Function at 0x41f850
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub rsp, 0x548
mov qword [rsp + 0x540], rbx
mov qword [rsp + 0x538], rbp
mov qword [rsp + 0x530], rsi
mov qword [rsp + 0x528], rdi
mov qword [rsp + 0x520], r12
mov qword [rsp + 0x518], r13
mov qword [rsp + 0x510], r14
mov r14, r8
mov r13, rdx
mov qword [rsp + 0xb0], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x41f921
mov r8, r13
lea rdx, str.CDIFxUninstall::MyDriverPackageGetPath_:_pszEnumFileName___s_n
lea rcx, [rsp + 0x1c0]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0xc0], rdx
lea rdi, [rsp + 0xc0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1c0]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x41f8f0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xc0]
call fcn.004548a0
xor r12d, r12d
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x78]
call fcn.004855f8
nop
mov edx, 0x104
lea rcx, [rsp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, str.DriverStoreFileRepository
lea rcx, [rsp + 0x30]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x40]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.00421850
test eax, eax
jne 0x41fa49
lea rdx, str.DRVSTORE
lea rcx, [rsp + 0x48]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x40]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.00421850
test eax, eax
je 0x41fca2
lea r8, str..
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x78]
call fcn.00485680
test eax, eax
je 0x41fc96
lea rcx, [rsp + 0x78]
call fcn.004854d0
mov ebp, eax
lea rcx, [rsp + 0x78]
call fcn.0048585c
test eax, eax
jne 0x41fc8e
mov edx, InitCommonControls
lea rcx, [rsp + 0x78]
mov rax, qword [rsp + 0x78]
call qword [rax + 0x70]
test eax, eax
je 0x41fc8e
lea rdx, [0x004ad8bc]
lea rcx, [rsp + 0x48]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.004858a4
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x41fc8e
nop
lea rdx, [rsp + 0x2ec]
lea rcx, [rsp + 0x70]
call fcn.0049b290
mov rbx, rax
lea rdx, [0x004a9dfc]
lea rcx, [rsp + 0x58]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.004858a4
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.0049b804
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x60]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x68]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x58]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x70]
call fcn.0049b1dc
mov r8, qword [rsp + 0x28]
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.00422290
test eax, eax
jne 0x41fc1f
lea rdx, [rsp + 0x2c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x41fc85
jmp 0x41fb50
xor ebp, ebp
mov rax, qword [rsp + 0x28]
mov edx, dword [rax - 8]
lea rcx, [rsp + 0x28]
call fcn.0049b550
mov rdx, r14
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x41fc36
call fcn.004545a0
test eax, eax
je 0x41fc7f
lea r8, [rsp + 0x2ec]
lea rdx, str.FOUND_:_pszDriverStoreInfPath___s_n
lea rcx, [rsp + 0xc0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xc0]
call fcn.004548a0
mov r12d, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebp, ebp
jne 0x41fa92
lea rcx, [rsp + 0x78]
call fcn.004853ec
jmp 0x41fcbf
call fcn.004545a0
test eax, eax
je 0x41fcbf
call fcn.004546e0
mov rcx, rax
lea rdx, str.FAILED_to_Find_Driver_Store_Folder_n
call fcn.004548a0
call fcn.004545a0
test eax, eax
je 0x41fd44
mov r8d, r12d
lea rdx, str.CDIFxUninstall::MyDriverPackageGetPath_:_bRetVal___d_n
lea rcx, [rsp + 0x1c0]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0xc0], rdx
lea rdi, [rsp + 0xc0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1c0]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x41fd12
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xc0]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x78]
call fcn.00485624
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
mov eax, r12d
mov rbx, qword [rsp + 0x540]
mov rbp, qword [rsp + 0x538]
mov rsi, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x528]
mov r12, qword [rsp + 0x520]
mov r13, qword [rsp + 0x518]
mov r14, qword [rsp + 0x510]
add rsp, 0x548
ret