Function at 0x403ae0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425f00
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1d74
call fcn.00417520
mov eax, dword [0x432a20]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1d68], esi
mov edi, edx
mov dword [ebp - 0x1d7c], edi
xor ebx, ebx
mov byte [ebp - 0x1d5d], bl
mov dword [ebp - 0x1d70], ebx
mov dword [ebp - 0x1d74], ebx
mov dword [ebp - 0x1d64], ebx
mov eax, dword [ebp + 8]
mov dword [esi], eax
push str._Delete_Installed_Inf__
call fcn.00406f10
add esp, 4
cmp edi, ebx
je 0x403e9f
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x403b60
sub eax, edx
je 0x403e9f
mov dword [ebp - 4], ebx
push str.Setupapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1d70], eax
cmp eax, ebx
je 0x403b9b
push str.SetupUninstallOEMInfA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1d74], eax
mov dword [ebp - 0x1d6c], ebx
lea ecx, [ebp - 0x1d6c]
push ecx
call fcn.00409b70
add esp, 4
push 0x400
push ebx
lea edx, [ebp - 0x41c]
push edx
call fcn.00416c00
add esp, 0xc
push 0x400
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x403c09
push str.Get_Windows_Directory___
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, esi
call fcn.00406dd0
add esp, 4
mov dword [ebp - 0x1d78], ebx
push 0x42ded0
lea ecx, [ebp - 0x1d78]
push ecx
call fcn.004151ff
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x403c12
sub eax, edx
cmp byte [ebp + eax - 0x41d], 0x5c
jne 0x403c3a
push 0x42a97c
push 0x400
lea edx, [ebp - 0x41c]
push edx
jmp 0x403c4b
push str.inf
push 0x400
lea eax, [ebp - 0x41c]
push eax
call fcn.00412fa1
add esp, 0xc
push 0x400
push ebx
lea ecx, [ebp - 0xc1c]
push ecx
call fcn.00416c00
add esp, 0xc
lea edx, [ebp - 0x41c]
push edx
push str._sOEM___.inf
lea edx, [ebp - 0xc1c]
call fcn.00401e30
add esp, 8
lea eax, [ebp - 0x1d5c]
push eax
lea ecx, [ebp - 0xc1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x1d64], edi
cmp edi, 0xffffffff
jne 0x403cd8
lea edx, [ebp - 0xc1c]
push edx
push str.Find_OEM_Inf___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, esi
call fcn.00406dd0
add esp, 8
mov dword [ebp - 0x1d80], ebx
push 0x42ded0
lea eax, [ebp - 0x1d80]
push eax
call fcn.004151ff
push 0x1000
push ebx
lea ecx, [ebp - 0x1c1c]
push ecx
call fcn.00416c00
add esp, 0xc
lea ecx, [ecx]
push 0x400
push ebx
lea edx, [ebp - 0x81c]
push edx
call fcn.00416c00
add esp, 0xc
lea eax, [ebp - 0x1d30]
push eax
lea ecx, [ebp - 0x41c]
push ecx
push str._s_s
lea edx, [ebp - 0x81c]
call fcn.00401e30
add esp, 0xc
test byte [ebp - 0x1d5c], 0x10
jne 0x403e09
lea edx, [ebp - 0x81c]
push edx
call fcn.00409540
add esp, 4
mov eax, dword [ebp - 0x1d7c]
push eax
mov ecx, esi
call fcn.00403ed0
test al, al
je 0x403e09
mov eax, dword [ebp - 0x1d74]
push ebx
cmp eax, ebx
je 0x403daa
push 1
lea ecx, [ebp - 0x1d30]
push ecx
call eax
test eax, eax
jne 0x403d92
lea edx, [ebp - 0x1d30]
push edx
push str.Delete_OEM_Inf___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, esi
call fcn.00406dd0
add esp, 8
jmp 0x403e09
lea eax, [ebp - 0x1d30]
push eax
push str._s_deleted_complete_by_API_
mov ecx, esi
call fcn.00406f10
add esp, 8
jmp 0x403e09
xor ecx, ecx
call fcn.00409550
add esp, 4
cmp eax, 0x40004
jne 0x403dca
lea edx, [ebp - 0x1d30]
mov ecx, esi
call fcn.00404230
jmp 0x403dd7
mov edx, esi
lea ecx, [ebp - 0x81c]
call fcn.00408e90
push 0x2e
lea ecx, [ebp - 0x81c]
push ecx
call fcn.00412520
add esp, 8
cmp eax, ebx
je 0x403e09
push str..pnf
push 5
push eax
call fcn.004124ad
add esp, 0xc
mov edx, esi
lea ecx, [ebp - 0x81c]
call fcn.00408e90
lea edx, [ebp - 0x1d5c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403cf0
mov ecx, dword [ebp - 0x1d6c]
call fcn.00409ae0
mov dword [ebp - 4], 0xffffffff
jmp 0x403e67
mov eax, dword [ebp - 0x1d70]
cmp eax, ebx
je 0x403e78
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, ebx
je 0x403e88
cmp edi, 0xffffffff
je 0x403e88
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push str._Delete_Installed_Inf_END_
mov ecx, esi
call fcn.00406f10
add esp, 4
mov al, byte [ebp - 0x1d5d]
jmp 0x403eb0
push str.Invalid_Driver_name__
mov ecx, esi
call fcn.00406f10
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00412333
mov esp, ebp
pop ebp
ret 4