Function at 0x140002b39
Capabilities:
Check if file exists
Get disk information
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x718
lea rsi, str.USBSTOR
xor r11d, r11d
xor r9d, r9d
movabs rax, 0x525c4946455c3a3f
xor r8d, r8d
movabs rdx, 0x66746e5c73756675
mov qword [rsp + 0x106], rax
lea rdi, [rsp + 0x2b8]
movabs rax, 0x5f7366746e5c7375
lea r14, [rsp + 0x198]
mov qword [rsp + 0x10e], rdx
movabs rdx, 0x6966652e343678
mov dword [rsp + 0x760], ecx
mov ecx, 0x10
rep movsd dword [rdi], dword [rsi]
mov qword [rsp + 0x110], rax
xor eax, eax
lea rdi, [rsp + 0x378]
lea rsi, str.g__b_
mov ecx, 0x22
mov qword [rsp + 0xc0], r11
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xe
lea rdi, [rsp + 0x248]
lea rsi, str._SD_
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xc
lea rdi, [rsp + 0x218]
lea rsi, str._ta_b_
rep movsd dword [rdi], dword [rsi]
mov ecx, 8
lea rdi, [rsp + 0x198]
mov qword [rsp + 0xc8], r11
rep stosd dword [rdi], eax
mov ecx, 8
lea rdi, [rsp + 0x1b8]
mov qword [rsp + 0x118], rdx
rep stosd dword [rdi], eax
mov edx, 0x14b
mov rax, qword [0x1400b4af0]
mov dword [rsp + 0xb2], 0x3a3f2820
mov word [rsp + 0xb6], 0x29
mov dword [rsp + 0xae], 0x5c3a3f
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.140002ad1
lea rax, [rsp + 0xd0]
mov edx, pe_nt_image_headers64
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.140036916
mov rcx, qword [rsp + 0x60]
mov r8d, 1
lea rdx, [0x1400855d8]
call fcn.140036956
mov ecx, 0x104
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x378]
mov qword [rsp + 0x78], rax
je 0x140004cfb
xor r8d, r8d
xor edx, edx
mov r9d, 0x12
lea rcx, [0x140086140]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov qword [rsp + 0x58], rax
inc rax
je 0x140002f92
lea rdx, [rsp + 0xc0]
mov ecx, 0x101
call fcn.140035acf
test eax, eax
jne 0x140002d1b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
jmp 0x140002f92
mov dword [rsp + 0x158], 0x20
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
xor ebp, ebp
lea rbx, [rsp + 0x158]
mov rcx, qword [rsp + 0x58]
mov edx, ebp
mov r8, rbx
call rdi
test eax, eax
je 0x140002d0b
mov rax, qword [0x1400b4fe0]
inc ebp
cmp dword [rax], 0
je 0x140002d63
mov edx, ebp
lea rcx, str.Processing_Hub__d:
call fcn.1400380b9
lea r12, [rsp + 0x178]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
mov qword [rsp + 0x20], r12
lea r8, [0x140086140]
mov dword [rsp + 0x178], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x140002d2f
xor r10d, r10d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
lea rsi, [rsp + 0x9c]
mov qword [rsp + 0x28], r10
mov r13, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov rdx, r12
mov qword [rsp + 0x20], rsi
call r13
test eax, eax
jne 0x140002d2f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x140002d2f
mov edx, dword [rsp + 0x9c]
mov ecx, 1
mov dword [rsp + 0x74], edx
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x140002d2f
xor r9d, r9d
mov dword [rax], 8
mov r8, rax
mov rdx, r12
mov qword [rsp + 0x28], r9
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x74]
call r13
test eax, eax
jne 0x140002e33
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x140002d2f
lea r13, [rsp + 0x98]
xor r8d, r8d
mov edx, dword [rsp + 0x16c]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_CM_Get_Child]
test eax, eax
jne 0x140002e26
mov byte [r15], 0
mov rcx, qword [rsp + 0x60]
lea r12, [rbx + 4]
mov r8d, 1
mov rdx, r12
call fcn.140036956
mov esi, eax
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140002e8c
mov r8, r12
mov edx, esi
lea rcx, str.__Hub__d____s
call fcn.1400380b9
test esi, esi
js 0x140002e26
xor r9d, r9d
mov ecx, dword [rsp + 0x98]
mov r8d, 0x104
mov rdx, r15
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x140002e26
mov rcx, r15
call fcn.140002000
lea rdx, [rsp + 0xc0]
mov rcx, r15
call fcn.140035bae
mov edx, eax
test eax, eax
je 0x140002ee4
mov eax, eax
movsxd rcx, esi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc0]
mov qword [rax + 0x10], rcx
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140002eff
mov r8, r15
lea rcx, str.__Found_ID__03d_:__s
call fcn.1400380b9
mov r12, qword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
xor r8d, r8d
mov edx, dword [rsp + 0x98]
mov rcx, r13
call r12
test eax, eax
jne 0x140002e26
xor r9d, r9d
mov byte [r15], 0
mov r8d, 0x104
mov rdx, r15
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x140002f06
mov rcx, r15
call fcn.140002000
lea rdx, [rsp + 0xc0]
mov rcx, r15
call fcn.140035bae
mov edx, eax
test eax, eax
je 0x140002f72
mov eax, eax
movsxd rcx, esi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc0]
mov qword [rax + 0x10], rcx
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140002f06
mov r8, r15
lea rcx, str.__Found_ID__03d_:__s
call fcn.1400380b9
jmp 0x140002f06
mov rcx, r15
mov r12, r14
xor ebp, ebp
xor r13d, r13d
call sub.msvcrt.dll_free
mov dword [rsp + 0x74], 8
mov rdi, qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_List_SizeA]
lea rsi, str.UASPSTOR
mov rax, qword [rsp + 0x68]
mov rdx, rsi
mov rbx, qword [rax + rbp*8]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
mov r8d, 0x102
mov rdx, rbx
mov rcx, r12
test eax, eax
mov eax, dword [rsp + 0x74]
cmove eax, ebp
mov dword [rsp + 0x74], eax
call rdi
test eax, eax
je 0x140002ff2
xor r8d, r8d
mov dword [r12], r8d
mov eax, dword [r12]
test eax, eax
je 0x140002fff
lea r13d, [rax + r13 - 1]
inc rbp
add r12, 4
cmp rbp, 8
jne 0x140002fb8
mov dword [rsp + 0x80], 0x11
xor esi, esi
lea rbx, [0x14008565e]
mov rax, qword [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [rax + rsi*8]
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, dword [rsp + 0x80]
cmove eax, esi
inc rsi
mov dword [rsp + 0x80], eax
cmp rsi, 0x11
jne 0x140003020
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov r12d, 1
lea rbp, [rsp + 0x1f8]
mov edx, 0x20
mov r9d, r12d
lea r8, str.IgnoreUsb_02d
mov rcx, rbp
call r15
mov rax, qword [0x1400b4c80]
mov byte [rsp + 0x217], 0
mov rdx, qword [rax]
test rdx, rdx
je 0x1400030c6
mov r8d, 1
mov rcx, rbp
xor ebx, ebx
call fcn.1400231ca
mov rsi, rax
test rax, rax
je 0x14000328a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_strtol
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_free
jmp 0x14000328a
xor eax, eax
lea rdi, [rsp + 0x60c]
mov ecx, 0x41
xor edx, edx
rep stosd dword [rdi], eax
xor ecx, ecx
mov qword [rsp + 0x400], rdx
mov dword [rsp + 0x120], ecx
mov rcx, rbp
mov qword [rsp + 0x508], rdx
mov dword [rsp + 0x280], 0xffffffff
mov dword [rsp + 0x2f8], 4
call sub.msvcrt.dll_strlen
lea rdx, [rsp + 0x60c]
mov rbx, rax
test rbx, rbx
je 0x140003196
cmp byte [rbp + rbx], 0x5c
je 0x14000312c
dec rbx
jmp 0x14000311b
mov rdi, rdx
lea ecx, [rax + 1]
mov rsi, rbp
mov qword [rsp + 0x58], rdx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov r9d, 0x20019
mov byte [rsp + rax + 0x60c], 0
lea rax, [rsp + 0x508]
mov rcx, 0xffffffff80000001
mov byte [rsp + rbx + 0x60c], 0
inc rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140003225
xor eax, eax
mov qword [rsp + 0x508], rax
jmp 0x14000325d
xor r8d, r8d
lea rax, [rsp + 0x400]
mov r9d, 0x2001d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, [0x14008566f]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400031d3
xor eax, eax
mov qword [rsp + 0x400], rax
jmp 0x14000325d
lea rax, [rsp + 0x13c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 7
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x508]
mov rcx, qword [rsp + 0x400]
lea rdx, [0x140085678]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140003187
lea rax, [rsp + 0x2f8]
lea rdx, [rbp + rbx]
xor r8d, r8d
mov rcx, qword [rsp + 0x508]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x120]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x400]
test rcx, rcx
je 0x140003270
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x508]
test rcx, rcx
je 0x140003283
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x120]
mov dword [rsp + r12*4 + 0x1d4], ebx
inc r12
cmp r12, 9
jne 0x140003062
mov eax, dword [rsp + 0x74]
mov r8d, 0x24a
lea rdx, str.dev.c
lea rcx, str._uasp_start___0____uasp_start___ARRAYSIZE_usbstor_name__
dec eax
cmp eax, 6
ja 0x1400032e0
mov eax, dword [rsp + 0x80]
dec eax
cmp eax, 0xf
jbe 0x1400032e6
mov r8d, 0x24b
lea rdx, str.dev.c
lea rcx, str._card_start___0____card_start___ARRAYSIZE_genstor_name__
call qword [sym.imp.msvcrt.dll__wassert]
test r13d, r13d
je 0x1400033ee
lea ecx, [r13 + 1]
xor r12d, r12d
xor r13d, r13d
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
je 0x140003316
mov rbp, qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ListA]
mov rdi, qword [0x1400b4fe0]
jmp 0x140003356
lea rcx, str.Could_not_allocate_Device_ID_list
call fcn.1400380b9
jmp 0x140004cfb
mov rax, qword [rsp + 0x68]
mov ebx, r12d
mov r9d, 0x102
add rbx, r15
mov rsi, qword [rax + r13*2]
mov rdx, rbx
mov rcx, rsi
call rbp
test eax, eax
je 0x14000336b
add r13, 4
cmp r13, 0x20
je 0x1400033f1
mov r8d, dword [r13 + r14]
mov dword [rsp + r13 + 0x1b8], r12d
cmp r8d, 1
jbe 0x140003348
jmp 0x140003327
cmp dword [rdi], 0
jne 0x140003382
add r12d, dword [r14 + r13]
mov edx, r12d
lea r8d, [r12 - 2]
lea rax, [r15 + rdx]
jmp 0x1400033cf
mov rdx, rsi
lea rcx, str.Processing_IDs_belonging_to__s:
lea rsi, str.___s
call fcn.1400380b9
cmp byte [rbx], 0
je 0x140003370
mov rdx, rbx
mov rcx, rsi
call fcn.1400380b9
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rbx, [rbx + rax + 1]
jmp 0x140003398
mov r9, rax
lea ecx, [r12 - 1]
sub r9, rdx
cmp byte [r9 + r8], 0
jne 0x1400033da
dec rax
mov r12d, ecx
cmp r12d, 2
ja 0x1400033b7
jmp 0x140003348
mov r9d, ecx
cmp byte [r15 + r9], 0
jne 0x1400033c9
cmp byte [rax], 0
jne 0x1400033c9
jmp 0x140003348
xor r15d, r15d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1400b42e0]
mov r9d, 0x12
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov qword [rsp + 0x58], rax
inc rax
jne 0x14000342c
call fcn.140038579
lea rcx, str.SetupDiGetClassDevs__Interface__failed:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x140004cfb
mov dword [rsp + 0x158], 0x20
xor eax, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x84], eax
lea rax, [rsp + 0x158]
mov edx, dword [rsp + 0x84]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov r8, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140004b3e
lea rbx, [rsp + 0x400]
