Function at 0x416dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
test ebx, ebx
setne al
add eax, eax
mov dword [esp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x4170c4
mov edi, eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x1c
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], eax
jmp 0x416eb2
lea eax, [ebp - 0x44]
test ebx, ebx
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x4c], eax
je 0x416e6b
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x4c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004cb7a0
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x4c]
mov eax, dword [eax + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0045b2d0
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x417065
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x44]
cmp eax, ecx
je 0x416eab
mov dword [esp], eax
call fcn.004ed8c0
add dword [ebp - 0x60], 1
mov eax, dword [ebp - 0x5c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
sub esp, 0xc
cmp eax, 1
jne 0x416fe0
mov dword [ebp - 0x50], 0
xor eax, eax
xor ebx, ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x50]
mov dword [esp + 8], ebx
mov dword [esp], edi
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
sub esp, 0x14
test eax, eax
jne 0x416e20
mov esi, dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x416e20
test ebx, ebx
je 0x416f29
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
test esi, esi
jne 0x416f34
mov eax, dword [ebp - 0x50]
xor ebx, ebx
jmp 0x416edd
mov dword [esp + 4], esi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x416f70
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004327e0
mov eax, dword [ebp - 0x50]
jmp 0x416edd
call fcn.0042c430
lea ecx, [ebp - 0x44]
mov dword [esp + 0x10], 0x4fc2db
mov dword [esp + 0xc], 0xcb
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x4c], ecx
mov ecx, 0x6570
mov dword [ebp - 0x44], 0x63656843
mov word [ebp - 0x38], cx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x40], 0x7272456b
mov dword [ebp - 0x3c], 0x7954726f
mov dword [ebp - 0x48], 0xe
mov dword [esp + 8], ecx
mov byte [ebp - 0x36], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x44]
cmp eax, ecx
je 0x416f66
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x416f66
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
call fcn.0042c430
mov esi, dword [ebp - 0x5c]
lea ebx, [ebp - 0x2c]
mov edx, 0x6563
mov dword [esp + 0x10], str.DeleteInstance_return_ERROR_NO_SUCH_DEVICE_leave
mov dword [esp + 0xc], 0x18c
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], 0x656c6544
mov dword [ebp - 0x28], 0x6e496574
mov dword [ebp - 0x24], 0x6e617473
mov word [ebp - 0x20], dx
mov dword [ebp - 0x30], 0xe
mov byte [ebp - 0x1e], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x417056
mov dword [esp], eax
call fcn.004ed8c0
mov eax, 2
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], edi
mov dword [esp], 5
mov dword [esp + 8], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
sub esp, 0xc
test eax, eax
mov dword [esp], edi
jne 0x4170b7
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
mov eax, 1
mov edx, dword [ebp - 0x4c]
lea esi, [ebp - 0x44]
cmp edx, esi
je 0x41705b
mov dword [esp], edx
mov dword [ebp - 0x5c], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x5c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
xor eax, eax
jmp 0x417095
lea eax, [ebp - 0x34]
mov dword [ebp - 0x5c], eax
jmp 0x416fec