Function at 0x403dc0
Capabilities:
Delete file
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb84
mov eax, dword [0x41c084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
mov edi, ecx
mov esi, edx
push ebx
push eax
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xb74], ebx
mov byte [ebp - 0x110], bl
call fcn.00410550
add esp, 0xc
test byte [0x41cf38], 0x10
je 0x403e5b
xor ecx, ecx
cmp ecx, str.DevInst.cpp
jne 0x403e23
mov eax, 0x41cfb4
jmp 0x403e3e
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x403e3d
mov eax, str.DevInst.cpp
jmp 0x403e3e
inc eax
push str.RemoveDeviceEx
push 0x33b
push eax
push 0x41926c
push str._T____s____s__d___s_:__n
call fcn.0040bbf0
add esp, 0x14
cmp esi, ebx
je 0x404406
cmp byte [esi], bl
je 0x404406
lea edx, [ebp - 0xa3c]
push edx
push ebx
push edi
mov dword [ebp - 0xb70], ebx
mov dword [ebp - 0xa3c], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x40439d
inc dword [ebp - 0xb70]
push 0x400
lea eax, [ebp - 0xa10]
push ebx
push eax
call fcn.00410550
add esp, 0xc
lea ecx, [ebp - 0xb6c]
push ecx
push 0x400
lea edx, [ebp - 0xa10]
push edx
lea eax, [ebp - 0xb78]
push eax
push 1
lea ecx, [ebp - 0xa3c]
push ecx
push edi
mov dword [ebp - 0xb6c], 0x400
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x404380
lea esi, [ebp - 0xa10]
cmp byte [ebp - 0xa10], bl
je 0x404380
jmp 0x403f00
mov eax, dword [ebp - 0xb80]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403f10
sub eax, edx
mov edx, dword [ebp - 0xb80]
push eax
push edx
push esi
call fcn.0040d6d4
add esp, 0xc
test eax, eax
je 0x403f4b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403f33
sub eax, edx
cmp byte [esi + eax + 1], bl
lea esi, [esi + eax + 1]
jne 0x403f00
jmp 0x404380
test byte [0x41cf38], 8
je 0x403fb5
xor eax, eax
cmp eax, str.DevInst.cpp
jne 0x403f64
mov eax, 0x41cfb4
jmp 0x403f7f
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x403f7e
mov eax, str.DevInst.cpp
jmp 0x403f7f
inc eax
push str.RemoveDeviceEx
push 0x360
push eax
push 0x41926c
push 8
call fcn.0040b6d0
movsx ecx, al
add esp, 4
push ecx
push str.__C____s____s__d___s_:
call fcn.0040bbf0
push esi
push str.Find_HardwareID___s_n
call fcn.0040bbf0
add esp, 0x20
push 0x104
lea edx, [ebp - 0x110]
push ebx
push edx
call fcn.00410550
push 0x400
lea eax, [ebp - 0x610]
push ebx
push eax
call fcn.00410550
add esp, 0x18
lea ecx, [ebp - 0xb6c]
push ecx
push 0x400
lea edx, [ebp - 0x610]
push edx
lea eax, [ebp - 0xb78]
push eax
push 9
lea ecx, [ebp - 0xa3c]
push ecx
push edi
mov dword [ebp - 0xb6c], 0x400
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x4041dc
push 0x100
lea edx, [ebp - 0x210]
push ebx
push edx
call fcn.00410550
mov ecx, 0xa
mov esi, str.SYSTEMCurrentControlSetControlClass_
lea edi, [ebp - 0x210]
lea eax, [ebp - 0x610]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x404047
lea edi, [ebp - 0x210]
sub eax, ecx
mov esi, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x404060
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xb7c]
push eax
and ecx, 3
push 0x20019
rep movsb byte es:[edi], byte [esi]
push ebx
lea ecx, [ebp - 0x210]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4041d6
lea edx, [ebp - 0xb6c]
push edx
mov edx, dword [ebp - 0xb7c]
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0xb78]
push ecx
push ebx
push str.InfPath
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4041c9
test byte [0x41cf38], 8
je 0x40413b
cmp eax, str.DevInst.cpp
jne 0x4040e4
mov eax, 0x41cfb4
jmp 0x4040ff
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x4040fe
mov eax, str.DevInst.cpp
jmp 0x4040ff
inc eax
push str.RemoveDeviceEx
push 0x38c
push eax
push 0x41926c
push 8
call fcn.0040b6d0
movsx ecx, al
add esp, 4
push ecx
push str.__C____s____s__d___s_:
call fcn.0040bbf0
lea edx, [ebp - 0x610]
push edx
push str.InfPath___s_n
call fcn.0040bbf0
add esp, 0x20
push 3
lea eax, [ebp - 0x610]
push 0x419c68
push eax
call fcn.004106ac
add esp, 0xc
test eax, eax
jne 0x4041c9
jmp 0x404160
mov cl, byte [eax + 0x41dd68]
mov byte [ebp + eax - 0x110], cl
inc eax
cmp cl, bl
jne 0x404160
lea eax, [ebp - 0x110]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x404180
mov ecx, dword [str.INF_]
mov dl, byte [0x419c70]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [ebp - 0x610]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4041a1
lea edi, [ebp - 0x110]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4041b1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xb7c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0xb84]
push 0x10
lea ecx, [ebp - 0xa20]
push ecx
lea edx, [ebp - 0xa3c]
push edx
mov esi, 1
push edi
mov dword [ebp - 0xa20], 8
mov dword [ebp - 0xa1c], 5
mov dword [ebp - 0xa18], esi
mov dword [ebp - 0xa14], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiSetClassInstallParamsA]
test eax, eax
je 0x4042e5
lea eax, [ebp - 0xa3c]
push eax
push edi
push 5
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x4042e5
lea ecx, [ebp - 0xb68]
push ecx
lea edx, [ebp - 0xa3c]
push edx
push edi
mov dword [ebp - 0xb68], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
je 0x404359
test dword [ebp - 0xb64], 0x180
je 0x404359
test byte [0x41cf38], 8
mov dword [ebp - 0xb74], esi
je 0x404359
xor eax, eax
cmp eax, str.DevInst.cpp
jne 0x404292
mov eax, 0x41cfb4
jmp 0x4042ae
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x4042ac
mov eax, str.DevInst.cpp
jmp 0x4042ae
add eax, esi
push str.RemoveDeviceEx
push 0x3ae
push eax
push 0x41926c
push 8
call fcn.0040b6d0
movsx ecx, al
add esp, 4
push ecx
push str.__C____s____s__d___s_:
call fcn.0040bbf0
push str.SetupDiGetDeviceInstallParams_Return_Need_Reboot__n
call fcn.0040bbf0
add esp, 0x1c
jmp 0x404359
test byte [0x41cf38], 1
je 0x404359
xor edx, edx
cmp edx, str.DevInst.cpp
jne 0x4042ff
mov eax, 0x41cfb4
jmp 0x40431b
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x404319
mov eax, str.DevInst.cpp
jmp 0x40431b
add eax, esi
push str.RemoveDeviceEx
push 0x39f
push eax
push 0x41926c
push esi
call fcn.0040b6d0
movsx eax, al
add esp, 4
push eax
push str.__C____s____s__d___s_:
call fcn.0040bbf0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetupDiCallClassInstaller_Failed__Error__d._n
call fcn.0040bbf0
add esp, 8
cmp byte [ebp - 0x110], bl
je 0x404380
push 0x80
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xa3c]
push eax
push ecx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x403e92
test byte [0x41cf38], 0x10
je 0x4043ef
xor edx, edx
cmp edx, str.DevInst.cpp
jne 0x4043b7
mov eax, 0x41cfb4
jmp 0x4043d2
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x4043d1
mov eax, str.DevInst.cpp
jmp 0x4043d2
inc eax
push str.RemoveDeviceEx
push 0x3c2
push eax
push 0x41926c
push str._T____s____s__d___s_:__________n
call fcn.0040bbf0
add esp, 0x14
mov eax, dword [ebp - 0xb74]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c754
mov esp, ebp
pop ebp
ret
test byte [0x41cf38], 1
je 0x40446f
xor eax, eax
cmp eax, str.DevInst.cpp
jne 0x40441f
mov eax, 0x41cfb4
jmp 0x40443a
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x404439
mov eax, str.DevInst.cpp
jmp 0x40443a
inc eax
push str.RemoveDeviceEx
push 0x33f
push eax
push 0x41926c
push 1
call fcn.0040b6d0
movsx ecx, al
add esp, 4
push ecx
push str.__C____s____s__d___s_:
call fcn.0040bbf0
push str.Invalid_Parameter__n
call fcn.0040bbf0
add esp, 0x1c
test byte [0x41cf38], 0x10
je 0x4044c1
xor edx, edx
cmp edx, str.DevInst.cpp
jne 0x404489
mov eax, 0x41cfb4
jmp 0x4044a4
push 0x5c
push str.DevInst.cpp
call fcn.0040ce20
add esp, 8
cmp eax, ebx
jne 0x4044a3
mov eax, str.DevInst.cpp
jmp 0x4044a4
inc eax
push str.RemoveDeviceEx
push 0x340
push eax
push 0x41926c
push str._T____s____s__d___s_:__________n
call fcn.0040bbf0
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 2
pop ebx
call fcn.0040c754
mov esp, ebp
pop ebp
ret