Function at 0x40ded0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472d3d
mov eax, dword fs:[0]
push eax
sub esp, 0xbf8
mov eax, dword [0x490bcc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.004543e0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x834], dx
push 0x206
push 0
lea eax, [ebp - 0x832]
push eax
call fcn.004543e0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004543e0
add esp, 0xc
lea ecx, [ebp - 0x854]
call fcn.00403760
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x89c]
call fcn.00403760
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x86c]
call fcn.00403760
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x884]
call fcn.00403760
mov byte [ebp - 4], 3
push 0
push closesocket
push 0x47ecf0
push 0x47ed00
lea eax, [ebp - 0xbbc]
push eax
call fcn.0040aa00
add esp, 0x14
mov dword [ebp - 0xb6c], eax
mov ecx, dword [ebp - 0xb6c]
push ecx
lea ecx, [ebp - 0x854]
call fcn.00403820
lea ecx, [ebp - 0xbbc]
call fcn.00403900
lea ecx, [ebp - 0x854]
call fcn.004036b0
cmp eax, 3
jbe 0x40e1e4
lea ecx, [ebp - 0x854]
call fcn.004036b0
sub eax, 3
push eax
push 0
lea edx, [ebp - 0xb8c]
push edx
lea ecx, [ebp - 0x854]
call fcn.0040f6b0
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0xb70], eax
mov byte [ebp - 4], 4
push 0x47ed5c
mov ecx, dword [ebp - 0xb70]
push ecx
lea edx, [ebp - 0xc04]
push edx
call fcn.0040f770
add esp, 0xc
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0xb58]
push eax
lea ecx, [ebp - 0x89c]
call fcn.00403820
lea ecx, [ebp - 0xc04]
call fcn.00403900
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb8c]
call fcn.00403900
lea ecx, [ebp - 0x854]
call fcn.00409cb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x89c]
call fcn.00409cb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push closesocket
push 0x47ed64
push str.InfPath
push 0x47ed78
call fcn.0040ab90
add esp, 0x14
movzx ecx, byte [0x49504c]
test ecx, ecx
jne 0x40e1e4
push 0
push closesocket
push 0x47edd4
push 0x47ede8
lea edx, [ebp - 0xbec]
push edx
call fcn.0040aa00
add esp, 0x14
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0xb68]
push eax
lea ecx, [ebp - 0x86c]
call fcn.00403820
lea ecx, [ebp - 0xbec]
call fcn.00403900
lea ecx, [ebp - 0x86c]
call fcn.004036b0
cmp eax, 3
jbe 0x40e1e4
lea ecx, [ebp - 0x86c]
call fcn.004036b0
sub eax, 3
push eax
push 0
lea ecx, [ebp - 0xbd4]
push ecx
lea ecx, [ebp - 0x86c]
call fcn.0040f6b0
mov dword [ebp - 0xb44], eax
mov edx, dword [ebp - 0xb44]
mov dword [ebp - 0xb54], edx
mov byte [ebp - 4], 5
push 0x47ee44
mov eax, dword [ebp - 0xb54]
push eax
lea ecx, [ebp - 0xba4]
push ecx
call fcn.0040f770
add esp, 0xc
mov dword [ebp - 0xb5c], eax
mov edx, dword [ebp - 0xb5c]
push edx
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0xba4]
call fcn.00403900
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbd4]
call fcn.00403900
lea ecx, [ebp - 0x86c]
call fcn.00409cb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x884]
call fcn.00409cb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push closesocket
push 0x47ee4c
push str.InfPathMp
push str.SYSTEMCurrentControlSetServicesNamSvcNDIS
call fcn.0040ab90
add esp, 0x14
push 1
lea ecx, [ebp - 0x83c]
call fcn.004031c0
lea ecx, [ebp - 0x83c]
call fcn.0040fb90
mov byte [ebp - 4], 6
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x420]
push edx
push str._wsdrivers_s.sys
push 0x208
lea eax, [ebp - 0x834]
push eax
call fcn.0040a780
add esp, 0x14
lea ecx, [ebp - 0x834]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x420]
push edx
push str._wsDriverStoreFileRepository
push 0x208
lea eax, [ebp - 0x218]
push eax
call fcn.0040a780
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e5a1
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x218]
push eax
push str._ws_ws.inf
push 0x208
lea ecx, [ebp - 0x218]
push ecx
call fcn.0040a780
add esp, 0x14
call fcn.00408ba0
mov dword [ebp - 0xb34], eax
lea edx, [ebp - 0x218]
mov dword [ebp - 0xb10], edx
cmp dword [ebp - 0xb10], 0
jne 0x40e2cb
mov dword [ebp - 0xb30], 0
jmp 0x40e38a
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xb18], eax
mov ecx, dword [ebp - 0xb18]
add ecx, 2
mov dword [ebp - 0xb64], ecx
mov edx, dword [ebp - 0xb18]
mov ax, word [edx]
mov word [ebp - 0xb1e], ax
add dword [ebp - 0xb18], 2
cmp word [ebp - 0xb1e], 0
jne 0x40e2e6
mov ecx, dword [ebp - 0xb18]
sub ecx, dword [ebp - 0xb64]
sar ecx, 1
mov dword [ebp - 0xb40], ecx
mov edx, dword [ebp - 0xb40]
add edx, 1
mov dword [ebp - 0xb14], edx
cmp dword [ebp - 0xb14], 0x3fffffff
jle 0x40e342
mov dword [ebp - 0xb38], 0
jmp 0x40e37e
mov eax, dword [ebp - 0xb14]
shl eax, 1
call fcn.00464c50
mov dword [ebp - 0xb74], esp
mov eax, dword [ebp - 0xb34]
push eax
mov ecx, dword [ebp - 0xb14]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0xb10]
push edx
mov eax, dword [ebp - 0xb74]
push eax
call fcn.0040f7d0
mov dword [ebp - 0xb38], eax
mov ecx, dword [ebp - 0xb38]
mov dword [ebp - 0xb30], ecx
mov edx, dword [ebp - 0xb30]
push edx
push str.Scan_DriverStore_for__s
push 1
mov eax, dword [0x49512c]
push eax
call fcn.004091d0
add esp, 0x10
lea ecx, [ebp - 0xaec]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xb24], eax
cmp dword [ebp - 0xb24], 0xffffffff
je 0x40e5a1
xor eax, eax
mov word [ebp - 0x62c], ax
push 0x20a
push 0
lea ecx, [ebp - 0x62a]
push ecx
call fcn.004543e0
add esp, 0xc
lea edx, [ebp - 0xac0]
push edx
lea eax, [ebp - 0x420]
push eax
push str._wsDriverStoreFileRepository_ws
push 0x208
lea ecx, [ebp - 0x62c]
push ecx
call fcn.0040a780
add esp, 0x14
lea edx, [ebp - 0x62c]
mov dword [ebp - 0xb10], edx
cmp dword [ebp - 0xb10], 0
jne 0x40e437
mov dword [ebp - 0xb2c], 0
jmp 0x40e4f6
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xb1c], eax
mov ecx, dword [ebp - 0xb1c]
add ecx, 2
mov dword [ebp - 0xb48], ecx
mov edx, dword [ebp - 0xb1c]
mov ax, word [edx]
mov word [ebp - 0xb26], ax
add dword [ebp - 0xb1c], 2
cmp word [ebp - 0xb26], 0
jne 0x40e452
mov ecx, dword [ebp - 0xb1c]
sub ecx, dword [ebp - 0xb48]
sar ecx, 1
mov dword [ebp - 0xb4c], ecx
mov edx, dword [ebp - 0xb4c]
add edx, 1
mov dword [ebp - 0xb14], edx
cmp dword [ebp - 0xb14], 0x3fffffff
jle 0x40e4ae
mov dword [ebp - 0xb3c], 0
jmp 0x40e4ea
mov eax, dword [ebp - 0xb14]
shl eax, 1
call fcn.00464c50
mov dword [ebp - 0xb60], esp
mov eax, dword [ebp - 0xb34]
push eax
mov ecx, dword [ebp - 0xb14]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0xb10]
push edx
mov eax, dword [ebp - 0xb60]
push eax
call fcn.0040f7d0
mov dword [ebp - 0xb3c], eax
mov ecx, dword [ebp - 0xb3c]
mov dword [ebp - 0xb2c], ecx
mov edx, dword [ebp - 0xb2c]
push edx
push str.Try_to_delete__s
push 1
mov eax, dword [0x49512c]
push eax
call fcn.004091d0
add esp, 0x10
mov dword [ebp - 0xb0c], 0
xor ecx, ecx
mov dword [ebp - 0xb08], ecx
mov dword [ebp - 0xb04], ecx
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xaf4], ecx
mov word [ebp - 0xaf0], cx
mov edx, 0x14
mov word [ebp - 0xafc], dx
lea eax, [ebp - 0x62c]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb08], 3
lea ecx, [ebp - 0xb0c]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea edx, [ebp - 0xaec]
push edx
mov eax, dword [ebp - 0xb24]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40e3cd
mov ecx, dword [ebp - 0xb24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x83c]
call fcn.0040fbc0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x884]
call fcn.00403900
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x86c]
call fcn.00403900
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x89c]
call fcn.00403900
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call fcn.00403900
lea esp, [ebp - 0xc08]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451fd2
mov esp, ebp
pop ebp
ret