xor eax, eax
mov ecx, 0x41
xor r12d, r12d
lea rdx, [rsp + 0x13c]
mov rdi, rbx
lea rbp, [rsp + 0x9c]
mov r8d, 0x16
rep stosd dword [rdi], eax
mov rdi, rdx
mov ecx, 7
mov rdx, qword [rsp + 0x68]
rep stosd dword [rdi], eax
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], 0x104
lea rdi, str.USBSTOR
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov rsi, qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x1400034fe
call fcn.140038579
lea rcx, str.SetupDiGetDeviceRegistryProperty__Enumerator_Name__failed:__s
mov rdx, rax
jmp 0x1400042cb
inc r12d
cmp r12d, 8
je 0x140003528
mov rdx, rdi
mov rcx, rbx
call rsi
test eax, eax
jne 0x1400034f5
mov byte [rsp + 0x150], 1
test r12d, r12d
je 0x140003528
mov eax, dword [rsp + 0x74]
cmp r12d, eax
jae 0x140003528
mov byte [rsp + 0x152], 1
xor r12d, r12d
lea rdi, [0x140085377]
mov rdx, qword [rsp + r12*8 + 0x378]
mov rcx, rbx
test rdx, rdx
cmove rdx, rdi
call rsi
test eax, eax
jne 0x140003568
mov eax, dword [rsp + 0x80]
mov byte [rsp + 0x151], 1
cmp r12d, eax
jb 0x140003571
mov byte [rsp + 0x152], 1
jmp 0x140003571
inc r12
cmp r12, 0x11
jne 0x140003532
mov rsi, qword [0x1400b4fe0]
cmp dword [rsi], 0
je 0x14000358c
mov rdx, rbx
lea rcx, str.Processing__s_device:
call fcn.1400380b9
cmp word [rsp + 0x150], 0
jne 0x1400035b4
cmp dword [rsi], 0
je 0x1400035a8
lea rcx, str.__Unsupported_or_disabled_by_policy
call fcn.1400380b9
inc dword [rsp + 0x84]
jmp 0x140003444
xor eax, eax
mov ecx, 0x41
mov rdi, rbx
mov rdx, qword [rsp + 0x68]
rep stosd dword [rdi], eax
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], 0x104
mov r8d, 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x14000367b
lea rax, str.Arsenal_________Virtual_
lea rsi, [0x140085377]
mov qword [rsp + 0x280], rax
lea rax, str.KernSafeVirtual_________
mov qword [rsp + 0x288], rax
lea rax, str.Msft____Virtual_Disk____
mov qword [rsp + 0x290], rax
lea rax, str.VMware__VMware_Virtual_S
mov qword [rsp + 0x298], rax
mov rax, qword [0x1400b4990]
cmp dword [rax], 1
sbb r12d, r12d
xor edi, edi
add r12d, 4
cmp r12d, edi
jle 0x140003679
mov rdx, qword [rsp + rdi*8 + 0x280]
mov rcx, rbx
test rdx, rdx
cmove rdx, rsi
inc rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x14000364e
mov eax, 1
jmp 0x14000367b
xor eax, eax
cmp byte [rsp + 0x152], 0
mov byte [rsp + 0x154], al
jne 0x140003782
mov r8d, 7
lea rdx, str.SCSIDisk
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
jne 0x140003782
lea rax, [rsp + 0xe6]
xor r13d, r13d
mov r14d, 0xf
mov qword [rsp + 0x78], rax
mov r12, qword [rsp + r13*8 + 0x248]
mov ecx, 1
test r12, r12
je 0x1400036ee
mov rcx, r12
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
mov eax, 0x10
cmp rcx, rax
cmova rcx, rax
mov rdi, qword [rsp + 0x78]
mov ecx, ecx
mov rsi, r12
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rcx, rbx
lea rdx, [rax + 1]
cmp rdx, 0x10
mov rdx, qword [rsp + 0x78]
cmovae rax, r14
mov byte [rsp + rax + 0xe6], 0
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140003732
mov byte [rsp + 0x152], 1
jmp 0x140003782
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_strlen
cmp rax, 1
ja 0x14000375b
mov r8d, 0x2a2
lea rdx, str.dev.c
lea rcx, str.strlen_scsi_card_name_copy____1
jmp 0x1400032e0
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
mov byte [rsp + rax + 0xe5], 0x26
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x140003728
inc r13
cmp r13, 7
jne 0x1400036c4
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x14000379d
mov rdx, rbx
lea rcx, str.__Hardware_ID:__s
call fcn.1400380b9
mov qword [rsp + 0x20], rbp
mov rdx, qword [rsp + 0x68]
lea rsi, [rsp + 0x60c]
mov r9d, 0x104
mov rcx, qword [rsp + 0x58]
mov r8, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
test eax, eax
jne 0x1400037ea
call fcn.140038579
lea rcx, str.SetupDiGetDeviceInstanceId_failed:__s
mov rdx, rax
call fcn.1400380b9
lea rdx, str._N_A_
mov rcx, rsi
call sub.msvcrt.dll_strcpy
xor eax, eax
mov ecx, 0x41
mov rdi, rbx
mov rdx, qword [rsp + 0x68]
rep stosd dword [rdi], eax
lea rsi, [rsp + 0xa0]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8d, 0x1f
mov dword [rsp + 0x28], 0x104
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x140003840
mov eax, dword [rsp + 0x400]
sub eax, 2
cmp eax, 1
setbe al
movzx eax, al
mov byte [rsp + 0x155], al
mov rdi, rbx
xor eax, eax
mov r9, rbx
mov ecx, 0x41
mov rdx, qword [rsp + 0x68]
mov r8, rsi
rep stosd dword [rdi], eax
mov qword [rsp + 0x20], rbp
mov rcx, qword [rsp + 0x58]
call fcn.140002124
test eax, eax
jne 0x140003961
call fcn.140038579
lea rcx, str.SetupDiGetDeviceRegistryProperty__Friendly_Name__failed:__s
mov rdx, rax
call fcn.1400380b9
mov ecx, 0xbe5
call fcn.14001e311
test rax, rax
jne 0x1400038c4
mov ecx, 0xbe5
mov ebx, 1
call fcn.14001e311
test rax, rax
je 0x1400038e6
mov ecx, 0xbe5
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
jmp 0x1400038e6
mov ecx, 0xbe5
mov ebx, 0x104
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
inc rax
cmp rax, 0x103
jbe 0x140003898
mov ecx, 0xbe5
call fcn.14001e311
mov rcx, rbx
mov rsi, rax
lea rax, [rsp + 0x400]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov ecx, 0xbe5
call fcn.14001e311
test rax, rax
jne 0x140003935
mov ecx, 0xbe5
call fcn.14001e311
test rax, rax
je 0x140003957
mov ecx, 0xbe5
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
jmp 0x140003957
mov ecx, 0xbe5
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
inc rax
cmp rax, 0x103
jbe 0x140003912
mov eax, 0x103
mov byte [rsp + rax + 0x400], 0
jmp 0x140003974
cmp byte [rsp + 0x154], 0
jne 0x140003974
test r15, r15
jne 0x140003a81
xor r14d, r14d
jmp 0x140003a75
cmp r13, rax
jae 0x1400039a8
mov al, byte [rbx + r13]
inc edi
cmp al, 0x5c
je 0x140003c1d
test ebp, ebp
jne 0x140003be2
mov rcx, rbx
mov r13d, edi
call sub.msvcrt.dll_strlen
cmp r12d, 2
jne 0x14000397c
cmp dword [rsp + 0x13c], 0
lea rax, [0x1400855d8]
lea r12, str._ID_
cmove r12, rax
mov eax, esi
imul rax, rax, 0x18
add rax, qword [rsp + 0xc0]
cmp qword [rax + 0x10], 0
je 0x140003c32
imul rsi, rsi, 0x18
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + rsi + 0x10]
test rdx, rdx
je 0x140003f6d
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140003a19
mov rax, qword [rsp + 0xd0]
lea rcx, str.__Matched_with_Hub__d_:__s
mov r8, qword [rax + rdx*8]
call fcn.1400380b9
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + rsi + 0x10]
mov rax, qword [rsp + 0xd0]
mov rdi, qword [rax + rdx*8]
test rdi, rdi
jne 0x140003cc1
or rbp, 0xffffffffffffffff
xor edi, edi
lea rax, [rbp - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140003a54
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test edi, edi
je 0x140003f6d
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + rsi + 0x10]
mov rax, qword [rsp + 0xd0]
mov r14, qword [rax + rdx*8]
lea r12, [0x1400855d8]
jmp 0x140003f70
mov r13, qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
mov r12, qword [sym.imp.SETUPAPI.dll_CM_Get_Child]
mov rbx, r15
mov rbp, qword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
cmp byte [rbx], 0
je 0x140003974
xor r8d, r8d
lea rcx, [rsp + 0x90]
mov rdx, rbx
call r13
test eax, eax
je 0x140003ad3
mov rax, qword [0x1400b4fe0]
mov rdx, rbx
lea rcx, str.Could_not_locate_device_node_for__s
cmp dword [rax], 0
je 0x140003f5b
jmp 0x140003b0b
lea rsi, [rsp + 0x98]
mov edx, dword [rsp + 0x90]
xor r8d, r8d
mov rcx, rsi
call r12
mov edi, eax
test eax, eax
je 0x140003b15
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140003f5b
mov rdx, rbx
lea rcx, str.Could_not_get_children_of__s
call fcn.1400380b9
jmp 0x140003f5b
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x16c], eax
jne 0x140003b8b
mov eax, dword [rsp + 0x74]
lea rdx, [rbx + 2]
mov rcx, rbx
mov eax, dword [rsp + rax*4 + 0x1b8]
add rax, r15
cmp rdx, rax
setae byte [rsp + 0x153]
call fcn.140002000
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.140035bae
mov esi, eax
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140003bd8
mov r8, rbx
mov edx, esi
lea rcx, str.__Matched_with_ID__03d_:__s
call fcn.1400380b9
jmp 0x140003bd8
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x16c], eax
je 0x140003ba0
xor r8d, r8d
mov edx, dword [rsp + 0x98]
mov rcx, rsi
call rbp
test eax, eax
je 0x140003b7b
jmp 0x140003bbf
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140003b25
mov rdx, rbx
lea rcx, str.NOTE:_Matched_instance_from_sibling_for__s
call fcn.1400380b9
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x16c], eax
jne 0x140003f5b
jmp 0x140003b25
xor r12d, r12d
xor ebp, ebp
jmp 0x140003997
cmp al, 0x5f
jne 0x140003997
mov ecx, edi
mov r8d, 0x10
xor edx, edx
add rcx, rbx
call sub.msvcrt.dll_strtoul
movzx eax, ax
mov dword [rsp + 0x140], eax
test r12d, r12d
jne 0x140003c27
mov dword [rsp + 0x13c], eax
mov r12d, 1
jmp 0x140003997
mov ebp, 1
jmp 0x140003997
mov r12d, 2
jmp 0x140003997
xor r8d, r8d
mov edx, dword [rsp + 0x90]
lea rcx, [rsp + 0x94]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
test eax, eax
jne 0x1400039db
xor r9d, r9d
lea rdi, [rsp + 0x508]
mov ecx, dword [rsp + 0x94]
mov r8d, 0x104
mov rdx, rdi
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x1400039db
mov rcx, rdi
call fcn.140002000
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.140035bae
mov esi, eax
mov rax, qword [0x1400b4fe0]
cmp dword [rax], 0
je 0x140003cb2
mov r8, rdi
mov edx, esi
lea rcx, str.__Matched_with__GP__ID__03d_:__s
call fcn.1400380b9
lea r12, str._GP_
mov rbx, rdi
jmp 0x1400039db
xor r8d, r8d
lea rcx, [rsp + 0xa8]
mov rdx, rbx
call qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
mov r8d, eax
test eax, eax
je 0x140003cf0
mov rdx, rbx
lea rcx, str.Could_not_get_device_instance_handle_for__s:_CR_error__d
call fcn.1400380b9
jmp 0x140003a3b
xor r13d, r13d
xor r14d, r14d
mov ecx, dword [rsp + 0xa8]
xor r8d, r8d
mov dword [rsp + 0x14c], r13d
lea r13, [rsp + 0xa4]
mov edx, 0x1d
lea r9, [rsp + 0x14c]
mov dword [rsp + 0xa4], 4
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Registry_PropertyA]
mov rdx, rbx
lea rcx, str.Could_not_get_port_for__s:_CR_error__d
mov r8d, eax
test eax, eax
jne 0x140003ce6
xor ebp, ebp
mov dword [rsp + 0x28], 0x40000000
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov r8d, 2
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140003d9c
call fcn.140038579
mov rdx, rdi
lea rcx, str.Could_not_open_hub__s:__s
