Function at 0x419000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x34]
sub esp, 0xdc
mov dword [ebp - 0xbc], ecx
mov dword [esp + 0xc], 0x1c
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1c
mov dword [esp], eax
call fcn.004327e0
mov dword [ebp - 0x34], 0x1c
mov dword [ebp - 0xc0], 0
lea esi, [esi]
lea edi, [edi]
lea eax, [ebp - 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc0]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
sub esp, 0xc
cmp eax, 1
jne 0x4196f3
mov eax, dword [ebp - 0xbc]
mov ebx, dword [eax + 0x84]
test ebx, ebx
je 0x419702
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x4c], 0
xor edx, edx
xor eax, eax
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
lea esi, [ebp - 0x64]
jmp 0x4190dc
mov edi, dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xbc]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.00414e60
sub esp, 0xc
test eax, eax
je 0x419103
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x64]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x4c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
mov dword [esp], eax
call ebx
sub esp, 0x14
test eax, eax
je 0x4190b0
mov ebx, dword [ebp - 0x64]
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xa4], 0
mov dword [ebp - 0xac], eax
test ebx, ebx
je 0x419500
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0xac]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004cb7a0
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xac]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [esp + 4], str.vid_12d1
mov dword [ebp - 0xc4], eax
call eax
sub esp, 8
test eax, eax
je 0x4192b1
lea edi, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xb0]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
jne 0x4191fd
mov esi, dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4192e0
lea esi, [ebp - 0x8c]
test ebx, ebx
mov dword [ebp - 0x90], 0
mov byte [ebp - 0x8c], 0
mov dword [ebp - 0x94], esi
je 0x4192d5
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x94]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004cb7a0
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x94]
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], str.USBClass_e0SubClass_01Prot_03
mov eax, dword [ebp - 0xc4]
call eax
sub esp, 8
test eax, eax
je 0x419305
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], str.USBDevClass_00SubClass_00Prot_00
mov dword [esp], eax
mov eax, dword [ebp - 0xc4]
call eax
sub esp, 8
test eax, eax
je 0x419305
mov eax, dword [ebp - 0x94]
cmp eax, esi
je 0x4192b1
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa4]
cmp eax, edx
je 0x4192c9
mov dword [esp], eax
call fcn.004ed8c0
add dword [ebp - 0xc0], 1
jmp 0x419050
mov eax, esi
jmp 0x419261
test ebx, ebx
je 0x4192f0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
test esi, esi
jne 0x4194c0
mov eax, dword [ebp - 0xb4]
xor ebx, ebx
jmp 0x4191ae
mov eax, dword [ebp - 0xbc]
lea ecx, [eax + 0x48]
lea eax, [ebp - 0xac]
mov dword [esp], eax
call fcn.004cdfc0
lea eax, [ebp - 0x74]
sub esp, 4
lea ecx, [ebp - 0xac]
mov dword [esp + 8], 5
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], 0x44495026
mov byte [ebp - 0x70], 0x5f
mov dword [ebp - 0x78], 5
mov byte [ebp - 0x6f], 0
call fcn.0045b2d0
sub esp, 0xc
cmp eax, 0xffffffff
je 0x41929f
lea ebx, [eax + 5]
lea ecx, [ebp - 0xac]
mov dword [esp + 8], 1
mov dword [esp], 0x4fc9a8
mov dword [esp + 4], ebx
call fcn.0045b2d0
sub esp, 0xc
cmp eax, 0xffffffff
mov edx, dword [ebp - 0xa8]
je 0x419590
sub eax, ebx
cmp ebx, edx
ja 0x41999f
lea edi, [ebp - 0x44]
sub edx, ebx
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0x4c], edi
mov edi, dword [ebp - 0xac]
add edi, ebx
cmp edx, eax
cmovbe eax, edx
mov ebx, eax
mov eax, edi
add eax, ebx
je 0x4193cd
test edi, edi
je 0x419950
cmp ebx, 0xf
ja 0x419663
cmp ebx, 1
je 0x4196ab
test ebx, ebx
mov eax, dword [ebp - 0xc8]
jne 0x41967c
mov dword [ebp - 0x48], ebx
mov byte [eax + ebx], 0
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax + 0x18]
je 0x4196bc
mov ecx, dword [ebp - 0xbc]
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
add ecx, 0x20
mov dword [ebp - 0xc4], edi
cmp eax, ecx
je 0x419782
mov ecx, dword [ebp - 0xbc]
test eax, eax
mov dword [ecx + 0x18], edx
mov edx, dword [ebp - 0xc4]
mov edi, dword [ecx + 0x20]
mov dword [ecx + 0x1c], ebx
mov dword [ecx + 0x20], edx
je 0x419791
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xc8]
je 0x41946c
mov dword [esp], eax
call fcn.004ed8c0
mov edi, dword [ebp - 0xbc]
lea eax, [edi + 0x18]
mov dword [esp], eax
call fcn.0042d8e0
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [esp + 8], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004188d0
sub esp, 0xc
test eax, eax
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
je 0x41987b
cmp edx, eax
je 0x41929f
mov dword [esp], edx
call fcn.004ed8c0
jmp 0x41929f
mov dword [esp + 4], esi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x419510
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004327e0
mov eax, dword [ebp - 0xb4]
jmp 0x4191ae
lea eax, [ebp - 0xa4]
jmp 0x41916d
call fcn.0042c430
mov edx, 0x6570
lea esi, [ebp - 0x44]
mov dword [esp + 0x10], 0x4fc2db
mov word [ebp - 0x38], dx
lea edx, [ebp - 0x4c]
mov dword [esp + 0xc], 0xcb
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], 0x63656843
mov dword [ebp - 0x40], 0x7272456b
mov dword [ebp - 0x3c], 0x7954726f
mov dword [ebp - 0x48], 0xe
mov byte [ebp - 0x36], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, esi
je 0x4194f2
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x4194f2
cmp ebx, edx
ja 0x41995c
lea eax, [ebp - 0x5c]
mov edi, edx
sub edi, ebx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xac]
lea ecx, [eax + ebx]
add eax, edx
mov dword [ebp - 0xc8], ecx
je 0x4195c3
test ecx, ecx
je 0x4199c4
cmp edi, 0xf
ja 0x4197a8
cmp edi, 1
je 0x419694
test edi, edi
mov eax, dword [ebp - 0xc4]
jne 0x4197c1
mov dword [ebp - 0x60], edi
mov byte [eax + edi], 0
mov eax, dword [ebp - 0xbc]
mov ebx, dword [eax + 0x18]
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0xc4]
je 0x4197df
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x5c]
add ecx, 0x20
mov dword [ebp - 0xc8], edx
mov edx, dword [ebp - 0x60]
cmp ebx, ecx
je 0x41984d
mov ecx, dword [ebp - 0xbc]
test ebx, ebx
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0xc8]
mov edi, dword [ecx + 0x20]
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], eax
je 0x419862
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x60], 0
mov byte [ebx], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0xc4]
jne 0x419464
jmp 0x41946c
test ebx, ebx
js 0x419978
lea eax, [ebx + 1]
mov dword [esp], eax
call fcn.004ed900
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x4c]
jmp 0x4193ed
mov eax, dword [ebp - 0xc8]
movzx eax, byte [eax]
mov byte [ebp - 0x5c], al
mov eax, dword [ebp - 0xc4]
jmp 0x4195e3
movzx eax, byte [edi]
mov byte [ebp - 0x44], al
mov eax, dword [ebp - 0xc8]
jmp 0x4193ed
mov edx, dword [ebp - 0x48]
test edx, edx
je 0x4196de
cmp edx, 1
jne 0x419816
movzx edx, byte [ebp - 0x44]
mov byte [eax], dl
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x48]
mov eax, dword [eax + 0x18]
mov edi, dword [ebp - 0xbc]
mov dword [edi + 0x1c], edx
mov byte [eax + edx], 0
mov eax, dword [ebp - 0x4c]
jmp 0x41944f
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 8
call fcn.0042c430
lea edx, [ebp - 0x4c]
lea esi, [ebp - 0x44]
mov ecx, 0x7574
mov dword [esp + 0x10], str.FindDevAndChangePid_receive_exit_message
mov dword [esp + 0xc], 0x23a
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], 0x65746544
mov dword [ebp - 0x40], 0x65447463
mov dword [ebp - 0x3c], 0x61745376
mov word [ebp - 0x38], cx
mov byte [ebp - 0x36], 0x73
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x35], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, esi
je 0x419776
mov dword [esp], eax
call fcn.004ed8c0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], edi
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0xc8], eax
jmp 0x41944f
cmp edx, ebx
js 0x419993
lea eax, [edi + 1]
mov dword [esp], eax
call fcn.004ed900
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], edi
mov edx, dword [ebp - 0xc8]
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x64]
jmp 0x4195e3
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x419801
cmp eax, 1
jne 0x4198b4
movzx eax, byte [ebp - 0x5c]
mov edx, dword [ebp - 0xbc]
mov byte [ebx], al
mov eax, dword [ebp - 0x60]
mov ebx, dword [edx + 0x18]
mov edx, dword [ebp - 0xbc]
mov dword [edx + 0x1c], eax
mov byte [ebx + eax], 0
mov ebx, dword [ebp - 0x64]
jmp 0x419645
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc8]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x48]
mov edi, dword [ebp - 0xbc]
mov eax, dword [eax + 0x18]
mov dword [edi + 0x1c], edx
mov byte [eax + edx], 0
mov eax, dword [ebp - 0x4c]
jmp 0x41944f
mov ebx, dword [ebp - 0xbc]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xc4], eax
mov ebx, eax
jmp 0x419645
cmp edx, eax
je 0x419887
mov dword [esp], edx
call fcn.004ed8c0
mov eax, dword [ebp - 0x94]
cmp eax, esi
je 0x419899
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa4]
cmp eax, edx
jne 0x41976e
xor eax, eax
jmp 0x419778
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x60]
mov ebx, dword [edx + 0x18]
jmp 0x419801
mov eax, dword [ebp - 0x94]
cmp eax, esi
je 0x419901
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa4]
cmp eax, edx
je 0x419919
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], ebx
call fcn.0043f8d0
mov ebx, eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xc8]
jne 0x4198f9
jmp 0x419901
mov dword [esp], edx
call fcn.004ed8c0
jmp 0x419919
mov dword [esp], 0x4fc4dc
call fcn.004e7b80
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4fc9aa
mov dword [esp], 0x4fc9c0
call fcn.004e8380
mov dword [esp], 0x4fc506
call fcn.004e7d10
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0xc8]
mov ebx, eax
jne 0x419946
jmp 0x419919
mov dword [esp], 0x4fc506
call fcn.004e7d10
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4fc9aa
mov dword [esp], 0x4fc9c0
call fcn.004e8380
mov ebx, eax
jmp 0x4198ef
mov dword [esp], 0x4fc4dc
call fcn.004e7b80