Function at 0x102ed54
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x103d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0x9f4], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0x9e0], edi
mov dword [ebp - 0x9ec], ebx
mov dword [ebp - 0xa28], esi
mov dword [ebp - 0xa2c], esi
mov dword [ebp - 0xa20], esi
mov dword [ebp - 0xa14], esi
mov dword [ebp - 0xa38], esi
mov dword [ebp - 0xa04], esi
mov dword [ebp - 0xa18], esi
mov dword [ebp - 0xa24], esi
call dword [sym.imp.SETUPAPI.dll_SetupGetThreadLogToken]
push esi
push 0xc8
mov dword [ebp - 0x9e8], eax
lea eax, [ebp - 0x194]
push eax
push ebx
push edi
mov dword [ebp - 0x9e4], edx
mov byte [ebp - 0x9f6], 0
mov byte [ebp - 0x9f5], 0
mov dword [ebp - 0xa0c], esi
mov dword [ebp - 0x9fc], esi
mov dword [ebp - 0xa08], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x102ee12
mov word [ebp - 0x194], ax
push ebx
push edi
call fcn.01031c91
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
test eax, eax
jne 0x102efc9
push 0x101c928
push 1
push 0
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateMutexW]
mov dword [ebp - 0xa08], eax
test eax, eax
jne 0x102ee6f
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
push eax
mov dword [ebp - 0x9f0], eax
push 0x101c8fc
push 1
push 0x1000000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x18
jmp 0x102faf7
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0xb7
jne 0x102efc9
cmp dword [0x103d08c], 0
mov esi, 0x10000000
je 0x102eee1
mov al, byte [0x103d090]
cmp al, 4
jae 0x102ee9b
test al, al
jne 0x102eee1
mov eax, dword [0x103d078]
mov ecx, dword [0x103d07c]
and eax, 2
and ecx, esi
or eax, ecx
je 0x102eee1
mov eax, dword [0x103d080]
mov edi, dword [0x103d084]
mov ecx, eax
mov edx, edi
and ecx, 2
and edx, esi
cmp ecx, eax
jne 0x102eee1
cmp edx, edi
jne 0x102eee1
push 0x1007d48
push dword [0x103d064]
push dword [0x103d060]
call fcn.0102d202
push 0x101c8c8
push 0x10004
push 0x1000000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
mov esi, dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_WaitForSingleObjectEx]
mov edi, 0xea60
jmp 0x102ef4d
cmp eax, 0x80
je 0x102ef5c
push 0x101c8c8
push 0x10004
push 0x1000000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push 0
push edi
push dword [ebp - 0xa08]
call esi
test eax, eax
jne 0x102ef1a
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
cmp dword [0x103d08c], 0
je 0x102efc9
mov al, byte [0x103d090]
cmp al, 4
jae 0x102ef7e
test al, al
jne 0x102efc9
mov eax, dword [0x103d078]
mov ecx, dword [0x103d07c]
mov esi, 0x10000000
and eax, 2
and ecx, esi
or eax, ecx
je 0x102efc9
mov eax, dword [0x103d080]
mov edi, dword [0x103d084]
mov ecx, eax
mov edx, edi
and ecx, 2
and edx, esi
cmp ecx, eax
jne 0x102efc9
cmp edx, edi
jne 0x102efc9
push 0x1007d58
push dword [0x103d064]
push dword [0x103d060]
call fcn.0102d202
push 0x101c8b0
push 0x30004
push 0x1000000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
cmp dword [0x103d08c], 0
je 0x102f04a
mov al, byte [0x103d090]
cmp al, 4
jae 0x102efff
test al, al
jne 0x102f04a
mov eax, dword [0x103d078]
mov ecx, dword [0x103d07c]
mov esi, 0x10010000
and eax, 1
and ecx, esi
or eax, ecx
je 0x102f04a
mov eax, dword [0x103d080]
mov edi, dword [0x103d084]
mov ecx, eax
mov edx, edi
and ecx, 1
and edx, esi
cmp ecx, eax
jne 0x102f04a
cmp edx, edi
jne 0x102f04a
push 0x1007d28
push dword [0x103d064]
push dword [0x103d060]
call fcn.0102d202
push 1
push 0x20800
push 0x10154e8
call sub.ntdll.dll_WinSqmStartSession
mov esi, dword [ebp - 0x9ec]
mov edi, dword [ebp - 0x9e0]
push esi
push edi
mov dword [0x103d098], eax
call fcn.0102d296
push dword [ebp + 0x14]
push esi
push edi
call fcn.0102e14b
push 0x20019
push 2
push 0
push 1
push esi
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp eax, 0xffffffff
je 0x102f0a6
push eax
mov dword [ebp - 0xa24], 1
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea eax, [ebp - 0xa38]
push eax
push dword [ebp + 0x14]
push esi
push edi
push dword [ebp - 0xa10]
call fcn.01033632
test eax, eax
jne 0x102f1d5
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov dword [ebp - 0x9f0], eax
cmp eax, 0xe0000248
jne 0x102f13f
cmp dword [0x103d08c], 0
je 0x102f136
mov al, byte [0x103d090]
cmp al, 4
jae 0x102f0ee
test al, al
jne 0x102f136
mov edx, dword [0x103d07c]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x102f136
mov edx, dword [0x103d084]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x103d080]
jne 0x102f136
cmp ecx, edx
jne 0x102f136
lea eax, [ebp - 0x194]
push eax
push 0x1007cd8
push dword [0x103d064]
push dword [0x103d060]
call fcn.0102d1a0
push 0x101c880
push 1
jmp 0x102f1af
cmp eax, 0xe0000203
jne 0x102f1ca
cmp dword [0x103d08c], 0
je 0x102f1a8
mov al, byte [0x103d090]
cmp al, 4
jae 0x102f160
test al, al
jne 0x102f1a8
mov edx, dword [0x103d07c]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x102f1a8
mov edx, dword [0x103d084]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x103d080]
jne 0x102f1a8
cmp ecx, edx
jne 0x102f1a8
lea eax, [ebp - 0x194]
push eax
push 0x1007ce8
push dword [0x103d064]
push dword [0x103d060]
call fcn.0102d1a0
push 0x101c838
push 2
push 0x1000000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
jmp 0x102faf7
push eax
push 0x101c7fc
jmp 0x102ee52
mov esi, 0x61c
push esi
lea eax, [ebp - 0x9dc]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9dc]
push eax
push dword [ebp - 0x9ec]
mov dword [ebp - 0x9dc], esi
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetSelectedDriverW]
mov dword [ebp - 0xa28], eax
test eax, eax
jne 0x102f309
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov dword [ebp - 0x9f0], eax
cmp eax, 0xe0000203
jne 0x102faf7
test dword [ebp + 0x14], 0x200
jne 0x102f242
push 1
push dword [ebp - 0x9ec]
push edi
call sub.SETUPAPI.dll_SetupDiReportDriverNotFoundError
push dword [ebp + 0x14]
push dword [ebp - 0x9ec]
push edi
push dword [ebp - 0xa10]
call fcn.0102de07
test eax, eax
jne 0x102faf7
test byte [ebp + 0x14], 0x20
je 0x102faf7
mov esi, 0x22c
push esi
lea eax, [ebp - 0x3c0]
push 0
push eax
call sub.msvcrt.dll_memset
mov edi, dword [ebp - 0x9ec]
add esp, 0xc
lea eax, [ebp - 0x3c0]
push eax
push edi
push dword [ebp - 0x9e0]
mov dword [ebp - 0x3c0], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x102f2ba
test dword [ebp - 0x3bc], 0x180
je 0x102f2ba
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x102f9b0
push 1
push 0xe
push dword [edi + 0x14]
call dword [sym.imp.SETUPAPI.dll_CM_Set_DevNode_Problem]
push 1
push 0x668
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
push 0x101c7e8
push 4
mov esi, 0x1000000
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
jmp 0x102f9c7
push dword [ebp - 0x9ec]
push edi
call fcn.01031a70
test eax, eax
jne 0x102f336
push 0x101c7a8
push 2
push 0x800000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
test byte [ebp + 0x14], 1
jne 0x102f362
lea eax, [ebp - 0x9dc]
push eax
push dword [ebp - 0x9ec]
push edi
call fcn.0103170b
test eax, eax
je 0x102f362
mov dword [ebp - 0x9f0], 0x5b3
jmp 0x102faf7
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
lea eax, [ebp - 0x9dc]
push eax
push dword [ebp - 0x9ec]
push edi
call fcn.0102e97f
mov dword [ebp - 0x9f0], eax
test eax, eax
jne 0x102faf7
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push dword [ebp - 0x9ec]
push edi
push 0x18
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
jne 0x102f3c5
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov dword [ebp - 0x9f0], eax
cmp eax, 0xe000020e
jne 0x102faf7
push dword [ebp - 0x9ec]
push edi
call fcn.0102d46e
test eax, eax
jne 0x102f3d9
or dword [ebp + 0x14], 4
xor edi, edi
test byte [ebp + 0x14], 4
jne 0x102f477
push edi
lea eax, [ebp - 0xa18]
push eax
push edi
push edi
lea eax, [ebp - 0xa00]
push eax
mov esi, 0x1015450
push esi
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
jne 0x102f477
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x102f477
cmp dword [ebp - 0xa00], 0x12
jne 0x102f477
push dword [ebp - 0xa18]
push 0x40
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalAlloc]
mov dword [ebp - 0xa04], eax
cmp eax, edi
je 0x102f477
push edi
push edi
push dword [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa00]
push eax
push esi
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
jne 0x102f477
push dword [ebp - 0xa04]
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
mov dword [ebp - 0xa04], edi
push dword [ebp - 0xa10]
call fcn.0103276c
test eax, eax
je 0x102f4b6
call fcn.01031d9b
test eax, eax
je 0x102f4b6
push 0x101c768
push 4
push 0x1000000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
mov dword [ebp - 0xa0c], 1
push edi
push edi
push 4
lea eax, [ebp - 0x9fc]
push eax
lea eax, [ebp - 0xa00]
push eax
push 0x1015428
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
je 0x102f4ec
cmp dword [ebp - 0xa00], 7
je 0x102f4f2
mov dword [ebp - 0x9fc], edi
mov esi, dword [ebp - 0x9ec]
push 4
pop ecx
add esi, ecx
mov edi, 0x1015304
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x102f5fe
call dword [sym.imp.SETUPAPI.dll_SetupOpenFileQueue]
mov dword [ebp - 0x9f4], eax
cmp eax, 0xffffffff
jne 0x102f52c
mov dword [ebp - 0x9f0], 8
jmp 0x102faf7
xor edi, edi
cmp dword [ebp - 0xa0c], edi
jne 0x102f545
test byte [ebp - 0x9fc], 2
jne 0x102f545
test byte [ebp + 0x14], 0x40
je 0x102f588
push 0x101c734
push 4
mov esi, 0x1000000
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push 8
push 8
push dword [ebp - 0x9f4]
call dword [sym.imp.SETUPAPI.dll_SetupSetFileQueueFlags]
test eax, eax
jne 0x102f58d
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov dword [ebp - 0x9f0], eax
jmp 0x102faf7
mov esi, 0x1000000
push 0x22c
lea eax, [ebp - 0x3c0]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c0]
push eax
push dword [ebp - 0x9ec]
mov dword [ebp - 0x3c0], 0x22c
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x102f577
mov eax, dword [ebp - 0x9f4]
or dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a8], eax
lea eax, [ebp - 0x3c0]
push eax
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
test eax, eax
jne 0x102f637
jmp 0x102f577
test byte [ebp + 0x14], 0x40
je 0x102f630
push 0x101c714
push 4
push 0x1000000
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
mov dword [ebp - 0x9f0], 0x57
jmp 0x102faf7
xor edi, edi
mov esi, 0x1000000
push 0x101c700
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
push 0x15
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x102f577
cmp dword [ebp - 0x9f4], 0xffffffff
je 0x102f792
push 0x101c6e8
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
mov eax, dword [ebp + 0x14]
add esp, 0x14
and eax, 8
mov dword [ebp - 0xa10], eax
lea ecx, [ebp - 0xa2c]
push ecx
neg eax
push edi
sbb eax, eax
push edi
and eax, 0xfffff9e1
push edi
add eax, 0x620
push eax
push dword [ebp - 0x9f4]
call dword [sym.imp.SETUPAPI.dll_SetupScanFileQueueW]
cmp dword [ebp - 0xa10], edi
je 0x102f6ef
cmp dword [ebp - 0xa2c], 1
je 0x102f6ef
mov dword [ebp - 0x9f0], 5
jmp 0x102faf7
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.SETUPAPI.dll_SetupInitDefaultQueueCallbackEx]
mov dword [ebp - 0xa20], eax
cmp eax, edi
je 0x102f577
push 0x101c6cc
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push dword [ebp - 0xa20]
push 0x102d766
push dword [ebp - 0x9f4]
push edi
call dword [sym.imp.SETUPAPI.dll_SetupCommitFileQueueW]
test eax, eax
je 0x102f577
push 1
push edi
push dword [ebp - 0x9f4]
call dword [sym.imp.SETUPAPI.dll_SetupPromptReboot]
test eax, eax
je 0x102f75f
mov dword [ebp - 0xa14], 1
push edi
cmp dword [ebp - 0xa04], edi
je 0x102f778
push dword [ebp - 0xa18]
push dword [ebp - 0xa04]
push 0x12
jmp 0x102f77b
push edi
push edi
push edi
push 0x1015464
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDevicePropertyW]
test byte [ebp + 0x14], 0x40
je 0x102f7e8
push edi
push 0x668
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
push edi
push 0x4c8
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
push edi
push 0x4c7
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
lea eax, [ebp - 0x9dc]
push eax
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call fcn.0102eb4f
jmp 0x102f57d
push 0x22c
lea eax, [ebp - 0x3c0]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c0]
push eax
push dword [ebp - 0x9ec]
mov dword [ebp - 0x3c0], 0x22c
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x102f577
cmp dword [ebp - 0x9f4], 0xffffffff
je 0x102f85b
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0x9f4]
call dword [sym.imp.SETUPAPI.dll_SetupGetFileQueueFlags]
test eax, eax
je 0x102f85b
test byte [ebp - 0xa34], 4
jne 0x102f85b
or dword [ebp - 0x3b8], 0x20000000
or dword [ebp - 0x3bc], esi
cmp dword [ebp - 0xa0c], edi
je 0x102f88c
or dword [ebp - 0x3bc], 0x20100
push 0x101c678
push 2
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
test byte [ebp - 0x9fc], 2
je 0x102f8b8
or dword [ebp - 0x3bc], 0x100
push 0x101c63c
push 2
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
lea eax, [ebp - 0x3c0]
push eax
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
test eax, eax
je 0x102f577
push 0x101c620
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push dword [ebp - 0x9ec]
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
push dword [ebp - 0x9e0]
push 0x22
call edi
test eax, eax
je 0x102f577
push 0x101c604
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
push 0x20
call edi
test eax, eax
je 0x102f577
push 0x101c5ec
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
push 2
call edi
test eax, eax
jne 0x102f269
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
push eax
push 0x101c5cc
push 1
mov dword [ebp - 0x9f0], eax
push esi
jmp 0x102ee59
push 0
push 0x668
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
mov esi, 0x1000000
push dword [ebp + 0x14]
push edi
push dword [ebp - 0x9e0]
call fcn.0102e77b
push dword [0x103d09c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push edi
push dword [ebp - 0x9e0]
call fcn.010315cd
test eax, eax
je 0x102fa38
test byte [ebp + 0x14], 0x10
jne 0x102fa1b
cmp dword [ebp - 0xa0c], 0
jne 0x102fa1b
test byte [ebp - 0x9fc], 2
jne 0x102fa1b
push 0x10000
push edi
push dword [ebp - 0x9e0]
call fcn.01031562
push 0x101c590
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push 1
jmp 0x102fa3a
push 0
push 0x4c8
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
push edi
push dword [ebp - 0x9e0]
call fcn.01031672
test eax, eax
je 0x102fab2
test byte [ebp + 0x14], 0x10
jne 0x102fa83
cmp dword [ebp - 0xa0c], 0
jne 0x102fa83
test byte [ebp - 0x9fc], 2
jne 0x102fa83
push 0x20000
push edi
push dword [ebp - 0x9e0]
call fcn.01031562
push 0x101c554
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push 1
push 0x4c7
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
xor esi, esi
jmp 0x102fac5
xor esi, esi
push esi
push 0x4c7
push dword [0x103d098]
call sub.ntdll.dll_WinSqmSetDWORD
cmp dword [ebp - 0x9fc], esi
je 0x102faf1
push esi
push 4
lea eax, [ebp - 0x9fc]
push eax
push 7
push 0x1015428
push edi
push dword [ebp - 0x9e0]
mov dword [ebp - 0x9fc], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDevicePropertyW]
mov dword [ebp - 0x9f0], esi
push dword [ebp - 0x9f0]
mov esi, 0x1000000
push 0x101c534
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
push 0x101c508
push 4
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x2c
push 0x101c11c
push 0x101c1e4
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetModuleHandleW]
push eax
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetProcAddress]
xor edi, edi
cmp dword [ebp - 0xa04], edi
je 0x102fb5e
push dword [ebp - 0xa04]
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
cmp dword [ebp - 0xa20], edi
je 0x102fb72
push dword [ebp - 0xa20]
call dword [sym.imp.SETUPAPI.dll_SetupTermDefaultQueueCallback]
cmp dword [ebp - 0x9f4], 0xffffffff
je 0x102fbe9
cmp dword [ebp - 0x9f0], edi
je 0x102fb91
push edi
push edi
push dword [ebp - 0x9f4]
call dword [sym.imp.SETUPAPI.dll_SetupUninstallNewlyCopiedInfs]
mov edi, dword [ebp - 0x9ec]
lea eax, [ebp - 0x3c0]
push eax
push edi
push dword [ebp - 0x9e0]
mov dword [ebp - 0x3c0], 0x22c
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x102fbdb
and dword [ebp - 0x3bc], 0xfffffff7
or dword [ebp - 0x3a8], 0xffffffff
lea eax, [ebp - 0x3c0]
push eax
push edi
push dword [ebp - 0x9e0]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
push dword [ebp - 0x9f4]
call dword [sym.imp.SETUPAPI.dll_SetupCloseFileQueue]
jmp 0x102fbef
mov edi, dword [ebp - 0x9ec]
cmp dword [ebp - 0xa28], 0
push dword [ebp - 0x9f0]
push dword [ebp - 0xa24]
push dword [ebp - 0xa14]
je 0x102fc13
lea eax, [ebp - 0x9dc]
push eax
jmp 0x102fc15
push 0
push edi
push dword [ebp - 0x9e0]
call sub.SETUPAPI.dll_pSetupDiCrimsonLogDeviceInstall
cmp dword [ebp - 0x9f0], 0
jne 0x102fde3
push 0
push dword [edi + 0x14]
lea eax, [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
test eax, eax
jne 0x102fcb3
test dword [ebp - 0xa30], 0x100
jne 0x102fcb3
test dword [ebp - 0xa30], 0x400
je 0x102fcb3
cmp dword [ebp - 0xa1c], eax
je 0x102fcb3
cmp dword [ebp - 0xa1c], 0xe
je 0x102fcb3
cmp dword [ebp - 0xa1c], 0x1c
je 0x102fcb3
push 0x101c4cc
push 2
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
test dword [ebp + 0x14], 0x200
jne 0x102fcb3
push 1
push dword [ebp - 0xa1c]
push edi
push dword [ebp - 0x9e0]
call sub.SETUPAPI.dll_SetupDiReportPnPDeviceProblem
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
push 0
push 0
push 1
lea eax, [ebp - 0x9f6]
push eax
lea eax, [ebp - 0xa00]
push eax
push 0x10153d8
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call edi
test eax, eax
je 0x102fd56
cmp dword [ebp - 0xa00], 0x11
jne 0x102fd56
cmp byte [ebp - 0x9f6], 0xff
jne 0x102fd56
call fcn.01032c9e
test eax, eax
jne 0x102fd3d
test dword [ebp + 0x14], 0x200
jne 0x102fd36
push 0x101c490
push 5
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push 1
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call sub.SETUPAPI.dll_SetupDiReportGenericDriverInstalled
jmp 0x102fd56
push 0x101c410
jmp 0x102fd42
push 0x101c3c0
push 5
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push 0
push 0
push 1
lea eax, [ebp - 0x9f5]
push eax
lea eax, [ebp - 0xa00]
push eax
push 0x10153ec
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call edi
test eax, eax
je 0x102fdfc
cmp dword [ebp - 0xa00], 0x11
jne 0x102fdfc
cmp byte [ebp - 0x9f5], 0xff
jne 0x102fdfc
call fcn.01032cc7
test eax, eax
jne 0x102fddc
test dword [ebp + 0x14], 0x200
jne 0x102fdd3
push 0x101c378
push 5
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
push 1
push dword [ebp - 0x9ec]
push dword [ebp - 0x9e0]
call sub.SETUPAPI.dll_SetupDiReportAdditionalSoftwareRequested
jmp 0x102fdfc
push 0x101c2f0
push 5
jmp 0x102fdea
push 0x101c2a0
jmp 0x102fdd8
push 0x101c260
push 2
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
add esp, 0x14
xor edi, edi
cmp dword [ebp - 0xa08], edi
je 0x102fe1e
push dword [ebp - 0xa08]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_ReleaseMutex]
push dword [ebp - 0xa08]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
cmp dword [0x103d08c], edi
je 0x102fe74
mov al, byte [0x103d090]
cmp al, 4
jae 0x102fe33
test al, al
jne 0x102fe74
mov ecx, dword [0x103d07c]
mov edx, 0x10010000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x102fe74
mov ecx, dword [0x103d084]
mov eax, ecx
and eax, edx
xor edx, edx
cmp edx, dword [0x103d080]
jne 0x102fe74
cmp eax, ecx
jne 0x102fe74
push 0x1007d38
push dword [0x103d064]
push dword [0x103d060]
call fcn.0102d202
push dword [0x103d098]
call sub.ntdll.dll_WinSqmEndSession
push dword [ebp - 0x9f0]
mov dword [0x103d098], edi
push 0x101c238
push 0x50004
push esi
push dword [ebp - 0x9e4]
push dword [ebp - 0x9e8]
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x9f0]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01034b90
leave
ret 0x10