Function at 0x140012650
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword gs:[0x30]
mov rbp, rcx
mov rcx, qword [r8 + 0x30]
mov r14, r8
movzx ebx, dl
xor esi, esi
mov rax, qword [rax + 0x60]
mov r15, qword [rax + 0x20]
call fcn.1400248b0
mov rcx, qword [r14 + 0x28]
mov rdi, rax
call fcn.1400248b0
movzx ecx, word [r15 + 0x38]
add rdi, rax
add rdi, rdi
mov r13d, esi
add rdi, rcx
test bl, bl
je 0x1400128bd
mov rcx, rbp
call fcn.14000e7d0
test eax, eax
jne 0x1400126ca
mov ecx, 0x54f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140012967
mov rax, qword gs:[0x30]
lea r8, [rdi + 0x40]
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14001295c
movzx edx, word [r15 + 0x38]
mov rcx, rax
mov r8, qword [r15 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.1400248e0
lea rdx, [0x140190b90]
mov rcx, rbx
call fcn.140022b20
mov rdx, qword [r14 + 0x28]
mov rcx, rbx
mov rdi, rax
call fcn.140022b20
mov r8d, dword [r14 + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call fcn.140012ab0
test eax, eax
je 0x14001289c
mov word [rdi], si
mov rcx, rbx
mov rdx, qword [r14 + 0x30]
call fcn.140022b20
mov r8d, dword [r14 + 0x3c]
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call fcn.140012ab0
test eax, eax
je 0x14001289c
mov eax, dword [r14 + 0x4c]
lea rdi, [rsp + 0x50]
mov dword [rsp + 0x290], eax
lea r8, [rsp + 0x50]
mov eax, dword [r14 + 0x48]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x298], eax
lea r15, [r14 + 8]
xor eax, eax
mov qword [rsp + 0x2a0], r12
mov r12, qword [r14 + 0x40]
mov ecx, 0x200
rep stosb byte [rdi], al
mov rcx, rbx
mov qword [r14], rsi
mov r9d, 0x100
mov qword [rsp + 0x20], rsi
mov ebp, esi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetINFClassW]
test eax, eax
je 0x140012885
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140012885
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], 1
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov dword [r15], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoW]
test eax, eax
je 0x140012877
mov eax, dword [rsp + 0x298]
mov r9, r12
mov r8d, 1
mov dword [rsp + 0x20], eax
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
test eax, eax
je 0x140012877
mov r8, r15
mov rdx, rdi
mov ecx, 0x19
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x140012877
mov r9d, dword [rsp + 0x290]
mov r8, rbx
mov rdx, r12
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.newdev.dll_UpdateDriverForPlugAndPlayDevicesW]
mov ebp, eax
test eax, eax
je 0x140012877
mov qword [r14], rdi
mov esi, eax
jmp 0x140012894
test rdi, rdi
je 0x140012885
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov esi, ebp
test ebp, ebp
jne 0x140012894
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
mov r12, qword [rsp + 0x2a0]
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14001295c
mov rax, qword gs:[0x30]
lea r8, [rdi + 0x40]
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14001295c
movzx edx, word [r15 + 0x38]
mov rcx, rax
mov r8, qword [r15 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.1400248e0
lea rdx, [0x140190b90]
mov rcx, rbx
call fcn.140022b20
mov rdx, qword [r14 + 0x28]
mov rcx, rbx
mov rdi, rax
call fcn.140022b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov word [rdi], si
mov rcx, rbx
mov rdx, qword [r14 + 0x30]
call fcn.140022b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, 1
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add rsp, 0x250
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret