Function at 0x1002a4e0
Capabilities:
Enumerate device drivers on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ab05a
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x18a0
call fcn.101a4cf0
mov eax, dword [0x10221008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1000
lea eax, [ebp - 0x1820]
mov dword [ebp - 0x1844], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1844]
push eax
push 0x1000
lea eax, [ebp - 0x1820]
push eax
call dword [sym.imp.PSAPI.DLL_EnumDeviceDrivers]
mov edi, dword [ebp - 0x1844]
test eax, eax
jne 0x1002a657
cmp edi, 0x1000
jae 0x1002a657
cmp dword [0x10227688], 0
je 0x1002a650
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
cmp byte [eax + 0x54], 0
je 0x1002a650
cmp dword [eax + 0x58], 2
jb 0x1002a650
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1885], al
xor eax, eax
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x182c], 0
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x182c], 7
mov word [ebp - 0x1840], ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1844]
shr eax, 2
push eax
lea eax, [ebp - 0x1840]
push str.EnumDeviceDrivers_failed__array_size_needed_is__d_n
push eax
call fcn.100c2310
add esp, 0xc
lea eax, [ebp - 0x1840]
mov ecx, 0x10227688
push 0x4d
push str.RC::RCTrojanDriverDetector::IsDupDriverExist
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverdetector.cpp
push eax
push 2
call fcn.100c1e70
cmp byte [ebp - 0x1885], 0
je 0x1002a63e
lea eax, [ebp - 0x1840]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1840]
call fcn.100049f0
xor al, al
jmp 0x1002aba2
shr edi, 2
cmp dword [0x10227688], 0
je 0x1002a72d
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
cmp byte [eax + 0x54], 0
je 0x1002a72d
cmp dword [eax + 0x58], 4
jb 0x1002a72d
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1885], al
xor eax, eax
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x182c], 0
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x182c], 7
mov word [ebp - 0x1840], ax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1840]
push edi
push str.There_are__d_drivers:_n
push eax
call fcn.100c2310
add esp, 0xc
lea eax, [ebp - 0x1840]
mov ecx, 0x10227688
push 0x52
push str.RC::RCTrojanDriverDetector::IsDupDriverExist
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverdetector.cpp
push eax
push 4
call fcn.100c1e70
cmp byte [ebp - 0x1885], 0
je 0x1002a71b
lea eax, [ebp - 0x1840]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1840]
call fcn.100049f0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1828], xmm0
mov dword [ebp - 0x1828], 0
mov dword [ebp - 0x1824], 0
call fcn.10014570
mov dword [ebp - 0x1828], eax
mov dword [ebp - 4], 4
xor esi, esi
test edi, edi
je 0x1002ab3f
nop dword [eax + eax]
push 0x802
lea eax, [ebp - 0x820]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x820]
push 0x400
push eax
push dword [ebp + esi*4 - 0x1820]
call dword [sym.imp.PSAPI.DLL_GetDeviceDriverFileNameW]
test eax, eax
je 0x1002ab36
xor eax, eax
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x182c], 0
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x182c], 7
mov word [ebp - 0x1840], ax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x820]
mov dword [ebp - 0x1894], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x1890], eax
mov dword [ebp - 0x1894], eax
mov dword [ebp - 0x1890], 7
mov word [ebp - 0x18a4], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002a810
sub ecx, edx
lea eax, [ebp - 0x820]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x18a4]
call fcn.10004a60
mov byte [ebp - 4], 6
lea edx, [ebp - 0x1840]
lea ecx, [ebp - 0x18a4]
call fcn.1002fb20
mov byte [ebp - 0x1885], al
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18a4]
call fcn.100049f0
cmp byte [ebp - 0x1885], 0
je 0x1002ab27
xorps xmm0, xmm0
lea ecx, [ebp - 0x1854]
movups xmmword [ebp - 0x1854], xmm0
call fcn.1002f690
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x184c]
test eax, eax
je 0x1002a89e
cmp dword [ebp - 0x1848], 0
jne 0x1002a89e
lea ecx, [ebp - 0x1848]
push ecx
call eax
lea edx, [ebp - 0x1885]
mov byte [ebp - 0x1885], 0
lea ecx, [ebp - 0x1840]
call fcn.1000e090
test al, al
je 0x1002a9df
cmp byte [ebp - 0x1885], 0
je 0x1002a9df
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x1002a8dd
push dword [ebp - 0x1848]
call eax
xor eax, eax
mov dword [ebp - 0x1874], 0
lea ecx, [ebp - 0x820]
mov dword [ebp - 0x1870], 0
mov dword [ebp - 0x1874], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x1870], 7
mov word [ebp - 0x1884], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002a917
sub ecx, edx
lea eax, [ebp - 0x820]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1884]
call fcn.10004a60
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1884]
call fcn.1009f300
lea eax, [ebp - 0x1884]
push eax
lea ecx, [ebp - 0x1828]
call fcn.100150b0
cmp eax, dword [ebp - 0x1828]
je 0x1002a99c
cmp dword [eax + 0x24], 8
lea edx, [eax + 0x10]
jb 0x1002a96e
mov edx, dword [eax + 0x10]
push dword [eax + 0x20]
cmp dword [ebp - 0x1870], 8
lea ecx, [ebp - 0x1884]
push edx
cmovae ecx, dword [ebp - 0x1884]
mov edx, dword [ebp - 0x1874]
call fcn.1000f470
add esp, 8
test eax, eax
jns 0x1002abc0
push dword [ebp - 0x1844]
lea eax, [ebp - 0x1884]
push eax
push ecx
lea eax, [ebp - 0x18ac]
push eax
lea ecx, [ebp - 0x1828]
call fcn.100151f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1884]
call fcn.100049f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1854]
call fcn.1002f850
jmp 0x1002ab27
cmp dword [0x10227688], 0
jne 0x1002a9ec
xor ecx, ecx
jmp 0x1002aa11
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
xor ecx, ecx
cmp byte [eax + 0x54], cl
je 0x1002aa11
cmp dword [eax + 0x58], 4
jb 0x1002aa11
cmp byte [eax + 0x5c], cl
setne cl
inc ecx
mov dword [ebp - 0x188c], ecx
test ecx, ecx
je 0x1002aac5
xor eax, eax
mov dword [ebp - 0x185c], 0
mov dword [ebp - 0x1858], 0
mov dword [ebp - 0x185c], 0
mov dword [ebp - 0x1858], 7
mov word [ebp - 0x186c], ax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x1840]
cmp dword [ebp - 0x182c], 8
cmovae eax, dword [ebp - 0x1840]
push eax
lea eax, [ebp - 0x186c]
push 0x101ebbbc
push eax
call fcn.100c2310
add esp, 0xc
lea eax, [ebp - 0x186c]
mov ecx, 0x10227688
push 0x68
push str.RC::RCTrojanDriverDetector::IsDupDriverExist
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverdetector.cpp
push eax
push 4
call fcn.100c1e70
cmp dword [ebp - 0x188c], 1
jbe 0x1002aab6
lea eax, [ebp - 0x186c]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x186c]
call fcn.100049f0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x1002aadb
push dword [ebp - 0x1848]
call eax
mov eax, dword [ebp - 0x1854]
test eax, eax
je 0x1002aaff
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x1854]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1854], ecx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1854]
test eax, eax
je 0x1002ab27
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x1854]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1854], ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1840]
call fcn.100049f0
inc esi
cmp esi, edi
jb 0x1002a770
mov byte [ebp - 0x1885], 0
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x1828]
mov esi, dword [ebp - 0x1828]
push dword [esi + 4]
call fcn.10014390
mov eax, dword [ebp - 0x1828]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x1828]
mov dword [eax], esi
mov ecx, dword [ebp - 0x1828]
mov dword [ecx + 8], esi
mov dword [ebp - 0x1824], 0
mov dword [ebp - 4], 0xffffffff
push 0x28
push dword [ebp - 0x1828]
call fcn.1018b7b5
mov al, byte [ebp - 0x1885]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1018b774
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp dword [0x10227688], 0
je 0x1002ac93
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
cmp byte [eax + 0x54], 0
je 0x1002ac93
cmp dword [eax + 0x58], 4
jb 0x1002ac93
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1885], al
xor eax, eax
mov dword [ebp - 0x185c], 0
mov dword [ebp - 0x1858], 0
mov dword [ebp - 0x185c], 0
mov dword [ebp - 0x1858], 7
mov word [ebp - 0x186c], ax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x186c]
push str._rYq
push eax
call fcn.100c2310
add esp, 0xc
lea eax, [ebp - 0x186c]
mov ecx, 0x10227688
push 0x72
push str.RC::RCTrojanDriverDetector::IsDupDriverExist
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverdetector.cpp
push eax
push 4
call fcn.100c1e70
cmp byte [ebp - 0x1885], 0
je 0x1002ac84
lea eax, [ebp - 0x186c]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x186c]
call fcn.100049f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1884]
call fcn.100049f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1854]
call fcn.1002f850
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1840]
call fcn.100049f0
mov byte [ebp - 0x1885], 1
jmp 0x1002ab46