797e8
lea r9, [rax + 1]
cmp byte [rsp + 0x128], 0
je 0x140004647
cmp byte [rsp + 0x129], 0
je 0x140004647
mov ecx, 0xbe7
mov qword [rsp + 0x80], r9
call fcn.14001e8f5
mov r9, qword [rsp + 0x80]
mov r8, rax
jmp 0x14000464f
mov r8, qword [rsp + 0xc0]
lea rcx, [rsp + 0x308]
mov edx, pe_nt_image_headers64
lea rdi, [rsp + 0x128]
xor r12d, r12d
call fcn.140001fb0
mov al, byte [rdi]
test al, al
je 0x14000471e
test esi, esi
jne 0x140004722
mov byte [rsp + 0xbc], al
mov rax, qword [0x1400b69c0]
cmp dword [rax], 0
je 0x1400046af
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x308]
mov edx, pe_nt_image_headers64
lea r8, [0x14008662e]
call qword [0x14011cbb0]
or r9, 0xffffffffffffffff
lea r8, [rsp + 0xba]
mov edx, pe_nt_image_headers64
mov esi, 2
lea rcx, [rsp + 0x308]
call qword [0x14011cbb0]
mov rcx, qword [0x1400b6230]
movsx r13d, byte [rdi]
call fcn.1400020c7
mov rcx, qword [0x1400b6a90]
mov ebp, eax
movsx eax, byte [rdi]
mov dword [rsp + 0x80], eax
call fcn.1400020c7
add eax, 0x41
cmp dword [rsp + 0x80], eax
je 0x140004713
add ebp, 0x41
xor esi, esi
cmp ebp, r13d
sete sil
inc r12d
inc rdi
jmp 0x14000466c
test esi, esi
je 0x14000476c
dec esi
lea r8, str.system_disk
jne 0x140004734
lea r8, str.disk_from_which_Rufus_is_running
lea eax, [r12 - 1]
mov qword [rsp + 0x60], r8
movsx ecx, byte [rsp + rax + 0x128]
call qword [0x14011cc00]
mov r8, qword [rsp + 0x60]
lea rcx, str.Removing__c:_from_the_list:_This_is_the__s_
mov edx, eax
call fcn.140038472
mov rcx, rbx
call fcn.1400796c8
jmp 0x1400048ba
lea rbp, [rsp + 0x308]
mov edi, 0x7f
mov rcx, rbp
call fcn.1400797e8
mov rcx, qword [rsp + 0x68]
xor edx, edx
sub rdi, rax
add rbp, rax
mov rax, qword [0x1400b6b90]
mov r8d, dword [rax]
call fcn.140038d8b
mov rcx, qword [0x1400b69c0]
lea rdx, [0x1400865ee]
cmp dword [rcx], 0
je 0x1400047b7
lea rdx, [0x14008662e]
mov qword [rsp + 0x20], rdx
or r8, 0xffffffffffffffff
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x28], rax
lea r9, [0x14008704d]
lea r12, [rsp + 0x308]
call qword [sym.imp.msvcrt.dll_clearerr]
mov byte [rsp + 0x386], 0
movsxd rbp, r14d
mov rsi, qword [0x1400b69d0]
mov eax, dword [rsp + 0x60]
lea rcx, [rsp + 0x61c]
imul rdi, rbp, 0x38
mov r13, qword [sym.imp.msvcrt.dll_fprintf]
add rdi, rsi
mov dword [rdi + 0x28], eax
call r13
lea rcx, [rsp + 0x410]
mov qword [rdi], rax
call r13
mov qword [rdi + 8], rax
test r12, r12
je 0x140004832
mov rcx, r12
call r13
mov r12, rax
imul rbp, rbp, 0x38
mov rcx, qword [rsp + 0xc0]
mov qword [rsi + rbp + 0x10], r12
test rcx, rcx
je 0x140004851
call qword [sym.imp.msvcrt.dll_fprintf]
mov rcx, rax
movsxd rax, r14d
imul rax, rax, 0x38
add rsi, rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x78], 0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], rax
je 0x140004889
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.msvcrt.dll_fprintf]
mov qword [rsi + 0x20], rax
mov eax, dword [rsp + 0x154]
mov dword [rsi + 0x2c], eax
inc r14d
cmp r14d, 0x40
jne 0x1400048a3
mov edx, 0x40
lea rcx, str.Warning:_Found_more_than__d_drives___ignoring_remaining_ones...
call fcn.140038472
mov rcx, rbx
call fcn.1400796c8
cmp r14d, 0x40
jne 0x1400048ba
jmp 0x1400048c6
inc ebp
jmp 0x140004132
inc dword [rsp + 0x88]
jmp 0x1400033d1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SETUPAPI.dll_ParamsW]
mov r13, qword [0x1400b69d0]
xor r8d, r8d
lea r9d, [r14 - 1]
mov rdx, r13
movsxd rax, r8d
mov esi, r8d
cmp r8d, r9d
jge 0x140004957
inc r8
mov r11, qword [rdx + 0x30]
mov rcx, r8
cmp r14d, ecx
jle 0x140004915
imul rbx, rcx, 0x38
mov rbx, qword [rbx + r13 + 0x30]
cmp rbx, r11
jae 0x140004910
movsxd rax, ecx
mov r11, rbx
inc rcx
jmp 0x1400048f7
cmp esi, eax
je 0x140004951
imul rax, rax, 0x38
lea rdi, [rsp + 0x250]
mov ecx, 0xe
mov rsi, rdx
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xe
mov rdi, rdx
add rax, r13
mov rsi, rax
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x250]
mov ecx, 0xe
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
add rdx, 0x38
jmp 0x1400048e2
mov rsi, qword [0x1400b6640]
mov rbx, qword [0x14011d030]
xor ebp, ebp
xor edi, edi
mov r12, qword [rsi]
cmp ebp, r14d
je 0x140004a00
mov eax, dword [r13 + 0x28]
mov rcx, qword [r13 + 0x10]
mov qword [rsp + 0x50], rax
call fcn.14000201a
mov rcx, r12
xor r8d, r8d
mov edx, 0x143
mov r9, rax
mov qword [rsp + 0x60], rax
call rbx
mov r12, rax
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov r9, qword [rsp + 0x60]
mov dword [rsp + 0x58], eax
test r9, r9
je 0x1400049bb
mov rcx, r9
call fcn.1400796c8
mov ecx, dword [rsp + 0x58]
call qword [0x14011c730]
mov rcx, qword [rsi]
mov edx, 0x151
movsxd r8, r12d
mov r9, qword [rsp + 0x50]
call rbx
mov rdx, qword [r13 + 0x10]
mov rcx, qword [rsi]
call fcn.14003bc79
cmp eax, edi
jl 0x1400049f5
mov rdx, qword [r13 + 0x10]
mov rcx, qword [rsi]
call fcn.14003bc79
mov edi, eax
inc ebp
add r13, 0x38
jmp 0x140004969
xor r9d, r9d
movsxd r8, edi
mov edx, 0x160
mov rcx, r12
call rbx
cmp dword [rsp + 0x770], 0x7f
ja 0x140004a1e
xor edi, edi
jmp 0x140004a51
xor edi, edi
mov rcx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
call rbx
mov rcx, qword [rsi]
cmp edi, eax
jae 0x140004a1a
xor r9d, r9d
movsxd r8, edi
mov edx, 0x150
call rbx
cmp dword [rsp + 0x770], eax
je 0x140004a51
inc edi
jmp 0x140004a20
mov rcx, qword [rsi]
xor r9d, r9d
movsxd r8, edi
mov edx, 0x14e
call rbx
xor r9d, r9d
mov r8d, 0x103e9
mov edx, 0x111
mov rax, qword [0x1400b66d0]
mov rcx, qword [rax]
call rbx
mov ebx, 1
jmp 0x140004a84
xor ebx, ebx
mov rsi, qword [0x1400b66d0]
mov edx, 0x3eb
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_MessageBeep]
mov r9d, 1
mov edx, 0x28
mov rcx, qword [rsi]
mov r8, rax
call qword [0x14011d030]
mov rcx, r15
call fcn.1400796c8
lea rcx, [rsp + 0xd8]
call fcn.140036e20
lea rcx, [rsp + 0xc8]
call fcn.140035e11
mov eax, ebx
add rsp, 0x728
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret