Function at 0x10003ca0
Capabilities:
Check if file exists
Delete file
Delete service
Get file attributes
Move file
Query environment variable
Stop service

Disassembly:
call sym.drvi.dll_SrnBlocker_IsInstalled
test eax, eax
jne 0x10003caf
mov eax, 1
ret
call fcn.10005af0
test eax, eax
je 0x10003cbd
jmp 0x10003cd0
jmp fcn.10004510
sub esp, 0x104
call fcn.10005b20
test eax, eax
je 0x10003d12
lea eax, [esp]
push 0x104
push eax
call fcn.10003230
add esp, 8
test eax, eax
jne 0x10003cfc
add esp, 0x104
ret
lea ecx, [esp]
push str.SrnBlocker_Uninstall
push ecx
call fcn.10008010
add esp, 0x104
ret
add esp, 0x104
jmp 0x10005090
push 0xffffffffffffffff
push 0x100098eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
push esi
push edi
xor edi, edi
push 0x1000c224
mov dword [esp + 0x18], 0x4d36e96e
mov word [esp + 0x1c], 0xe325
mov word [esp + 0x1e], 0x11ce
mov byte [esp + 0x20], 0xbf
mov byte [esp + 0x21], 0xc1
mov byte [esp + 0x22], 8
mov byte [esp + 0x23], 0
mov byte [esp + 0x24], 0x2b
mov byte [esp + 0x25], 0xe1
mov byte [esp + 0x26], 3
mov byte [esp + 0x27], 0x18
mov dword [esp + 0x14], edi
call ebx
cmp eax, edi
je 0x1000511b
push str.Wow64DisableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x1000511b
lea ecx, [esp + 0x10]
push ecx
call eax
lea edx, [esp + 0x40]
push 0x104
push edx
push str._SystemRoot_System32drivers_rsmd5.sys
mov dword [esp + 0x25c], edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 2
push edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x100051bb
call fcn.10005670
push 0x5c
push str.F:RC50WSSC50SCap24_srcdrviSrnBlocker.cpp
mov esi, eax
call sub.MSVCRT.dll_strrchr
add esp, 8
inc eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x301
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000c158
push esi
call fcn.100014b0
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, edi
mov dword [esp + 0x250], ebp
je 0x100051b4
push 0x1000c224
call ebx
cmp eax, edi
je 0x100051b4
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x100051b4
mov ecx, dword [esp + 0x10]
push ecx
call eax
xor eax, eax
jmp 0x10005332
lea edx, [esp + 0x24]
xor eax, eax
mov ecx, 7
lea edi, [esp + 0x24]
push edx
push eax
rep stosd dword es:[edi], eax
push ebp
mov dword [esp + 0x30], 0x1c
mov ebx, 1
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x100052ed
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea eax, [esp + 0x148]
push 0x103
push eax
push 0
lea ecx, [esp + 0x34]
push 4
push ecx
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x100052bb
lea edx, [esp + 0x144]
push str.rsmd5
push edx
call sub.MSVCRT.dll__mbscmp
add esp, 8
test eax, eax
jne 0x100052a1
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000525d
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1000525d
push 4
lea edx, [esp + 0x44]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiRemoveDevice]
test eax, eax
jne 0x100052a1
call fcn.10005670
push 0x5c
push str.F:RC50WSSC50SCap24_srcdrviSrnBlocker.cpp
mov esi, eax
call sub.MSVCRT.dll_strrchr
add esp, 8
inc eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x32b
call edi
push eax
push 0x1000c158
push esi
call fcn.100014b0
add esp, 0xc
call edi
lea ecx, [esp + 0x24]
mov eax, ebx
push ecx
push eax
push ebp
inc ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x100051f0
jmp 0x100052ed
call fcn.10005670
push 0x5c
push str.F:RC50WSSC50SCap24_srcdrviSrnBlocker.cpp
mov esi, eax
call sub.MSVCRT.dll_strrchr
add esp, 8
inc eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x317
call edi
push eax
push 0x1000c158
push esi
call fcn.100014b0
add esp, 0xc
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x250], 0xffffffff
test eax, eax
je 0x1000532d
push 0x1000c224
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000532d
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000532d
mov edx, dword [esp + 0x10]
push edx
call eax
mov eax, 1
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x244
ret