Function at 0x140032d20
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Query or enumerate registry value
Set file attributes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1440
call fcn.1400ec240
sub rsp, rax
mov qword [rsp + 0x148], 0xfffffffffffffffe
mov qword [rsp + 0x1478], rbx
mov qword [rsp + 0x1480], rbp
mov qword [rsp + 0x1488], rsi
mov rax, qword [0x140134780]
xor rax, rsp
mov qword [rsp + 0x1430], rax
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0xc8], ebp
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140032d9a
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x108], rax
lea r12, [0x1400eeb50]
mov rdi, r12
shr rdi, 0x10
jne 0x140032de4
movzx ebx, r12w
mov ecx, ebx
call fcn.14003c170
test rax, rax
je 0x140032df5
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.1400060c0
jmp 0x140032df5
mov rdx, r12
lea rcx, [rsp + 0x108]
call fcn.140006560
nop
mov qword [rsp + 0xe0], rbp
mov dword [rsp + 0x118], ebp
call fcn.14003c3f0
mov r11, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140032e23
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
test rdi, rdi
jne 0x140032e61
movzx ebx, r12w
mov ecx, ebx
call fcn.14003c170
test rax, rax
je 0x140032e73
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400060c0
mov rsi, qword [rsp + 0x50]
jmp 0x140032e73
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140006560
mov rsi, qword [rsp + 0x50]
call fcn.14003c3f0
mov r11, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140032e92
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xf8], rax
test rdi, rdi
jne 0x140032ed1
movzx edi, r12w
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140032ee2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.1400060c0
jmp 0x140032ee2
mov rdx, r12
lea rcx, [rsp + 0xf8]
call fcn.140006560
nop
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140032f01
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xb0], rax
lea rdx, str.FUNC_01VEN_10EC
test rdx, 0xffffffffffff0000
jne 0x140032f4a
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140032f58
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400060c0
jmp 0x140032f58
lea rcx, [rsp + 0xb0]
call fcn.140006560
nop
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140032f77
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa0], rax
lea rdx, str.SNDWCLASS_00MAN_025D
test rdx, 0xffffffffffff0000
jne 0x140032fc0
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140032fce
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.1400060c0
jmp 0x140032fce
lea rcx, [rsp + 0xa0]
call fcn.140006560
nop
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140032fed
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r15, [rax + 0x18]
mov qword [rsp + 0x90], r15
lea rdx, [0x1400f0e28]
test rdx, 0xffffffffffff0000
jne 0x14003303e
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140033053
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400060c0
mov r15, qword [rsp + 0x90]
jmp 0x140033053
lea rcx, [rsp + 0x90]
call fcn.140006560
mov r15, qword [rsp + 0x90]
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140033072
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r14, [rax + 0x18]
mov qword [rsp + 0x88], r14
lea rdx, [0x1400f0e10]
test rdx, 0xffffffffffff0000
jne 0x1400330c3
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400330d8
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1400060c0
mov r14, qword [rsp + 0x88]
jmp 0x1400330d8
lea rcx, [rsp + 0x88]
call fcn.140006560
mov r14, qword [rsp + 0x88]
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400330f7
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r13, [rax + 0x18]
mov qword [rsp + 0xa8], r13
lea rdx, [0x1400f0df8]
test rdx, 0xffffffffffff0000
jne 0x140033148
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14003315d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.1400060c0
mov r13, qword [rsp + 0xa8]
jmp 0x14003315d
lea rcx, [rsp + 0xa8]
call fcn.140006560
mov r13, qword [rsp + 0xa8]
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14003317c
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0xb8], r12
lea rdx, [0x1400f0de0]
test rdx, 0xffffffffffff0000
jne 0x1400331cd
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400331e2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1400060c0
mov r12, qword [rsp + 0xb8]
jmp 0x1400331e2
lea rcx, [rsp + 0xb8]
call fcn.140006560
mov r12, qword [rsp + 0xb8]
call fcn.14003c3f0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140033201
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x98], rbp
lea rdx, [0x1400f0dc8]
test rdx, 0xffffffffffff0000
jne 0x140033252
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140033267
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400060c0
mov rbp, qword [rsp + 0x98]
jmp 0x140033267
lea rcx, [rsp + 0x98]
call fcn.140006560
mov rbp, qword [rsp + 0x98]
call fcn.14003c3f0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140033286
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xc0], rbx
lea rdx, [0x1400f0db0]
test rdx, 0xffffffffffff0000
jne 0x1400332d7
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400332ec
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.1400060c0
mov rbx, qword [rsp + 0xc0]
jmp 0x1400332ec
lea rcx, [rsp + 0xc0]
call fcn.140006560
mov rbx, qword [rsp + 0xc0]
call fcn.14003c3f0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14003330b
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x80], rdi
lea rax, [0x1400f0d98]
test rax, 0xffffffffffff0000
jne 0x140033361
movzx ecx, ax
call fcn.14003c170
test rax, rax
je 0x140033379
lea rcx, [0x1400f0d98]
movzx r8d, cx
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400060c0
mov rdi, qword [rsp + 0x80]
jmp 0x140033379
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140006560
mov rdi, qword [rsp + 0x80]
mov word [rsp + 0xe00], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xe02]
call fcn.1400a09f0
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x140033566
lea rdx, [rdi - 0x18]
or rdi, rax
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400333d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400333fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033421
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033445
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033469
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003348d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400334b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400334d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400334f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003351d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003353e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x14003355f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140034fcb
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x3b118], 0
je 0x140033626
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x70], rax
call fcn.14003c3f0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400335a4
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xe8], rax
lea rdx, str.INTCSDW
test rdx, 0xffffffffffff0000
jne 0x1400335ed
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14003360e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.1400060c0
jmp 0x14003360e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xe8]
call fcn.140006310
nop
mov r8d, 1
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x40]
call fcn.140031be0
mov dword [rsp + 0x150], SafeArrayDestroyData
mov dword [rsp + 0x68], 0
lea r8, [rsp + 0x150]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140033cda
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xb0]
nop
nop
nop
mov qword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [rsp + 0x5d0]
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
lea rdx, str.HDAUDIO
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
jne 0x1400336e9
lea rdx, str.INTELAUDIO
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
jne 0x1400336e9
lea rdx, str.SNDWCLASS
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x140033cad
lea rdx, str.HDAUDIO
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
lea rdx, str.INTELAUDIO
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
xor ecx, ecx
test rax, rax
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x60], ecx
lea rdx, str.SNDWCLASS
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
xor ecx, ecx
test rax, rax
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x58], ecx
lea r8, [rsp + 0x5d0]
mov edx, 0x100
lea rcx, [rsp + 0x9f0]
call fcn.1400a1bd0
cmp dword [rsp + 0x58], 0
je 0x140033774
mov word [rsp + 0xa6c], 0
jmp 0x140033791
cmp dword [rsp + 0x60], 0
je 0x140033787
mov word [rsp + 0xa6a], 0
jmp 0x140033791
mov word [rsp + 0xa64], 0
mov rdx, rsi
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x1400337b8
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b0], 0
jne 0x1400338ed
mov rdx, rdi
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x1400337df
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b0], 0
jne 0x1400338ed
mov rdx, r15
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x140033806
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b4], 0
jne 0x1400338ed
mov rdx, r14
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x14003382d
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b4], 0
jne 0x1400338ed
mov rdx, r13
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x140033854
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b4], 0
jne 0x1400338ed
mov rdx, r12
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x140033877
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b4], 0
jne 0x1400338ed
mov rdx, rbp
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x14003389a
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b4], 0
jne 0x1400338ed
mov rdx, rbx
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x1400338bd
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b4], 0
jne 0x1400338ed
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x140033cad
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x1b4], 0
je 0x140033cad
mov ecx, 0xa
call fcn.140001d80
lea r11, [rsp + 0x118]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0xe0]
mov r8d, 4
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x48]
call fcn.140001ff0
test eax, eax
je 0x140033cad
lea rdx, str.IntcAzAudAddService
mov rcx, qword [rsp + 0xe0]
call fcn.14009f5d0
test rax, rax
jne 0x14003397b
lea rdx, str.RTHDMIAzAudService
mov rcx, qword [rsp + 0xe0]
call fcn.14009f5d0
test rax, rax
jne 0x14003397b
lea rdx, str.RTKSdWHwCodec
mov rcx, qword [rsp + 0xe0]
call fcn.14009f5d0
test rax, rax
je 0x140033cad
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x140033cad
mov ecx, 1
mov dword [rsp + 0x7c], ecx
mov dword [rsp + 0x78], 0x208
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0xbf0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140033ca2
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400a1c80
lea r8, [rsp + 0xbf0]
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400a1c80
mov dword [rsp + 0x60], 0
cmp dword [rsp + 0x58], 0
je 0x140033a76
lea rdx, [rsp + 0xbf0]
mov rcx, qword [rsp + 0x40]
call fcn.140017430
mov ecx, dword [rsp + 0x60]
cmp eax, 1
mov eax, 1
cmovg ecx, eax
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rax, [rsp + 0xe00]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x140033bd4
xor r8d, r8d
lea rdx, [rsp + 0x5d0]
mov rcx, qword [rsp + 0x40]
call fcn.1400229c0
lea r8, [rsp + 0x150]
mov rdx, qword [rsp + 0x48]
mov ecx, 5
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x60], 0
jne 0x140033b32
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x138]
call fcn.140013740
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.1400183d0
test eax, eax
je 0x140033b32
mov rcx, qword [rsp + 0x40]
movsxd rax, dword [rcx + 0x3b0e0]
imul rax, rax, 0x12c8
mov edx, dword [rsp + 0x58]
mov dword [rax + rcx + 0x5cc], edx
cmp dword [0x140139918], 0
jne 0x140033bd4
cmp dword [0x14013991c], 0
jne 0x140033bd4
cmp dword [0x140139920], 0
jne 0x140033bd4
cmp dword [0x140139924], 0
jne 0x140033bd4
cmp dword [0x140139928], 0
jne 0x140033bd4
mov edx, 0x80
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400ee8ac]
lea rcx, [rsp + 0x3c0]
call fcn.14009f5d0
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rsp + 0x60], 0
jne 0x140033c90
cmp dword [0x140139918], 0
jne 0x140033c10
cmp dword [0x14013991c], 0
jne 0x140033c10
cmp dword [0x140139920], 0
jne 0x140033c10
cmp dword [0x140139924], 0
jne 0x140033c10
cmp dword [0x140139928], 0
je 0x140033c90
lea r9, [rsp + 0xc8]
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0x3c0]
call fcn.1400022b0
test eax, eax
je 0x140033c44
mov r8d, eax
mov edx, 3
mov rcx, qword [rsp + 0x40]
call fcn.14000c780
jmp 0x140033c90
lea rdx, [0x1400ee8ac]
lea rcx, [rsp + 0x3c0]
call fcn.14009f5d0
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x9f0]
mov rcx, qword [rsp + 0x40]
call fcn.14001efd0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
add eax, 1
mov dword [rsp + 0x68], eax
lea r8, [rsp + 0x150]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140033670
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140001d80
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14003412d
mov dword [rsp + 0x150], SafeArrayDestroyData
xor r15d, r15d
lea r8, [rsp + 0x150]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14003411e
or r14, 0xffffffffffffffff
nop
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rsp + 0x5d0]
lea rdx, [rsp + 0x150]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
lea rdx, str.HDAUDIO
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
jne 0x140033db7
lea rdx, str.INTELAUDIO
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
jne 0x140033db7
lea rdx, str.SNDWCLASS
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x1400340f2
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
jne 0x140033def
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x5d0]
call fcn.14009f5d0
test rax, rax
je 0x1400340f2
mov rbx, qword [rsp + 0x40]
cmp dword [rbx + 0x1b0], 0
je 0x1400340f2
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0
lea rdx, [rsp + 0x5d0]
mov rcx, rbx
call fcn.140011050
mov edi, eax
xor r9d, r9d
mov r8d, dword [rsp + 0x164]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
xor ecx, ecx
test eax, eax
mov r13d, 1
cmovne ecx, r13d
test edi, edi
jne 0x140033e58
test ecx, ecx
je 0x1400340f2
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, r13d
lea rdx, [rsp + 0x150]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400340f2
mov dword [rsp + 0x7c], r13d
mov dword [rsp + 0x78], 0x208
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xbf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400340e9
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400a1c80
lea r8, [rsp + 0xbf0]
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400a1c80
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
lea rax, [rsp + 0xe00]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdi + 9]
lea rdx, [rsp + 0x150]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x1400340d9
xor r8d, r8d
lea rdx, [rsp + 0x5d0]
mov rcx, rbx
call fcn.1400229c0
lea r8, [rsp + 0x150]
mov rdx, rbp
lea ecx, [rdi + 5]
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
mov r13d, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
call fcn.14003c3f0
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
je 0x140034113
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x3c0]
lea rax, [rsp + 0x3c0]
test rax, 0xffffffffffff0000
jne 0x140033fe6
movzx edi, cx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140034010
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400060c0
jmp 0x140034010
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0x3c0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x60]
call fcn.140006310
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400183d0
test eax, eax
je 0x140034037
movsxd rax, dword [rbx + 0x3b0e0]
imul rax, rax, 0x12c8
mov dword [rax + rbx + 0x5cc], r13d
cmp dword [0x140139918], 0
jne 0x1400340d9
cmp dword [0x14013991c], 0
jne 0x1400340d9
cmp dword [0x140139920], 0
jne 0x1400340d9
cmp dword [0x140139924], 0
jne 0x1400340d9
cmp dword [0x140139928], 0
jne 0x1400340d9
mov edx, 0x80
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400ee8ac]
lea rcx, [rsp + 0x3c0]
call fcn.14009f5d0
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x9f0]
mov rcx, rbx
call fcn.14001efd0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r15d, 1
lea r8, [rsp + 0x150]
mov edx, r15d
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140034122
jmp 0x140033d40
mov ecx, 0x80004005
call fcn.140001120
int3
or r14, 0xffffffffffffffff
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
jmp 0x140034131
or r14, 0xffffffffffffffff
mov ecx, 0xa
call fcn.140001d80
xor r8d, r8d
lea rdx, [0x1400ee9c8]
mov rbp, qword [rsp + 0x40]
mov rcx, rbp
call fcn.1400229c0
xor r8d, r8d
lea rdx, [0x1400f16a0]
mov rcx, rbp
call fcn.1400229c0
cmp dword [0x140139918], 0
jne 0x1400341d2
cmp dword [0x14013991c], 0
jne 0x1400341d2
cmp dword [0x140139920], 0
jne 0x1400341d2
cmp dword [0x140139924], 0
jne 0x1400341d2
cmp dword [0x140139928], 0
jne 0x1400341d2
mov edx, 0x208
lea rcx, [rsp + 0x1220]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.INF_
mov edx, 0x104
lea rcx, [rsp + 0x1220]
call fcn.1400a1c80
lea rdx, [rsp + 0x1220]
mov rcx, rbp
call fcn.140023fe0
jmp 0x1400349d9
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x170]
call fcn.1400a09f0
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.infoem.inf
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400a1c80
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400349d0
or r12, 0xffffffffffffffff
nop
nop
call fcn.14003c3f0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x1400349c5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x19c]
lea rax, [rsp + 0x19c]
test rax, 0xffffffffffff0000
jne 0x1400342ac
movzx edi, cx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400343b7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400060c0
mov rbx, qword [rsp + 0x48]
jmp 0x1400343b7
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x19c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140034327
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400343b7
cmp dword [rdx + 0x10], eax
jge 0x1400342f3
cmp dword [rbx - 0xc], eax
jl 0x140034988
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x1400343b7
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003430b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov rsi, qword [rsp + 0x50]
jmp 0x1400343b7
mov r12d, dword [rbx - 0x10]
lea r13, [rsp + 0x19c]
sub r13, rbx
sar r13, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14003435b
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140004410
mov rbx, qword [rsp + 0x48]
cmp r13, r12
ja 0x14003437b
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rbx
call fcn.14009f850
jmp 0x140034398
movsxd rax, edi
lea r12, [rax + rax]
mov r9, r12
lea r8, [rsp + 0x19c]
mov rdx, r12
mov rcx, rbx
call fcn.14009f640
test edi, edi
js 0x1400349ba
cmp edi, dword [rbx - 0xc]
jg 0x1400349ba
mov dword [rbx - 0x10], edi
mov word [rbx + r12], 0
or r12, 0xffffffffffffffff
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14003494d
lea r9, [rsp + 0x120]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140034943
mov qword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [rsp + 0x1010]
mov r13d, 1
mov edx, r13d
lea rcx, [rsp + 0x120]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140034943
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x1010]
mov rdx, r14
mov rcx, rbp
call fcn.140003280
test eax, eax
jne 0x140034485
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034969
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140034969
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rsp + 0x7e0]
xor edx, edx
lea rcx, [rsp + 0x120]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x14003491b
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x7e0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
mov rdi, rcx
test ecx, ecx
jne 0x14003452e
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400345c4
cmp dword [rdx + 0x10], eax
jge 0x1400344fa
cmp dword [rsi - 0xc], eax
jl 0x140034993
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x1400345c4
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034512
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x48]
jmp 0x1400345c4
mov r12d, dword [rsi - 0x10]
lea r13, [rsp + 0x7e0]
sub r13, rsi
sar r13, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140034562
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004410
mov rsi, qword [rsp + 0x50]
cmp r13, r12
ja 0x140034582
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rsi + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rsi
call fcn.14009f850
jmp 0x14003459f
movsxd rax, edi
lea r12, [rax + rax]
mov r9, r12
lea r8, [rsp + 0x7e0]
mov rdx, r12
mov rcx, rsi
call fcn.14009f640
test edi, edi
js 0x1400349a9
cmp edi, dword [rsi - 0xc]
jg 0x1400349a9
mov dword [rsi - 0x10], edi
mov word [r12 + rsi], 0
or r12, 0xffffffffffffffff
mov r13d, 1
movsxd rdi, dword [rsi - 0x10]
mov ecx, r13d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400345e8
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004410
mov rsi, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.14009fd30
test edi, edi
js 0x14003499e
cmp edi, dword [rsi - 0xc]
jg 0x14003499e
mov dword [rsi - 0x10], edi
mov word [rsi + rdi*2], 0
cmp dword [rsi - 0x10], 0
jl 0x1400348f3
lea rdx, str.REALTEK
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
je 0x1400348f3
sub rax, rsi
sar rax, 1
cmp eax, 0xffffffff
je 0x1400348f3
lea r9, [rsp + 0x120]
xor r8d, r8d
lea rdx, [rsp + 0x1010]
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140034943
mov qword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [rsp + 0x7e0]
mov edx, 2
lea rcx, [rsp + 0x120]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140034943
lea rdx, [0x1400ee9c8]
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x1400346bd
cmp dword [rbp + 0x1b0], 0
jne 0x1400347e5
lea rdx, [0x1400f16a0]
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x1400346e3
cmp dword [rbp + 0x1b0], 0
jne 0x1400347e5
lea rdx, str.FUNC_01VEN_8086
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x140034709
cmp dword [rbp + 0x1b4], 0
jne 0x1400347e5
lea rdx, str.FUNC_01VEN_1002
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x14003472f
cmp dword [rbp + 0x1b4], 0
jne 0x1400347e5
lea rdx, str.FUNC_01VEN_1022
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x140034755
cmp dword [rbp + 0x1b4], 0
jne 0x1400347e5
lea rdx, str.FUNC_01VEN_10DE
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x140034777
cmp dword [rbp + 0x1b4], 0
jne 0x1400347e5
lea rdx, str.FUNC_01VEN_1106
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x140034799
cmp dword [rbp + 0x1b4], 0
jne 0x1400347e5
lea rdx, str.FUNC_01VEN_1039
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x1400347bb
cmp dword [rbp + 0x1b4], 0
jne 0x1400347e5
lea rdx, str.FUNC_01VEN_10B9
lea rcx, [rsp + 0x7e0]
call fcn.14009f5d0
test rax, rax
je 0x140034943
cmp dword [rbp + 0x1b4], 0
je 0x140034943
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400a1c80
lea r8, [rsp + 0x19c]
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400a1c80
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x140]
call fcn.140013740
mov rdx, rax
mov rcx, rbp
call fcn.1400183d0
mov edi, eax
lea r9, [rsp + 0xc8]
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0x3c0]
call fcn.1400022b0
test eax, eax
je 0x140034882
mov r8d, eax
mov edx, 3
mov rcx, rbp
call fcn.14000c780
jmp 0x140034943
test edi, edi
je 0x14003489c
movsxd rax, dword [rbp + 0x3b0e0]
imul rax, rax, 0x12c8
mov dword [rax + rbp + 0x5cc], r13d
lea rdx, [0x1400ee8ac]
lea rcx, [rsp + 0x3c0]
call fcn.14009f5d0
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov edx, 0x80
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140034943
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034969
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140034969
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034969
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140034969
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034969
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x170]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400349b4
mov rsi, qword [rsp + 0x50]
jmp 0x140034240
mov ecx, 0x80070057
call fcn.140001120
nop
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
nop
or r14, 0xffffffffffffffff
jmp 0x1400349d0
mov ecx, 0x80070057
call fcn.140001120
nop
mov ecx, 0x80004005
call fcn.140001120
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, 0xa
call fcn.140001d80
cmp dword [rbp + 0x3b118], 0
je 0x140034bec
lea rax, [rsp + 0x40]
mov qword [rsp + 0xd0], rax
call fcn.14003c3f0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140034a1c
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.INTCDMIC
test rdx, 0xffffffffffff0000
jne 0x140034a5f
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140034a7c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400060c0
jmp 0x140034a7c
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.140006310
nop
mov r12d, 1
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140031be0
lea rdx, [rsp + 0xd8]
mov qword [rsp + 0xd0], rdx
call fcn.14003c3f0
mov rdx, rax
xor esi, esi
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140034ac3
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xd8], rax
lea rdx, str.INTCOED
test rdx, 0xffffffffffff0000
jne 0x140034b0c
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140034b2c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.1400060c0
jmp 0x140034b2c
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xd8]
call fcn.140006310
nop
mov r8d, r12d
lea rdx, [rsp + 0xd8]
mov rcx, rbp
call fcn.140031be0
lea rdx, [rsp + 0xf0]
mov qword [rsp + 0xd0], rdx
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140034b6e
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xf0], rax
lea rdx, str.INTCAUDIOBUS
test rdx, 0xffffffffffff0000
jne 0x140034bb7
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140034bd7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400060c0
jmp 0x140034bd7
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xf0]
call fcn.140006310
nop
mov r8d, r12d
lea rdx, [rsp + 0xf0]
mov rcx, rbp
call fcn.140031be0
jmp 0x140034bf2
xor esi, esi
lea r12d, [rsi + 1]
lea rax, [rsp + 0x110]
mov qword [rsp + 0xd0], rax
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140034c21
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x110], rax
lea rdx, str.AMDAFDAUDIOSERVICE
test rdx, 0xffffffffffff0000
jne 0x140034c6e
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140034c93
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.1400060c0
or rbx, 0xffffffffffffffff
jmp 0x140034c97
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x110]
call fcn.140006310
jmp 0x140034c97
or rbx, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x110]
mov rcx, rbp
call fcn.140031be0
cmp dword [rbp + 0x3b11c], 0
je 0x140034d62
lea rax, [rsp + 0x100]
mov qword [rsp + 0xd0], rax
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140034ce6
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x100], rax
lea rdx, str.RTKAUDHM
test rdx, 0xffffffffffff0000
jne 0x140034d2f
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140034d4f
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.1400060c0
jmp 0x140034d4f
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x100]
call fcn.140006310
nop
mov r8d, r12d
lea rdx, [rsp + 0x100]
mov rcx, rbp
call fcn.140031be0
test byte [0x14013a788], 2
je 0x140034e0b
lea rax, [rsp + 0x70]
mov qword [rsp + 0xd0], rax
call fcn.14003c3f0
mov rcx, rax
test rax, rax
mov eax, 0
setne al
test eax, eax
jne 0x140034d9e
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.CSAUDIO
test rdx, 0xffffffffffff0000
jne 0x140034dde
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140034dfb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400060c0
jmp 0x140034dfb
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.140006310
nop
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.140031be0
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140001d80
mov rcx, rbp
call fcn.140018ae0
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034e42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034e66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034e8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034eae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034ed2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034ef6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034f1a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034f3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034f62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034f86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140034fa7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140034fc8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r12d
mov rcx, qword [rsp + 0x1430]
xor rcx, rsp
call fcn.1400a1970
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret