Function at 0x140037c0c
Capabilities:
Create directory
Delete file
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xba8
xor r13d, r13d
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x1c8], r13
cmp qword [0x14010dd08], r13
jne 0x140037c62
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.140015734
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x140]
mov rdx, rsi
call fcn.140017040
mov rcx, qword [0x14010dd78]
lea r8, [rsp + 0x990]
mov r9d, 0x104
mov edx, 0x2711
mov qword [rsp + 0x248], r13
call fcn.1400509dc
lea rdx, [0x1400f5f70]
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x210], r13
call fcn.140062680
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x2c8], r13
call fcn.14005818c
lea rcx, [rsp + 0x208]
mov ebx, 0x80000000
mov qword [rsp + 0x2c0], r13
mov dword [rsp + 0x100], ebx
call fcn.14005818c
lea rcx, [rsp + 0x218]
call fcn.14005818c
lea rax, [rsp + 0x2c0]
lea r11, [rsp + 0x2c8]
mov qword [rsp + 0x2e0], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x2d8], r11
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x2e8], r13
call fcn.140053a54
shr rax, 0x10
mov byte [rsp + 0x51], r13b
lea ecx, [rax - 0x60000]
cmp eax, 0x60000
mov qword [rsp + 0x2a8], rax
setae byte [rsp + 0x4d]
cmp ecx, 0xffff
lea rcx, [rsp + 0x70]
setbe dil
mov byte [rsp + 0x4e], dil
call fcn.14005818c
mov rcx, qword [str._SystemRoot__]
mov rax, qword [0x1400f5f58]
lea r11, [rsp + 0x280]
lea r8, [rsp + 0x70]
mov qword [r11], rcx
mov qword [r11 + 8], rax
mov rax, qword [0x1400f5f60]
mov qword [r11 + 0x10], rax
mov eax, dword [0x1400f5f68]
lea rdx, [rsp + 0x280]
mov dword [r11 + 0x18], eax
xor eax, eax
xor r9d, r9d
lea r14d, [rax + 1]
mov rcx, rsi
mov dword [rsp + 0x29c], eax
mov dword [rsp + 0x2a0], eax
mov dword [rsp + 0x2a4], eax
mov byte [rsp + 0x20], r14b
call fcn.14006a800
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x1d0], eax
lea ecx, [rax + 0x1e]
movsxd rdx, ecx
lea rcx, [rsp + 0x70]
call fcn.14005828c
cmp dil, r13b
lea esi, [r14 + 2]
jl 0x140037e59
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xc00]
call fcn.140062680
lea rdx, str.System32Drvload.exe
lea rcx, [rsp + 0xc00]
call fcn.1400582c8
mov rcx, qword [rsp + 0xc00]
call fcn.1400d3800
lea rcx, [rsp + 0xc00]
neg eax
sbb dil, dil
and dil, sil
mov byte [rsp + 0x4e], dil
call fcn.14005041c
lea rcx, [rsp + 0x1c0]
mov edx, 0x400032
mov rbp, r14
mov qword [rsp + 0xf8], r14
mov dil, r13b
mov byte [rsp + 0x4c], r13b
call fcn.140057f14
mov rcx, qword [rsp + 0x1c0]
lea rdx, [0x1400f5f10]
mov r8d, 0xa
call fcn.14001aac4
mov rcx, qword [rsp + 0x1c0]
mov qword [rcx + 0xa], r13
mov rax, qword [rsp + 0x1c0]
add rax, 0x12
mov qword [rsp + 0x58], rax
mov esi, 2
cmp dil, 0xff
jae 0x140037ec8
add dil, r14b
mov byte [rsp + 0x4c], dil
lea rcx, [rsp + 0x210]
mov rdx, r12
mov r14b, r13b
call fcn.140062798
mov r11, qword [rsp + 0x210]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], r11
mov bpl, r13b
mov dword [rsp + 0x190], r13d
mov qword [rsp + 0x168], r13
mov byte [rsp + 0x11c], sil
mov byte [rsp + 0x4f], r13b
call fcn.140014d78
mov rdx, qword [rsp + 0x40]
xor eax, eax
lea r8d, [rax + 8]
mov byte [rsp + 0x50], r13b
mov r12d, r13d
mov dword [rsp + 0x48], r13d
lea rcx, str.listdev:
mov r13b, 0xf0
mov byte [rsp + 0xc08], sil
mov byte [rsp + 0x198], al
mov byte [rsp + 0x19d], al
mov dword [rsp + 0x64], r13d
mov r15, rax
mov qword [rsp + 0xc0], rax
mov rdi, rax
mov qword [rsp + 0x268], rax
call fcn.140051960
xor r8d, r8d
cmp al, r8b
je 0x140038073
mov rax, qword [rsp + 0x40]
mov r12d, 0x100
add rax, 0x10
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x40], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140037ffb
lea edx, [rdi + 9]
lea r9d, [rdi + 0xd]
cmp dx, cx
ja 0x140037faa
cmp cx, r9w
jbe 0x140037fc2
mov r10d, 0x20
cmp r10w, cx
cmovne rdi, rax
mov qword [rsp + 0x268], rdi
jmp 0x140037fc8
mov r10d, 0x20
cmp dx, cx
ja 0x140037fd3
cmp cx, r9w
jbe 0x140037fec
cmp r10w, cx
je 0x140037fec
add rax, rsi
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140037ffb
jmp 0x140037fc8
cmp word [rax], r8w
je 0x140037ffb
mov word [rax], r8w
add qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.140014d78
cmp word [rdi], r8w
jne 0x140038096
lea rcx, [rsp + 0x1c0]
call fcn.14005041c
lea rcx, [rsp + 0x70]
call fcn.14005041c
lea rcx, [rsp + 0x218]
call fcn.14005041c
lea rcx, [rsp + 0x208]
call fcn.14005041c
lea rcx, [rsp + 0x260]
call fcn.14005041c
lea rcx, [rsp + 0x1f0]
call fcn.14005041c
lea rcx, [rsp + 0x210]
call fcn.14005041c
mov rax, 0xffffffff80070057
jmp 0x14003b710
lea rdx, [rsp + 0x40]
lea rcx, str.buildcache:
mov r8d, 0xa
call fcn.14005aa40
xor r8d, r8d
cmp al, r8b
jne 0x14003b62d
cmp dword [rsp + 0x2a8], 0x60000
movzx esi, byte [rsp + 0x4e]
mov eax, 3
cmovae esi, eax
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
mov dl, r8b
mov qword [rsp + 0x90], r8
mov word [rsp + 0x194], r8w
mov byte [rsp + 0x1a0], r8b
mov dil, 0xff
mov byte [rsp + 0xc00], dl
cmp cx, word [rax]
jne 0x140038cd0
mov bl, byte [rsp + 0x4e]
lea rdx, [rsp + 0x40]
lea rcx, str.extract
mov r8d, 8
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038124
lea eax, [r8 + 1]
mov byte [rsp + 0x198], al
mov byte [rsp + 0xc08], al
mov r14b, al
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.cab
mov r8d, 4
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x14003814b
mov r14b, 1
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.nocheck
mov r8d, 8
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x14003817a
lea eax, [r8 + 1]
mov byte [rsp + 0x19d], al
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.devcon
mov r8d, 7
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400381a9
lea eax, [r8 + 1]
mov byte [rsp + 0x19e], al
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.rescan
mov r8d, 7
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400381d5
mov r13b, r8b
mov dword [rsp + 0x64], r13d
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.norescan
mov r8d, 9
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400381f9
mov r13b, 0xc0
jmp 0x1400381cb
mov rdx, qword [rsp + 0x40]
lea rcx, str.rescan:
mov r8d, 8
call fcn.140051960
xor edx, edx
cmp al, dl
je 0x140038257
add qword [rsp + 0x40], 0x10
movsx eax, r13b
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0xa8], eax
call fcn.1400ab8ac
mov r13d, dword [rsp + 0xa8]
xor r8d, r8d
cmp r13b, r8b
mov dword [rsp + 0x64], r13d
jge 0x140038c7f
jmp 0x1400381c8
lea rdx, [rsp + 0x40]
lea rcx, str.dummy
mov r8d, 6
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038286
lea eax, [r8 + 1]
mov byte [rsp + 0x19f], al
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.sub
mov r8d, 4
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400382af
mov byte [rsp + 0x50], 1
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.self
mov r8d, 5
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400382d8
mov byte [rsp + 0x50], 2
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.7pe
mov r8d, 4
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400382ff
mov sil, 3
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.7pe_
mov r8d, 4
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038326
mov sil, bl
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.drvload
mov r8d, 8
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
jne 0x14003831e
lea rdx, [rsp + 0x40]
lea rcx, str.inner
mov r8d, 6
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x14003836c
mov sil, 0xc0
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.nnverify
mov r8d, 9
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038398
mov byte [rsp + 0xc08], 1
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.rverify
mov r8d, 8
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400383c4
mov byte [rsp + 0xc08], r8b
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.listdevi
mov r8d, 0xa
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400383f3
and r12d, 0xff00
or r12d, 2
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.listdevc
mov r8d, 0xa
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038422
and r12d, 0xff00
or r12d, 4
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.listdev
mov r8d, 0xa
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038451
and r12d, 0xff00
or r12d, 8
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.comp
mov r8d, 6
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038482
lea eax, [r8 + 1]
mov dl, al
mov byte [rsp + 0xc00], al
jmp 0x140038c86
lea rdx, [rsp + 0x40]
lea rcx, str.hwid
mov r8d, 5
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400384ab
bts r12d, 0xc
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5dec]
mov r8d, 5
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400384d4
bts r12d, 0xb
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.inst
mov r8d, 5
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400384fd
bts r12d, 0xd
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.All
mov r8d, 4
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038526
bts r12d, 9
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5dd4]
mov r8d, 5
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x14003854f
bts r12d, 0xa
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.auto
mov r8d, 5
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x14003857f
lea eax, [r8 + 3]
mov word [rsp + 0x194], ax
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.sys
mov r8d, 4
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400385ae
lea eax, [r8 + 1]
mov byte [rsp + 0x1a0], al
jmp 0x140038c7f
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xa
inc rcx
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x1400385d9
or bpl, 1
jmp 0x140038c7f
mov rcx, qword [str.disverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xb
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038601
or bpl, 3
jmp 0x140038c7f
mov rcx, qword [str.AutoDisverify]
lea rdx, [rsp + 0x40]
mov r8d, 0xe
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038629
or bpl, 0x10
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.sysdir:
mov r8d, 7
call fcn.14005aa40
xor edx, edx
cmp al, dl
je 0x140038673
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x1cd
mov qword [rsp + 0x1b0], rax
call fcn.1400241d4
xor r8d, r8d
mov qword [rsp + 0x40], rax
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5db0]
mov r8d, 4
call fcn.14005aa40
xor r8d, r8d
cmp al, r8b
je 0x140038738
mov rax, qword [rsp + 0x40]
cmp word [rax], r8w
je 0x140038c75
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rax]
ja 0x1400386b9
cmp word [rax], r10w
jbe 0x1400386df
mov r11d, 0x20
cmp r11w, word [rax]
je 0x1400386e5
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x1a8], rcx
jmp 0x1400386e5
mov r11d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x140038c75
mov edx, 2
cmp r9w, cx
ja 0x140038703
cmp cx, r10w
jbe 0x140038720
cmp r11w, cx
je 0x140038720
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140038c75
jmp 0x1400386f7
cmp word [rax], r8w
je 0x140038c75
mov word [rax], r8w
add qword [rsp + 0x40], rdx
jmp 0x140038c75
lea rdx, [rsp + 0x40]
lea rcx, str.IdCah:
mov r8d, 6
call fcn.14005aa40
xor r8d, r8d
cmp al, r8b
je 0x140038805
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x1400387dc
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, ax
ja 0x14003877d
cmp ax, r10w
jbe 0x14003879d
mov rdx, qword [rsp + 0x1c8]
mov r11d, 0x20
cmp r11w, ax
cmovne rdx, rcx
mov qword [rsp + 0x1c8], rdx
jmp 0x1400387a3
mov r11d, 0x20
mov edx, 2
cmp r9w, ax
ja 0x1400387b4
cmp ax, r10w
jbe 0x1400387cd
cmp r11w, ax
je 0x1400387cd
add rcx, rdx
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
je 0x1400387dc
jmp 0x1400387a8
cmp word [rcx], r8w
je 0x1400387dc
mov word [rcx], r8w
add qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.140014d78
mov rax, qword [rsp + 0x1c8]
cmp word [rax], r8w
jne 0x140038c7f
mov qword [rsp + 0x1c8], r8
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.retid:
mov r8d, 6
call fcn.14005aa40
xor r8d, r8d
cmp al, r8b
je 0x1400388ba
mov rax, qword [rsp + 0x40]
cmp word [rax], r8w
je 0x140038c75
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rax]
ja 0x14003884b
cmp word [rax], r10w
jbe 0x140038871
mov r11d, 0x20
cmp r11w, word [rax]
je 0x140038877
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x2c8], rax
mov qword [rsp + 0x160], rcx
jmp 0x140038877
mov r11d, 0x20
movzx ecx, word [rax]
cmp cx, r8w
je 0x140038c75
mov edx, 2
cmp r9w, cx
ja 0x140038899
cmp cx, r10w
jbe 0x140038720
cmp r11w, cx
je 0x140038720
add rax, rdx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140038c75
jmp 0x140038889
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevClass:
mov r8d, 0xa
call fcn.140051960
xor r8d, r8d
cmp al, r8b
je 0x14003897d
mov rcx, qword [rsp + 0x40]
add rcx, 0x14
mov qword [rsp + 0x40], rcx
cmp word [rcx], r8w
je 0x140038c75
lea r9d, [r8 + 9]
lea r10d, [r8 + 0xd]
cmp r9w, word [rcx]
ja 0x140038909
cmp word [rcx], r10w
jbe 0x140038929
mov rax, qword [rsp + 0x168]
mov r11d, 0x20
cmp r11w, word [rcx]
cmovne rax, rcx
mov qword [rsp + 0x168], rax
jmp 0x14003892f
mov r11d, 0x20
movzx eax, word [rcx]
cmp ax, r8w
je 0x140038c75
mov edx, 2
cmp r9w, ax
ja 0x14003894d
cmp ax, r10w
jbe 0x14003896a
cmp r11w, ax
je 0x14003896a
add rcx, rdx
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
je 0x140038c75
jmp 0x140038941
cmp word [rcx], r8w
je 0x140038c75
mov word [rcx], r8w
jmp 0x14003872e
mov rdx, qword [rsp + 0x40]
lea rcx, str.DevID:
mov r8d, 7
call fcn.140051960
xor ecx, ecx
cmp al, cl
je 0x140038a4e
mov rax, qword [rsp + 0x40]
add rax, 0xe
mov qword [rsp + 0x40], rax
cmp word [rax], cx
je 0x1400389cd
lea edx, [rcx + 9]
cmp dx, word [rax]
ja 0x1400389c1
lea ecx, [rdx + 4]
cmp word [rax], cx
jbe 0x1400389cd
mov ecx, 0x20
cmp cx, word [rax]
cmovne r15, rax
lea rcx, [rsp + 0x40]
mov edx, 0x27
call fcn.14001aeec
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
cmp word [rcx], r8w
je 0x1400389f7
lea eax, [r8 + 2]
mov word [rcx], r8w
add qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.140014d78
cmp r15, r8
je 0x140038c7f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rcx, eax
cmp rcx, r8
jle 0x140038a3d
lea edx, [r8 + 1]
lea r9d, [r8 + 0x26]
cmp r9w, word [r15 + rcx*2 - 2]
jne 0x140038a3d
mov word [r15 + rcx*2], r8w
sub rcx, rdx
sub eax, edx
cmp rcx, r8
jg 0x140038a26
cmp eax, r8d
jg 0x140038c7f
mov r15, r8
jmp 0x140038c7f
lea rdx, [rsp + 0x40]
lea rcx, str.infcache:
mov r8d, 0xa
call fcn.14005aa9c
xor ecx, ecx
cmp al, cl
je 0x140038ad4
mov rax, qword [rsp + 0x40]
cmp word [rax], cx
je 0x140038aa1
lea edx, [rcx + 9]
cmp dx, word [rax]
ja 0x140038a85
lea ecx, [rdx + 4]
cmp word [rax], cx
jbe 0x140038aa1
mov rcx, qword [rsp + 0x248]
mov edx, 0x20
cmp dx, word [rax]
cmovne rcx, rax
mov qword [rsp + 0x248], rcx
lea rcx, [rsp + 0x40]
mov edx, 0x27
call fcn.14001aeec
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
cmp word [rcx], r8w
je 0x140038c75
lea eax, [r8 + 2]
mov word [rcx], r8w
add qword [rsp + 0x40], rax
jmp 0x140038c75
mov rdx, qword [rsp + 0x40]
lea rcx, str.disable:
mov r8d, 9
call fcn.140051960
xor edx, edx
cmp al, dl
je 0x140038b04
mov rcx, qword [rsp + 0x40]
lea eax, [rdx + 2]
add rcx, rax
mov dil, al
jmp 0x140038bba
mov rdx, qword [rsp + 0x40]
lea rcx, str.enable:
mov r8d, 8
call fcn.140051960
xor ecx, ecx
cmp al, cl
je 0x140038b26
mov dil, 1
jmp 0x140038b46
mov rdx, qword [rsp + 0x40]
lea rcx, str.remove:
mov r8d, 8
call fcn.140051960
xor ecx, ecx
cmp al, cl
je 0x140038b4d
mov dil, 5
mov rcx, qword [rsp + 0x40]
jmp 0x140038bba
mov rdx, qword [rsp + 0x40]
lea rcx, str.update:
mov r8d, 8
call fcn.140051960
xor ecx, ecx
cmp al, cl
je 0x140038b6f
mov dil, 0x11
jmp 0x140038b46
mov rdx, qword [rsp + 0x40]
lea rcx, str.status:
mov r8d, 8
call fcn.140051960
xor ecx, ecx
cmp al, cl
je 0x140038b91
mov dil, 0x12
jmp 0x140038b46
mov rdx, qword [rsp + 0x40]
lea rcx, str.restart:
mov r8d, 9
call fcn.140051960
xor ecx, ecx
cmp al, cl
je 0x140038c07
mov rcx, qword [rsp + 0x40]
mov dil, 3
add rcx, 2
add rcx, 0x10
xor eax, eax
mov qword [rsp + 0x40], rcx
cmp word [rcx], ax
je 0x140038aa1
mov eax, 9
cmp ax, word [rcx]
ja 0x140038be6
mov eax, 0xd
cmp word [rcx], ax
jbe 0x140038aa1
mov rax, qword [rsp + 0x90]
mov edx, 0x20
cmp dx, word [rcx]
cmovne rax, rcx
mov qword [rsp + 0x90], rax
jmp 0x140038aa1
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f5d14]
mov r8d, 3
call fcn.14005a964
xor r8d, r8d
cmp al, r8b
je 0x140038c2d
mov byte [rsp + 0x4f], 1
jmp 0x140038c7f
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx]
cmp ax, r8w
je 0x140038c75
mov edx, 9
lea ebx, [rdx + 4]
lea r13d, [rdx - 7]
lea r9d, [rdx + 0x17]
cmp dx, ax
ja 0x140038c55
cmp ax, bx
jbe 0x140038c6c
cmp r9w, ax
je 0x140038c6c
add rcx, r13
mov qword [rsp + 0x40], rcx
mov ax, word [rcx]
cmp ax, r8w
jne 0x140038c4b
mov r13d, dword [rsp + 0x64]
mov bl, byte [rsp + 0x4e]
lea rcx, [rsp + 0x40]
call fcn.140014d78
mov dl, byte [rsp + 0xc00]
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
je 0x1400380eb
mov ebx, dword [rsp + 0x100]
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0xc0], r15
mov dword [rsp + 0x48], r12d
movzx eax, byte [rsp + 0x198]
cmp r13b, 0xf0
mov r13d, r12d
setl byte [rsp + 0x88]
shr r13d, 8
mov r9d, 1
and r13b, r9b
cmovne eax, r8d
mov dword [rsp + 0x118], r13d
mov byte [rsp + 0x198], al
cmp r12d, r8d
je 0x140038d1e
mov al, r13b
neg al
sbb cl, cl
and cl, dl
mov dl, cl
mov byte [rsp + 0xc00], cl
bt r12d, 0xd
jae 0x140038d36
bt r12d, 0xa
jae 0x140038d36
btr r12d, 0xa
mov dword [rsp + 0x48], r12d
cmp r13b, r8b
je 0x140038d70
mov eax, 2
test al, r12b
je 0x140038d5d
test r12d, 0x3c00
jne 0x140038d5d
cmp dl, r8b
jne 0x140038d5d
bts r12d, 0xd
mov dword [rsp + 0x48], r12d
cmp r13b, r8b
je 0x140038d70
cmp qword [rsp + 0x268], r8
je 0x14003aa15
cmp dil, r8b
jge 0x14003b2a2
cmp bpl, r8b
jne 0x14003b28a
mov rdi, qword [rsp + 0xbf0]
cmp sil, r8b
mov ecx, r8d
movzx eax, sil
cmovge ecx, eax
or byte [rsp + 0x4d], cl
mov byte [rsp + 0x19c], cl
cmp r13b, r8b
jne 0x140038dc0
mov rax, qword [rsp + 0x2e8]
cmp byte [rsp + 0x4c], r9b
cmove rax, rdi
mov qword [rsp + 0x2e8], rax
mov r12, qword [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x250], r15
mov qword [r12], r8
lea r8d, [rdx + 0x20]
lea rcx, [r12 + 0x400000]
call fcn.1400d4180
mov rbp, qword [rsp + 0x1c8]
xor r15d, r15d
mov rsi, r15
cmp rbp, r15
je 0x140038e85
lea rcx, [0x14010ee80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.140016268
mov rdi, rax
cmp rax, r15
je 0x140038e78
mov rdx, qword [rax + 8]
cmp rdx, r15
je 0x140038e78
mov rcx, qword [rax + 0x18]
movabs rax, 0x3fffffffffffffff
and rcx, rax
cmp rcx, 0x400032
jb 0x140038e78
lea r8d, [r15 + 0xa]
lea rcx, [0x1400f5f10]
call fcn.14005047c
cmp eax, r15d
jne 0x140038e78
mov rsi, qword [rdi + 8]
mov r8d, 0x400020
mov rcx, r12
add rsi, 0x12
mov rdx, rsi
call fcn.14001aac4
lea rcx, [0x14010ee80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rsi, r15
mov ecx, r15d
mov eax, 0x20
sete byte [rsp + 0x98]
mov dword [rsp + 0x280], eax
xor eax, eax
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x140], r12
mov dword [rsp + 0x284], r15d
cmp word [rax], 0x24
mov esi, r15d
mov edi, 2
sete cl
mov dword [rsp + 0x60], ecx
cmp ecx, r15d
je 0x140038f07
add rax, rdi
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
jne 0x140038f07
lea ecx, [rdi - 1]
add rax, rdi
add esi, ecx
mov qword [rsp + 0x40], rax
cmp word [rax], 0x24
je 0x140038ef7
lea rcx, [rsp + 0x40]
call fcn.140014d78
mov rcx, qword [rsp + 0x40]
mov edx, 0x2c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r12, r15
mov qword [rsp + 0xb8], r15
mov rbp, rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x80], r15
cmp rax, r15
je 0x140038fc2
lea rcx, [rsp + 0xc8]
add rbp, rdi
mov word [rax], r15w
mov qword [rsp + 0xc8], rbp
call fcn.140014d78
mov rbp, qword [rsp + 0xc8]
mov rcx, rbp
mov edx, 0x2c
mov qword [rsp + 0xc8], rbp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r12, rax
mov qword [rsp + 0xb8], rax
cmp rax, r15
je 0x140038fba
add r12, rdi
lea rcx, [rsp + 0xb8]
mov word [rax], r15w
mov qword [rsp + 0xb8], r12
call fcn.140014d78
mov r12, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], r12
mov rcx, rbp
call fcn.140016460
mov rcx, qword [rsp + 0x40]
call fcn.140016460
cmp r12, r15
je 0x14003902c
mov edx, 0x2c
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, r15
je 0x140039024
lea rcx, [rsp + 0x130]
add rdi, 2
mov word [rax], r15w
mov qword [rsp + 0x130], rdi
call fcn.140014d78
mov rdi, qword [rsp + 0x130]
mov rcx, rdi
mov qword [rsp + 0x80], rdi
call fcn.140016460
mov rcx, r12
call fcn.140016460
mov rax, qword [rsp + 0x40]
cmp word [rax], r15w
je 0x14003912e
lea rcx, [rsp + 0x40]
mov edx, 1
call fcn.14006a52c
cmp rax, r15
je 0x14003912e
mov ecx, 0x23
cmp cx, word [rax]
jne 0x14003912e
lea rcx, [rsp + 0x200]
call fcn.14005818c
lea r11, str..tmp.cab
lea r9, str.devi
lea rdx, [rsp + 0x200]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call fcn.1400070b8
lea rdx, str.__dd__len16M___
lea rcx, [rsp + 0x1d8]
call fcn.140062680
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x1d8]
call fcn.1400582c8
lea rdx, [0x1400f5cb8]
lea rcx, [rsp + 0x1d8]
call fcn.1400582c8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x1d8]
call fcn.1400582c8
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.1400b0614
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x218]
call fcn.1400172d0
lea rcx, [rsp + 0x1d8]
mov qword [rsp + 0x40], rax
call fcn.14005041c
lea rcx, [rsp + 0x200]
call fcn.14005041c
mov rcx, qword [rsp + 0x40]
call fcn.1400d36c4
mov rcx, qword [rsp + 0x40]
mov r15d, eax
mov dword [rsp + 0x258], eax
call fcn.1400d4710
xor r11d, r11d
mov rdi, rax
cmp r14b, r11b
jne 0x140039193
cmp r15d, r11d
jne 0x140039183
cmp eax, 4
jle 0x140039183
mov rcx, qword [rsp + 0x40]
movsxd rdx, eax
lea rcx, [rcx + rdx*2 - 8]
lea rdx, str..CAB
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
je 0x140039193
mov r14d, r11d
mov dword [rsp + 0x1e0], r11d
jmp 0x140039262
movsxd r10, dword [rsp + 0x1d0]
mov ecx, 1
lea rax, str.SysWow64
cmp byte [0x14010b009], cl
lea rdx, str.System32
mov r14d, ecx
cmove rdx, rax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x1e0], ecx
lea rcx, [rax + r10*2]
mov r8d, 0x10
call fcn.14001aac4
mov rax, qword [rsp + 0x70]
lea ecx, [r10 + 8]
movsxd rdx, ecx
mov r8d, 0x1a
lea rcx, [rax + rdx*2]
lea rdx, str.cabinet.dll
call fcn.14001aac4
cmp r13b, r11b
jne 0x140039262
mov rcx, qword [rsp + 0x70]
call fcn.1400d3800
xor r11d, r11d
cmp eax, r11d
jne 0x140039262
lea edx, [r11 + 0x63]
lea rcx, [rsp + 0x238]
call fcn.140058200
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x238]
lea rdx, str.__dd__bs1M__s_0__._33INDATA
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.1400b0614
lea rcx, [rsp + 0x238]
call fcn.14005041c
xor r11d, r11d
cmp r12, r11
je 0x14003927d
mov eax, 0x2a
cmp ax, word [r12]
cmove r12, r11
mov qword [rsp + 0xb8], r12
cmp edi, 4
jle 0x1400392ac
mov rax, qword [rsp + 0x40]
movsxd rcx, edi
lea rdx, [0x1400f4b98]
lea rcx, [rax + rcx*2 - 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
jne 0x1400392ac
lea ecx, [r11 + 1]
mov eax, ecx
jmp 0x1400392b4
mov eax, r11d
mov ecx, 1
cmp r15d, r11d
jne 0x1400392c0
mov edi, ecx
cmp eax, r11d
jne 0x1400392c3
mov edi, r11d
mov r15d, dword [rsp + 0x60]
cmp esi, ecx
je 0x1400392ea
cmp eax, r11d
je 0x1400392db
cmp r15d, r11d
je 0x1400392db
cmp r12, r11
jne 0x1400392ea
cmp edi, r11d
je 0x1400392e5
cmp r15d, r11d
jne 0x1400392ea
mov al, r11b
jmp 0x1400392ec
mov al, cl
cmp edi, r11d
jne 0x1400392f9
cmp al, r11b
mov eax, r11d
je 0x1400392fb
mov eax, ecx
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x150], r11
mov qword [rsp + 0x158], r11
mov word [rsp + 0x196], r11w
cmp r13b, r11b
jne 0x140039405
cmp r12, r11
je 0x140039405
cmp word [r12], r11w
je 0x140039405
cmp eax, r11d
jne 0x140039405
lea rcx, [rsp + 0x68]
mov rdx, r12
call fcn.140062798
mov rcx, qword [rsp + 0x68]
call fcn.14001b0b8
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x220]
mov edx, 0x105
call fcn.140058200
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov rcx, qword [rsp + 0x220]
xor eax, eax
cmp word [rcx], ax
je 0x1400393b8
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x220], rax
jmp 0x1400393bd
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov eax, 0x5c
cmp word [r12 + rcx*2 - 2], ax
je 0x1400393e4
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0x68]
call fcn.1400582c8
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x150], rax
call fcn.14005041c
xor r11d, r11d
lea ecx, [r11 + 1]
cmp r15d, r11d
jne 0x14003941b
cmp byte [rsp + 0x4d], r11b
je 0x14003944c
cmp byte [rsp + 0x198], r11b
jne 0x14003944c
mov sil, byte [rsp + 0xc08]
cmp byte [rsp + 0x1a0], r11b
jne 0x140039454
cmp r13b, r11b
jne 0x140039454
cmp sil, cl
je 0x140039454
cmp ebx, r11d
je 0x140039454
xor edx, edx
xor ecx, ecx
call fcn.1400c1174
xor r11d, r11d
mov ebx, eax
jmp 0x140039454
mov sil, byte [rsp + 0xc08]
mov eax, 2
cmp sil, al
cmove ebx, r11d
mov dword [rsp + 0x100], ebx
cmp r14d, r11d
je 0x1400394c0
cmp rbp, r11
je 0x1400394c0
or dword [rsp + 0xc08], 0xffffffff
lea rdx, [rsp + 0xc08]
lea rcx, [rsp + 0x128]
mov qword [rsp + 0x128], rbp
call fcn.140066614
mov r11d, dword [rsp + 0xc08]
mov edx, dword [rsp + 0x11c]
lea ecx, [r11 - 1]
movzx eax, r11b
cmp ecx, 0x12
movzx edx, dl
cmovbe edx, eax
xor r11d, r11d
mov dword [rsp + 0x11c], edx
mov al, byte [rsp + 0x4c]
mov ebp, dword [rsp + 0x64]
mov ecx, 1
cmp al, cl
jne 0x14003954d
cmp r13b, r11b
jne 0x14003954d
cmp byte [rsp + 0x198], r11b
jne 0x14003954d
movsx ecx, byte [rsp + 0x19d]
movsx r9d, byte [rsp + 0x19c]
mov r8d, dword [rsp + 0x2a8]
movsx eax, bpl
lea rdx, str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x4f0]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_wsprintfW]
mov r12, qword [rsp + 0xbf0]
lea r8, [rsp + 0x4f0]
lea rdx, [0x1400f5b80]
mov rcx, r12
call fcn.14001667c
mov al, byte [rsp + 0x4c]
mov ecx, 1
jmp 0x140039555
mov r12, qword [rsp + 0xbf0]
mov esi, dword [rsp + 0x48]
xor r14d, r14d
cmp bpl, r14b
jge 0x14003959e
cmp esi, r14d
jne 0x140039639
cmp bpl, 0xf0
jl 0x14003962a
cmp byte [rsp + 0x19c], r14b
je 0x14003962a
cmp edi, r14d
jne 0x140039590
cmp r15d, r14d
je 0x14003962a
cmp byte [rsp + 0x19d], r14b
jne 0x14003962a
cmp al, cl
jne 0x1400395b8
lea r8, [0x1400f04f4]
lea rdx, [0x1400f5b68]
mov rcx, r12
call fcn.14001667c
mov r15d, 0x11
lea rdx, str.rescan__BEGIN
xor r8d, r8d
mov rcx, r12
mov r9d, r15d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140026b88
movsx ecx, bpl
and ecx, 7
call fcn.14001dd00
lea edx, [r15 + 0x21]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0xf8], rax
call fcn.14001c3ec
lea rdx, str.rescan__END
mov r9d, r15d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140026b88
cmp esi, r14d
jne 0x140039639
mov rax, qword [rsp + 0x40]
cmp word [rax], r14w
je 0x14003aa1e
lea rcx, [rsp + 0xa0]
call fcn.14005818c
mov rcx, qword [rsp + 0x40]
call fcn.1400190a4
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1400c1bc0
mov r9d, r14d
mov qword [rsp + 0x40], rax
cmp esi, r14d
je 0x140039682
bt esi, 9
mov eax, 2
cmovae r9d, eax
or r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x14010dd10]
mov qword [rsp + 0xb0], rax
cmp rax, 0xffffffffffffffff
jne 0x1400396b2
mov qword [rsp + 0xb0], r14
cmp edi, r14d
je 0x14003aa29
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x128], r14
call fcn.14005818c
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
movzx r9d, dil
mov dword [rsp + 0xf0], r9d
cmp r10, r11
je 0x1400396ff
mov rcx, r10
call fcn.14001ae2c
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
mov r9d, dword [rsp + 0xf0]
and edi, 0xffffff00
mov r15, r11
mov qword [rsp + 0x130], r11
or edi, r9d
movzx r14d, r11w
mov word [rsp + 0xc08], r11w
mov dword [rsp + 0x48], edi
cmp r10, r11
je 0x140039885
cmp r13b, r11b
je 0x140039885
mov eax, 0x22
movzx ebp, r11w
mov rsi, r10
lea r13d, [rax + 5]
cmp ax, word [r10]
je 0x140039752
cmp r13w, word [r10]
jne 0x14003975a
mov bp, word [r10]
lea rsi, [r10 + 2]
mov rcx, rsi
call fcn.14001dd78
mov r12d, r9d
cmp eax, r11d
cmovge r12d, eax
cmp eax, r11d
jl 0x1400397a6
lea rcx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 4]
mov rcx, rsi
movsxd r8, eax
lea r8, [r8 + r8 + 2]
call fcn.14001aa7c
mov r9d, dword [rsp + 0xf0]
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
xor r11d, r11d
cmp bp, r11w
je 0x140039878
mov r10d, 2
jmp 0x1400397c0
add rsi, r10
cmp bp, ax
je 0x1400397cb
movzx eax, word [rsi]
cmp ax, r11w
jne 0x1400397b8
jmp 0x1400397ce
mov r15, rsi
mov ebx, 0x22
movzx ebp, word [rsi]
cmp bx, bp
je 0x1400397e1
cmp r13w, bp
jne 0x140039846
add rsi, r10
mov rcx, rsi
call fcn.14001dd78
mov ecx, r9d
cmp eax, r11d
cmovge ecx, eax
cmp ecx, r12d
jne 0x140039846
cmp eax, r11d
jl 0x140039836
lea rcx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 4]
mov rcx, rsi
movsxd r8, eax
lea r8, [r8 + r8 + 2]
call fcn.14001aa7c
mov r9d, dword [rsp + 0xf0]
xor r11d, r11d
lea r10d, [r11 + 2]
jmp 0x140039836
add rsi, r10
cmp bp, ax
je 0x140039841
movzx eax, word [rsi]
cmp ax, r11w
jne 0x14003982e
jmp 0x1400397d3
mov r15, rsi
jmp 0x1400397d3
mov r14w, word [r15]
mov ebx, dword [rsp + 0x100]
mov edi, dword [rsp + 0x48]
mov r10, qword [rsp + 0xc0]
mov qword [rsp + 0x130], r15
mov word [rsp + 0xc08], r14w
cmp r14w, r11w
je 0x140039878
mov word [r15], r11w
and edi, 0xffffff00
or edi, r12d
mov dword [rsp + 0x48], edi
mov cl, byte [rsp + 0xc00]
mov eax, edi
mov r8d, r11d
and eax, 0x806
cmp eax, 0x802
sete r8b
cmp eax, 0x800
jne 0x1400398b6
cmp cl, r11b
jne 0x1400398b6
mov r9d, 1
mov edx, r9d
jmp 0x1400398bf
mov edx, r11d
mov r9d, 1
mov eax, edi
and eax, 0x1006
cmp eax, 0x1004
jne 0x1400398d5
cmp cl, r11b
mov ecx, r9d
je 0x1400398d8
mov ecx, r11d
mov esi, r11d
mov eax, edi
and eax, 0x2002
cmp eax, 0x2000
sete sil
or ecx, edx
neg ecx
mov dword [rsp + 0x1e4], esi
sbb r13w, r13w
mov word [rsp + 0x64], r13w
test dil, 4
jne 0x14003990e
mov ebp, r9d
cmp r8d, r11d
je 0x140039913
mov ebp, 2
mov dword [rsp + 0xe0], ebp
cmp r10, r11
je 0x14003993c
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r11d, r11d
movsxd rdi, eax
mov qword [rsp + 0x2b0], rdi
mov edi, dword [rsp + 0x48]
jmp 0x140039944
mov qword [rsp + 0x2b0], r11
mov r12d, 0xfe
lea rcx, [rsp + 0x3f2]
xor edx, edx
mov r8, r12
mov word [rsp + 0x3f0], r11w
call fcn.1400d4180
xor eax, eax
lea rcx, [rsp + 0x2f2]
mov r8, r12
xor edx, edx
mov word [rsp + 0x2f0], ax
call fcn.1400d4180
xor ecx, ecx
mov eax, 0x20
mov dword [rsp + 0x280], eax
cmp byte [rsp + 0x98], cl
je 0x14003a0ce
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
add r12, 2
lea r9d, [rax - 0xf]
lea rdx, str.DEVI_ID__BEGIN
mov qword [r12], rcx
mov rcx, qword [rsp + 0xbf0]
xor r8d, r8d
call fcn.140026b88
xor r11d, r11d
cmp byte [rsp + 0x198], r11b
jne 0x140039f16
mov r9, qword [rsp + 0xb0]
cmp r9, r11
je 0x140039f16
mov r14, qword [rsp + 0x58]
mov ecx, r11d
mov rax, r12
mov dword [rsp + 0x120], ecx
sub rax, r14
cmp rax, 0x400000
jge 0x140039f05
mov edx, ecx
lea r8, [rsp + 0x280]
mov rcx, r9
call qword [0x14010dd38]
xor r11d, r11d
cmp eax, r11d
je 0x140039f05
cmp edi, r11d
je 0x140039a96
cmp qword [rsp + 0x168], r11
je 0x140039a88
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x284]
xor r9d, r9d
mov r8d, 0x80
mov qword [rsp + 0x3f0], r11
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
jne 0x140039edb
mov eax, 2
test al, dil
jne 0x140039e09
mov rax, qword [0x14010dd58]
mov dword [rsp + 0x270], r11d
cmp rax, r11
je 0x140039ae1
mov r8d, dword [rsp + 0x294]
mov ecx, 0x20
lea rdx, [rsp + 0x270]
mov dword [rsp + 0x280], ecx
lea rcx, [rsp + 0x1f8]
xor r9d, r9d
mov dword [rsp + 0x1f8], 0x400
call rax
xor r11d, r11d
movsxd rsi, esi
movsx r15d, r13w
mov r14d, ebp
mov rdi, r12
mov qword [rsp + 0x1f8], r12
mov r13d, 1
mov qword [rsp + 0x278], rsi
mov ecx, dword [rsp + 0x58]
lea rbp, [r12 + 0x1fffc]
mov eax, 0xfffe
sub ecx, r12d
mov qword [rsp + 0x30], r11
mov qword [r12], r11
add ecx, 0x3f0002
lea rdx, [rsp + 0x280]
mov r8d, r14d
cmp ecx, eax
mov qword [rsp + 0x2b8], rbp
cmovg ecx, eax
mov eax, 0x20
xor r9d, r9d
mov dword [rsp + 0x280], eax
movsxd rax, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + rbp], r11
mov qword [rsp + 0x20], rbp
mov qword [rbp], r11
call qword [0x14010dd18]
xor r11d, r11d
mov ecx, 0x20
mov dword [rsp + 0x280], ecx
cmp eax, r11d
je 0x140039ed2
cmp byte [rsp + 0x118], r11b
je 0x140039c70
mov rcx, qword [rsp + 0xc0]
cmp rcx, r11
je 0x140039bfb
mov eax, dword [rsp + 0x48]
and eax, 2
cmp al, r11b
jne 0x140039bfb
cmp r13d, r11d
je 0x140039bfb
mov r8d, dword [rsp + 0x2b0]
mov r9d, 0x100
mov rdx, rbp
call fcn.140029084
xor r11d, r11d
cmp rax, r11
jne 0x140039bf2
test byte [rsp + 0x48], 8
je 0x140039ed2
lea eax, [r11 + 2]
cmp r14d, eax
je 0x140039ed2
mov r14d, eax
jmp 0x140039b04
cmp rsi, r11
jne 0x140039df3
movsxd rdi, r15d
cmp word [rbp], r11w
je 0x140039c39
cmp rdi, r11
jl 0x140039c39
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x78]
call fcn.14001afb4
xor r11d, r11d
bt dword [rsp + 0x48], 0xa
jae 0x140039c39
mov rbp, qword [rsp + 0x2b8]
jmp 0x140039bfe
movsx eax, byte [rsp + 0xc00]
cmp r15d, eax
jge 0x140039ed2
mov rdi, qword [rsp + 0x1f8]
mov ecx, 1
mov eax, r11d
add r15d, ecx
cmp r14d, 2
mov r13d, r11d
setne al
lea r14d, [rcx + rax]
jmp 0x140039b04
lea rdx, str.ACPI
mov r8d, 4
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r11d, r11d
cmp eax, r11d
je 0x140039ed2
lea edx, [r11 + 1]
cmp r13d, edx
jne 0x140039cc2
mov r8d, dword [rsp + 0x120]
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0xbf0]
mov r9, rbp
call fcn.14001667c
xor r11d, r11d
lea edx, [r11 + 1]
movzx eax, word [rbp]
movzx esi, r11w
mov ecx, r11d
cmp ax, r11w
je 0x140039dc7
mov r8d, 0x26
cmp ax, r8w
jne 0x140039cf1
movsx eax, byte [rsp + 0x11c]
add ecx, edx
cmp ecx, eax
jge 0x140039d02
add si, dx
movzx eax, si
mov ax, word [rbp + rax*2]
cmp ax, r11w
jne 0x140039cdd
cmp si, r11w
jbe 0x140039dc7
cmp qword [rsp + 0x1f8], r12
jae 0x140039d42
cmp word [rdi - 2], si
jne 0x140039d34
movzx r8d, si
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r11d, r11d
cmp eax, r11d
je 0x140039d99
movzx eax, word [rdi - 4]
lea rdi, [rdi + rax*2 + 6]
cmp rdi, r12
jb 0x140039d16
mov rcx, r12
mov word [r12 - 2], si
cmp rbp, r12
jne 0x140039d79
movzx eax, si
lea r12, [r12 + rax*2]
jmp 0x140039d5d
add r12, 2
cmp word [r12], r11w
jne 0x140039d59
mov rbp, r12
jmp 0x140039d88
mov word [r12], ax
mov eax, 2
add r12, rax
add rbp, rax
movzx eax, word [rbp]
cmp ax, r11w
jne 0x140039d69
mov word [r12], r11w
mov rax, r12
sub rax, rcx
sar rax, 1
add r12, 6
mov word [rcx - 4], ax
mov esi, 2
cmp word [rbp], r11w
je 0x140039daa
add rbp, rsi
jmp 0x140039d9e
mov rdi, qword [rsp + 0x1f8]
add rbp, rsi
mov edx, 1
cmp word [rbp], r11w
jne 0x140039cc2
jmp 0x140039dcc
mov esi, 2
cmp byte [rsp + 0xc00], r11b
je 0x140039ec7
cmp r14d, esi
je 0x140039ec7
mov r14d, esi
mov rsi, qword [rsp + 0x278]
jmp 0x140039b04
mov esi, dword [rsp + 0x1e4]
movzx r13d, word [rsp + 0x64]
mov edi, dword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xb0]
lea r8, [rsp + 0x2f0]
lea rdx, [rsp + 0x280]
mov r9d, 0x80
mov qword [rsp + 0x2f0], r11
mov qword [rsp + 0x20], r11
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
mov rax, qword [rsp + 0xc0]
xor r11d, r11d
cmp rax, r11
je 0x140039e67
cmp esi, r11d
jne 0x140039e67
lea rcx, [rsp + 0x2f0]
mov rdx, rax
call fcn.1400291c0
xor r11d, r11d
cmp eax, r11d
je 0x140039edb
bt edi, 0xa
jb 0x140039e73
bt edi, 0xd
jb 0x140039e83
mov ebp, dword [rsp + 0xe0]
cmp esi, r11d
je 0x140039a96
mov ebp, dword [rsp + 0xe0]
cmp byte [rsp + 0x118], r11b
je 0x140039a96
lea rax, [rsp + 0x2f0]
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x278], rax
call fcn.14001afb4
xor r11d, r11d
jmp 0x140039edb
mov edi, dword [rsp + 0x48]
test sil, dil
jne 0x140039f46
jmp 0x140039ed6
mov edi, dword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x120]
mov esi, dword [rsp + 0x1e4]
mov ebp, dword [rsp + 0xe0]
mov r13w, word [rsp + 0x64]
mov r9, qword [rsp + 0xb0]
inc ecx
jmp 0x1400399f8
mov r15, qword [rsp + 0x130]
mov r14w, word [rsp + 0xc08]
mov r13d, dword [rsp + 0x118]
cmp r13b, r11b
je 0x140039f41
cmp r14w, r11w
je 0x14003aa4d
mov word [r15], r14w
mov r10, r15
mov qword [rsp + 0xc0], r15
jmp 0x1400396f7
mov esi, 2
mov ebp, dword [rsp + 0xa8]
cmp ebp, r11d
je 0x140039f64
test sil, dil
je 0x140039f64
mov dword [rsp + 0x1e8], 1
jmp 0x140039fc6
mov rdi, qword [rsp + 0x250]
mov dword [rsp + 0x1e8], r11d
cmp rdi, r11
je 0x140039fc6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
mov word [rcx], ax
lea r12, [rcx + 2]
mov word [r12], ax
add r12, rsi
inc eax
movsxd r10, eax
mov rcx, r12
add r10, r10
mov r8, r10
call fcn.14001aac4
xor r11d, r11d
add r12, r10
mov word [r12], r11w
add r12, rsi
mov word [r12], r11w
add r12, rsi
mov qword [r12], r11
mov r13, qword [rsp + 0xbf0]
mov qword [rsp + 0x28], r11
lea rdx, str.DEVI_ID__END
mov r9d, 0x11
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], r11
call fcn.140026b88
xor r14d, r14d
mov word [r12 - 2], r14w
mov r12, qword [rsp + 0x1c8]
cmp r12, r14
je 0x14003a0e0
lea rcx, [0x14010ee80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], r14
call fcn.140016268
lea edx, [r14 + 0x26]
mov rdi, r12
mov rcx, rax
cmp dx, word [r12]
jne 0x14003a052
lea eax, [rdx - 0x24]
add rdi, rax
cmp dx, word [rdi]
je 0x14003a04a
cmp rcx, r14
jne 0x14003a07c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rsi
mov rdx, rdi
mov rcx, r13
movsxd r9, eax
mov qword [rsp + 0x20], 0x400032
call fcn.14001b48c
jmp 0x14003a0bf
mov dl, byte [rcx + 0x1f]
and dl, 0xc0
cmp dl, 0xc0
jne 0x14003a0a0
mov rax, qword [rcx + 0x18]
movabs r8, 0x3fffffffffffffff
and rax, r8
cmp rax, 0x400032
jb 0x14003a0bf
cmp dl, r14b
je 0x14003a0a9
mov qword [rcx + 8], r14
lea rdx, [rcx + 0x18]
mov r9d, 0x400032
mov r8, rsi
add rcx, 8
call fcn.14005aadc
lea rcx, [0x14010ee80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003a0e0
mov ebp, dword [rsp + 0xa8]
mov r13, qword [rsp + 0xbf0]
xor r14d, r14d
mov rsi, qword [rsp + 0xb0]
mov rcx, rsi
call qword [0x14010dd20]
cmp byte [rsp + 0x198], r14b
jne 0x14003a111
lea r8, [0x1400f04f4]
lea rdx, [0x1400f3b00]
mov rcx, r13
call fcn.14001667c
mov rax, qword [rsp + 0x70]
movsxd r12, dword [rsp + 0x1d0]
mov r14d, 8
lea rdx, [0x1400f5ad8]
lea rcx, [rax + r12*2]
mov r8, r14
call fcn.14001aac4
xor r13d, r13d
cmp ebp, r13d
jne 0x14003ac37
cmp rsi, r13
je 0x14003ac2d
mov dl, byte [rsp + 0x198]
cmp dl, r13b
jne 0x14003a183
mov rax, qword [rsp + 0x58]
cmp word [rax], r13w
je 0x14003ab7a
cmp dword [rsp + 0x258], r13d
jne 0x14003aadf
cmp dword [rsp + 0x1e0], r13d
je 0x14003aadf
mov rax, qword [rsp + 0x150]
cmp rax, r13
je 0x14003a19e
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14003a2d7
mov esi, dword [rsp + 0x60]
mov cl, byte [rsp + 0x19c]
cmp esi, r13d
je 0x14003a1bd
cmp cl, r13b
jne 0x14003a1c6
cmp byte [rsp + 0x1a0], r13b
jne 0x14003a1c6
cmp cl, r13b
jne 0x14003a2e5
lea rcx, [rsp + 0x110]
call fcn.14005818c
lea r11, [0x1400f5ad0]
lea r9, str.devi
lea rcx, [rsp + 0x110]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r11
call fcn.1400070b8
lea rcx, [rsp + 0x228]
mov edx, 0x105
call fcn.140058200
mov rdx, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x110]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov r11, qword [rsp + 0x228]
cmp word [r11], r13w
je 0x14003a24c
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x110], r11
mov qword [rsp + 0x228], rax
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0x110]
call fcn.1400582c8
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x208]
call fcn.1400172d0
cmp byte [rsp + 0x19c], r13b
jne 0x14003a2a4
cmp byte [rsp + 0x1a0], r13b
jne 0x14003a2a4
mov rcx, rax
mov qword [rsp + 0x158], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [rsp + 0x196], ax
jmp 0x14003a2ac
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x228]
call fcn.14005041c
lea rcx, [rsp + 0x110]
call fcn.14005041c
mov dl, byte [rsp + 0x198]
mov rax, qword [rsp + 0x150]
jmp 0x14003a2db
mov esi, dword [rsp + 0x60]
cmp byte [rsp + 0x19c], r13b
je 0x14003a309
cmp dl, r13b
jne 0x14003a309
cmp rax, r13
je 0x14003a309
mov cl, byte [rsp + 0x19d]
mov r14d, 1
cmp cl, r13b
cmove esi, r14d
mov dword [rsp + 0x60], esi
jmp 0x14003a316
mov cl, byte [rsp + 0x19d]
mov r14d, 1
cmp byte [rsp + 0x51], r13b
mov rbp, qword [rsp + 0x80]
cmovne rax, r13
mov qword [rsp + 0x150], rax
cmp cl, r13b
je 0x14003a344
cmp rax, r13
je 0x14003a344
cmp rbp, r13
cmovne esi, r13d
mov dword [rsp + 0x60], esi
neg rax
movzx eax, word [rsp + 0x194]
mov edi, 0xa
sbb r15d, r15d
shl eax, 0x10
lea rdx, str.INF_
not r15d
mov r8, rdi
and r15d, 3
or r15d, eax
mov rax, qword [rsp + 0x70]
lea rcx, [rax + r12*2]
call fcn.14001aac4
lea rcx, [rsp + 0x230]
mov edx, 0x1040
call fcn.140058200
lea rcx, [rsp + 0x744]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x740], r13d
call fcn.1400d4180
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x740]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0xd0], r13
call fcn.1400d3748
cmp qword [rsp + 0xd0], r13
je 0x14003ac18
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.140062680
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xd8]
call fcn.140069210
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0xd8]
call fcn.1400582c8
lea rdx, str.DefaultInstall_132
lea rcx, [rsp + 0xe8]
call fcn.140062680
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xd8]
mov r12d, eax
mov dword [rsp + 0xc00], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xd8]
movsxd rbx, eax
mov word [rcx + rbx*2], r13w
mov dword [rsp + 0xc08], ebx
cmp esi, r13d
jne 0x14003a473
cmp byte [rsp + 0x198], r13b
je 0x14003a476
mov r14d, r13d
mov rax, qword [rsp + 0x150]
neg rax
sbb ecx, ecx
and ecx, 0x20000
add ecx, 0x10000
or r15d, ecx
mov rdx, qword [rsp + 0x230]
lea rcx, [rsp + 0x140]
call fcn.14001709c
test byte [rsp + 0x740], 0x10
jne 0x14003a8c9
mov rax, qword [rsp + 0xd8]
movsxd rcx, ebx
lea rdx, [rsp + 0x76c]
mov word [rax + rcx*2], r13w
lea rcx, [rsp + 0xd8]
call fcn.1400582c8
mov rcx, qword [rsp + 0xd8]
lea r9, [rsp + 0x140]
lea r8, [0x140037c04]
xor edx, edx
call qword [0x14010dd40]
cmp esi, r13d
je 0x14003a6b3
mov r13, qword [rsp + 0x178]
mov bl, byte [rsp + 0x4c]
cmp r13, qword [rsp + 0x170]
jae 0x14003a694
add r13, rdi
mov rbp, r13
movzx r12d, word [r13 - 2]
lea eax, [r12 + 2]
movsxd rcx, eax
lea rsi, [r13 + rcx*2]
mov ecx, 1
movzx eax, word [rsi - 2]
lea r13, [rsi + rax*2 + 2]
cmp bl, cl
jbe 0x14003a566
lea rcx, [rsp + 0x140]
or r8d, 0xffffffff
mov rdx, rbp
call fcn.14001716c
xor ecx, ecx
cmp rax, rcx
jne 0x14003a589
mov ecx, 1
xor eax, eax
mov edi, 4
cmp byte [rsp + 0x1a0], al
je 0x14003a59b
lea rcx, [rsp + 0x140]
mov r8d, r15d
mov rdx, rsi
call fcn.14002dc74
mov r12d, dword [rsp + 0xc00]
mov edi, 0xa
jmp 0x14003a50e
mov edx, 3
cmp byte [rsp + 0x19c], dl
je 0x14003a5b2
cmp byte [rsp + 0x19e], al
je 0x14003a607
or edi, ecx
cmp byte [rsp + 0x19e], al
je 0x14003a5d8
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov r8, rbp
mov rdx, rsi
call fcn.14002e620
mov r14, rax
jmp 0x14003a5fa
cmp byte [rsp + 0x19c], dl
jne 0x14003a5fc
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov r8, rbp
mov rdx, rsi
call fcn.14002e79c
mov r14d, eax
xor eax, eax
cmp r14d, eax
je 0x14003a589
test dil, 2
jne 0x14003a647
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x140]
mov r9d, r15d
mov r8, rsi
mov rdx, rbp
or edi, 2
mov dword [rsp + 0x20], r12d
call fcn.14002dac0
mov r14d, eax
xor eax, eax
cmp r14d, eax
je 0x14003a589
lea ecx, [rax + 1]
lea edx, [rax + 3]
test cl, dil
je 0x14003a5b2
test dil, 4
jne 0x14003a589
mov rax, qword [rsp + 0xe8]
movsxd r12, dword [rsp + 0xc00]
xor edx, edx
mov word [rax + r12*2], dx
lea rcx, [rsp + 0xe8]
mov rdx, rsi
call fcn.1400582c8
mov r8, qword [rsp + 0xe8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.14002e9a0
jmp 0x14003a591
mov esi, dword [rsp + 0x60]
mov ebx, dword [rsp + 0xc08]
xor r13d, r13d
cmp esi, r13d
jne 0x14003a8c9
mov rbp, qword [rsp + 0x80]
cmp byte [rsp + 0x19d], r13b
je 0x14003a8c9
cmp rbp, r13
je 0x14003a8c9
mov rdx, qword [rsp + 0x150]
cmp rdx, r13
je 0x14003a8c9
lea rcx, [rsp + 0x108]
call fcn.140062680
lea rcx, [rsp + 0x108]
mov rdx, rbp
call fcn.1400582c8
lea rcx, [rsp + 0x240]
mov edx, 0x2800
call fcn.140058200
mov r9, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x240]
lea r8, str.:_6R
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0x240]
lea rcx, [0x14010df00]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026b88
lea rcx, [rsp + 0x240]
call fcn.14005041c
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.14002d7c4
mov edi, 4
lea rbp, [0x1400f04f4]
cmp rax, r13
lea ecx, [rdi - 1]
mov rsi, rax
cmovne rbp, rax
lea eax, [rdi - 2]
cmp byte [rsp + 0x19c], cl
je 0x14003a7a6
cmp byte [rsp + 0x19e], r13b
je 0x14003a816
or edi, 1
cmp byte [rsp + 0x19e], r13b
je 0x14003a7d1
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e620
jmp 0x14003a7f6
cmp byte [rsp + 0x19c], cl
jne 0x14003a7fe
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e79c
mov r14d, eax
mov eax, 2
inc edi
cmp edi, eax
jge 0x14003a8aa
cmp r14d, r13d
je 0x14003a8aa
test al, dil
jne 0x14003a868
or edi, eax
cmp rsi, r13
je 0x14003a84a
mov r8, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
mov r9d, r15d
mov rdx, rsi
mov qword [rsp + 0x28], r13
or dword [rsp + 0x20], 0xffffffff
call fcn.14002dac0
mov r14d, eax
mov eax, 2
inc edi
cmp edi, eax
jge 0x14003a8aa
cmp rsi, r13
je 0x14003a85a
cmp r14d, r13d
je 0x14003a8aa
mov ecx, 3
test al, dil
je 0x14003a7a6
test dil, 4
jne 0x14003a8aa
mov rax, qword [rsp + 0xe8]
movsxd rcx, r12d
mov word [rax + rcx*2], r13w
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xe8]
call fcn.1400582c8
mov r8, qword [rsp + 0xe8]
mov r9d, 0x100000
xor edx, edx
xor ecx, ecx
call fcn.14002e9a0
cmp rsi, r13
je 0x14003a8b3
mov word [rsi], r13w
lea rcx, [rsp + 0x108]
call fcn.14005041c
mov esi, dword [rsp + 0x60]
mov edi, 0xa
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rbp, qword [rsp + 0x80]
cmp eax, r13d
jne 0x14003a492
mov rcx, qword [rsp + 0xd0]
mov ebx, dword [rsp + 0x100]
cmp rcx, r13
je 0x14003a910
cmp rcx, 0xffffffffffffffff
je 0x14003a910
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x1f0]
cmp r14d, r13d
cmove rdi, r13
mov ecx, 0x5f
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xf8], rdi
mov word [rax], cx
cmp esi, r13d
je 0x14003ab84
cmp qword [rsp + 0x150], r13
je 0x14003ab84
lea r14d, [rcx - 0x5e]
cmp byte [rsp + 0x19c], r14b
jne 0x14003ab84
cmp byte [rsp + 0x51], r13b
jne 0x14003ab84
mov rax, rbp
cmp rax, r13
jne 0x14003ab84
cmp byte [rsp + 0x88], r13b
jne 0x14003ab84
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x51], r14b
call fcn.14005041c
lea rcx, [rsp + 0xd8]
call fcn.14005041c
mov rcx, qword [rsp + 0xd0]
cmp rcx, r13
je 0x14003a9cd
cmp rcx, 0xffffffffffffffff
je 0x14003a9cd
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x230]
mov qword [rsp + 0xd0], r13
call fcn.14005041c
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x68]
call fcn.14005041c
mov dil, byte [rsp + 0x4c]
mov r12, qword [rsp + 0xbf8]
jmp 0x140037eb5
mov rbp, 0xffffffff80070057
jmp 0x14003aa45
xor r13d, r13d
mov rbp, r13
jmp 0x14003adae
lea rcx, [rsp + 0xa0]
mov ebp, 1
call fcn.14005041c
lea rcx, [rsp + 0x68]
call fcn.14005041c
xor r13d, r13d
jmp 0x14003adb8
mov r12b, byte [rsp + 0x4f]
mov r8, qword [rsp + 0x78]
cmp r12b, r11b
je 0x14003aa9c
cmp word [r8], r11w
je 0x14003aa9c
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xd
movsxd rcx, eax
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], dx
mov rax, qword [rsp + 0x78]
mov edx, 0xa
mov word [rax + rcx*2 + 2], dx
mov rax, qword [rsp + 0x78]
xor edx, edx
mov word [rax + rcx*2 + 4], dx
mov r8, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xbf0]
mov rdx, qword [rsp + 0x268]
mov rcx, rbx
call fcn.140057738
xor eax, eax
lea rcx, [rsp + 0x78]
mov rbp, rax
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x68]
call fcn.14005041c
jmp 0x14003b2bb
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
sub eax, r9d
cmp eax, r9d
jl 0x14003ab1e
mov rdx, qword [rsp + 0x40]
lea r8d, [r9 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2]
je 0x14003ab16
lea r8d, [r9 + 0x2e]
cmp r8w, word [rdx + rcx*2]
jne 0x14003ab1e
mov word [rdx + rcx*2], r13w
sub eax, r9d
cmp eax, r13d
jge 0x14003ab2f
mov rbp, 0xffffffff80070057
jmp 0x14003ad97
mov rdx, qword [rsp + 0xc8]
cmp rdx, r13
je 0x14003ab48
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and rdx, rcx
mov rcx, qword [rsp + 0x248]
mov r9b, byte [rsp + 0x50]
mov r8, rdx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x140]
or r9b, 0x10
call fcn.140037288
mov ebp, eax
jmp 0x14003ad97
mov ebp, 0x491
jmp 0x14003ad97
mov rcx, qword [rsp + 0xbf0]
lea r8, [0x1400f04f4]
lea rdx, [0x1400f3b00]
mov qword [rsp + 0x150], r13
call fcn.14001667c
lea rcx, [rsp + 0xe8]
call fcn.14005041c
lea rcx, [rsp + 0xd8]
call fcn.14005041c
mov rcx, qword [rsp + 0xd0]
cmp rcx, r13
je 0x14003abda
cmp rcx, 0xffffffffffffffff
je 0x14003abda
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x230]
mov qword [rsp + 0xd0], r13
call fcn.14005041c
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x68]
call fcn.14005041c
mov rbp, rdi
jmp 0x14003adb8
mov qword [rsp + 0xd0], r13
lea rcx, [rsp + 0x230]
jmp 0x14003ad8d
mov ebp, 1
jmp 0x14003ad97
mov esi, r13d
cmp dword [rsp + 0x60], r13d
jne 0x14003ac81
mov rax, qword [rsp + 0x58]
cmp word [rax], r13w
jne 0x14003ac81
cmp byte [rsp + 0x19d], r13b
jne 0x14003ac81
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x68]
call fcn.14005041c
mov ebp, 0x491
jmp 0x14003b6b5
lea r15d, [r12 + 4]
lea rcx, [rsp + 0xf8]
lea eax, [r15 + 0x3c]
movsxd rdx, eax
call fcn.140058200
mov rax, qword [rsp + 0x70]
lea rdx, str.System32DRIVERS
lea rcx, [rax + r12*2]
mov r8d, 0x22
mov rdi, r12
call fcn.14001aac4
mov rcx, qword [rsp + 0x70]
call fcn.1400d36c4
cmp eax, r13d
jne 0x14003acd4
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x70]
lea rdx, [0x1400f5ad8]
mov r8, r14
lea rcx, [rax + r12*2]
call fcn.14001aac4
mov rcx, qword [rsp + 0x70]
call fcn.1400d36c4
cmp eax, r13d
jne 0x14003ad08
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x70]
lea rdx, str.INF_
mov r8d, 0xa
lea rcx, [rax + r12*2]
call fcn.14001aac4
movzx r12d, word [rsp + 0x194]
lea rcx, [rsp + 0x4f4]
xor edx, edx
mov r8d, 0x24c
shl r12d, 0x10
mov dword [rsp + 0x4f0], r13d
call fcn.1400d4180
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0xb0], r13
call fcn.1400d3748
cmp qword [rsp + 0xb0], r13
jne 0x14003adff
mov qword [rsp + 0xb0], r13
lea rcx, [rsp + 0xf8]
mov ebp, 2
call fcn.14005041c
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x68]
call fcn.14005041c
cmp ebx, r13d
jle 0x14003ade0
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov ecx, ebx
call fcn.1400c1174
lea rcx, [0x14010e020]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x208]
call fcn.14002e944
lea rcx, [rsp + 0x218]
call fcn.14002e944
jmp 0x14003b2b3
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140062680
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140069210
lea rdx, [0x1400f0aa8]
lea rcx, [rsp + 0x58]
call fcn.1400582c8
mov rbx, qword [rsp + 0xb8]
cmp rbx, r13
je 0x14003ae41
cmp word [rbx], r13w
jne 0x14003ae48
lea rbx, [0x1400f5a50]
mov rdx, qword [rsp + 0xc8]
cmp rdx, r13
je 0x14003ae5b
cmp word [rdx], r13w
jne 0x14003ae62
lea rdx, str.DefaultInstall
lea rcx, [rsp + 0x80]
call fcn.140062680
lea rdx, [0x1400f1060]
lea rcx, [rsp + 0x80]
call fcn.1400582c8
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.1400582c8
lea rdx, [0x1400f1060]
lea rcx, [rsp + 0x80]
call fcn.1400582c8
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0xc00], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0xc08], eax
test byte [rsp + 0x4f0], 0x10
jne 0x14003b1f3
mov rcx, qword [rsp + 0x58]
movsxd rdx, eax
mov word [rcx + rdx*2], r13w
lea rdx, [rsp + 0x51c]
lea rcx, [rsp + 0x58]
call fcn.1400582c8
mov r14, qword [rsp + 0x58]
lea rcx, [rsp + 0xb8]
mov dil, r13b
call fcn.14005818c
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x128], r13
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0xb8]
mov rcx, r14
mov word [rax], r13w
call fcn.1400c1bc0
mov rcx, qword [rsp + 0x128]
mov rdx, qword [rsp + 0xb8]
sub rcx, rdx
mov qword [rsp + 0x40], rax
movsxd rax, r15d
sar rcx, 1
cmp rax, rcx
jne 0x14003af7c
mov rcx, qword [rsp + 0x70]
mov r8d, r15d
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
movzx edi, r13b
cmp eax, r13d
mov eax, 1
cmove edi, eax
cmp dword [rsp + 0x1e8], r13d
je 0x14003af93
mov rax, qword [rsp + 0xc0]
cmp rax, r13
jne 0x14003afa8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.14002d7c4
mov rbx, rax
cmp byte [rsp + 0x19d], r13b
jne 0x14003afd4
mov eax, dword [rsp + 0x60]
cmp eax, r13d
jne 0x14003b03c
cmp byte [rsp + 0x4d], r13b
je 0x14003afca
cmp dil, r13b
jne 0x14003b03c
cmp rbx, r13
jne 0x14003b041
jmp 0x14003b1e6
lea rcx, [rsp + 0xc8]
mov edx, 0x2800
call fcn.140058200
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc8]
lea r8, str.:_6R
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0xc8]
lea rcx, [0x14010df00]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026b88
lea rcx, [rsp + 0xc8]
call fcn.14005041c
mov eax, dword [rsp + 0x60]
cmp rbx, r13
je 0x14003b046
movzx r13d, word [rbx - 4]
xor edx, edx
lea rbp, [0x1400f04f4]
cmp rbx, rdx
lea edi, [rdx + 4]
cmovne rbp, rbx
cmp eax, edx
jne 0x14003b140
cmp byte [rsp + 0x1a0], dl
jne 0x14003b149
lea ecx, [rdx + 3]
cmp byte [rsp + 0x19c], cl
je 0x14003b083
cmp byte [rsp + 0x19e], dl
je 0x14003b0eb
mov eax, 1
or edi, eax
cmp byte [rsp + 0x19e], dl
je 0x14003b0b1
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e620
mov rsi, rax
jmp 0x14003b0d5
cmp byte [rsp + 0x19c], cl
jne 0x14003b0d7
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
or r9d, 0xffffffff
mov r8, rbp
call fcn.14002e79c
mov esi, eax
xor edx, edx
cmp esi, edx
je 0x14003b1c6
mov eax, 2
test al, dil
jne 0x14003b136
jmp 0x14003b0f0
mov eax, 2
or edi, eax
cmp rbx, rdx
je 0x14003b125
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
or dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x140]
mov r9d, r12d
mov rdx, rbx
call fcn.14002dac0
xor edx, edx
mov esi, eax
cmp eax, edx
je 0x14003b1c6
mov eax, 1
lea ecx, [rax + 2]
test al, dil
je 0x14003b088
test dil, 4
jne 0x14003b1c6
cmp byte [rsp + 0x1a0], dl
je 0x14003b160
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x140]
mov r8d, r12d
call fcn.14002dc74
jmp 0x14003b1c6
cmp byte [rsp + 0x19f], dl
jne 0x14003b1c6
movsxd rcx, dword [rsp + 0xc00]
mov rax, qword [rsp + 0x80]
mov word [rax + rcx*2], dx
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.1400582c8
mov r8, qword [rsp + 0x80]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call fcn.14002e9a0
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x14003b1c6
cmp qword [rsp + 0x160], rax
je 0x14003b1c6
lea rcx, [rsp + 0x140]
mov r8d, r13d
mov rdx, rbp
call fcn.140017198
xor r13d, r13d
cmp rbx, r13
je 0x14003b1d2
mov word [rbx], r13w
mov rcx, qword [rsp + 0xf8]
cmp word [rcx], r13w
je 0x14003b1e6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xb8]
call fcn.14005041c
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
mov eax, dword [rsp + 0xc08]
jne 0x14003aece
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0x58]
call fcn.14005041c
mov rcx, qword [rsp + 0xb0]
movsxd rbx, esi
cmp rcx, r13
je 0x14003b24c
cmp rcx, 0xffffffffffffffff
je 0x14003b24c
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0xb0], r13
call fcn.14005041c
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x68]
call fcn.14005041c
mov rbp, rbx
jmp 0x14003b6b5
movsx edx, bpl
xor ecx, ecx
and edx, 0x12
call fcn.1400c1174
xor eax, eax
mov rbp, rax
jmp 0x14003b6b5
cmp qword [rsp + 0x90], r8
jne 0x14003b2cd
mov rbp, 0xffffffff80070057
mov rbx, qword [rsp + 0xbf0]
lea rsi, str.__DEVI.REBOOT
mov r15d, 0x40
jmp 0x14003b5e6
mov ebp, 2
lea rcx, [rsp + 0xc08]
mov rdx, rbp
call fcn.140058200
mov rax, qword [rsp + 0xc08]
xor r13d, r13d
mov word [rax], r13w
mov r10, qword [rsp + 0x90]
lea r14d, [rbp + 0x38]
mov qword [rsp + 0x250], r10
cmp dil, 0x12
je 0x14003b314
lea eax, [rbp + 0x24]
cmp ax, word [r10]
jne 0x14003b359
mov rsi, r10
jmp 0x14003b334
cmp r14w, ax
je 0x14003b340
mov ecx, 0x3d
cmp cx, ax
je 0x14003b340
add r10, rbp
mov qword [rsp + 0x90], r10
movzx eax, word [r10]
cmp ax, r13w
jne 0x14003b319
jmp 0x14003b360
mov word [r10], r13w
mov r10, qword [rsp + 0x90]
add r10, rbp
mov qword [rsp + 0x90], r10
jmp 0x14003b360
lea rsi, str.__DEVI.REBOOT
mov r12b, byte [rsp + 0x4f]
mov ebx, 1
lea r15d, [rbx + 0x3f]
jmp 0x14003b375
mov ebp, 2
mov r8d, 0x22
cmp r8w, word [r10]
je 0x14003b39c
lea edx, [r8 + 5]
cmp dx, word [r10]
je 0x14003b39c
lea rax, [0x1400f04f4]
mov qword [rsp + 0x90], rax
jmp 0x14003b3ec
movsx eax, byte [r10]
lea rcx, [rsp + 0x90]
add r10, 2
movzx edx, ax
mov qword [rsp + 0x90], r10
call fcn.1400cfd44
mov rcx, qword [rsp + 0x90]
cmp word [rcx], r13w
je 0x14003b3d6
mov word [rcx], r13w
add qword [rsp + 0x90], rbp
lea rcx, [rsp + 0x90]
call fcn.140014d78
mov edx, 0x27
lea r8d, [rdx - 5]
movzx eax, word [r10]
mov ecx, 0x68
mov r9d, r13d
or ax, 0x20
cmp cx, ax
jne 0x14003b410
cmp r14w, word [r10 + 2]
jne 0x14003b410
mov r9d, 0x200
jmp 0x14003b450
mov ecx, 0x63
cmp cx, ax
jne 0x14003b429
cmp r14w, word [r10 + 2]
jne 0x14003b429
mov r9d, 0x400
jmp 0x14003b450
mov eax, 0x2b
cmp ax, word [r10]
jne 0x14003b443
cmp r14w, word [r10 + 2]
jne 0x14003b443
mov r9d, 0x600
jmp 0x14003b450
cmp r15w, word [r10]
jne 0x14003b454
cmp r14w, word [r10 + 2]
jne 0x14003b454
add r10, 4
cmp r8w, word [r10]
je 0x14003b460
cmp dx, word [r10]
jne 0x14003b497
movsx edx, byte [r10]
lea rcx, [rsp + 0xc00]
add r10, rbp
mov qword [rsp + 0xc00], r10
call fcn.1400cfd44
mov rcx, qword [rsp + 0xc00]
mov edx, 0x27
lea r8d, [rdx - 5]
cmp word [rcx], r13w
je 0x14003b497
mov word [rcx], r13w
cmp dil, 0x11
jne 0x14003b554
mov rax, r10
mov r11, r13
mov qword [rsp + 0xc00], rax
cmp r8w, word [r10]
je 0x14003b4bb
cmp dx, word [r10]
jne 0x14003b505
movsx edx, byte [r10]
lea rcx, [rsp + 0xc00]
add r10, 2
mov qword [rsp + 0xc00], r10
call fcn.1400cfd44
mov rcx, qword [rsp + 0xc00]
cmp word [rcx], r13w
je 0x14003b527
mov word [rcx], r13w
mov rax, qword [rsp + 0xc00]
jmp 0x14003b4fa
cmp r14w, cx
je 0x14003b510
add rax, rbp
mov qword [rsp + 0xc00], rax
movzx ecx, word [rax]
cmp cx, r13w
jne 0x14003b4f4
jmp 0x14003b527
mov word [rax], r13w
mov r11, qword [rsp + 0xc00]
add r11, rbp
mov qword [rsp + 0xc00], r11
lea rax, [rsp + 0x19a]
lea rcx, [rsp + 0x140]
mov r9d, ebx
mov qword [rsp + 0x28], rax
mov r8, r11
mov rdx, r10
mov dword [rsp + 0x20], 0xfffffff0
call fcn.14002dac0
jmp 0x14003b591
mov al, r12b
mov r8d, 0x100
mov rdx, r10
neg al
movsx eax, dil
sbb ecx, ecx
and ecx, 0x10000
or ecx, eax
lea rax, [rsp + 0x19a]
or ecx, r9d
lea r9, [rsp + 0xc08]
mov qword [rsp + 0x20], rax
bts ecx, 0xb
call fcn.140064d64
mov r10, qword [rsp + 0x90]
movsxd rbp, eax
cmp word [r10], r13w
jne 0x14003b370
mov rbx, qword [rsp + 0x250]
cmp dil, 0x12
jne 0x14003b5d1
mov r8, qword [rsp + 0xc08]
mov rdx, rbx
mov rbx, qword [rsp + 0xbf0]
mov rcx, rbx
call fcn.140057738
jmp 0x14003b5d9
mov rbx, qword [rsp + 0xbf0]
lea rcx, [rsp + 0xc08]
call fcn.14005041c
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x2d8]
call fcn.1400172f0
lea rax, [rsp + 0x19a]
cmp word [rax], r15w
je 0x14003b61e
movzx edx, word [rax]
lea r9, str.0x_X
mov r8, rsi
mov rcx, rbx
call fcn.14005b180
xor edx, edx
mov rcx, rbx
call fcn.1400864e0
jmp 0x14003b6b5
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0xc08]
xor edx, edx
mov r8d, 0x1e5
mov qword [rsp + 0xc08], rax
call fcn.1400241d4
mov rbx, qword [rsp + 0xc08]
mov qword [rsp + 0x40], rax
xor eax, eax
cmp word [rbx], ax
jne 0x14003b66c
mov rbp, 0xffffffff80070057
jmp 0x14003b6b5
lea rdx, str.35:INDATABuildInfCache
lea rcx, [rsp + 0xc00]
call fcn.140062680
lea rcx, [rsp + 0xc00]
mov rdx, rbx
call fcn.1400582c8
mov rdx, qword [rsp + 0xc00]
mov rcx, qword [rsp + 0xbf0]
call fcn.140043954
lea rcx, [rsp + 0xc00]
mov rbp, rax
call fcn.14005041c
lea rcx, [rsp + 0x1c0]
call fcn.14005041c
lea rcx, [rsp + 0x70]
call fcn.14005041c
lea rcx, [rsp + 0x218]
call fcn.14005041c
lea rcx, [rsp + 0x208]
call fcn.14005041c
lea rcx, [rsp + 0x260]
call fcn.14005041c
lea rcx, [rsp + 0x1f0]
call fcn.14005041c
lea rcx, [rsp + 0x210]
call fcn.14005041c
mov rax, rbp
add rsp, 0xba8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret