Function at 0x1400095f0
Capabilities:
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x468]
sub rsp, 0x568
mov rax, qword [0x14005a318]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov rbx, r9
mov qword [rsp + 0x50], rbx
mov r13, r8
mov qword [rsp + 0x78], r8
mov r15, rdx
mov qword [rsp + 0x70], rdx
mov r14, rcx
mov qword [rsp + 0x68], rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], rbx
mov dword [rsp + 0x24], 0
xor esi, esi
mov dword [rsp + 0x20], esi
lea rcx, [rbp - 0x78]
call fcn.1400040d0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x240]
call fcn.140026d60
mov edx, 0x104
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.140001330
mov rcx, rax
test rax, rax
je 0x140009d59
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14000eb75.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x240]
lea rdi, [rsi - 1]
cmp rax, 0x10000
jae 0x1400096db
lea rax, [rbp + 0x240]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.14000d420
jmp 0x140009704
lea rcx, [rbp + 0x240]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400096e5
mov r8d, eax
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x38]
call fcn.14000d640
nop
lea r8, str.Inf_
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.14000c690
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009740
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
lea r8, str.oem.inf
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x80]
call fcn.14000c690
nop
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp - 0x40], rax
mov dword [rsp + 0x30], 1
mov r12d, 1
cmp rax, 0xffffffffffffffff
je 0x140009c3b
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400097a3
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14000eb75.0]
mov rcx, rax
test rax, rax
jne 0x1400097c4
call fcn.140001330
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x14000eb75.0]
mov rcx, rax
test rax, rax
je 0x140009d4e
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14000eb75.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r15d, dword [rsp + 0x24]
or r15d, 4
mov dword [rsp + 0x24], r15d
lea rax, [rbp + 0x1c]
mov rsi, rdi
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400097f0
mov r13, qword [rsp + 0x48]
movsxd rdi, dword [r13 - 0x10]
lea r14d, [rsi + rdi]
test r14d, r14d
js 0x140009d43
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140009834
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.14000d810
mov rbx, qword [rsp + 0x40]
add rdi, rdi
mov r9, rdi
mov r8, r13
mov rdx, rdi
mov rcx, rbx
call fcn.140003ca0
movsxd rdx, esi
add rdx, rdx
lea rcx, [rdi + rbx]
mov r9, rdx
lea r8, [rbp + 0x1c]
call fcn.140003ca0
cmp r14d, dword [rbx - 0xc]
jg 0x140009d43
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor edi, edi
mov word [rbx + rax*2], di
lea r14, [rbx - 0x18]
mov rcx, r14
call fcn.14000d5a0
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x58]
call fcn.140008d00
test eax, eax
je 0x140009bdd
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
cmp dword [rdx - 0x10], edi
je 0x1400098cf
test rdx, rdx
je 0x140009d4e
mov rcx, qword [rbp - 0x60]
call fcn.1400308ec
mov r13d, edi
test eax, eax
sete r13b
mov dword [rsp + 0x30], r13d
jmp 0x1400098d4
mov r13d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
cmp dword [rax - 0x10], edi
je 0x140009b62
call fcn.140001330
mov rcx, rax
test rax, rax
je 0x140009d4e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14000eb75.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
mov rsi, qword [rbp - 0x68]
cmp dword [rsi - 0x10], 0
jl 0x140009a03
lea rdx, [0x14004f034]
mov rcx, rsi
call fcn.14002626c
mov rsi, qword [rbp - 0x68]
test rax, rax
je 0x140009a03
sub rax, rsi
sar rax, 1
cmp eax, 0xffffffff
jle 0x140009a03
lea r8d, [rax + 1]
mov r9d, dword [rsi - 0x10]
sub r9d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.14000d170
or r15d, 8
mov dword [rsp + 0x24], r15d
lea rcx, [rsp + 0x60]
call fcn.14000c920
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400099d3
cmp dword [rbx + 0x10], 0
jl 0x1400099c4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400099c4
call fcn.14000d5a0
mov rdi, rax
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400099b9
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x1400099d3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.14000d640
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400099fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
xor r15d, r15d
jmp 0x140009af4
xor r15d, r15d
mov edi, r15d
movzx eax, word [rsi]
test ax, ax
je 0x140009a8a
movzx ecx, ax
call fcn.140030c14
test eax, eax
je 0x140009a2c
mov rax, rsi
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x140009a2f
mov rdi, r15
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x140009a11
test rdi, rdi
je 0x140009a8a
mov rdx, qword [rbp - 0x68]
sub rdi, rdx
sar rdi, 1
test edi, edi
js 0x140009d64
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140009a72
mov edx, edi
lea rcx, [rbp - 0x68]
call fcn.14000d810
mov rdx, qword [rbp - 0x68]
cmp edi, dword [rdx - 0xc]
jg 0x140009d64
mov dword [rdx - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x68]
mov word [rax + rcx*2], r15w
lea rcx, [rbp - 0x68]
call fcn.14000c9e0
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140009af9
cmp dword [rdi + 0x10], r15d
jl 0x140009ae6
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140009ae6
call fcn.14000d5a0
mov rbx, rax
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140009adb
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
add rbx, 0x18
mov qword [rsp + 0x28], rbx
jmp 0x140009af9
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.14000d640
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x140009d6f
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140009b27
add rax, 2
test cx, cx
jne 0x140009b10
mov eax, r15d
jmp 0x140009b2c
sbb eax, eax
or eax, 1
mov r12d, r15d
test eax, eax
sete r12b
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009b58
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
mov r15d, dword [rsp + 0x24]
mov rbx, qword [rsp + 0x40]
test r12d, r12d
je 0x140009bdd
test r13d, r13d
je 0x140009bdd
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
test rdx, rdx
je 0x140009d4e
mov rcx, qword [rbp - 0x78]
call fcn.1400308ec
test eax, eax
jne 0x140009bdd
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
test rdx, rdx
je 0x140009d4e
mov rcx, qword [rbp - 0x70]
call fcn.1400308ec
test eax, eax
jne 0x140009bdd
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfW]
test eax, eax
je 0x140009bd7
mov esi, dword [rsp + 0x20]
inc esi
mov dword [rsp + 0x20], esi
jmp 0x140009be1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [rsp + 0x20]
and r15d, 0xfffffffb
mov dword [rsp + 0x24], r15d
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140009c11
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140009780
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009c60
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009c86
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
nop
lea rcx, [rbp - 0x78]
call fcn.1400093f0
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009cb4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009cd8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009cfd
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000eb75.0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140009d1e
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14000eb75.0]
mov eax, esi
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.140023ea0
add rsp, 0x568
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140003d60
int3
mov ecx, 0x80004005
call fcn.140003d60
nop
mov ecx, 0x80004005
call fcn.140003d60
nop
mov ecx, 0x80070057
call fcn.140003d60
int3
mov ecx, 0x80004005
call fcn.140003d60
int3