Function at 0x41e86d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x513720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 6
pop ecx
push 0xe
push edx
mov dword [ebp - 0x838], eax
lea edi, [ebp - 0x828]
xor eax, eax
mov dword [ebp - 0x82c], edx
push edx
mov dword [esi], edx
rep stosd dword es:[edi], eax
push edx
mov dword [ebx], edx
mov dword [ebp - 0x10], 0x6b736944
mov dword [ebp - 0xc], 0x76697244
mov word [ebp - 8], 0x65
mov dword [ebp - 0x834], edx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov dword [ebp - 0x830], eax
cmp eax, 0xffffffff
je 0x41ecad
push 0x7ff
lea eax, [ebp - 0x80f]
mov dword [ebp - 0x82c], 0x1c
push 0
push eax
mov byte [ebp - 0x810], 0
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
push 0
push dword [ebp - 0x830]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x41eca1
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x810]
push 0
push 0x7fe
push eax
push 0
push 7
lea eax, [ebp - 0x82c]
push eax
push dword [ebp - 0x830]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x41eb77
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004bae8d
pop ecx
pop ecx
test eax, eax
jne 0x41eb77
push eax
push 0x7fe
lea eax, [ebp - 0x810]
push eax
push 0
push 0xc
lea eax, [ebp - 0x82c]
push eax
push dword [ebp - 0x830]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x41eb77
lea eax, [ebp - 0x810]
push eax
push 0x800
push dword [ebp - 0x838]
call fcn.004bab23
push 0x500550
push 0x800
push dword [ebp - 0x838]
call fcn.004bab23
add esp, 0x18
lea eax, [ebp - 0x810]
push str.vdiskbus
push eax
call edi
test eax, eax
jne 0x41ec9a
push str.netzone
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec8c
push str.diskless
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec8c
push str.richdisk
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec7e
push str.deepin
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec70
push str.kic.disk
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec62
push str.nmenu
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec54
push str.alddisk
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec46
push str.vhd_cms
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec38
push str.mzd.live
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec2a
push str.ccboot
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec1c
push str.vnd_scsi
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ec0b
push str.bnvirtualscsihba
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ebfa
push str.bxp_virtual
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ebfa
push str.s.t._virtual
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ebe9
push str.kb.mdisk
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ebd8
push str.hin_virtual
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ebc7
push str.obm_virtual
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41ebb6
push str.msft_virtual
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
jne 0x41eba5
mov eax, dword [ebp - 0x834]
lea ecx, [ebp - 0x82c]
inc eax
push ecx
push eax
push dword [ebp - 0x830]
mov dword [ebp - 0x834], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x41e929
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0x12
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0x11
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0xf
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0xe
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0xd
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0xc
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0xb
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 0xa
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 9
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 8
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 7
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 6
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 5
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 4
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 3
jmp 0x41eca1
mov dword [esi], 1
mov dword [ebx], 2
jmp 0x41eca1
xor eax, eax
inc eax
mov dword [esi], eax
mov dword [ebx], eax
push dword [ebp - 0x830]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b923d
mov esp, ebp
pop ebp
ret 0x10