Function at 0x100d4d3
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x1039856
call fcn.0103738d
mov eax, dword [ebp + 8]
push 6
mov dword [ebp - 0x3c], ecx
pop ecx
xor ebx, ebx
push 6
push ebx
mov dword [ebp - 0x34], eax
push ebx
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
push ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov dword [ebp - 0x48], eax
cmp eax, 0xffffffff
jne 0x100d54f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100968c
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d955
test byte [eax + 0x1c], 1
je 0x100d955
push 0x1001e78
push 0x38
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
jmp 0x100d955
push 0x4e08
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
or dword [ebp - 4], 0xffffffff
mov edi, eax
pop ecx
mov dword [ebp - 0x50], edi
jmp 0x100d576
cmp edi, ebx
jne 0x100d5a8
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d59e
test byte [eax + 0x1c], 1
je 0x100d59e
push 0x1001e78
push 0x39
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
mov esi, 0x8007000e
jmp 0x100d933
push 0x4e08
push ebx
push edi
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x30], 0x1c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x100d931
mov ecx, dword [ebp - 0x3c]
push 0x200
push edi
push 1
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x48]
call fcn.0100c6ee
test eax, eax
jne 0x100d929
mov ecx, dword [ebp - 0x3c]
push 0x4000
lea eax, [edi + 0x200]
push eax
push 7
push 1
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x48]
call fcn.0100c6ee
test eax, eax
jne 0x100d929
mov ecx, dword [ebp - 0x3c]
push 0x200
mov word [edi + 0x4400], ax
lea eax, [edi + 0x4200]
push eax
push 1
push 4
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x48]
call fcn.0100c6ee
test eax, eax
je 0x100d65e
xor eax, eax
mov word [edi + 0x4200], ax
jmp 0x100d78c
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x44], ebx
jne 0x100d67b
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x44], eax
cmp eax, ebx
je 0x100d78c
push 1
lea eax, [edi + 0x4200]
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x54], eax
cmp eax, ebx
je 0x100d78c
push 0x2000
mov dword [ebp - 4], 2
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x40], eax
jmp 0x100d6c8
cmp dword [ebp - 0x40], ebx
je 0x100d783
lea eax, [ebp - 0x58]
push eax
push 0x2000
push dword [ebp - 0x40]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x100d77a
mov eax, dword [ebp - 0x40]
push 0x5c
push dword [eax + 0xc]
call sub.msvcrt.dll_wcsrchr
pop ecx
pop ecx
cmp eax, ebx
je 0x100d738
add eax, 2
push eax
push 0x104
lea eax, [edi + 0x4400]
push eax
call fcn.0100a010
cmp eax, ebx
jge 0x100d77a
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100d77a
test byte [ecx + 0x1c], 1
je 0x100d77a
push eax
push 0x1001e78
push 0x3a
jmp 0x100d76f
mov eax, dword [ebp - 0x40]
push dword [eax + 0xc]
lea eax, [edi + 0x4400]
push 0x104
push eax
call fcn.0100a010
cmp eax, ebx
jge 0x100d77a
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100d77a
test byte [ecx + 0x1c], 1
je 0x100d77a
push eax
push 0x1001e78
push 0x3b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01008600
push dword [ebp - 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x16
push 0x1001f98
push dword [ebp - 0x34]
call esi
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x1e
push 0x1001fcc
push dword [ebp - 0x34]
call esi
mov ecx, dword [ebp - 0x3c]
push 0x400
lea eax, [edi + 0x4608]
push eax
push edi
call fcn.0100cc12
push ebx
lea ecx, [ebp - 0x38]
push ecx
add eax, eax
push eax
lea eax, [edi + 0x4608]
push eax
push dword [ebp - 0x34]
call esi
test eax, eax
jne 0x100d7ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100968c
mov esi, eax
jmp 0x100d933
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x20
push 0x1001fec
push dword [ebp - 0x34]
call esi
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x1c
push 0x1002010
push dword [ebp - 0x34]
call esi
mov ecx, dword [ebp - 0x3c]
push 0x400
lea eax, [edi + 0x4608]
push eax
lea eax, [edi + 0x200]
push eax
call fcn.0100cc12
push ebx
lea ecx, [ebp - 0x38]
push ecx
add eax, eax
push eax
lea eax, [edi + 0x4608]
push eax
push dword [ebp - 0x34]
call esi
test eax, eax
je 0x100d7db
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x1e
push 0x1002030
push dword [ebp - 0x34]
call esi
cmp word [edi + 0x4200], bx
je 0x100d8b6
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x16
push 0x1002050
push dword [ebp - 0x34]
call esi
mov ecx, dword [ebp - 0x3c]
push 0x400
lea eax, [edi + 0x4608]
push eax
lea eax, [edi + 0x4200]
push eax
call fcn.0100cc12
push ebx
lea ecx, [ebp - 0x38]
push ecx
add eax, eax
push eax
lea eax, [edi + 0x4608]
push eax
push dword [ebp - 0x34]
call esi
test eax, eax
je 0x100d7db
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x18
push 0x1002068
push dword [ebp - 0x34]
call esi
cmp word [edi + 0x4400], bx
je 0x100d918
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x14
push 0x1002084
push dword [ebp - 0x34]
call esi
mov ecx, dword [ebp - 0x3c]
push 0x400
lea eax, [edi + 0x4608]
push eax
lea eax, [edi + 0x4400]
push eax
call fcn.0100cc12
push ebx
lea ecx, [ebp - 0x38]
push ecx
add eax, eax
push eax
lea eax, [edi + 0x4608]
push eax
push dword [ebp - 0x34]
call esi
test eax, eax
je 0x100d7db
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x16
push 0x100209c
push dword [ebp - 0x34]
call esi
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x18
push 0x1001fb0
push dword [ebp - 0x34]
call esi
inc dword [ebp - 0x4c]
jmp 0x100d5c7
xor esi, esi
push dword [ebp - 0x48]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp edi, ebx
je 0x100d947
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x44], ebx
je 0x100d955
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
call fcn.010373f8
ret 4