Function at 0x140031be0
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Query or enumerate registry value
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1600
call fcn.1400ec240
sub rsp, rax
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rsp + 0x1650], rbx
mov rax, qword [0x140134780]
xor rax, rsp
mov qword [rsp + 0x15f0], rax
mov ebp, r8d
mov dword [rsp + 0x78], r8d
mov r15, rdx
mov qword [rsp + 0x80], rdx
mov r14, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xc0], rdx
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x98], 0
mov dword [rsp + 0x90], 0
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140031c80
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, [0x1400eeb50]
test rdx, 0xffffffffffff0000
jne 0x140031cc5
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140031cd4
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400060c0
mov rbx, qword [rsp + 0x40]
jmp 0x140031cd4
lea rcx, [rsp + 0x40]
call fcn.140006560
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x60], 0
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140031cfb
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.ACPVEN_1002
test rdx, 0xffffffffffff0000
jne 0x140031d3b
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140031d46
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400060c0
jmp 0x140031d46
lea rcx, [rsp + 0x70]
call fcn.140006560
nop
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140031d65
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x68], rsi
lea rdx, str.ACPVEN_1022
test rdx, 0xffffffffffff0000
jne 0x140031daa
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140031db9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400060c0
mov rsi, qword [rsp + 0x68]
jmp 0x140031db9
lea rcx, [rsp + 0x68]
call fcn.140006560
mov rsi, qword [rsp + 0x68]
mov r9d, 6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x140031e63
lea rdx, [rsi - 0x18]
or r12, rax
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140031df9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140031e1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140031e3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140031e5c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140032bd5
mov dword [rsp + 0xe8], SafeArrayDestroyData
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0xe8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
or r12, 0xffffffffffffffff
test eax, eax
je 0x140032382
nop
nop
nop
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
mov r8d, 4
lea rdx, [rsp + 0xe8]
mov rcx, r13
call fcn.140001ff0
test eax, eax
je 0x14003234c
mov rdx, qword [rsp + 0x98]
test rdx, rdx
jne 0x140031ee4
xor ecx, ecx
jmp 0x140031ef6
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsp + 0x40]
call fcn.140006310
mov rbx, qword [rsp + 0x40]
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140031f2e
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14009fd30
test edi, edi
js 0x140032373
cmp edi, dword [rbx - 0xc]
jg 0x140032373
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
mov rdx, qword [r15]
test rdx, rdx
je 0x14003234c
cmp dword [rbx - 0x10], 0
jl 0x14003234c
mov rcx, rbx
call fcn.14009f5d0
test rax, rax
je 0x14003234c
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14003234c
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edi, 1
mov r8d, edi
lea rdx, [rsp + 0xe8]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140032344
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x8c], 0x208
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x780]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140032331
mov dword [rsp + 0x58], eax
mov edx, 0x104
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x360]
call fcn.1400a1c80
lea r8, [rsp + 0x780]
mov edx, 0x104
lea rcx, [rsp + 0x360]
call fcn.1400a1c80
lea rdx, [rsp + 0x780]
mov rcx, r14
call fcn.140017430
xor r14d, r14d
cmp eax, edi
cmovg r14d, edi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rax, [rsp + 0x13e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdi + 8]
lea rdx, [rsp + 0xe8]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x14003232c
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rsp + 0xfc0]
lea rdx, [rsp + 0xe8]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, edi
lea rdx, [rsp + 0xe8]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov ecx, dword [rsp + 0x58]
call fcn.1400a3350
mov rbp, rax
test rax, rax
je 0x14003214e
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8d, edi
lea rdx, [rsp + 0xe8]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov r8d, dword [rsp + 0x78]
lea rdx, [rsp + 0xfc0]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.14002ba20
lea r8, [rsp + 0x11d0]
lea rdx, [rsp + 0x360]
mov rcx, rdi
call fcn.140005380
test eax, eax
je 0x140032193
xor edx, edx
lea rcx, [rsp + 0x11d0]
call fcn.140002bd0
lea r8, [rsp + 0xe8]
mov rdx, r13
mov ecx, 5
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
mov edi, eax
test r14d, r14d
jne 0x1400321f7
cmp dword [rsp + 0x78], r14d
je 0x1400321f7
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0xc8]
call fcn.140013740
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.1400183d0
test eax, eax
je 0x1400321f7
mov rcx, qword [rsp + 0x48]
movsxd rax, dword [rcx + 0x3b0e0]
imul rax, rax, 0x12c8
mov dword [rax + rcx + 0x5cc], edi
mov eax, dword [rsp + 0x5c]
test edi, edi
mov ecx, 1
cmovne eax, ecx
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x78], 0
je 0x1400322e0
test r14d, r14d
jne 0x1400322d9
cmp dword [0x140139918], r14d
jne 0x14003224e
cmp dword [0x14013991c], r14d
jne 0x14003224e
cmp dword [0x140139920], r14d
jne 0x14003224e
cmp dword [0x140139924], r14d
jne 0x14003224e
cmp dword [0x140139928], r14d
je 0x1400322d2
lea r9, [rsp + 0x60]
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0x360]
call fcn.1400022b0
test eax, eax
je 0x14003227f
mov r8d, eax
xor edx, edx
mov r14, qword [rsp + 0x48]
mov rcx, r14
call fcn.14000c780
jmp 0x1400322e5
lea rdx, [0x1400ee8ac]
lea rcx, [rsp + 0x360]
call fcn.14009f5d0
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r14, qword [rsp + 0x48]
jmp 0x1400322e5
mov r14, qword [rsp + 0x48]
jmp 0x1400322e5
mov r14, qword [rsp + 0x48]
jmp 0x1400322e5
mov r14, qword [rsp + 0x48]
test rbp, rbp
je 0x140032331
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], 0
jl 0x140032317
lea rdx, str.INTCAUDIOBUS
call fcn.14009f5d0
test rax, rax
je 0x140032317
sub rax, qword [rdi]
sar rax, 1
cmp eax, 0xffffffff
jne 0x140032322
mov rdx, rbp
mov rcx, r14
call fcn.14001fad0
mov rcx, rbp
call fcn.1400a32b0
jmp 0x140032331
mov r14, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x80]
jmp 0x14003234c
mov r15, qword [rsp + 0x80]
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0xe8]
mov edx, eax
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14003237e
jmp 0x140031ea0
mov ecx, 0x80070057
call fcn.140001120
int3
mov ebp, dword [rsp + 0x78]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test ebp, ebp
jne 0x14003241c
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400323b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400323d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400323f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140032413
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x5c]
jmp 0x140032bd5
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x110]
call fcn.1400a09f0
mov edx, 0x104
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.infoem.inf
mov edx, 0x104
lea rcx, [rsp + 0x360]
call fcn.1400a1c80
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140032b49
call fcn.14003c3f0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140032b3e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x13c]
lea rax, [rsp + 0x13c]
test rax, 0xffffffffffff0000
jne 0x1400324ec
movzx edi, cx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400325f1
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400060c0
mov rsi, qword [rsp + 0x50]
jmp 0x1400325f1
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x13c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140032567
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400325f1
cmp dword [rdx + 0x10], eax
jge 0x140032533
cmp dword [rsi - 0xc], eax
jl 0x140032af7
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x1400325f1
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003254b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x40]
jmp 0x1400325f1
mov ebp, dword [rsi - 0x10]
lea r13, [rsp + 0x13c]
sub r13, rsi
sar r13, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14003259a
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004410
mov rsi, qword [rsp + 0x50]
cmp r13, rbp
ja 0x1400325ba
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rsi + r13*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.14009f850
jmp 0x1400325d7
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x13c]
mov rdx, rbp
mov rcx, rsi
call fcn.14009f640
test edi, edi
js 0x140032b33
cmp edi, dword [rsi - 0xc]
jg 0x140032b33
mov dword [rsi - 0x10], edi
mov word [rsi + rbp], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140032abc
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140032ab2
mov qword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [rsp + 0x570]
mov edi, 1
mov edx, edi
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140032ab2
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xdb0]
lea r8, [rsp + 0x570]
mov rdx, rbp
mov rcx, r14
call fcn.140003280
test eax, eax
jne 0x1400326c2
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032ad8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140032ad8
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [rsp + 0x570]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140032ab2
mov qword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [rsp + 0x990]
mov edx, edi
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140032ab2
lea rax, [rsp + 0xdb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x990]
lea r8, [rsp + 0xba0]
mov rdx, rbp
mov rcx, r14
call fcn.140012f50
lea r9, [rsp + 0xd0]
lea r8, str.AddService
lea rdx, [rsp + 0xba0]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140032a8a
mov qword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [rsp + 0x570]
mov edx, edi
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x140032a62
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x570]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14003280f
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400328a1
cmp dword [rdx + 0x10], eax
jge 0x1400327db
cmp dword [rbx - 0xc], eax
jl 0x140032b02
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x1400328a1
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400327f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x50]
jmp 0x1400328a1
mov r13d, dword [rbx - 0x10]
lea r14, [rsp + 0x570]
sub r14, rbx
sar r14, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140032843
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rbx, qword [rsp + 0x40]
cmp r14, r13
ja 0x140032863
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rbx + r14*2]
mov r9, r13
mov rdx, r13
mov rcx, rbx
call fcn.14009f850
jmp 0x140032880
movsxd rax, edi
lea r13, [rax + rax]
mov r9, r13
lea r8, [rsp + 0x570]
mov rdx, r13
mov rcx, rbx
call fcn.14009f640
test edi, edi
js 0x140032b18
cmp edi, dword [rbx - 0xc]
jg 0x140032b18
mov dword [rbx - 0x10], edi
mov word [r13 + rbx], 0
mov r14, qword [rsp + 0x48]
movsxd rdi, dword [rbx - 0x10]
mov r13d, 1
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400328cb
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14009fd30
test edi, edi
js 0x140032b0d
cmp edi, dword [rbx - 0xc]
jg 0x140032b0d
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
test rdx, rdx
je 0x140032a36
cmp dword [rbx - 0x10], 0
jl 0x140032a36
mov rcx, rbx
call fcn.14009f5d0
test rax, rax
je 0x140032a36
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140032a36
mov edx, 0x104
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0x360]
call fcn.1400a1c80
lea r8, [rsp + 0x13c]
mov edx, 0x104
lea rcx, [rsp + 0x360]
call fcn.1400a1c80
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x78]
call fcn.140013740
mov rdx, rax
mov rcx, r14
call fcn.1400183d0
mov edi, eax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0x360]
call fcn.1400022b0
test eax, eax
je 0x1400329c5
mov r8d, eax
xor edx, edx
mov rcx, r14
call fcn.14000c780
jmp 0x140032ab2
test edi, edi
je 0x1400329df
movsxd rax, dword [r14 + 0x3b0e0]
imul rax, rax, 0x12c8
mov dword [rax + r14 + 0x5cc], r13d
lea rdx, [0x1400ee8ac]
lea rcx, [rsp + 0x360]
call fcn.14009f5d0
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov edx, 0x80
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140032ab2
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032ad8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140032ad8
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032ad8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140032ad8
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032ad8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140032ad8
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032ad8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x110]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140032b23
mov rbx, qword [rsp + 0x40]
jmp 0x140032480
mov ecx, 0x80070057
call fcn.140001120
nop
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x68]
jmp 0x140032b49
mov ecx, 0x80070057
call fcn.140001120
nop
mov ecx, 0x80004005
call fcn.140001120
nop
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032b66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032b88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032baa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140032bd1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x15f0]
xor rcx, rsp
call fcn.1400a1970
mov rbx, qword [rsp + 0x1650]
add rsp, 0x1600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret