Function at 0x403a00
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x123c
call fcn.00411c00
mov eax, dword [0x43f194]
push ebx
push esi
push edi
mov dword [esp + 0x1244], eax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x2f0]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x9dc]
xor ebx, ebx
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x9d8]
push str.inf_
push ecx
call fcn.004115bd
lea edx, [esp + 0x9e0]
push str.o.inf
push edx
call fcn.004115bd
add esp, 0x10
lea eax, [esp + 0xff0]
push eax
lea ecx, [esp + 0x9dc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
lea ecx, [ecx]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xff0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40411f
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x7d0]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x7d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x7d0]
push str.inf_
push edx
call fcn.004115bd
lea eax, [esp + 0x1024]
push eax
lea ecx, [esp + 0x7dc]
push ecx
call fcn.004115bd
add esp, 0x10
push ebx
push 2
push ebx
lea edx, [esp + 0x7dc]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403a90
mov edi, dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push str.PrimaryDriver
push str.Setup.HP_LaserJet_M1005
push esi
push ebx
call edi
test eax, eax
jne 0x403e46
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
push str.M1005.DeviceDesc
push str.Strings
push esi
push ebx
call edi
test eax, eax
je 0x403a90
mov edx, dword [esp + 0x10]
lea eax, [edx + edx]
push eax
call fcn.00411e2f
mov ecx, dword [esp + 0x14]
add esp, 4
push ebx
push ecx
mov edi, eax
push edi
push str.M1005.DeviceDesc
push str.Strings
push esi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
je 0x403a90
push str.HP_LaserJet_M1005
push edi
call fcn.00411f9f
add esp, 8
test eax, eax
je 0x403e38
lea edx, [esp + 0x7d0]
push edx
lea eax, [esp + 0x2f4]
mov edi, 1
push eax
mov dword [esp + 0x20], edi
call fcn.004115e7
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 8
push 0x80
lea ecx, [esp + 0x2f4]
push ecx
call esi
lea edx, [esp + 0x2f0]
push edx
mov ecx, 0x442370
call fcn.00402000
cmp dword [0x442368], edi
jne 0x403d23
xor eax, eax
mov word [esp + 0xde8], bx
mov ecx, 0x81
lea edi, [esp + 0xdea]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x6c8], bl
mov ecx, 0x40
lea edi, [esp + 0x6c9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x4f8], bl
mov ecx, 0x31
lea edi, [esp + 0x4f9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0xdec]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0xde8]
push ecx
call fcn.00402980
add esp, 4
lea edx, [esp + 0x6c8]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x403c70
lea edi, [esp + 0x6c8]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403c82
mov edx, dword [str.pnputil.exe]
mov eax, dword [0x430810]
mov ecx, dword [0x430814]
mov dword [edi], edx
mov dl, byte [0x430818]
mov dword [edi + 4], eax
lea eax, [esp + 0x2f0]
mov dword [edi + 8], ecx
push eax
mov byte [edi + 0xc], dl
call fcn.00402980
add esp, 4
mov dword [esp + 0x4f8], 0x20642d
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403cd0
lea edi, [esp + 0x4f8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403ce1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4fc]
push ecx
push 0x430800
lea edx, [esp + 0x6d4]
push edx
push 1
call fcn.004122d7
add esp, 0x14
push str._r_ndeleted_the_scanner_inf_package_in_vista..._r_n
jmp 0x403e0a
lea eax, [esp + 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x403d5c
push 4
push ebx
lea ecx, [esp + 0x2f8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, ebx
mov dword [0x442358], edi
mov ecx, 0x442370
jne 0x403d61
push str._:_failed_to_delete_file_r_n
jmp 0x403d66
mov ecx, 0x442370
push str._:_file_deleted_r_n
call fcn.00402000
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
lea edx, [esp + 0x7d0]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004115e7
add esp, 8
lea ecx, [esp + 0x20]
push str..pnf
push ecx
call fcn.0041156a
lea edx, [esp + eax*2 + 0x20]
add esp, 4
push edx
call fcn.004115e7
add esp, 8
push 0x80
lea eax, [esp + 0x24]
push eax
call esi
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x442370
call fcn.00402000
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x403e05
push 4
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, ebx
mov dword [0x442358], 1
mov ecx, 0x442370
jne 0x403dfe
push str._:_failed_to_delete_file_r_n
jmp 0x403e0f
push str._:_file_deleted_r_n
jmp 0x403e0f
push str._:_file_deleted_r_n
mov ecx, 0x442370
call fcn.00402000
mov ecx, dword [esp + 0x14]
mov eax, 1
cmp ecx, eax
jne 0x403a90
mov ecx, dword [esp + 0x1244]
call fcn.00411bef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.00411d17
add esp, 4
jmp 0x403a90
mov ecx, dword [esp + 0x10]
lea edx, [ecx + ecx]
push edx
call fcn.00411e2f
add esp, 4
push ebx
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
push edi
push str.PrimaryDriver
push str.Setup.HP_LaserJet_M1005
push esi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
je 0x403a90
push str.HP_LaserJet_M1005
push edi
call fcn.00411f9f
add esp, 8
test eax, eax
je 0x403e38
lea ecx, [esp + 0x7d0]
push ecx
lea edx, [esp + 0x2f4]
mov edi, 1
push edx
mov dword [esp + 0x1c], edi
call fcn.004115e7
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 8
push 0x80
lea eax, [esp + 0x2f4]
push eax
call esi
lea ecx, [esp + 0x2f0]
push ecx
mov ecx, 0x442370
call fcn.00402000
cmp dword [0x442368], edi
jne 0x40400a
xor eax, eax
mov word [esp + 0xbe0], bx
mov ecx, 0x81
lea edi, [esp + 0xbe2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x5c0], bl
mov ecx, 0x40
lea edi, [esp + 0x5c1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x228], bl
xor eax, eax
mov ecx, 0x31
lea edi, [esp + 0x229]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [esp + 0xbe4]
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0xbe0]
push eax
call fcn.00402980
add esp, 4
lea edx, [esp + 0x5c0]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x403f57
lea edi, [esp + 0x5c0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403f70
mov ecx, dword [str.pnputil.exe]
mov edx, dword [0x430810]
mov eax, dword [0x430814]
mov dword [edi], ecx
mov cl, byte [0x430818]
mov dword [edi + 4], edx
lea edx, [esp + 0x2f0]
mov dword [edi + 8], eax
push edx
mov byte [edi + 0xc], cl
call fcn.00402980
add esp, 4
mov dword [esp + 0x228], 0x20642d
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403fb7
lea edi, [esp + 0x228]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403fc8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
lea eax, [esp + 0x22c]
push eax
rep movsb byte es:[edi], byte [esi]
push 0x430800
lea ecx, [esp + 0x5cc]
push ecx
push 1
call fcn.004122d7
add esp, 0x14
push str._r_ndeleted_the_printer_inf_package_in_vista..._r_n
jmp 0x4040f1
lea edx, [esp + 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404043
push 4
push ebx
lea eax, [esp + 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, ebx
mov dword [0x442358], edi
mov ecx, 0x442370
jne 0x404048
push str._:_failed_to_delete_file_r_n
jmp 0x40404d
mov ecx, 0x442370
push str._:_file_deleted_r_n
call fcn.00402000
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x7d0]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.004115e7
add esp, 8
lea eax, [esp + 0x20]
push str..pnf
push eax
call fcn.0041156a
lea ecx, [esp + eax*2 + 0x20]
add esp, 4
push ecx
call fcn.004115e7
add esp, 8
push 0x80
lea edx, [esp + 0x24]
push edx
call esi
lea eax, [esp + 0x20]
push eax
mov ecx, 0x442370
call fcn.00402000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4040ec
push 4
push ebx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, ebx
mov dword [0x442358], 1
mov ecx, 0x442370
jne 0x4040e5
push str._:_failed_to_delete_file_r_n
jmp 0x4040f6
push str._:_file_deleted_r_n
jmp 0x4040f6
push str._:_file_deleted_r_n
mov ecx, 0x442370
call fcn.00402000
mov ecx, dword [esp + 0x18]
mov eax, 1
cmp ecx, eax
jne 0x403a90
mov ecx, dword [esp + 0x1244]
call fcn.00411bef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1244]
mov eax, 1
call fcn.00411bef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret