Function at 0x140029870
Capabilities:
Create process on windows
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2790
call fcn.1400ec240
sub rsp, rax
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [rsp + 0x27e0], rbx
mov rax, qword [0x140134780]
xor rax, rsp
mov qword [rsp + 0x2780], rax
mov r14, rdx
mov r12, rcx
mov qword [rsp + 0x70], rcx
xor ebp, ebp
mov dword [rsp + 0x60], ebp
call fcn.14003c3f0
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x1400298df
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14002990d
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x40], rsi
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14002993e
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x78], ebp
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x7c], ebp
lea rcx, [rsp + 0x100]
call fcn.14000cab0
nop
mov dword [rsp + 0x84], ebp
mov r9d, 6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov r13, rax
mov qword [rsp + 0x90], rax
cmp rax, 0xffffffffffffffff
jne 0x140029a23
lea r9, [fcn.1400049c0]
lea edx, [rax + 9]
lea r8d, [rax + 0x65]
lea rcx, [rsp + 0x100]
call fcn.1400a29b0
nop
lea rdx, [rdi - 0x18]
or r15, r13
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400299d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400299fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140029a1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r15d
jmp 0x14002ae4d
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x660]
call fcn.1400a09f0
mov r8, r14
mov edx, 0x208
lea rcx, [rsp + 0xee0]
call fcn.1400a1bd0
lea r8, [0x1400f1278]
mov edx, 0x208
lea rcx, [rsp + 0xee0]
call fcn.1400a1c80
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rsp + 0x68], rax
or r15, 0xffffffffffffffff
lea ebp, [r15 + 2]
cmp rax, r15
je 0x14002ad42
nop
nop
nop
mov r8, r14
mov edx, 0x208
lea rcx, [rsp + 0xee0]
call fcn.1400a1bd0
lea r8, [0x1400ef048]
mov edx, 0x208
lea rcx, [rsp + 0xee0]
call fcn.1400a1c80
lea r8, [rsp + 0x68c]
mov edx, 0x208
lea rcx, [rsp + 0xee0]
call fcn.1400a1c80
lea rdx, [rsp + 0xee0]
mov rcx, r12
call fcn.140003fb0
test eax, eax
jne 0x14002acb9
xor r9d, r9d
xor edx, edx
lea r8d, [rax + 2]
lea rcx, [rsp + 0xee0]
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov r13, rax
mov qword [rsp + 0xa0], rax
cmp rax, 0xffffffffffffffff
je 0x14002ac94
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x14002ac94
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rsp + 0xcd0]
xor edx, edx
lea rcx, [rsp + 0xa8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x14002ac94
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0xcd0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140029bf9
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140029c8d
cmp dword [rdx + 0x10], eax
jge 0x140029bc5
cmp dword [rbx - 0xc], eax
jl 0x14002acd3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140029c8d
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140029bdd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov rsi, qword [rsp + 0x40]
jmp 0x140029c8d
mov ebp, dword [rbx - 0x10]
lea r12, [rsp + 0xcd0]
sub r12, rbx
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140029c2c
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140004410
mov rbx, qword [rsp + 0x48]
cmp r12, rbp
ja 0x140029c4c
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.14009f850
jmp 0x140029c69
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0xcd0]
mov rdx, rbp
mov rcx, rbx
call fcn.14009f640
test edi, edi
js 0x14002ad26
cmp edi, dword [rbx - 0xc]
jg 0x14002ad26
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
mov ebp, 1
mov r12, qword [rsp + 0x70]
movsxd rdi, dword [rbx - 0x10]
mov ecx, ebp
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140029cb0
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140004410
mov rbx, qword [rsp + 0x48]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14009fd30
test edi, edi
js 0x14002ad1b
cmp edi, dword [rbx - 0xc]
jg 0x14002ad1b
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
lea rdx, str.REALTEK
mov rcx, rbx
call fcn.14009f5d0
test rax, rax
jne 0x140029cfa
test byte [r14 + 0x218], 8
jne 0x14002aca6
lea rdx, str.INTEL
mov rcx, rbx
call fcn.14009f5d0
test rax, rax
jne 0x140029d2d
mov eax, dword [r14 + 0x218]
test al, 1
jne 0x14002acb4
test al, 2
jne 0x14002acad
test al, 4
jne 0x14002ac9f
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rsp + 0xcd0]
mov edx, ebp
lea rcx, [rsp + 0xa8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, [rsp + 0xcd0]
mov rdx, r13
mov rcx, r12
call fcn.140003280
test eax, eax
jne 0x140029d95
mov dword [rsp + 0x84], ebp
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov rdi, qword [rsp + 0x68]
jmp 0x14002acb9
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea rdx, [rsp + 0xcd0]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x14002ac8f
xor r12d, r12d
nop
lea r8, [0x1400ee798]
mov edx, 0x104
lea rcx, [rsp + 0x1500]
call fcn.1400a1bd0
lea r8, [0x1400ee798]
mov edx, 0x104
lea rcx, [rsp + 0x12f0]
call fcn.1400a1bd0
mov qword [rsp + 0x20], r12
mov r9d, 0x104
lea r8, [rsp + 0x1500]
mov edx, 2
lea rcx, [rsp + 0xa8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
mov edi, r12d
test eax, eax
cmovne edi, ebp
mov qword [rsp + 0x20], r12
mov r9d, 0x104
lea r8, [rsp + 0x12f0]
mov edx, 3
lea rcx, [rsp + 0xa8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
mov r13d, r12d
test eax, eax
cmovne r13d, ebp
test edi, edi
je 0x14002aba8
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x1500]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140029ed3
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140029f62
cmp dword [rdx + 0x10], eax
jge 0x140029e9f
cmp dword [rsi - 0xc], eax
jl 0x14002acde
mov dword [rsi - 0x10], r12d
mov word [rsi], ax
jmp 0x140029f62
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140029eb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x40], rsi
mov rbx, qword [rsp + 0x48]
jmp 0x140029f62
mov ebp, dword [rsi - 0x10]
lea r12, [rsp + 0x1500]
sub r12, rsi
sar r12, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140029f06
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rsi, qword [rsp + 0x40]
cmp r12, rbp
ja 0x140029f26
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rsi + r12*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.14009f850
jmp 0x140029f43
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x1500]
mov rdx, rbp
mov rcx, rsi
call fcn.14009f640
test edi, edi
js 0x14002ad10
cmp edi, dword [rsi - 0xc]
jg 0x14002ad10
mov dword [rsi - 0x10], edi
mov word [rsi + rbp], 0
mov ebp, 1
movsxd rdi, dword [rsi - 0x10]
mov ecx, ebp
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140029f85
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rsi, qword [rsp + 0x40]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.14009fd30
test edi, edi
js 0x14002ad05
cmp edi, dword [rsi - 0xc]
jg 0x14002ad05
mov dword [rsi - 0x10], edi
mov word [rsi + rdi*2], 0
lea r12, [rsi - 0x18]
mov qword [rsp + 0x88], r12
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp r12, rdi
je 0x14002a022
cmp dword [rdi + 0x10], 0
jl 0x14002a011
mov rax, qword [rdi]
cmp qword [r12], rax
jne 0x14002a011
mov rcx, r12
call fcn.140004470
mov rsi, rax
mov ecx, r15d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140029ffc
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
jmp 0x14002a022
mov r8d, dword [rsi - 0x10]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140006310
mov dx, 0x2a
lea rcx, [rsp + 0x58]
call fcn.1400069e0
lea rdx, [0x1400f0320]
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a04e
test byte [r14 + 0x21c], 1
jne 0x14002a06c
lea rdx, [0x1400f0320]
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
je 0x14002a07a
test byte [r14 + 0x21c], 2
je 0x14002a07a
cmp dword [r14 + 0x210], 0
je 0x14002ab87
lea rdx, str.PCIVEN_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a0c4
lea rdx, str.PCICC_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a0c4
lea rdx, str.ACPICLS_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a0c4
test byte [r14 + 0x218], 1
jne 0x14002ab8c
lea rdx, str.INTELAUDIODSP_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a0e6
test byte [r14 + 0x218], 4
jne 0x14002ab91
lea rdx, str.INTELAUDIOCTLR_DEV_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a11c
lea rdx, str.INTELAUDIOLINKTYPE_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a11c
test byte [r14 + 0x218], 2
jne 0x14002ab96
lea rdx, str.PCIVEN_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a194
lea rdx, str.PCICC_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a194
lea rdx, str.ACPICLS_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a194
lea rdx, str.INTELAUDIODSP_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a194
lea rdx, str.INTELAUDIOCTLR_DEV_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
jne 0x14002a194
lea rdx, str.INTELAUDIOLINKTYPE_
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
je 0x14002a1a2
test byte [r14 + 0x218], 0x10
jne 0x14002ab9b
cmp dword [r14 + 0x210], 0
jne 0x14002abcb
mov dword [rsp + 0x430], 0x20
mov dword [rsp + 0x98], 0
movsxd rax, r13d
mov qword [rsp + 0xc0], rax
lea r8, [rsp + 0x430]
xor edx, edx
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14002aba0
nop
nop
nop
lea rcx, [rsp + 0x100]
call fcn.140007620
xor eax, eax
mov r13d, eax
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, [rsp + 0x1f50]
lea rdx, [rsp + 0x430]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x1500]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jbe 0x14002a3fa
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, ebp
lea rdx, [rsp + 0x430]
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov ecx, dword [rsp + 0x50]
call fcn.1400a3350
mov r12, rax
test rax, rax
je 0x14002a3f2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, ebp
lea rdx, [rsp + 0x430]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov rbp, r12
cmp word [r12], r13w
je 0x14002a3d3
mov ebx, 1
nop
nop
nop
nop
mov r8, rbp
mov edx, 0x104
lea rcx, [rsp + 0xac0]
call fcn.1400a1bd0
mov edx, 0x104
lea rcx, [rsp + 0xac0]
call fcn.14009fd30
mov rdx, rsi
lea rcx, [rsp + 0xac0]
call fcn.14009f5d0
test rax, rax
jne 0x14002a343
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xac0]
call fcn.14009f5d0
test rax, rax
je 0x14002a346
mov r13d, ebx
test byte [r14 + 0x21c], 2
je 0x14002a375
lea rdx, [rsp + 0xac0]
lea rcx, [rsp + 0xf0]
call fcn.140013740
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.14000cb30
test byte [r14 + 0x21c], bl
je 0x14002a3b1
lea rdx, [0x1400f0320]
lea rcx, [rsp + 0xac0]
call fcn.14009f5d0
test rax, rax
je 0x14002a3b1
lea r8, [rsp + 0xac0]
mov edx, 0x104
lea rcx, [rsp + 0x1710]
call fcn.1400a1bd0
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea rbp, [rbp + rcx*2]
cmp word [rbp], ax
jne 0x14002a2f0
mov rbx, qword [rsp + 0x48]
mov rcx, r12
call fcn.1400a32b0
test r13d, r13d
jne 0x14002a764
lea ebp, [r13 + 1]
mov r12, qword [rsp + 0x88]
jmp 0x14002a3fa
mov r12, qword [rsp + 0x88]
cmp qword [rsp + 0xc0], 0
je 0x14002ab49
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x12f0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 1
jbe 0x14002ab49
mov rcx, r15
lea rdi, [rsp + 0x12f0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14002a4ae
mov rdi, qword [r12]
cmp dword [r12 + 8], eax
je 0x14002a544
cmp dword [r12 + 0x10], eax
jge 0x14002a472
cmp dword [rsi - 0xc], eax
jl 0x14002ace9
xor ebp, ebp
mov dword [rsi - 0x10], ebp
mov word [rsi], ax
jmp 0x14002a546
mov eax, r15d
lock xadd dword [r12 + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002a490
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x48]
xor ebp, ebp
jmp 0x14002a546
mov ebp, dword [rsi - 0x10]
lea r12, [rsp + 0x12f0]
sub r12, rsi
sar r12, 1
mov ecx, 1
mov rdx, qword [rsp + 0x88]
sub ecx, dword [rdx + 0x10]
mov eax, dword [rdx + 0xc]
sub eax, edi
or eax, ecx
jge 0x14002a4e9
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rsi, qword [rsp + 0x40]
cmp r12, rbp
ja 0x14002a509
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rsi + r12*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.14009f850
jmp 0x14002a526
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x12f0]
mov rdx, rbp
mov rcx, rsi
call fcn.14009f640
test edi, edi
js 0x14002acfa
cmp edi, dword [rsi - 0xc]
jg 0x14002acfa
mov dword [rsi - 0x10], edi
mov word [rsi + rbp], 0
xor ebp, ebp
jmp 0x14002a546
xor ebp, ebp
lea rcx, [rsp + 0x40]
call fcn.140006ac0
mov rsi, qword [rsp + 0x40]
lea rdx, [rsi - 0x18]
mov qword [rsp + 0x88], rdx
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp rdx, rdi
je 0x14002a5c9
cmp dword [rdi + 0x10], 0
jl 0x14002a5b8
mov rax, qword [rdi]
cmp qword [rdx], rax
jne 0x14002a5b8
mov rcx, rdx
call fcn.140004470
mov rsi, rax
mov ecx, r15d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14002a5a3
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
jmp 0x14002a5c9
mov r8d, dword [rsi - 0x10]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140006310
mov dx, 0x2a
lea rcx, [rsp + 0x58]
call fcn.1400069e0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x430]
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov ecx, dword [rsp + 0x50]
call fcn.1400a3350
mov r12, rax
test rax, rax
je 0x14002ab44
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x430]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov rbp, r12
cmp word [r12], 0
je 0x14002a753
mov ebx, 1
nop
nop
nop
nop
mov r8, rbp
mov edx, 0x104
lea rcx, [rsp + 0xac0]
call fcn.1400a1bd0
mov edx, 0x104
lea rcx, [rsp + 0xac0]
call fcn.14009fd30
mov rdx, rsi
lea rcx, [rsp + 0xac0]
call fcn.14009f5d0
test rax, rax
jne 0x14002a6c3
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xac0]
call fcn.14009f5d0
test rax, rax
je 0x14002a6c6
mov r13d, ebx
test byte [r14 + 0x21c], 2
je 0x14002a6f5
lea rdx, [rsp + 0xac0]
lea rcx, [rsp + 0xd8]
call fcn.140013740
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.14000cb30
test byte [r14 + 0x21c], bl
je 0x14002a731
lea rdx, [0x1400f0320]
lea rcx, [rsp + 0xac0]
call fcn.14009f5d0
test rax, rax
je 0x14002a731
lea r8, [rsp + 0xac0]
mov edx, 0x104
lea rcx, [rsp + 0x1710]
call fcn.1400a1bd0
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea rbp, [rbp + rcx*2]
cmp word [rbp], ax
jne 0x14002a670
mov rbx, qword [rsp + 0x48]
mov rcx, r12
call fcn.1400a32b0
test r13d, r13d
je 0x14002ab3d
xor r12d, r12d
mov dword [rsp + 0x84], r12d
test byte [r14 + 0x21c], 2
je 0x14002a8ec
mov ebp, r12d
lea r13d, [r12 + 1]
mov r8d, ebp
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x100]
call fcn.14001a020
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14002a7f9
cmp dword [rbx + 0x10], 0
jl 0x14002a7ea
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002a7ea
call fcn.140004470
mov rdi, rax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14002a7df
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14002a7f9
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140006310
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002a81d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
lea rdi, [0x1400ee798]
mov rbx, qword [rsp + 0x48]
mov rsi, rbx
mov rcx, r13
repe cmpsw word [rsi], word [rdi]
je 0x14002a83b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x14002a8e7
add ebp, 1
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14002a874
cmp rax, qword [rbx - 0x18]
jne 0x14002a874
lea rsi, [rbx - 0x18]
lock add dword [rbx - 8], 1
mov rbx, qword [rsp + 0x48]
jmp 0x14002a8b0
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14002acf4
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14009f640
lea rax, [rsi + 0x18]
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0xc8]
lea rcx, [0x14013a7a0]
call fcn.140005700
test eax, eax
je 0x14002a785
mov rsi, qword [rsp + 0x40]
mov ebp, 1
jmp 0x14002ab49
mov rsi, qword [rsp + 0x40]
test byte [r14 + 0x218], 4
je 0x14002a928
lea r8, [rsp + 0x1d40]
lea rdx, [rsp + 0xee0]
mov rdi, qword [rsp + 0x70]
mov rcx, rdi
call fcn.140005380
test eax, eax
je 0x14002a92d
xor edx, edx
lea rcx, [rsp + 0x1d40]
call fcn.140002bd0
jmp 0x14002a92d
mov rdi, qword [rsp + 0x70]
add dword [rsp + 0x80], 1
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x1b30]
call fcn.1400a1bd0
lea r8, [rsp + 0xee0]
mov edx, 0x208
lea rcx, [rsp + 0x2160]
call fcn.1400a1bd0
mov dword [rsp + 0x658], r12d
lea r8, [rdi + 0x3c4]
mov edx, 0x104
lea rcx, [rsp + 0x450]
call fcn.1400a1bd0
lea r8, [rsp + 0x1f50]
lea rdx, [rsp + 0x450]
mov rcx, rdi
call fcn.1400288c0
lea r11, [rsp + 0x78]
mov qword [rsp + 0x20], r11
mov ebp, 1
mov r9d, ebp
lea r8, [rsp + 0x2160]
lea rdx, [rsp + 0x1b30]
xor ecx, ecx
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesW
test eax, eax
jne 0x14002a9ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.14000c1e0
lea rdx, [0x1400ee798]
mov rcx, rdi
call fcn.140004590
jmp 0x14002aae6
cmp dword [rsp + 0x78], 0
je 0x14002aace
mov eax, dword [r14 + 0x218]
test bpl, al
jne 0x14002aa11
test al, 2
jne 0x14002aa11
test al, 8
je 0x14002aace
cmp dword [rdi + 0x3b114], 0
je 0x14002aace
mov edx, 0x208
lea rcx, [rsp + 0x1920]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str._system32_net.exe
lea rcx, [rsp + 0x1920]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, str._stop_audiosrv
lea r8, [rsp + 0x1920]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r11, [rsp + 0x78]
mov qword [rsp + 0x20], r11
mov r9d, ebp
lea r8, [rsp + 0x2160]
lea rdx, [rsp + 0x1b30]
xor ecx, ecx
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesW
test eax, eax
jne 0x14002aaa6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.14000c1e0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, str._start_audiosrv
lea r8, [rsp + 0x1920]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rsp + 0x450]
mov rcx, rdi
call fcn.14001cd90
mov dword [rsp + 0x60], ebp
add dword [rsp + 0x7c], ebp
test byte [r14 + 0x21c], bpl
je 0x14002ab49
lea rdx, [rsp + 0x1710]
lea rcx, [rsp + 0xf8]
call fcn.140013740
mov rdx, rax
lea rcx, [0x14013a7a0]
call fcn.140005700
test eax, eax
jne 0x14002ab49
lea rdx, [rsp + 0x1710]
lea rcx, [rsp + 0xe0]
call fcn.140013740
mov rdx, rax
lea rcx, [0x14013a7a0]
call fcn.14000cb30
jmp 0x14002ab49
mov ebp, 1
jmp 0x14002ab49
mov ebp, 1
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
lea r8, [rsp + 0x430]
mov edx, eax
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
mov r12, qword [rsp + 0x88]
jne 0x14002a200
jmp 0x14002aba5
xor r12d, r12d
jmp 0x14002aba8
xor r12d, r12d
jmp 0x14002aba8
xor r12d, r12d
jmp 0x14002aba8
xor r12d, r12d
jmp 0x14002aba8
xor r12d, r12d
jmp 0x14002aba8
xor r12d, r12d
jmp 0x14002aba8
xor r12d, r12d
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
je 0x14002ac7b
jmp 0x140029dc0
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x2570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, ebp
xor edx, edx
lea rcx, [rsp + 0xee0]
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
jne 0x14002ac2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov r12, qword [rsp + 0x70]
mov rcx, r12
call fcn.14000c1e0
mov r13, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x68]
jmp 0x14002ac94
cmp dword [r14 + 0x214], 0
je 0x14002ac63
lea r8, [rsp + 0xee0]
lea rdx, [rsp + 0x8b0]
mov r12, qword [rsp + 0x70]
mov rcx, r12
call fcn.140028eb0
lea rdx, [rsp + 0x8b0]
mov rcx, r12
call fcn.14001ceb0
jmp 0x14002ac68
mov r12, qword [rsp + 0x70]
mov dword [rsp + 0x60], ebp
mov r13, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x68]
jmp 0x14002ac94
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x68]
jmp 0x14002ac94
mov rdi, qword [rsp + 0x68]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
jmp 0x14002acb9
mov rdi, qword [rsp + 0x68]
jmp 0x14002acb9
mov rdi, qword [rsp + 0x68]
jmp 0x14002acb9
mov rdi, qword [rsp + 0x68]
jmp 0x14002acb9
mov rdi, qword [rsp + 0x68]
lea rdx, [rsp + 0x660]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002ad31
jmp 0x140029aa0
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
call fcn.140002f80
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r13, qword [rsp + 0x90]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov edx, dword [rsp + 0x80]
mov dword [r14 + 0x208], edx
mov eax, dword [rsp + 0x7c]
mov dword [r14 + 0x20c], eax
mov ecx, 0xfffffffe
test edx, edx
jne 0x14002ad78
lea edi, [rdx + 1]
mov edx, dword [rsp + 0x60]
xor esi, esi
jmp 0x14002ad96
cmp edx, eax
je 0x14002ad89
mov edi, 0xfffffffd
mov edx, dword [rsp + 0x60]
xor esi, esi
jmp 0x14002ad96
xor esi, esi
mov edi, esi
mov edx, dword [rsp + 0x60]
test edx, edx
cmove edi, ecx
cmp dword [r14 + 0x210], 0
je 0x14002ada7
test edx, edx
cmovne ecx, esi
mov edi, ecx
mov eax, dword [rsp + 0x84]
test eax, eax
je 0x14002adc8
test edi, edi
je 0x14002adc8
and dword [r14 + 0x220], 0xfffffffe
and eax, 1
or dword [r14 + 0x220], eax
lea r9, [fcn.1400049c0]
mov edx, 8
lea r8d, [rdx + 0x5c]
lea rcx, [rsp + 0x100]
call fcn.1400a29b0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002ae08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002ae2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
add r15d, 0xffffffff
test r15d, r15d
jg 0x14002ae4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rsp + 0x2780]
xor rcx, rsp
call fcn.1400a1970
mov rbx, qword [rsp + 0x27e0]
add rsp, 0x2790
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret