Function at 0x1005209
Capabilities:
Access peb ldr_data

Disassembly:
add ebp, 0x24
push esp
call fcn.01003067
pop es
std
jne 0x1005214
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x100522b
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.01003067
push esi
add al, 0x71
into
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.01003067
imul eax, edx, 0xa
or al, 0x49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x1005254
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x1005254
call fcn.01003067
sub ebp, 0x5a8b01c6
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.01003067
sal dword [ebp + 0x75ffafac], cl
or bh, bh
jne 0x100529d
push dword [ebp]
call fcn.01003867
pushal
mov dword [ebp + 0x5c], ebx
mov dword [0x100aa5c], ebx
jne 0x10052e8
invalid
push 4
push 0x100b48c
push 0x100146c
call fcn.01002a34
cmp eax, ebx
je 0x10052c7
cmp eax, 4
jbe 0x10052e8
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.010038cc
mov dword [0x100aa5c], 0x80070714
xor eax, eax
jmp 0x10055b7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
mov dword [ebp + 0x6c], ebx
push 0x11
xor eax, eax
cmp byte [0x100baa2], bl
pop ecx
lea edi, [ebp - 8]
rep stosd dword es:[edi], eax
mov dword [ebp + 0x70], ebx
mov dword [ebp - 8], 0x44
jne 0x1005400
push 4
lea eax, [ebp + 0x68]
push eax
push 0x1001460
call fcn.01002a34
cmp eax, ebx
je 0x10053df
cmp eax, 4
ja 0x10053df
xor edi, edi
inc edi
cmp dword [ebp + 0x68], edi
jne 0x1005342
mov word [ebp + 0x28], bx
jmp 0x100535c
cmp dword [ebp + 0x68], 2
jne 0x1005350
mov word [ebp + 0x28], 6
jmp 0x100535c
cmp dword [ebp + 0x68], 3
jne 0x100535f
mov word [ebp + 0x28], 3
mov dword [ebp + 0x24], edi
cmp dword [ebp + 0x6c], ebx
jne 0x1005415
mov ax, word [0x100b898]
cmp ax, bx
je 0x10053bc
test al, 1
je 0x1005380
mov dword [ebp + 0x64], 0x1001458
jmp 0x100538b
test al, 2
je 0x100538b
mov dword [ebp + 0x64], 0x1001450
push 0x104
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x64]
call fcn.01002a34
test eax, eax
je 0x10053df
push 0x10013b4
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10053bc
mov dword [ebp + 0x60], edi
cmp dword [ebp + 0x60], ebx
jne 0x100545a
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x1001444
call fcn.01002a34
test eax, eax
jne 0x1005415
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.010038cc
mov dword [0x100aa5c], 0x80070714
xor eax, eax
jmp 0x10055b5
push 0x100baa2
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
inc edi
cmp dword [ebp + 0x6c], edi
jne 0x100545a
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x1001434
call fcn.01002a34
test eax, eax
je 0x10053df
cmp byte [0x100baa2], bl
jne 0x10055a6
push 0x10013b4
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10055a6
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.010022ff
test eax, eax
je 0x10053f9
cmp dword [ebp + 0x5c], ebx
jne 0x1005495
cmp word [0x100aa64], di
je 0x1005495
cmp dword [0x100b880], ebx
je 0x1005495
cmp dword [ebp + 0x70], ebx
jne 0x100549e
mov dword [ebp + 0x5c], edi
call fcn.0100198b
cmp dword [ebp + 0x70], ebx
je 0x100557d
cmp dword [0x100a2c0], ebx
je 0x10055bd
cmp dword [ebp + 0x70], ebx
je 0x100557d
test byte [0x100b494], 4
je 0x100557d
push 0x1001278
call fcn.0100370f
mov edi, eax
cmp edi, ebx
je 0x10055e1
push str.DoInfInstall
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10055f7
cmp dword [0x100b890], ebx
mov ecx, dword [ebp + 0x74]
mov dword [ebp + 0x44], ecx
lea ecx, [ebp - 0x10c]
mov dword [ebp + 0x4c], ecx
mov cx, word [0x100aa64]
mov word [ebp + 0x50], cx
movzx ecx, word [0x100b898]
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], 0x100abb4
mov dword [ebp + 0x48], 0x100ac44
mov dword [ebp + 0x54], ecx
je 0x1005529
or byte [ebp + 0x56], 1
mov cl, byte [0x100b494]
test cl, 8
je 0x1005538
or byte [ebp + 0x56], 2
test cl, 0x10
je 0x1005541
or byte [ebp + 0x56], 4
mov cl, byte [0x100bba8]
test cl, 0x40
je 0x1005550
or byte [ebp + 0x56], 8
test cl, cl
jns 0x1005558
or byte [ebp + 0x56], 0x10
mov ecx, dword [0x100b498]
mov dword [ebp + 0x58], ecx
lea ecx, [ebp + 0x3c]
push ecx
call eax
cmp eax, ebx
mov dword [0x100aa5c], eax
push edi
jl 0x1005626
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1005591
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x74]
call fcn.01004560
test eax, eax
je 0x100562c
push dword [ebp + 0x74]
call esi
inc dword [ebp + 0x6c]
cmp dword [ebp + 0x6c], 2
jb 0x10052f3
xor edi, edi
inc edi
cmp dword [0x100a330], ebx
je 0x10055b3
call fcn.01001b8b
mov eax, edi
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
push ebx
push 0x10
push ebx
push ebx
push 0x4c7
push ebx
call fcn.010038cc
push dword [ebp + 0x74]
call esi
mov dword [0x100aa5c], 0x8007042b
jmp 0x10053f9
push ebx
push 0x10
push ebx
push 0x1001278
push 0x4c8
push ebx
call fcn.010038cc
jmp 0x1005612
push ebx
push 0x10
push ebx
push str.DoInfInstall
push 0x4c9
push ebx
call fcn.010038cc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp + 0x74]
call esi
call fcn.01003547
mov dword [0x100aa5c], eax
jmp 0x10053f9
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp + 0x74]
call esi
jmp 0x10053f9