Function at 0x415cda
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push 0x2a4
mov eax, 0x469d75
call fcn.004522ba
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x278], 0
lea esi, [ebp - 0x26c]
mov dword [ebp - 0x270], eax
mov edi, ecx
call fcn.00415be5
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x258], esi
jne 0x415d2c
xor edi, edi
inc edi
lea esi, [ebp - 0x26c]
call fcn.00409790
mov eax, edi
call fcn.0045233d
ret
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.00455920
add esp, 0xc
mov dword [ebp - 0x274], esi
call fcn.0040ac6a
mov dword [ebp - 0x278], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.drivers
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x218]
call fcn.00415c6e
push ebx
lea eax, [ebp - 0x218]
push eax
call esi
push 0
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x415db2
push 8
pop edi
jmp 0x415fd3
push 3
push dword [ebp - 0x270]
lea eax, [ebp - 0x218]
push eax
call fcn.0040b748
test eax, eax
jne 0x415dd2
push 0xa
pop edi
jmp 0x415fb2
push dword [ebp - 0x270]
lea eax, [ebp - 0x234]
mov dword [ebp - 0x274], 1
call fcn.00415c29
pop ecx
push 8
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x268]
pop ebx
cmp dword [ebp - 0x254], ebx
jae 0x415e09
lea esi, [ebp - 0x268]
mov edi, dword [ebp - 0x230]
cmp dword [ebp - 0x21c], ebx
jae 0x415e1d
lea edi, [ebp - 0x230]
push str.Group
call fcn.0040b575
test eax, eax
je 0x415fa0
mov edi, dword [ebp - 0x230]
cmp dword [ebp - 0x21c], ebx
jae 0x415e43
lea edi, [ebp - 0x230]
push str.Description
mov esi, str.poflt_minifilter_driver
call fcn.0040b575
test eax, eax
je 0x415fa0
mov edx, dword [ebp - 0x270]
lea eax, [ebp - 0x294]
call fcn.00401860
lea ecx, [ebp - 0x250]
push str._Instance
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040d8fc
pop ecx
pop ecx
lea esi, [ebp - 0x294]
mov byte [ebp - 4], 4
call fcn.00409790
push str.Instances_
lea eax, [ebp - 0x234]
push eax
call fcn.0040bc85
mov esi, dword [ebp - 0x24c]
cmp dword [ebp - 0x238], ebx
jae 0x415eb8
lea esi, [ebp - 0x24c]
mov edi, dword [ebp - 0x230]
cmp dword [ebp - 0x21c], ebx
jae 0x415ecc
lea edi, [ebp - 0x230]
push str.DefaultInstance
call fcn.0040b575
test eax, eax
jne 0x415eed
lea esi, [ebp - 0x250]
push 0xb
pop edi
call fcn.00409790
jmp 0x415fa3
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x250]
push eax
lea esi, [ebp - 0x234]
call fcn.004077b0
push 0x40b3c
push 0x46ec3c
lea esi, [ebp - 0x2b0]
call fcn.0040b494
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
jb 0x415f24
mov eax, dword [eax + 4]
jmp 0x415f27
add eax, 4
mov edi, dword [ebp - 0x230]
cmp dword [ebp - 0x21c], ebx
jae 0x415f3b
lea edi, [ebp - 0x230]
push str.Altitude
mov esi, eax
call fcn.0040b575
test eax, eax
je 0x415f6d
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x21c], ebx
jae 0x415f5f
lea eax, [ebp - 0x230]
push eax
call fcn.0040b549
test eax, eax
je 0x415f6d
xor bl, bl
jmp 0x415f6f
mov bl, 1
lea esi, [ebp - 0x2b0]
call fcn.00409790
lea esi, [ebp - 0x250]
test bl, bl
jne 0x415ee0
xor edi, edi
call fcn.00409790
lea esi, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00409790
jmp 0x415fd3
push 0xb
pop edi
lea esi, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00409790
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x274], 0
je 0x415fd3
push dword [ebp - 0x270]
call fcn.0040b899
push dword [ebp - 0x278]
call fcn.0040acaa
jmp 0x415d19