Function at 0x1400039e0
Capabilities:
Check os version
Get common file path
Read .ini file

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x720
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x700], rax
mov rbx, r8
xor edi, edi
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x90
xor r12d, r12d
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
call fcn.140004c60
lea rdx, [rsp + 0x4e0]
mov r8d, 0x104
xor ecx, ecx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x38], 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [rdi + 0x5c]
lea rcx, [rsp + 0x4e0]
call fcn.1400046b0
lea r9, [rsp + 0x4e0]
lea r8, [0x140011588]
lea rcx, [rsp + 0x230]
mov edx, 0x104
mov byte [rax], dil
call fcn.140004c20
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x30]
not rcx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + rcx + 0x22f]
mov rcx, rbx
call fcn.140003590
cmp dword [rsp + 0x40], r12d
jne 0x1400044f1
cmp dword [rsp + 0x30], r12d
je 0x1400044f1
cmp dword [rsp + 0x38], r12d
je 0x1400044f1
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x758], r13
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [rsp + 0x54]
cmp edx, 5
jne 0x140004210
cmp dword [rsp + 0x58], 1
jae 0x140004219
xor eax, eax
mov qword [rsp + 0x740], rbp
mov qword [rsp + 0x748], rsi
lea rcx, [rsp + 0x121]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x718], r14
mov byte [rsp + 0xf0], 0
mov qword [rsp + 0xf1], rax
mov qword [rsp + 0x710], r15
mov dword [rsp + 0xf9], eax
mov word [rsp + 0xfd], ax
mov byte [rsp + 0xff], al
mov byte [rsp + 0x120], al
call fcn.140004c60
lea rcx, [rsp + 0x341]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x340], 0
call fcn.140004c60
lea r9, [rsp + 0x230]
lea rdx, [0x140011584]
lea rcx, str.OemVista
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, 1
mov ebx, ebp
mov esi, eax
cmp eax, ebx
jl 0x140003cce
nop
nop
nop
lea r8, str.Oem_d
lea rcx, [rsp + 0xf0]
mov r9d, ebx
mov edx, 0x10
call fcn.140004c20
lea rdx, [rsp + 0x230]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x28], rdx
lea r8, [0x1400113e2]
lea rcx, str.OemVista
lea rdx, [rsp + 0xf0]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [rsp + 0x54]
cmp edx, 5
jne 0x140004282
cmp dword [rsp + 0x58], ebp
jae 0x14000428b
lea rcx, [rsp + 0x340]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rsp + 0x120]
lea r9, [rsp + 0x340]
mov qword [rsp + 0x20], rdx
lea r8, str._sinf_s
lea rcx, [rsp + 0x340]
mov edx, 0x104
call fcn.140004c20
lea rcx, [rsp + 0x340]
call fcn.140004d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x340]
lea r9, [0x140011558]
lea r8, [0x140011410]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x340]
mov edx, 0x104
not rcx
sub rax, 3
sub rcx, rbp
add rcx, rax
call fcn.140004c20
lea rcx, [rsp + 0x340]
call fcn.140004d50
add ebx, ebp
cmp ebx, esi
jle 0x140003bc0
lea rcx, [rsp + 0x450]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x100
call fcn.140004e10
mov ecx, 0x100
mov r13, rax
call fcn.140004e10
mov ecx, 0x28
mov rdi, rax
mov qword [rsp + 0x38], rax
call fcn.140004e10
mov ecx, 0x28
mov r14, rax
call fcn.140004e10
lea r9, [rsp + 0x450]
lea r8, str._hs_hs
mov r15, rax
lea rax, str.remove.ini
mov edx, 0xff
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140004c20
lea r8, str.fuck_you
lea rdx, str.VerifyMark
lea rcx, str.OEMInf
mov r9, r15
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x28
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rax, [rsp + 0x450]
mov rsi, r13
xor ebx, ebx
sub rsi, rax
nop
xor eax, eax
lea r8, str.oem_d.inf
lea rcx, [rsp + 0x100]
lea edx, [rax + 0x14]
mov r9d, ebx
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov word [rsp + 0x110], ax
mov byte [rsp + 0x112], al
call fcn.140004c20
lea rdx, [rsp + 0x450]
movzx eax, byte [rdx]
mov byte [rsi + rdx], al
add rdx, rbp
test al, al
jne 0x140003dc3
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasb al, byte [rdi]
mov eax, dword [str.inf_]
or rcx, 0xffffffffffffffff
mov dword [rdi - 1], eax
movzx eax, word [0x140011504]
lea rdx, [rsp + 0x100]
mov word [rdi + 3], ax
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, rbp
test al, al
jne 0x140003e10
lea r8, str.oem_d.inf
lea rcx, [rsp + 0x4c0]
mov r9d, ebx
mov edx, 0x16
call fcn.140004c20
lea r8, str.fuck_me
lea rdx, str.VerifyMark
lea rcx, str.OEMInf
mov r9, r14
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x28
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdi, r15
sub rdi, r14
mov rdx, r14
nop
movzx ecx, byte [rdx]
movzx eax, byte [rdx + rdi]
sub ecx, eax
jne 0x140003e82
add rdx, rbp
test eax, eax
jne 0x140003e70
test ecx, ecx
jne 0x140003f39
mov eax, dword [rsp + 0x54]
cmp eax, 5
jne 0x1400042a0
cmp dword [rsp + 0x58], ebp
jae 0x1400042a9
lea rcx, [rsp + 0x340]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rsp + 0x100]
lea r9, [rsp + 0x340]
mov qword [rsp + 0x20], rdx
lea r8, str._sinf_s
lea rcx, [rsp + 0x340]
mov edx, 0x104
call fcn.140004c20
lea rcx, [rsp + 0x340]
call fcn.140004d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x340]
lea r9, [0x140011558]
lea r8, [0x140011410]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x340]
mov edx, 0x104
not rcx
sub rax, 3
sub rcx, rbp
add rcx, rax
call fcn.140004c20
lea rcx, [rsp + 0x340]
call fcn.140004d50
add ebx, ebp
cmp ebx, 0x1f4
jl 0x140003d80
mov rcx, r13
call fcn.140004d80
mov rcx, qword [rsp + 0x38]
call fcn.140004d80
mov rcx, r14
call fcn.140004d80
mov rcx, r15
call fcn.140004d80
lea r9, [rsp + 0x230]
lea rdx, str.DevNum
lea rcx, str.PIDVID
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r15, qword [rsp + 0x710]
mov r14, qword [rsp + 0x718]
cmp eax, ebp
mov ebx, eax
mov edi, ebp
jl 0x140004022
nop
nop
nop
nop
lea r8, str.Dev_d
lea rcx, [rsp + 0xf0]
mov r9d, edi
mov edx, 0x10
call fcn.140004c20
lea r11, [rsp + 0x230]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x28], r11
lea r8, [0x1400113e2]
lea rdx, [rsp + 0xf0]
lea rcx, str.PIDVID
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [rsp + 0x120], 0
je 0x14000401c
lea rcx, [rsp + 0x120]
call fcn.1400030a0
add edi, ebp
cmp edi, ebx
jle 0x140003fb0
lea r9, [rsp + 0x230]
lea rdx, [0x1400114d8]
lea rcx, str.DelInf
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, ebp
cmp eax, ebx
mov esi, eax
jl 0x14000414d
nop
lea r8, str.Inf_d
lea rcx, [rsp + 0xf0]
mov r9d, ebx
mov edx, 0x10
call fcn.140004c20
lea r9, [rsp + 0x4e0]
lea r8, [0x140011588]
lea rcx, [rsp + 0x120]
mov edx, 0x104
call fcn.140004c20
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x4e0]
lea r8, [0x1400113e2]
lea rdx, [rsp + 0xf0]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x230]
not rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + rcx + 0x120]
lea rcx, str.DelInf
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r8, str.Sev_d
lea rcx, [rsp + 0xf0]
mov r9d, ebx
mov edx, 0x10
call fcn.140004c20
lea rdx, [rsp + 0x230]
lea r9, [rsp + 0x5f0]
mov qword [rsp + 0x28], rdx
lea r8, [0x1400113e2]
lea rcx, str.DelInf
lea rdx, [rsp + 0xf0]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x120]
call fcn.1400034c0
add ebx, ebp
cmp ebx, esi
jle 0x140004050
lea r9, [rsp + 0x230]
lea rdx, [0x1400114bc]
lea rcx, [0x1400114b8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, ebp
cmp eax, ebp
mov ebx, eax
jl 0x1400042be
call fcn.140003000
mov r12d, 0x100
mov esi, eax
nop
nop
nop
lea r8, str.Num_d
lea rcx, [rsp + 0xf0]
mov r9d, edi
mov edx, 0x10
call fcn.140004c20
lea r11, [rsp + 0x230]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x28], r11
lea r8, [0x1400113e2]
lea rdx, [rsp + 0xf0]
lea rcx, [0x1400114b8]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, 0x200
test esi, esi
lea rdx, [rsp + 0x120]
mov rcx, 0xffffffff80000002
cmovne r8d, r12d
call fcn.140003320
add edi, ebp
cmp edi, ebx
jle 0x140004190
jmp 0x1400042c4
cmp edx, 5
jbe 0x140003b06
lea rcx, str.setupapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r13, rax
mov qword [rsp + 0x48], rax
je 0x140003b06
lea rdx, str.SetupUninstallOEMInfA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r12, rax
jne 0x140003b06
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov r13, qword [rsp + 0x758]
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.140004c00
add rsp, 0x720
pop r12
pop rdi
pop rbx
ret
cmp edx, 5
jbe 0x140003c2c
lea rcx, [rsp + 0x120]
xor r8d, r8d
mov edx, ebp
call r12
jmp 0x140003cc4
cmp eax, 5
jbe 0x140003ea1
lea rcx, [rsp + 0x100]
xor r8d, r8d
mov edx, ebp
call r12
jmp 0x140003f39
mov r12d, 0x100
lea r9, [rsp + 0x230]
lea rdx, [0x1400114bc]
lea rcx, str.CUKEY
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, ebp
cmp eax, ebp
mov ebx, eax
jl 0x14000437b
call fcn.140003000
mov esi, eax
nop
nop
nop
lea r8, str.Num_d
lea rcx, [rsp + 0xf0]
mov r9d, edi
mov edx, 0x10
call fcn.140004c20
lea r11, [rsp + 0x230]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x28], r11
lea r8, [0x1400113e2]
lea rdx, [rsp + 0xf0]
lea rcx, str.CUKEY
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, 0x200
test esi, esi
lea rdx, [rsp + 0x120]
mov rcx, 0xffffffff80000001
cmovne r8d, r12d
call fcn.140003320
add edi, ebp
cmp edi, ebx
jle 0x140004300
lea r9, [rsp + 0x230]
lea rdx, str.File
lea rcx, str.DelFile
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov rsi, qword [rsp + 0x748]
cmp eax, ebp
mov edi, eax
jl 0x14000445b
nop
lea r8, str.File_d
lea rcx, [rsp + 0xf0]
mov r9d, ebp
mov edx, 0x10
call fcn.140004c20
lea r11, [rsp + 0x230]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x28], r11
lea r8, [0x1400113e2]
lea rdx, [rsp + 0xf0]
lea rcx, str.DelFile
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r8, str.FilePath_d
lea rcx, [rsp + 0xf0]
mov r9d, ebp
mov edx, 0x10
call fcn.140004c20
lea r9, [rsp + 0x230]
lea rdx, [rsp + 0xf0]
lea rcx, str.DelFile
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea rcx, [rsp + 0x120]
mov edx, eax
call fcn.140003870
add ebp, 1
cmp ebp, edi
jle 0x1400043b0
mov rax, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x740]
test rax, rax
je 0x140004476
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x140017540], 0
je 0x14000448c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupPromptReboot]
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x30], 0
call qword [sym.imp.SETUPAPI.dll_CM_Connect_MachineA]
test eax, eax
je 0x1400044b0
mov eax, 2
jmp 0x14000425e
mov r9, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNode_ExA]
test eax, eax
jne 0x1400044da
mov r8, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_CM_Reenumerate_DevNode_Ex]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400044ea
call qword [sym.imp.SETUPAPI.dll_CM_Disconnect_Machine]
xor eax, eax
jmp 0x14000425e
xor eax, eax
jmp 0x140004266