Function at 0x411010
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
sub rsp, 0x2c8
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov qword [r11 - 0x10], r13
mov qword [r11 - 0x18], r14
mov qword [r11 - 0x20], r15
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov ebx, ecx
mov dword [rsp + 0x30], ecx
mov qword [r11 - 0x180], 0xf
xor esi, esi
mov qword [r11 - 0x188], rsi
mov byte [rsp + 0x130], sil
lea rcx, [r11 - 0x1a0]
call fcn.0040a430
test al, al
jne 0x4110a9
cmp qword [rsp + 0x148], 0x10
jb 0x41109f
mov rcx, qword [rsp + 0x130]
call fcn.0041873c
mov eax, 0x4e2e
jmp 0x4121ac
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], rsi
mov byte [rsp + 0xb8], 0
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0xf0], rsi
mov byte [rsp + 0xe0], 0
mov ecx, 0x7300
call fcn.00424f00
mov r12, rax
test rax, rax
jne 0x41118e
lea rcx, str.Info__:_Fail_to_allocate_memory_for_UninstallSysFileList_n
call fcn.00404a90
nop
cmp qword [rsp + 0xf8], 0x10
jb 0x41111c
mov rcx, qword [rsp + 0xe0]
call fcn.0041873c
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0xf0], rsi
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0xd0], 0x10
jb 0x411150
mov rcx, qword [rsp + 0xb8]
call fcn.0041873c
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], rsi
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0x148], 0x10
jb 0x411184
mov rcx, qword [rsp + 0x130]
call fcn.0041873c
mov eax, 0x4e2f
jmp 0x4121ac
mov ecx, 0x1cc00
call fcn.00424f00
mov r14, rax
test rax, rax
jne 0x41123b
lea rcx, str.Info__:_Fail_to_allocate_memory_for_UninstallOldPIDList_n
call fcn.00404a90
nop
cmp qword [rsp + 0xf8], 0x10
jb 0x4111c9
mov rcx, qword [rsp + 0xe0]
call fcn.0041873c
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0xf0], rsi
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0xd0], 0x10
jb 0x4111fd
mov rcx, qword [rsp + 0xb8]
call fcn.0041873c
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], rsi
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0x148], 0x10
jb 0x411231
mov rcx, qword [rsp + 0x130]
call fcn.0041873c
mov eax, 0x4e2f
jmp 0x4121ac
xor edx, edx
mov r8d, 0x7300
mov rcx, r12
call fcn.004255a0
mov r8d, dword [0x00476b74]
imul r8, r8, 0x1cc
lea rdx, [0x00476b80]
mov rcx, r12
call fcn.00425980
mov ebp, dword [0x00476b74]
mov rcx, rbp
imul rcx, rcx, 0x1cc
add rcx, r12
mov r8d, 0x1cc0
lea rdx, str.smtmoadb.sys
call fcn.00425980
add ebp, 0x10
xor edx, edx
mov r8d, 0x1cc00
mov rcx, r14
call fcn.004255a0
mov r8d, dword [0x0046126c]
imul r8, r8, 0x1cc
lea rdx, [0x00482180]
mov rcx, r14
call fcn.00425980
mov r13d, dword [0x0046126c]
mov rcx, r13
imul rcx, rcx, 0x1cc
add rcx, r14
mov r8d, 0x4b78
lea rdx, str.vid_12d1pid_1030
call fcn.00425980
add r13d, 0x2a
test bl, 2
je 0x4112f6
mov edx, ebp
mov rcx, r12
call fcn.0040c960
mov qword [rsp + 0x120], 0xf
mov qword [rsp + 0x118], rsi
mov byte [rsp + 0x108], 0
mov r15, rsi
lea rcx, str.Setupapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x41133a
lea rcx, str.Info__:_Cant_find_Setupapi.dll__so_use_the_raw_delete._n
call fcn.00404a90
jmp 0x411352
lea rdx, str.SetupUninstallOEMInfA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x41135e
lea rcx, str.Info__:_Cant_find_SetupUninstallOEMInf_in_Setupapi.dll__so_use_the_raw_delete._n
call fcn.00404a90
lea r8, str.infoem.inf
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x60]
call fcn.00404870
nop
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.00403070
nop
cmp qword [rsp + 0x80], 0x10
jb 0x4113a8
mov rcx, qword [rsp + 0x68]
call fcn.0041873c
lea rcx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rcx, qword [rsp + 0x108]
lea rdx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x41206c
test bl, 1
je 0x41206c
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], 0
lea rbx, str.Inf_
nop
nop
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x88]
call fcn.00403070
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa8]
cmp r10, 0x10
cmovae rdx, rcx
mov r8, qword [rsp + 0xa0]
cmp rbx, rdx
jb 0x4115fa
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
add rax, r8
cmp rax, rbx
jbe 0x4115fa
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
mov rsi, rbx
sub rsi, rax
cmp r8, rsi
jae 0x4114ac
call fcn.0043e4b0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
mov rax, r8
sub rax, rsi
mov ebx, 5
cmp rax, rbx
cmovb rbx, rax
mov rax, 0xffffffffffffffff
sub rax, r8
cmp rax, rbx
jbe 0x4114d6
lea rax, [rbx + r8]
cmp rax, r8
jae 0x4114eb
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
test rbx, rbx
je 0x411712
lea rdi, [rbx + r8]
cmp rdi, 0xfffffffffffffffe
jbe 0x411513
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
cmp r10, rdi
jae 0x41153a
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.00402120
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411576
test rdi, rdi
jne 0x411576
xor esi, esi
mov qword [rsp + 0xa0], rsi
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rax], sil
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411714
test rdi, rdi
je 0x41170e
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
cmp r10, 0x10
cmovae rdx, rcx
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
sub r10, r8
lea rcx, [rax + r8]
lea r8, [rsi + rdx]
mov r9, rbx
mov rdx, r10
call fcn.00426220
mov qword [rsp + 0xa0], rdi
lea rax, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rdi + rax], 0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
xor esi, esi
jmp 0x411714
mov rax, 0xffffffffffffffff
sub rax, r8
cmp rax, 5
jbe 0x411613
lea rax, [r8 + 5]
cmp rax, r8
jae 0x411628
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
lea rdi, [r8 + 5]
cmp rdi, 0xfffffffffffffffe
jbe 0x411647
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
cmp r10, rdi
jae 0x41166e
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.00402120
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x4116a5
test rdi, rdi
jne 0x4116a5
mov qword [rsp + 0xa0], rsi
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rax], dil
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411714
test rdi, rdi
je 0x411714
lea rcx, [rsp + 0x90]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x90]
sub r10, r8
add rcx, r8
mov r9d, 5
mov r8, rbx
mov rdx, r10
call fcn.00426220
mov qword [rsp + 0xa0], rdi
lea rax, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rdi + rax], 0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411714
xor esi, esi
jmp 0x411714
xor esi, esi
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x17c]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
lea rdx, [rsp + 0x17c]
cmp rdx, rax
jb 0x4118f4
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
add rax, r8
lea rdx, [rsp + 0x17c]
cmp rax, rdx
jbe 0x4118f4
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
lea rsi, [rsp + 0x17c]
sub rsi, rax
cmp r8, rsi
jae 0x4117b0
call fcn.0043e4b0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
mov rax, r8
sub rax, rsi
cmp rax, rdi
cmovb rdi, rax
mov rax, 0xffffffffffffffff
sub rax, r8
cmp rax, rdi
jbe 0x4117d5
lea rax, [rdi + r8]
cmp rax, r8
jae 0x4117ea
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
test rdi, rdi
je 0x411a0f
lea rbx, [rdi + r8]
cmp rbx, 0xfffffffffffffffe
jbe 0x411812
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
cmp r10, rbx
jae 0x411839
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.00402120
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411872
test rbx, rbx
jne 0x411872
mov qword [rsp + 0xa0], rbx
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rax], bl
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411a0f
test rbx, rbx
je 0x411a0f
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
cmp r10, 0x10
cmovae rdx, rcx
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
sub r10, r8
lea rcx, [rax + r8]
lea r8, [rsi + rdx]
mov r9, rdi
mov rdx, r10
call fcn.00426220
mov qword [rsp + 0xa0], rbx
lea rax, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rbx + rax], 0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411a0f
mov rax, 0xffffffffffffffff
sub rax, r8
cmp rax, rdi
jbe 0x41190c
lea rax, [rdi + r8]
cmp rax, r8
jae 0x411921
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
test rdi, rdi
je 0x411a0f
lea rbx, [rdi + r8]
cmp rbx, 0xfffffffffffffffe
jbe 0x411949
call fcn.0043e3e0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
cmp r10, rbx
jae 0x411970
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.00402120
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x4119a6
test rbx, rbx
jne 0x4119a6
mov qword [rsp + 0xa0], rsi
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rax], bl
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411a0f
test rbx, rbx
je 0x411a0f
lea rcx, [rsp + 0x90]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x90]
sub r10, r8
add rcx, r8
mov r9, rdi
lea r8, [rsp + 0x17c]
mov rdx, r10
call fcn.00426220
mov qword [rsp + 0xa0], rbx
lea rax, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rbx + rax], 0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
xor esi, esi
xor edi, edi
test ebp, ebp
je 0x411cbf
lea rbx, [r12 + 0x1c8]
cmp dword [rbx], esi
je 0x411a59
mov edx, edi
imul rdx, rdx, 0x1cc
add rdx, r12
lea rcx, [rsp + 0x90]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x90]
call fcn.0040a5c0
cmp al, 1
je 0x411a6d
mov r10, qword [rsp + 0xa8]
add edi, 1
add rbx, 0x1cc
cmp edi, ebp
jae 0x411cb7
jmp 0x411a23
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rcx, qword [rsp + 0x90]
call fcn.0040f6a0
call fcn.00418c7c
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x41202e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae r8, qword [rsp + 0x90]
lea rdx, str._nInfo__:_Remove_inf_file___s__n
lea rcx, [rsp + 0x38]
call fcn.004038f0
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.00404a90
test r15, r15
je 0x411b65
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x17c]
call r15
test eax, eax
je 0x411b36
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Info__:_Remove_inf_file__s__OK._n
call fcn.00404a90
mov esi, 1
jmp 0x411c75
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
mov r8d, eax
lea rcx, str.Info__:_Remove_inf_file__s__err:_d._n
call fcn.00404a90
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rcx, qword [rsp + 0x90]
call fcn.00401bf0
test al, al
jne 0x411bb0
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Error_:_Remove_read_only_inf_file__s___err._n
call fcn.00404a90
jmp 0x411bd6
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Error_:_Remove_read_only_inf_file__s__Succeed._n
call fcn.00404a90
mov rdx, qword [rsp + 0xa0]
lea r8, [rdx - 1]
add rdx, 0xfffffffffffffffd
mov qword [rsp + 0x20], 3
lea r9, [0x00443430]
lea rcx, [rsp + 0x88]
call fcn.00403bd0
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rcx, qword [rsp + 0x90]
call fcn.00401bf0
test al, al
jne 0x411c4e
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Remove_read_only_pnf_file__s___err._n
call fcn.00404a90
jmp 0x411c75
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Remove_read_only_pnf_file__s__Succeed._n
call fcn.00404a90
nop
lea rdx, [rdi - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x411ca5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411cbf
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411cbf
mov r8, qword [rsp + 0xa0]
xor ebx, ebx
test r13d, r13d
je 0x411f77
nop
nop
mov edi, ebx
imul rdi, rdi, 0x1cc
add rdi, r14
lea rcx, [rsp + 0x90]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x90]
mov rdx, rdi
call fcn.0040a5c0
cmp al, 1
je 0x411d2c
mov rcx, rdi
call fcn.00410850
add ebx, 1
cmp ebx, r13d
jae 0x411d17
mov r10, qword [rsp + 0xa8]
jmp 0x411cd0
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411f77
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rcx, qword [rsp + 0x90]
call fcn.0040f6a0
call fcn.00418c7c
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x412039
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae r8, qword [rsp + 0x90]
lea rdx, str._nInfo__:_Remove_inf_file___s__n
lea rcx, [rsp + 0x40]
call fcn.004038f0
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.00404a90
test r15, r15
je 0x411e27
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x17c]
call r15
test eax, eax
je 0x411df0
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Info__:_Remove_inf_file__s__OK._n
call fcn.00404a90
jmp 0x411f37
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
mov r8d, eax
lea rcx, str.Info__:_Remove_inf_file__s__err:_d._n
call fcn.00404a90
test esi, esi
jne 0x411f37
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rcx, qword [rsp + 0x90]
call fcn.00401bf0
test al, al
jne 0x411e72
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Error_:_Remove_read_only_inf_file__s___err._n
call fcn.00404a90
jmp 0x411e98
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Error_:_Remove_read_only_inf_file__s__Succeed._n
call fcn.00404a90
mov rdx, qword [rsp + 0xa0]
lea r8, [rdx - 1]
add rdx, 0xfffffffffffffffd
mov qword [rsp + 0x20], 3
lea r9, [0x00443430]
lea rcx, [rsp + 0x88]
call fcn.00403bd0
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rcx, qword [rsp + 0x90]
call fcn.00401bf0
test al, al
jne 0x411f10
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Remove_read_only_pnf_file__s___err._n
call fcn.00404a90
jmp 0x411f37
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
lea rcx, str.Remove_read_only_pnf_file__s__Succeed._n
call fcn.00404a90
nop
lea rdx, [rdi - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x411f67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
jmp 0x411f77
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
lea rdx, [0x0044146f]
cmp rdx, rax
jb 0x411fe5
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
add rax, r8
cmp rax, rdx
jbe 0x411fe5
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, rcx
mov r8, rdx
sub r8, rax
xor r9d, r9d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x88]
call fcn.00403070
xor esi, esi
jmp 0x412007
xor esi, esi
mov qword [rsp + 0xa0], rsi
lea rax, [rsp + 0x90]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rax], sil
lea rdx, [rsp + 0x150]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x412044
lea rbx, str.Inf_
jmp 0x411410
mov ecx, 0x80004005
call fcn.00401000
int3
mov ecx, 0x80004005
call fcn.00401000
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x412094
mov rcx, qword [rsp + 0x90]
call fcn.0041873c
mov ebx, dword [rsp + 0x30]
jmp 0x412098
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rdx, qword [rsp + 0x108]
lea rcx, str.Info__:_No_inf_file__s__should_be_delete._n
call fcn.00404a90
jmp 0x412098
mov ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x4120a8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, 4
je 0x4120d9
cmp byte [0x0046113a], 1
jne 0x4120d9
mov edx, 1
lea rcx, str.WUDFUpdate_01007.dll
call fcn.0040c960
mov edx, dword [0x00461268]
lea rcx, [0x00461270]
call fcn.0040c960
lea rcx, str._nInfo__:_Remove_driver_file__OK._n
call fcn.00404a90
mov rcx, r12
call fcn.00424fd0
mov rcx, r14
call fcn.00424fd0
nop
cmp qword [rsp + 0x120], 0x10
jb 0x41210e
mov rcx, qword [rsp + 0x108]
call fcn.0041873c
mov qword [rsp + 0x120], 0xf
mov qword [rsp + 0x118], rsi
mov byte [rsp + 0x108], 0
cmp qword [rsp + 0xf8], 0x10
jb 0x412142
mov rcx, qword [rsp + 0xe0]
call fcn.0041873c
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0xf0], rsi
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0xd0], 0x10
jb 0x412176
mov rcx, qword [rsp + 0xb8]
call fcn.0041873c
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], rsi
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0x148], 0x10
jb 0x4121aa
mov rcx, qword [rsp + 0x130]
call fcn.0041873c
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.00425570
mov rbx, qword [rsp + 0x2d0]
mov rbp, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e0]
mov rdi, qword [rsp + 0x2e8]
mov r12, qword [rsp + 0x2c0]
mov r13, qword [rsp + 0x2b8]
mov r14, qword [rsp + 0x2b0]
mov r15, qword [rsp + 0x2a8]
add rsp, 0x2c8
ret