Function at 0x180022cd0
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rax, qword gs:[0x30]
mov rbp, rcx
mov rcx, qword [r8 + 0x30]
mov r14, r8
movzx ebx, dl
xor esi, esi
mov rax, qword [rax + 0x60]
mov r15, qword [rax + 0x20]
call fcn.18001f970
mov rcx, qword [r14 + 0x28]
mov rdi, rax
call fcn.18001f970
movzx ecx, word [r15 + 0x38]
add rdi, rax
add rdi, rdi
mov r13d, esi
add rdi, rcx
test bl, bl
je 0x180022f42
mov rcx, rbp
call fcn.180013700
test eax, eax
jne 0x180022d5c
mov ecx, 0x54f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180022fec
mov rax, qword gs:[0x30]
lea r8, [rdi + 0x40]
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x180022fe1
movzx edx, word [r15 + 0x38]
mov rcx, rax
mov r8, qword [r15 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.18001f910
lea rdx, [0x18002fd9c]
mov rcx, rbx
call fcn.18001f8c0
mov rdx, qword [r14 + 0x28]
mov rcx, rbx
mov rdi, rax
call fcn.18001f8c0
mov r8d, dword [r14 + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call fcn.180020d70
test eax, eax
je 0x180022f21
mov word [rdi], si
mov rcx, rbx
mov rdx, qword [r14 + 0x30]
call fcn.18001f8c0
mov r8d, dword [r14 + 0x3c]
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call fcn.180020d70
test eax, eax
je 0x180022f21
mov eax, dword [r14 + 0x4c]
lea rdi, [rsp + 0x60]
mov dword [rsp + 0x44], eax
lea r8, [rsp + 0x60]
mov eax, dword [r14 + 0x48]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x40], eax
lea r15, [r14 + 8]
xor eax, eax
mov qword [rsp + 0x2b8], r12
mov r12, qword [r14 + 0x40]
mov ecx, 0x200
rep stosb byte [rdi], al
mov rcx, rbx
mov qword [r14], rsi
mov r9d, 0x100
mov qword [rsp + 0x20], rsi
mov ebp, esi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetINFClassW]
test eax, eax
je 0x180022f0a
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180022f0a
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], 1
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov dword [r15], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoW]
test eax, eax
je 0x180022efc
mov eax, dword [rsp + 0x40]
mov r9, r12
mov r8d, 1
mov dword [rsp + 0x20], eax
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
test eax, eax
je 0x180022efc
mov r8, r15
mov rdx, rdi
mov ecx, 0x19
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x180022efc
mov r9d, dword [rsp + 0x44]
mov r8, rbx
mov rdx, r12
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesW
mov ebp, eax
test eax, eax
je 0x180022efc
mov qword [r14], rdi
mov esi, eax
jmp 0x180022f19
test rdi, rdi
je 0x180022f0a
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov esi, ebp
test ebp, ebp
jne 0x180022f19
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
mov r12, qword [rsp + 0x2b8]
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x180022fe1
mov rax, qword gs:[0x30]
lea r8, [rdi + 0x40]
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x180022fe1
movzx edx, word [r15 + 0x38]
mov rcx, rax
mov r8, qword [r15 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.18001f910
lea rdx, [0x18002fd9c]
mov rcx, rbx
call fcn.18001f8c0
mov rdx, qword [r14 + 0x28]
mov rcx, rbx
mov rdi, rax
call fcn.18001f8c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov word [rdi], si
mov rcx, rbx
mov rdx, qword [r14 + 0x30]
call fcn.18001f8c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, 1
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180028780
add rsp, 0x270
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret