Function at 0x430800
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4632c9
mov eax, dword fs:[0]
push eax
sub esp, 0xa30
mov eax, dword [0x47f038]
xor eax, esp
mov dword [esp + 0xa2c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47f038]
xor eax, esp
push eax
lea eax, [esp + 0xa44]
mov dword fs:[0], eax
push str.CommandSetupDiGetDeviceChildren_n
mov esi, ecx
call fcn.004412c0
push 0x474
call fcn.0044e29f
add esp, 8
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0xa58]
xor edi, edi
mov dword [esp + 0xa4c], edi
cmp eax, edi
je 0x43087e
push ebx
push edi
push edi
mov ecx, eax
call fcn.00405340
mov ebp, eax
mov dword [esp + 0x1c], ebp
jmp 0x430884
mov dword [esp + 0x1c], edi
mov ebp, edi
xor eax, eax
mov dword [esp + 0xa4c], 0xffffffff
cmp ebp, edi
je 0x430bc8
test bl, bl
jne 0x430bc8
push 0x206
lea ecx, [esp + 0x3e]
push edi
push ecx
mov word [esp + 0x44], ax
call fcn.0044e1b0
mov eax, dword [esp + 0xa68]
add esp, 0xc
cmp word [eax], di
je 0x4308df
lea edx, [esp + 0x38]
sub edx, eax
jmp 0x4308d0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x4308d0
push 0x7fe
lea eax, [esp + 0x246]
xor edx, edx
push edi
push eax
mov word [esp + 0x24c], dx
call fcn.0044e1b0
add esp, 0xc
mov dword [esp + 0x14], edi
cmp word [esp + 0x38], di
je 0x430aea
lea ecx, [esp + 0x20]
call fcn.00407d10
push edi
lea ecx, [esp + 0x24]
push ecx
push 0x1003
lea edx, [esp + 0x44]
push edx
push 0x99
mov ebx, 1
push edi
mov ecx, ebp
mov dword [esp + 0xa64], ebx
call fcn.00404d70
mov eax, dword [esp + 0x24]
mov dword [esi + 0x480], ebx
lea ebx, [esi + 0x484]
mov dword [esp + 0x18], eax
mov dword [esi + 0x47c], eax
mov eax, str.GETDEVICECHILDREN_successful
mov edx, ebx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x430963
mov eax, dword [esi + 0x47c]
mov ecx, dword [esi + 0x480]
push ebx
push eax
push ecx
lea edx, [esp + 0x24c]
push str._d__d___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x254]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4309a1
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push edi
sar eax, 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x260]
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x24c]
push eax
push ecx
call ebp
mov edx, dword [esi + 0x260]
mov ebx, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edx
call ebx
cmp dword [esp + 0x18], 0
jle 0x430a7d
lea esp, [esp]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + edi*8]
push eax
lea ecx, [esp + 0x244]
push str.__s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x24c]
add esp, 0xc
mov dword [esp + 0x14], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x430a20
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x18]
push edx
mov edx, dword [esi + 0x260]
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x24c]
push ecx
push edx
call ebp
lea eax, [esp + 0x240]
push eax
push str.wszReturn___s__n
call fcn.004412c0
mov ecx, dword [esi + 0x260]
add esp, 8
push ecx
call ebx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, dword [esp + 0x18]
jl 0x4309f0
lea ecx, [esp + 0x20]
call fcn.00407cb0
mov eax, dword [esi + 0x260]
push 0
lea edx, [esp + 0x18]
push edx
push 8
push 0x471ee0
push eax
mov dword [esp + 0x28], 0
call ebp
mov ecx, dword [esi + 0x260]
push ecx
call ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esi + 0x269], 1
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.004053e0
push esi
call fcn.0044e22a
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0xa4c], 0xffffffff
call fcn.00407e50
jmp 0x430bc6
push str.error_wszOutput:_No_Input_n
call fcn.004412c0
lea ebx, [esi + 0x484]
mov eax, str.GETDEVICECHILDREN_failed
mov edx, ebx
add esp, 4
mov dword [esi + 0x480], 1
mov dword [esi + 0x47c], edi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x430b16
mov edx, dword [esi + 0x47c]
mov eax, dword [esi + 0x480]
push ebx
push edx
push eax
lea ecx, [esp + 0x24c]
push str._d__d___s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x254]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x430b54
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push edi
sar eax, 1
lea edx, [esp + 0x18]
push edx
mov edx, dword [esi + 0x260]
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x24c]
push ecx
push edx
call ebx
mov eax, dword [esi + 0x260]
mov ebp, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push eax
call ebp
mov edx, dword [esi + 0x260]
push edi
lea ecx, [esp + 0x18]
push ecx
push 8
push 0x471ee0
push edx
mov dword [esp + 0x28], edi
call ebx
mov eax, dword [esi + 0x260]
push eax
call ebp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esi + 0x269], 1
xor eax, eax
mov ecx, dword [esp + 0xa44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa2c]
xor ecx, esp
call fcn.0044e1a0
add esp, 0xa3c
ret 0xc