Function at 0x140028c40
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb20
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0xb78], rbx
mov rax, qword [0x14012e6d8]
xor rax, rsp
mov qword [rsp + 0xb10], rax
mov qword [rsp + 0x80], r8
mov rbp, rdx
mov qword [rsp + 0x58], rdx
mov r14, rcx
xor esi, esi
lea r15d, [rsi + 1]
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x74], esi
call fcn.140055b68
mov rcx, rax
mov eax, esi
test rcx, rcx
setne al
test eax, eax
jne 0x140028cba
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea r13, [0x1400e9c18]
mov rbx, r13
or r12, 0xffffffffffffffff
shr rbx, 0x10
jne 0x140028cff
movzx edi, r13w
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x140028d1f
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140006090
jmp 0x140028d1f
xor eax, eax
mov rcx, r12
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.1400062e0
nop
mov dword [rsp + 0x6c], 0
mov word [rsp + 0x6f0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x6f2]
call fcn.14009c4e0
call fcn.140055b68
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140028d65
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x140028d9b
movzx edi, r13w
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x140028dbb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006090
jmp 0x140028dbb
xor eax, eax
mov rcx, r12
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.1400062e0
nop
test rbp, rbp
jne 0x140028dc4
xor ecx, ecx
jmp 0x140028dd6
xor eax, eax
mov rcx, r12
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.1400062e0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0x10], 0
jl 0x140028e1f
lea rdx, str.FUNC_01VEN_8086DEV
mov rcx, rbx
call fcn.14009b200
test rax, rax
je 0x140028e18
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
mov edi, 1
cmovne esi, edi
jmp 0x140028e24
mov edi, 1
jmp 0x140028e24
mov edi, 1
cmp dword [rbx - 0x10], 0
jl 0x140028e8e
lea rdx, str.SWDMMDEVAPI
mov rcx, rbx
call fcn.14009b200
test rax, rax
je 0x140028e8e
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140028e8e
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140028e66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140028e87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
jmp 0x140029357
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140029316
mov dword [rsp + 0x98], SafeArrayDestroyData
xor edi, edi
mov dword [rsp + 0x4c], edi
movsxd rsi, esi
mov qword [rsp + 0x60], rsi
lea r8, [rsp + 0x98]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14002930c
mov qword [rsp + 0x20], rdi
mov r9d, 0x104
lea r8, [rsp + 0x4e0]
lea rdx, [rsp + 0x98]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
mov rdx, rbp
lea rcx, [rsp + 0x4e0]
call fcn.14009b200
test rax, rax
je 0x1400292da
mov dword [rsp + 0x48], edi
xor r8d, r8d
mov edx, dword [rsp + 0xac]
lea rcx, [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rsp + 0x900]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDW]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x900]
call fcn.14009b200
test rax, rax
je 0x1400292da
mov ebp, edi
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
mov r8d, SafeArrayDestroy
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.140002510
test eax, eax
je 0x14002906e
mov rdx, qword [rsp + 0x78]
test rdx, rdx
jne 0x140028fae
mov ecx, edi
jmp 0x140028fc0
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsp + 0x40]
call fcn.1400062e0
mov rdi, qword [rsp + 0x40]
movsxd rsi, dword [rdi - 0x10]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x140028ff8
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.140004670
mov rdi, qword [rsp + 0x40]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.14009b820
test esi, esi
js 0x140029301
cmp esi, dword [rdi - 0xc]
jg 0x140029301
mov dword [rdi - 0x10], esi
mov word [rdi + rsi*2], 0
cmp dword [rdi - 0x10], 0
jl 0x140029061
lea rdx, str.MICROSOFT
mov rcx, rdi
call fcn.14009b200
test rax, rax
je 0x140029054
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
mov r8d, 1
cmovne ebp, r8d
mov rsi, qword [rsp + 0x60]
jmp 0x140029074
mov rsi, qword [rsp + 0x60]
mov r8d, 1
jmp 0x140029074
mov rsi, qword [rsp + 0x60]
mov r8d, 1
jmp 0x140029074
mov r8d, 1
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea rdx, [rsp + 0x98]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140029146
mov eax, 1
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x70], 0x208
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140029131
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.inf_
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call fcn.14009ccf0
lea r8, [rsp + 0x2d0]
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call fcn.14009ccf0
jmp 0x140029136
mov ebp, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
jmp 0x14002914d
mov edi, 1
mov ebp, edi
lea rdx, [rsp + 0x2d0]
mov rcx, r14
call fcn.140017110
cmp eax, 1
cmovg ebp, edi
test rsi, rsi
cmovne ebp, edi
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdi + 9]
lea rdx, [rsp + 0x98]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x1400292ce
lea r8, [rsp + 0x98]
mov rdx, r13
lea ecx, [rdi + 5]
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
mov r15d, eax
test eax, eax
je 0x1400292ac
test ebp, ebp
jne 0x1400292c7
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call fcn.140013b00
mov rdx, rax
mov rcx, r14
call fcn.1400180b0
test eax, eax
je 0x140029206
movsxd rax, dword [r14 + 0x3b1d8]
imul rax, rax, 0x12c8
mov dword [rax + r14 + 0x6c4], r15d
cmp dword [0x1401302e8], edi
jne 0x140029232
cmp dword [0x1401302ec], edi
jne 0x140029232
cmp dword [0x1401302f0], edi
jne 0x140029232
cmp dword [0x1401302f4], edi
jne 0x140029232
cmp dword [0x1401302f8], edi
je 0x1400292b0
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0xc0]
call fcn.1400027d0
test eax, eax
je 0x14002925e
mov r8d, eax
xor edx, edx
mov rcx, r14
call fcn.14000cf00
jmp 0x1400292b0
lea rdx, [0x1400e9d14]
lea rcx, [rsp + 0xc0]
call fcn.14009b200
mov word [rax], 0x2e
mov word [rax + 2], 0x50
mov word [rax + 4], 0x4e
mov word [rax + 6], 0x46
mov edx, 0x80
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400292b0
test ebp, ebp
jne 0x1400292d5
lea rdx, [rsp + 0x4e0]
mov rcx, r14
call fcn.14001d610
mov rbp, qword [rsp + 0x58]
jmp 0x1400292da
mov rbp, qword [rsp + 0x58]
jmp 0x1400292da
mov rbp, qword [rsp + 0x58]
jmp 0x1400292da
mov rbp, qword [rsp + 0x58]
mov eax, dword [rsp + 0x4c]
add eax, 1
mov dword [rsp + 0x4c], eax
lea r8, [rsp + 0x98]
mov edx, eax
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14002930c
jmp 0x140028ee2
mov ecx, 0x80070057
call fcn.140001610
int3
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140029333
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140029354
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r15d
mov rcx, qword [rsp + 0xb10]
xor rcx, rsp
call fcn.14009af10
mov rbx, qword [rsp + 0xb78]
add rsp, 0xb20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret