Function at 0x4042b0
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
mov rax, rsp
sub rsp, 0xda8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00445f40]
xor rax, rsp
mov qword [rsp + 0xd60], rax
mov rdi, rdx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
call fcn.004137b4
mov rcx, rax
xor r12d, r12d
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x40432b
mov ecx, 0x80004005
call entry0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
call fcn.004137b4
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x40435a
mov ecx, 0x80004005
call entry0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0xa0], r12d
xor edx, edx
mov r8d, 0x13c
lea rcx, [rsp + 0xa4]
call fcn.0041a500
xor r9d, r9d
xor r8d, r8d
mov edx, 0x408
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
mov r15, rax
mov dword [rsp + 0x40], r12d
mov edx, 0x100
lea rcx, [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdi, [rsp + 0x3e0]
xor eax, eax
mov rsi, 0xffffffffffffffff
mov rcx, rsi
repne scasb al, byte [rdi]
mov rax, qword [str.INFoem.inf]
mov qword [rdi - 1], rax
mov eax, dword [0x00434800]
mov dword [rdi + 7], eax
movzx eax, word [0x00434804]
mov word [rdi + 0xb], ax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
lea r13d, [rsi + 2]
nop
nop
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0xcc]
repne scasb al, byte [rdi]
not rcx
sub rcx, r13
mov rdi, rcx
test ecx, ecx
jne 0x404480
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x4044fb
cmp dword [rdx + 0x10], eax
jge 0x404455
cmp dword [rbx - 0xc], eax
jl 0x404bc1
mov dword [rbx - 0x10], r12d
mov byte [rbx], al
jmp 0x4044fb
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40446c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
jmp 0x4044fb
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xcc]
sub rbp, rbx
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x4044ae
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.00401690
mov rbx, qword [rsp + 0x50]
cmp rbp, rsi
ja 0x4044ca
movsxd rsi, edi
lea r8, [rbx + rbp]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.00419ed0
jmp 0x4044e3
movsxd rsi, edi
mov r9, rsi
lea r8, [rsp + 0xcc]
mov rdx, rsi
mov rcx, rbx
call fcn.00419df0
test edi, edi
js 0x405403
cmp edi, dword [rbx - 0xc]
jg 0x405403
mov dword [rbx - 0x10], edi
mov byte [rsi + rbx], 0
mov esi, r12d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov rbp, rax
mov eax, 0x66666667
mov edi, dword [rsp + 0x40]
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea edx, [rdx + rdx*4]
add edx, edx
cmp edi, edx
jne 0x404557
cmp r15d, 0x5a
jge 0x404557
movsxd r8, r15d
xor r9d, r9d
mov edx, 0x402
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
add r15d, r13d
add edi, r13d
mov dword [rsp + 0x40], edi
cmp rbp, 0xffffffffffffffff
je 0x404a50
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x404a42
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x100
lea r8, [rsp + 0x1e0]
mov edx, r13d
lea rcx, [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x404a42
lea rdi, [rsp + 0x1e0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str..NTamd64]
mov qword [rdi - 1], rax
movzx eax, byte [0x004347f0]
mov byte [rdi + 7], al
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x404a42
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x100
lea r8, [rsp + 0x1e0]
lea edx, [rdi + 2]
lea rcx, [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x404a42
mov rdx, qword [0x004479e0]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
je 0x404650
mov rax, qword [0x004479e0]
cmp dword [rax - 0x10], edi
jne 0x4049d8
mov rdx, qword [0x004479e8]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a18]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447aa0]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a90]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a38]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447ac8]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447ac0]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a28]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a00]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a88]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a68]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a80]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447ad0]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a08]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a98]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447ab8]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a20]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447ad8]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x004479f8]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447ab0]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a10]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a60]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a58]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a50]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a30]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447aa8]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447ae0]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a48]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a40]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a78]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x00447a70]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x4049d8
mov rdx, qword [0x004479f0]
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
je 0x404a42
mov esi, r13d
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Strings
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x404aa9
mov qword [rsp + 0x20], rdi
mov r9d, 0x100
lea r8, [rsp + 0x1e0]
mov edx, r13d
lea rcx, [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x404aa9
lea rdx, str.Microsoft
lea rcx, [rsp + 0x1e0]
call fcn.00419c30
test rax, rax
jne 0x404aa9
mov r12d, r13d
jmp 0x404aa9
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
jmp 0x404b9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edi
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x404aa1
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
test esi, esi
je 0x404b9d
test r12d, r12d
je 0x404b9d
mov rdx, rbx
lea rcx, [rsp + 0xc50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rbx
lea rcx, [rsp + 0x920]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rbp, qword [rsp + 0x78]
mov rdx, rbp
lea rcx, [rsp + 0x810]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rbp
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x0043459c]
lea rcx, [rsp + 0x920]
call fcn.00419c30
mov byte [rax], 0x2e
mov byte [rax + 1], 0x50
mov byte [rax + 2], 0x4e
mov byte [rax + 3], 0x46
lea rdx, [rsp + 0xc50]
lea rcx, [rsp + 0x810]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x920]
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, 0x80
lea rcx, [rsp + 0x810]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x810]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, 0x80
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0xa0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x404bcc
mov rsi, 0xffffffffffffffff
xor r12d, r12d
jmp 0x404410
mov ecx, 0x80070057
call entry0
int3
mov edx, 0x100
lea rcx, [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdi, [rsp + 0x3e0]
xor eax, eax
mov rsi, 0xffffffffffffffff
mov rcx, rsi
repne scasb al, byte [rdi]
mov rax, qword [str.INF_alcx.inf]
mov qword [rdi - 1], rax
mov eax, dword [0x004347e0]
mov dword [rdi + 7], eax
movzx eax, word [0x004347e4]
mov word [rdi + 0xb], ax
movzx eax, byte [0x004347e6]
mov byte [rdi + 0xd], al
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov rbx, qword [rsp + 0x48]
nop
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0xcc]
repne scasb al, byte [rdi]
not rcx
sub rcx, r13
mov rdi, rcx
test ecx, ecx
jne 0x404caf
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x404d2a
cmp dword [rdx + 0x10], eax
jge 0x404c84
cmp dword [rbx - 0xc], eax
jl 0x40539c
mov dword [rbx - 0x10], eax
mov byte [rbx], al
jmp 0x404d2a
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x404c9b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
jmp 0x404d2a
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xcc]
sub rbp, rbx
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x404cdd
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.00401690
mov rbx, qword [rsp + 0x48]
cmp rbp, rsi
ja 0x404cf9
movsxd rsi, edi
lea r8, [rbx + rbp]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.00419ed0
jmp 0x404d12
movsxd rsi, edi
mov r9, rsi
lea r8, [rsp + 0xcc]
mov rdx, rsi
mov rcx, rbx
call fcn.00419df0
test edi, edi
js 0x4053f8
cmp edi, dword [rbx - 0xc]
jg 0x4053f8
mov dword [rbx - 0x10], edi
mov byte [rsi + rbx], 0
xor r12d, r12d
xor ebp, ebp
xor r9d, r9d
xor edx, edx
lea r8d, [r12 + 2]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov rsi, rax
mov eax, 0x66666667
mov edi, dword [rsp + 0x40]
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea edx, [rdx + rdx*4]
add edx, edx
cmp edi, edx
jne 0x404d89
cmp r15d, 0x5a
jge 0x404d89
movsxd r8, r15d
xor r9d, r9d
mov edx, 0x402
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
add r15d, r13d
add edi, r13d
mov dword [rsp + 0x40], edi
cmp rsi, 0xffffffffffffffff
je 0x405237
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x405229
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x100
lea r8, [rsp + 0x2e0]
mov edx, r13d
lea rcx, [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x405229
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [rsp + 0x2e0]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x405229
mov qword [rsp + 0x20], rdi
mov r9d, 0x100
lea r8, [rsp + 0x2e0]
lea edx, [rdi + 2]
lea rcx, [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x405229
mov rdx, qword [0x004479e0]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
je 0x404e58
mov rax, qword [0x004479e0]
cmp dword [rax - 0x10], edi
jne 0x4051c3
mov rdx, qword [0x004479e8]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a18]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447aa0]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a90]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a38]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447ac8]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447ac0]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a28]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a00]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a88]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a68]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a80]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447ad0]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a08]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a98]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447ab8]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a20]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447ad8]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x004479f8]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447ab0]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a10]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a60]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a58]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a50]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a30]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447aa8]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447ae0]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a48]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a78]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x00447a70]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x4051c3
mov rdx, qword [0x004479f0]
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
je 0x405229
mov r12d, r13d
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Strings
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x405287
mov qword [rsp + 0x20], rdi
mov r9d, 0x100
lea r8, [rsp + 0x2e0]
mov edx, r13d
lea rcx, [rsp + 0x58]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x405287
lea rdx, str.Microsoft
lea rcx, [rsp + 0x2e0]
call fcn.00419c30
test rax, rax
jne 0x405287
mov ebp, r13d
jmp 0x405287
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
jmp 0x40537b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edi
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x40527f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
test r12d, r12d
je 0x40537b
test ebp, ebp
je 0x40537b
mov rdx, rbx
lea rcx, [rsp + 0xb40]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rbx
lea rcx, [rsp + 0xa30]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rdi
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x0043459c]
lea rcx, [rsp + 0xa30]
call fcn.00419c30
mov byte [rax], 0x2e
mov byte [rax + 1], 0x50
mov byte [rax + 2], 0x4e
mov byte [rax + 3], 0x46
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0xa30]
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, 0x80
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, 0x80
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0xa0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4053a7
mov rsi, 0xffffffffffffffff
jmp 0x404c40
mov ecx, 0x80070057
call entry0
int3
test r12d, r12d
je 0x4053b0
test ebp, ebp
jne 0x4053b3
xor r13d, r13d
lea rdx, [rbx - 0x18]
mov rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x4053d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x4053f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
jmp 0x40540e
mov ecx, 0x80070057
call entry0
int3
mov ecx, 0x80070057
call entry0
nop
mov rcx, qword [rsp + 0xd60]
xor rcx, rsp
call fcn.004196e0
mov rbx, qword [rsp + 0xdc0]
mov rbp, qword [rsp + 0xdc8]
mov rsi, qword [rsp + 0xda0]
mov rdi, qword [rsp + 0xd98]
mov r12, qword [rsp + 0xd90]
mov r13, qword [rsp + 0xd88]
mov r14, qword [rsp + 0xd80]
mov r15, qword [rsp + 0xd78]
add rsp, 0xda8
ret