Function at 0x402db0
Capabilities:
Delete file
Set file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x708
mov rax, qword [0x00445f40]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x10], rdi
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x78], rdx
mov qword [r11 - 0x18], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0x408
mov qword [r11 - 0x30], r15
call qword [sym.imp.USER32.dll_SendMessageA]
xor r12d, r12d
mov rbp, rax
lea rax, [rsp + 0x40]
lea edx, [r12 + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r15d, r12d
call qword [sym.imp.SETUPAPI.dll_SetupGetInfFileListA]
test eax, eax
jne 0x402e86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r12
mov r9d, 0x400
mov edi, eax
lea rax, [rsp + 0x48]
xor edx, edx
mov ecx, 0x1100
mov r8d, edi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x402e77
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4036c6
mov rcx, qword [rbx + 0x40]
movsxd r8, ebp
xor r9d, r9d
mov edx, 0x402
mov qword [rsp + 0x700], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
add ebp, 1
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x40]
mov edx, 2
mov rcx, rdi
mov r8, rax
mov rsi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.SETUPAPI.dll_SetupGetInfFileListA]
test eax, eax
jne 0x402f32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r12
mov r9d, 0x400
mov edi, eax
lea rax, [rsp + 0x48]
xor edx, edx
mov ecx, 0x1100
mov r8d, edi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x402f23
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4036be
mov rcx, qword [rbx + 0x40]
movsxd r8, ebp
xor r9d, r9d
mov edx, 0x402
mov qword [rsp + 0x6e8], r13
mov qword [rsp + 0x6e0], r14
call qword [sym.imp.USER32.dll_SendMessageA]
add ebp, 1
cmp byte [rsi], r15b
mov rbx, rsi
mov r12d, 1
je 0x40368b
mov r14d, dword [rsp + 0x40]
mov r13d, dword [rsp + 0x40]
nop
nop
nop
mov eax, dword [rsp + 0x40]
add rax, rsi
cmp rbx, rax
jae 0x403695
lea rdx, [rsp + 0x4b0]
xor r14d, r14d
xor r13d, r13d
sub rdx, rdi
mov rcx, rdi
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
add rcx, r12
test al, al
jne 0x402fb0
xor eax, eax
lea rdi, [rsp + 0x4b0]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rbx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, r12
test al, al
jne 0x402fe0
xor r9d, r9d
lea rcx, [rsp + 0x4b0]
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov rsi, rax
mov eax, 0x66666667
imul r15d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea edx, [rdx + rdx*4]
add edx, edx
cmp r15d, edx
jne 0x403047
cmp ebp, 0x5a
jge 0x403047
mov rax, qword [rsp + 0x78]
movsxd r8, ebp
xor r9d, r9d
mov rcx, qword [rax + 0x40]
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageA]
add ebp, r12d
add r15d, r12d
cmp rsi, 0xffffffffffffffff
je 0x403517
lea r9, [rsp + 0x60]
lea rdx, str.Manufacturer
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x403504
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x60]
xor edi, edi
mov r9d, 0x100
mov edx, r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x403504
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x403504
lea r8, [rsp + 0x80]
lea edx, [rdi + 2]
lea rcx, [rsp + 0x60]
mov r9d, 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x403504
mov rdx, qword [0x004479e0]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
je 0x403112
mov rax, qword [0x004479e0]
cmp dword [rax - 0x10], edi
jne 0x40349a
mov rdx, qword [0x004479e8]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a18]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447aa0]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a90]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a38]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447ac8]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447ac0]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a28]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a00]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a88]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a68]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a80]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447ad0]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a08]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a98]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447ab8]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a20]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447ad8]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x004479f8]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447ab0]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a10]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a60]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a58]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a50]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a30]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447aa8]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447ae0]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a48]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a40]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a78]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x00447a70]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x40349a
mov rdx, qword [0x004479f0]
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
je 0x403504
lea r9, [rsp + 0x60]
lea rdx, str.Strings
xor r8d, r8d
mov rcx, rsi
mov r14d, r12d
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x403567
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x60]
mov r9d, 0x100
mov edx, r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x403567
lea rdx, str.Microsoft
lea rcx, [rsp + 0x80]
call fcn.00419c30
test rax, rax
jne 0x403567
mov r13d, r12d
jmp 0x403567
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov rdi, qword [rsp + 0x48]
jmp 0x40366a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x400
xor edx, edx
mov edi, eax
xor eax, eax
mov ecx, 0x1100
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x40355f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
test r14d, r14d
je 0x403665
test r13d, r13d
je 0x40365e
lea rcx, [rsp + 0x5b0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x3a0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x180]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x290]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x0043459c]
lea rcx, [rsp + 0x3a0]
call fcn.00419c30
lea rdx, [rsp + 0x5b0]
lea rcx, [rsp + 0x180]
mov byte [rax], 0x2e
mov byte [rax + 1], 0x50
mov byte [rax + 2], 0x4e
mov byte [rax + 3], 0x46
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x180]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x290]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40366a
mov rdi, qword [rsp + 0x48]
jmp 0x40366a
mov rdi, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rsi, qword [rsp + 0x58]
movsxd rcx, eax
lea rbx, [rbx + rcx + 1]
cmp byte [rbx], 0
jne 0x402f80
jmp 0x403695
mov r14d, dword [rsp + 0x40]
mov r13d, dword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14d, r14d
mov r14, qword [rsp + 0x6e0]
je 0x4036b0
test r13d, r13d
jne 0x4036b3
xor r12d, r12d
mov r13, qword [rsp + 0x6e8]
mov eax, r12d
mov rsi, qword [rsp + 0x700]
mov r15, qword [rsp + 0x6d8]
mov r12, qword [rsp + 0x6f0]
mov rdi, qword [rsp + 0x6f8]
mov rbp, qword [rsp + 0x728]
mov rbx, qword [rsp + 0x720]
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.004196e0
add rsp, 0x708
ret