mov r8, rax
call fcn.1400380b9
jmp 0x140003a3b
xor eax, eax
mov ecx, 0x1f
xor r11d, r11d
mov r9d, 0x23
lea rdx, [rsp + 0x284]
lea r8, [rsp + 0x280]
mov dword [rsp + 0xa4], 0x23
mov rdi, rdx
mov edx, 0x220448
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x14c]
mov qword [rsp + 0x38], r11
mov rcx, rbp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x280], eax
mov dword [rsp + 0x28], 0x23
mov qword [rsp + 0x20], r8
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov edi, eax
test eax, eax
jne 0x140003e1c
call fcn.140038579
mov rdx, rbx
lea rcx, str.Could_not_get_node_connection_information_for__s:__s
mov r8, rax
jmp 0x140003ef6
movzx edx, word [rsp + 0x28c]
movzx eax, word [rsp + 0x28e]
xor edi, edi
mov ecx, edx
or cx, ax
je 0x140003e59
mov dword [rsp + 0x140], eax
movzx eax, byte [rsp + 0x297]
mov edi, 1
mov dword [rsp + 0x13c], edx
inc eax
mov dword [rsp + 0x144], eax
mov eax, dword [rsp + 0x14c]
xor r9d, r9d
xor r10d, r10d
mov rcx, rbp
mov edx, 0x40000001
mov qword [rsp + 0x38], r10
lea r8, [rsp + 0xf6]
mov dword [rsp + 0xf6], eax
mov eax, 0xfffffffb
shl rdx, 4
mov qword [rsp + 0xfe], r9
shl rax, 0x20
and rax, qword [rsp + 0xfa]
mov r9d, 0x10
or rax, rdx
mov qword [rsp + 0x20], r8
mov edx, 0x22045c
mov qword [rsp + 0xfa], rax
lea rax, [rsp + 0xa4]
mov dword [rsp + 0xa4], 0x10
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x140003f00
call fcn.140038579
mov rdx, rbx
lea rcx, str.Could_not_get_node_connection_information__V2__for_device__s:__s
mov r8, rax
call fcn.1400380b9
jmp 0x140003a41
mov al, byte [rsp + 0x102]
test al, 4
je 0x140003f1b
mov dword [rsp + 0x144], 5
jmp 0x140003a41
test al, 1
je 0x140003f2f
mov dword [rsp + 0x144], 4
jmp 0x140003a41
test al, 8
je 0x140003f43
mov dword [rsp + 0x148], 2
jmp 0x140003a41
test al, 2
je 0x140003a41
mov dword [rsp + 0x148], 1
jmp 0x140003a41
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rbx, [rbx + rax + 1]
jmp 0x140003a99
xor r14d, r14d
cmp byte [rsp + 0x153], 0
je 0x140003ff5
lea rcx, [rsp + 0x400]
mov byte [rsp + 0x290], 0
movabs rax, 0x7369442049534353
movabs rdx, 0x656369766544206b
mov qword [rsp + 0x280], rax
movabs rax, 0x6976654420534155
mov qword [rsp + 0x288], rdx
lea rdx, [rsp + 0x280]
mov qword [rsp + 0xf6], rax
mov dword [rsp + 0xfd], 0x656369
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140003ff5
cmp byte [rax + 0x11], 0
jne 0x140003ff5
mov rdx, qword [rsp + 0xf6]
mov qword [rax], rdx
mov dword [rax + 7], 0x656369
cmp byte [rsp + 0x154], 0
lea rdx, [rsp + 0x400]
lea rcx, str.Found_VHD_device__s
jne 0x140004041
cmp byte [rsp + 0x152], 0
je 0x14000404b
cmp byte [rsp + 0x150], 0
je 0x140004032
mov eax, dword [rsp + 0x13c]
or eax, dword [rsp + 0x140]
jne 0x14000404b
lea rdx, [rsp + 0x400]
lea rcx, str.Found_card_reader_device__s
call fcn.1400380b9
jmp 0x140004255
test dword [rsp + 0x150], 0xff0000ff
jne 0x1400040a7
cmp byte [rsp + 0x155], 0
je 0x1400040a7
mov rax, qword [0x1400b4cf0]
lea rdx, [rsp + 0x400]
cmp dword [rax], 0
jne 0x14000409e
lea rcx, str.Found_non_USB_removable_device__s___Eliminated
call fcn.1400380b9
mov rax, qword [0x1400b4fe0]
lea rcx, str.If_you_REALLY_need__you_can_enable_listing_of_this_device_with__Ctrl__Alt__F_
cmp dword [rax], 0
je 0x1400035a8
jmp 0x1400035a3
lea rcx, str.Found_non_USB_removable_device__s
jmp 0x140004041
mov r9d, dword [rsp + 0x13c]
mov eax, dword [rsp + 0x140]
mov edi, r9d
or edi, eax
jne 0x14000410c
cmp byte [rsp + 0x150], 0
jne 0x1400040eb
mov rax, qword [0x1400b4fe0]
lea rdx, [rsp + 0x400]
lea rcx, str.Found_non_USB_non_removable_device__s___Eliminated
cmp dword [rax], 0
je 0x1400035a8
jmp 0x1400042cb
movabs rax, 0x3f3f3f3a3f3f3f3f
mov word [rsp + 0x510], 0x3f
mov qword [rsp + 0x508], rax
jmp 0x1400041c7
mov edx, 0x104
lea rbx, [rsp + 0x508]
mov dword [rsp + 0x20], eax
lea r8, str._04X:_04X
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__snprintf]
mov rax, qword [0x1400b4cd0]
mov byte [rsp + 0x60b], 0
mov edx, dword [rsp + 0x13c]
mov ecx, dword [rsp + 0x140]
cmp dword [rax], 0
je 0x140004183
cmp edx, 0x525
jne 0x14000415f
cmp ecx, 0x622b
jmp 0x14000417d
cmp edx, 0x781
jne 0x14000416f
cmp ecx, 0x75a0
jmp 0x14000417d
cmp edx, 0x10d6
jne 0x140004183
cmp ecx, 0x1101
je 0x1400035a8
xor eax, eax
mov r8d, dword [rsp + rax*4 + 0x1d8]
mov r9d, r8d
shr r9d, 0x10
cmp edx, r9d
jne 0x1400041be
movzx r8d, r8w
cmp ecx, r8d
jne 0x1400041be
lea rdx, [rsp + 0x400]
mov r8, rbx
lea rcx, str.Ignoring__s___s___per_user_settings
call fcn.1400380b9
jmp 0x1400035a8
inc rax
cmp rax, 8
jne 0x140004185
cmp dword [rsp + 0x144], 5
jbe 0x1400041dc
xor r8d, r8d
mov dword [rsp + 0x144], r8d
cmp byte [rsp + 0x153], 0
lea rdx, [0x1400855d8]
lea rcx, str.UAS__
mov eax, dword [rsp + 0x144]
lea r9, [0x1400855e3]
mov qword [rsp + 0x30], r12
cmove r9, rdx
cmovne rdx, rcx
lea rcx, [rsp + 0x508]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x400]
mov qword [rsp + 0x20], rcx
mov r8, qword [rsp + rax*8 + 0x218]
lea rcx, str.Found__s_s_s_device__s___s___s
call fcn.1400380b9
mov edx, dword [rsp + 0x148]
test edx, edx
je 0x140004255
add edx, 0x2f
lea rcx, str.NOTE:_This_device_is_a_USB_3._c_device_operating_at_lower_speed...
call fcn.1400380b9
mov rax, qword [0x1400b42e0]
mov r13, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
xor r12d, r12d
xor ebx, ebx
mov dword [rsp + 0x178], 0x20
mov qword [rsp + 0x88], rax
mov rcx, rbx
lea rsi, [rsp + 0x178]
call sub.msvcrt.dll_free
mov qword [rsp + 0x20], rsi
mov r9d, r12d
mov r8, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x158]
call r13
test eax, eax
jne 0x1400042e1
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x103
je 0x1400042d5
call fcn.140038579
lea rcx, str.SetupDiEnumDeviceInterfaces_failed:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x1400035a8
lea rcx, str.A_device_was_eliminated_because_it_didnt_report_itself_as_a_disk
jmp 0x1400035a3
xor ecx, ecx
lea rdi, [rsp + 0x9c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov ebp, eax
test eax, eax
jne 0x1400043a2
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x140004387
mov edx, dword [rsp + 0x9c]
mov ecx, 1
mov dword [rsp + 0x68], edx
call sub.msvcrt.dll_calloc
mov r9d, dword [rsp + 0x68]
lea rcx, str.Unable_to_allocate_data_for_SP_DEVICE_INTERFACE_DETAIL_DATA
test rax, rax
mov rbx, rax
je 0x1400043a9
xor edx, edx
mov dword [rax], 8
mov rcx, qword [rsp + 0x58]
mov r8, rax
mov qword [rsp + 0x28], rdx
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
jne 0x1400043b0
call fcn.140038579
lea rcx, str.SetupDiGetDeviceInterfaceDetail__actual__failed:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x140004b36
call fcn.140038579
lea rcx, str.SetupDiGetDeviceInterfaceDetail__dummy__failed:__s
mov rdx, rax
call fcn.1400380b9
xor ebx, ebx
jmp 0x140004b36
lea rcx, str.SetupDiGetDeviceInterfaceDetail__dummy____no_data_was_allocated
call fcn.1400380b9
jmp 0x14000439b
xor eax, eax
lea rsi, [rbx + 4]
xor r9d, r9d
mov r8d, 3
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x140004407
call fcn.140038579
mov rdx, rsi
lea rcx, [0x140085cde]
mov r8, rax
call fcn.1400380b9
jmp 0x140004b36
mov rdx, rsi
mov qword [rsp + 0x68], rax
call fcn.1400090f4
mov rcx, qword [rsp + 0x68]
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test edi, edi
js 0x140004b36
lea eax, [rdi + 0x80]
mov ecx, eax
mov dword [rsp + 0x78], eax
call fcn.140009cf4
test eax, eax
jne 0x14000444a
lea rcx, str.Device_eliminated_because_it_appears_to_contain_no_media
jmp 0x14000460b
mov ecx, dword [rsp + 0x78]
call fcn.140009c68
mov qword [rsp + 0x68], rax
cmp rax, 0x7fffff
ja 0x140004476
mov edx, 8
lea rcx, str.Device_eliminated_because_it_is_smaller_than__d_MB
call fcn.1400380b9
jmp 0x1400049da
lea rsi, [rsp + 0x120]
mov ecx, dword [rsp + 0x78]
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov rdx, rsi
call fcn.1400098de
test eax, eax
je 0x140004b36
cmp byte [rsp + 0x151], 0
je 0x14000450e
mov al, byte [rsp + 0x153]
or al, byte [rsp + 0x154]
jne 0x14000450e
cmp byte [rsp + 0x155], 0
je 0x1400049da
mov rax, qword [0x1400b4cf0]
cmp dword [rax], 0
jne 0x14000450e
mov r13, qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
lea r12, [rsp + 0xae]
mov al, byte [rsi]
test al, al
je 0x1400044f8
mov byte [rsp + 0xae], al
mov rcx, r12
call r13
cmp eax, 2
je 0x140004509
cmp byte [rsi], 0
je 0x14000450e
lea rcx, str.Device_eliminated_because_it_contains_a_mounted_partition_that_is_set_as_non_removable
jmp 0x14000460b
inc rsi
jmp 0x1400044e0
mov rsi, qword [0x1400b4910]
cmp dword [rsi], 0
jne 0x1400045ca
mov al, byte [rsp + 0x154]
or al, byte [rsp + 0x152]
je 0x14000456c
cmp byte [rsp + 0x152], 0
je 0x1400045ca
mov eax, 0x19
mov rsi, qword [rsp + 0x68]
shl rax, 0x21
cmp rax, rsi
jae 0x1400045ca
lea rcx, str.Device_eliminated_because_it_was_detected_as_a_card_larger_than__d_GB
mov edx, 0xc8
call fcn.1400380b9
lea rcx, str.To_use_such_a_card__check_List_USB_Hard_Drives_under_advanced_drive_properties
jmp 0x14000460b
movzx edx, word [rsp + 0x13c]
mov ecx, dword [rsp + 0x78]
lea r9, [rsp + 0x400]
movzx r8d, word [rsp + 0x140]
call fcn.140034fc0
mov edx, eax
test eax, eax
jle 0x1400045c1
lea rcx, str.Device_eliminated_because_it_was_detected_as_a_Hard_Drive__score__d___0_
call fcn.1400380b9
mov rax, qword [0x1400b4cf0]
cmp dword [rax], 0
jne 0x1400045b8
lea rcx, str.If_this_device_is_not_a_Hard_Drive__please_e_mail_the_author_of_this_application
call fcn.1400380b9
lea rcx, str.NOTE:_You_can_enable_the_listing_of_Hard_Drives_under_advanced_drive_properties
jmp 0x14000460b
cmp dword [rsi], 0
je 0x14000452e
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x1400045ee
lea rdx, str.PortableBaseLayer
call sub.msvcrt.dll_strcmp
lea rcx, str.Device_eliminated_because_it_is_a_Windows_Sandbox_VHD
test eax, eax
je 0x14000460b
cmp byte [rsp + 0x154], 0
je 0x140004615
mov rax, qword [0x1400b4920]
cmp dword [rax], 0
jne 0x140004615
lea rcx, str.Device_eliminated_because_listing_of_VHDs_is_disabled__Alt_G_
call fcn.1400380b9
jmp 0x1400049da
cmp byte [rsp + 0x120], 0
jne 0x140004655
mov rax, qword [0x1400b4ff0]
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r8d, dword [rax]
call fcn.1400389a1
mov rdx, qword [rsp + 0xb8]
mov r8d, edi
mov ecx, 0xbe6
mov r9, rax
call fcn.14001e311
mov r12, rax
jmp 0x140004a62
mov rdi, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor r12d, r12d
lea rsi, [rsp + 0x106]
mov eax, r12d
mov al, byte [rsp + rax + 0x120]
test al, al
je 0x1400046b2
mov byte [rsp + 0x106], al
mov rcx, rsi
call rdi
test eax, eax
je 0x1400046ad
mov eax, r12d
mov edx, eax
cmp byte [rsp + rdx + 0x120], 0
je 0x1400046aa
lea ecx, [rax + 1]
mov rax, rcx
mov cl, byte [rsp + rcx + 0x120]
mov byte [rsp + rdx + 0x120], cl
jmp 0x140004688
dec r12d
inc r12d
jmp 0x140004667
cmp byte [rsp + 0x120], 0
je 0x1400046d5
cmp byte [rsp + 0x121], 0
je 0x1400046d5
mov ecx, 0xbe7
call fcn.14001e311
test rax, rax
jmp 0x1400046de
cmp qword [rsp + 0xb8], 0
sete al
mov dl, byte [rsp + 0x120]
test al, al
jne 0x140004725
test dl, dl
je 0x140004709
cmp byte [rsp + 0x121], 0
je 0x140004709
mov ecx, 0xbe7
call fcn.14001e311
mov rcx, rax
jmp 0x140004711
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
mov r12d, pe_nt_image_headers64
inc rax
cmp rax, 0x7f
ja 0x140004792
cmp byte [rsp + 0x120], 0
je 0x140004748
cmp byte [rsp + 0x121], 0
je 0x140004748
mov ecx, 0xbe7
call fcn.14001e311
test rax, rax
jmp 0x140004751
cmp qword [rsp + 0xb8], 0
sete al
mov r12d, 1
test al, al
jne 0x140004792
cmp byte [rsp + 0x120], 0
je 0x140004781
cmp byte [rsp + 0x121], 0
je 0x140004781
mov ecx, 0xbe7
call fcn.14001e311
mov rcx, rax
jmp 0x140004789
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
lea r12, [rax + 1]
cmp byte [rsp + 0x120], 0
je 0x1400047b5
cmp byte [rsp + 0x121], 0
je 0x1400047b5
mov ecx, 0xbe7
call fcn.14001e311
mov rsi, rax
jmp 0x1400047bd
mov rsi, qword [rsp + 0xb8]
lea rax, [rsp + 0x2f8]
cmp byte [rsp + 0x120], 0
mov rcx, r12
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
je 0x1400047f0
cmp byte [rsp + 0x121], 0
je 0x1400047f0
mov ecx, 0xbe7
call fcn.14001e311
test rax, rax
jmp 0x1400047f9
cmp qword [rsp + 0xb8], 0
sete al
mov dl, byte [rsp + 0x120]
test al, al
jne 0x140004840
test dl, dl
je 0x140004824
cmp byte [rsp + 0x121], 0
je 0x140004824
mov ecx, 0xbe7
call fcn.14001e311
mov rcx, rax
jmp 0x14000482c
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
lea rdx, [rax + 1]
mov eax, 0x7f
cmp rdx, 0x7f
ja 0x1400048a7
cmp byte [rsp + 0x120], 0
je 0x140004863
cmp byte [rsp + 0x121], 0
je 0x140004863
mov ecx, 0xbe7
call fcn.14001e311
test rax, rax
jmp 0x14000486c
cmp qword [rsp + 0xb8], 0
setne al
test al, al
je 0x140004cff
cmp byte [rsp + 0x120], 0
je 0x14000489a
cmp byte [rsp + 0x121], 0
je 0x14000489a
mov ecx, 0xbe7
call fcn.14001e311
mov rcx, rax
jmp 0x1400048a2
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_strlen
mov byte [rsp + rax + 0x2f8], 0
xor esi, esi
movsx edi, byte [rsp + rsi + 0x120]
test ebp, ebp
jne 0x14000499d
test dil, dil
je 0x140004999
mov rax, qword [0x1400b4e20]
mov byte [rsp + 0xb4], dil
cmp dword [rax], 0
je 0x140004912
lea rbp, [rsp + 0x2f8]
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov r8d, 0x7f
lea rdx, [0x140085618]
mov rcx, rbp
sub r8, rax
mov eax, 4
cmp r8, rax
cmova r8, rax
call sub.msvcrt.dll_strncat
lea r13, [rsp + 0xb2]
lea r12, [rsp + 0x2f8]
mov rcx, r13
call sub.msvcrt.dll_strlen
mov rcx, r12
mov rbp, rax
call sub.msvcrt.dll_strlen
inc rbp
mov rdx, r13
mov rcx, r12
mov r8d, 0x7f
sub r8, rax
cmp rbp, r8
cmovbe r8, rbp
mov ebp, 2
call sub.msvcrt.dll_strncat
mov rcx, qword [0x1400b46f0]
call fcn.1400020e3
mov rcx, qword [0x1400b4ef0]
movsx r13d, byte [rsp + rsi + 0x120]
mov r12d, eax
call fcn.1400020e3
add eax, 0x41
cmp r13d, eax
je 0x140004991
add r12d, 0x41
xor ebp, ebp
cmp r12d, edi
sete bpl
inc rsi
jmp 0x1400048b1
test ebp, ebp
je 0x1400049e7
dec ebp
lea rax, str.disk_from_which_Rufus_is_running
lea r8, str.system_disk
cmove r8, rax
lea eax, [rsi - 1]
movsx ecx, byte [rsp + rax + 0x120]
mov qword [rsp + 0x68], r8
call qword [sym.imp.msvcrt.dll_toupper]
mov r8, qword [rsp + 0x68]
lea rcx, str.Removing__c:_from_the_list:_This_is_the__s_
mov edx, eax
call fcn.1400380b9
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x1400035a8
mov rax, qword [0x1400b4ff0]
mov rcx, qword [rsp + 0x68]
xor edx, edx
lea r12, [rsp + 0x2f8]
mov r8d, dword [rax]
call fcn.1400389a1
lea r9, [0x1400855d8]
mov rcx, r12
mov rsi, rax
mov rax, qword [0x1400b4e20]
cmp dword [rax], 0
lea rax, [0x140085618]
cmovne r9, rax
mov qword [rsp + 0x88], r9
call sub.msvcrt.dll_strlen
mov edx, pe_nt_image_headers64
mov qword [rsp + 0x20], rsi
mov r9, qword [rsp + 0x88]
sub rdx, rax
lea rcx, [r12 + rax]
lea r8, [0x140085ff0]
call qword [sym.imp.msvcrt.dll__snprintf]
mov byte [rsp + 0x377], 0
movsxd rdi, dword [rsp + 0x60]
mov rsi, qword [0x1400b4e30]
lea rcx, [rsp + 0x60c]
mov eax, dword [rsp + 0x78]
mov r13, qword [sym.imp.msvcrt.dll__strdup]
imul rbp, rdi, 0x38
add rbp, rsi
mov dword [rbp + 0x28], eax
call r13
lea rcx, [rsp + 0x400]
mov qword [rbp], rax
call r13
mov qword [rbp + 8], rax
test r12, r12
je 0x140004aaf
mov rcx, r12
call r13
mov r12, rax
imul rax, rdi, 0x38
mov rcx, qword [rsp + 0xb8]
mov qword [rsi + rax + 0x10], r12
test rcx, rcx
je 0x140004ace
call qword [sym.imp.msvcrt.dll__strdup]
mov rcx, rax
imul rdi, rdi, 0x38
mov rax, qword [rsp + 0x68]
add rsi, rdi
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], rax
test r14, r14
je 0x140004afe
mov rcx, r14
call qword [sym.imp.msvcrt.dll__strdup]
mov qword [rsi + 0x20], rax
mov eax, dword [rsp + 0x14c]
mov dword [rsi + 0x2c], eax
inc dword [rsp + 0x60]
cmp dword [rsp + 0x60], 0x40
jne 0x140004b1a
mov edx, 0x40
lea rcx, str.Warning:_Found_more_than__d_drives___ignoring_remaining_ones...
call fcn.1400380b9
mov rcx, rbx
call sub.msvcrt.dll_free
inc dword [rsp + 0x84]
cmp dword [rsp + 0x60], 0x40
jne 0x140003444
jmp 0x140004b3e
inc r12d
jmp 0x14000427b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov r13, qword [0x1400b4e30]
mov eax, dword [rsp + 0x60]
xor r8d, r8d
mov rdx, r13
lea r9d, [rax - 1]
movsxd rax, r8d
mov esi, r8d
cmp r9d, r8d
jle 0x140004bd4
inc r8
mov r11, qword [rdx + 0x30]
mov rcx, r8
cmp dword [rsp + 0x60], ecx
jle 0x140004b92
imul rbx, rcx, 0x38
mov rbx, qword [rbx + r13 + 0x30]
cmp rbx, r11
jae 0x140004b8d
movsxd rax, ecx
mov r11, rbx
inc rcx
jmp 0x140004b73
cmp esi, eax
je 0x140004bce
imul rax, rax, 0x38
lea rdi, [rsp + 0x280]
mov ecx, 0xe
mov rsi, rdx
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xe
mov rdi, rdx
add rax, r13
mov rsi, rax
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x280]
mov ecx, 0xe
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
add rdx, 0x38
jmp 0x140004b5e
mov rsi, qword [0x1400b4af0]
mov rbx, qword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
xor edi, edi
mov eax, dword [rsp + 0x60]
mov r12, qword [rsi]
cmp ebp, eax
jge 0x140004c79
mov rcx, qword [r13 + 0x10]
mov r14d, dword [r13 + 0x28]
call fcn.140002036
mov rcx, r12
xor r8d, r8d
mov edx, 0x143
mov r9, rax
mov qword [rsp + 0x68], rax
call rbx
mov r12, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r9, qword [rsp + 0x68]
mov dword [rsp + 0x58], eax
test r9, r9
je 0x140004c36
mov rcx, r9
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rcx, qword [rsi]
mov edx, 0x151
mov r9, r14
movsxd r8, r12d
call rbx
mov rdx, qword [r13 + 0x10]
mov rcx, qword [rsi]
call fcn.14003b721
cmp eax, edi
jl 0x140004c6e
mov rdx, qword [r13 + 0x10]
mov rcx, qword [rsi]
call fcn.14003b721
mov edi, eax
inc ebp
add r13, 0x38
jmp 0x140004be6
xor r9d, r9d
movsxd r8, edi
mov edx, 0x160
mov rcx, r12
call rbx
cmp dword [rsp + 0x760], 0x7f
ja 0x140004c97
xor edi, edi
jmp 0x140004cca
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsi]
mov edx, 0x146
call rbx
cmp edi, eax
jae 0x140004c93
xor r9d, r9d
mov rcx, qword [rsi]
movsxd r8, edi
mov edx, 0x150
call rbx
cmp dword [rsp + 0x760], eax
je 0x140004cca
inc edi
jmp 0x140004c99
mov rcx, qword [rsi]
xor r9d, r9d
movsxd r8, edi
mov edx, 0x14e
call rbx
xor r9d, r9d
mov r8d, 0x103e9
mov edx, 0x111
mov rax, qword [0x1400b4b90]
mov rcx, qword [rax]
call rbx
mov ebx, 1
jmp 0x140004d06
xor ebx, ebx
jmp 0x140004d06
xor eax, eax
jmp 0x1400048a7
mov rsi, qword [0x1400b4b90]
mov edx, 0x3eb
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9d, 1
mov edx, 0x28
mov rcx, qword [rsi]
mov r8, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r15
call sub.msvcrt.dll_free
lea rcx, [rsp + 0xd0]
call fcn.140036a83
lea rcx, [rsp + 0xc0]
call fcn.140035b4e
mov eax, ebx
add rsp, 0x718
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret