Function at 0x415730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
mov ebp, ecx
push esi
push ebx
sub esp, 0x5c
lea ebx, [esp + 0x40]
lea esi, [esp + 0x38]
call fcn.0042c430
mov dword [esp], 0x16
mov edi, eax
mov dword [esp + 0x38], ebx
call fcn.004ed900
mov dword [eax], 0x48766544
mov dword [eax + 4], 0x72507361
mov dword [eax + 8], 0x656c626f
mov dword [eax + 0xc], 0x6e61486d
mov dword [eax + 0x10], 0x6e696c64
mov byte [eax + 0x14], 0x67
mov byte [eax + 0x15], 0
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x10], str.This_device_have_some_problem__error_code_is:__d
mov dword [esp + 0xc], 0x2a8
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x40], 0x15
mov dword [esp + 0x3c], 0x15
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x4157d5
mov dword [esp], eax
call fcn.004ed8c0
cmp dword [esp + 0x90], 0x16
mov dword [esp + 0x30], 0xffffffff
je 0x415b60
lea eax, [esp + 0x70]
lea edi, [esp + 0x74]
mov ecx, ebp
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.00415320
sub esp, 8
mov eax, dword [esp + 0x88]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
sub esp, 0x10
test eax, eax
jne 0x4158f0
test byte [esp + 0x35], 4
jne 0x41597a
mov dword [esp + 0x30], 0
call fcn.0042c430
mov ebp, dword [esp + 0x30]
mov edi, eax
mov dword [esp], 0x16
mov dword [esp + 0x38], ebx
call fcn.004ed900
mov dword [eax], 0x48766544
mov dword [eax + 4], 0x72507361
mov dword [eax + 8], 0x656c626f
mov dword [eax + 0xc], 0x6e61486d
mov dword [eax + 0x10], 0x6e696c64
mov byte [eax + 0x14], 0x67
mov byte [eax + 0x15], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], str.DevHasProblemHandling_leave_with__d
mov dword [esp + 0xc], 0x2c8
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x15
mov dword [esp + 0x3c], 0x15
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x4158db
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [esp + 0x30]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
call fcn.0042c430
mov edx, 0x656c
mov dword [esp + 0x10], str.This_device_dosent_have_a_device_node
mov dword [esp + 0xc], 0x27a
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], 0x65447349
mov dword [esp + 0x44], 0x61764176
mov dword [esp + 0x48], 0x62616c69
mov word [esp + 0x4c], dx
mov dword [esp + 0x3c], 0xe
mov byte [esp + 0x4e], 0
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x41595c
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x84]
sub esp, 4
test eax, eax
jne 0x415837
call fcn.0042c430
mov edx, dword [esp + 0x30]
mov dword [esp], 0x16
mov ebp, eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], edx
call fcn.004ed900
mov edx, dword [esp + 0x2c]
mov dword [eax], 0x48766544
mov dword [eax + 4], 0x72507361
mov dword [eax + 8], 0x656c626f
mov dword [eax + 0xc], 0x6e61486d
mov dword [eax + 0x10], 0x6e696c64
mov byte [eax + 0x14], 0x67
mov byte [eax + 0x15], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], str.CM_Get_DevNode_Status_return__d
mov dword [esp + 0xc], 0x2b1
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x15
mov dword [esp + 0x3c], 0x15
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x415a13
mov dword [esp], eax
call fcn.004ed8c0
call fcn.0042c430
mov dword [esp], 0x16
mov ebp, eax
mov dword [esp + 0x38], ebx
call fcn.004ed900
mov dword [eax], 0x48766544
mov dword [eax + 4], 0x72507361
mov dword [eax + 8], 0x656c626f
mov dword [eax + 0xc], 0x6e61486d
mov dword [eax + 0x10], 0x6e696c64
mov byte [eax + 0x14], 0x67
mov byte [eax + 0x15], 0
mov dword [esp + 0x10], str.This_device_node_have_problem__remove_it
mov dword [esp + 0xc], 0x2b3
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x15
mov dword [esp + 0x3c], 0x15
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x415a9c
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [esp + 0x70]
mov dword [esp + 8], edi
mov dword [esp], 5
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
sub esp, 0xc
test eax, eax
jne 0x415bf2
call fcn.0042c430
mov dword [esp], 0x16
mov edi, eax
mov dword [esp + 0x38], ebx
call fcn.004ed900
mov dword [esp + 0x40], 0x15
mov dword [esp + 0x38], eax
mov dword [eax], 0x48766544
mov dword [eax + 4], 0x72507361
mov dword [eax + 8], 0x656c626f
mov dword [eax + 0xc], 0x6e61486d
mov dword [eax + 0x10], 0x6e696c64
mov byte [eax + 0x14], 0x67
mov dword [esp + 0x3c], 0x15
mov byte [eax + 0x15], 0
mov dword [esp + 0x10], str.Remove_error
mov dword [esp + 0xc], 0x2b5
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x415b49
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp + 0x30], 4
jmp 0x41584a
call fcn.0042c430
mov dword [esp], 0x16
mov edi, eax
mov dword [esp + 0x38], ebx
call fcn.004ed900
mov dword [eax], 0x48766544
mov dword [eax + 4], 0x72507361
mov dword [eax + 8], 0x656c626f
mov dword [eax + 0xc], 0x6e61486d
mov dword [eax + 0x10], 0x6e696c64
mov byte [eax + 0x14], 0x67
mov byte [eax + 0x15], 0
mov dword [esp + 0x10], str.This_device_have_been_disabled__so_do_nothing
mov dword [esp + 0xc], 0x2ab
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x15
mov dword [esp + 0x3c], 0x15
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x415842
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x415842
call fcn.0042c430
mov dword [esp], 0x16
mov edi, eax
mov dword [esp + 0x38], ebx
call fcn.004ed900
mov dword [esp + 0x40], 0x15
mov dword [esp + 0x38], eax
mov dword [eax], 0x48766544
mov dword [eax + 4], 0x72507361
mov dword [eax + 8], 0x656c626f
mov dword [eax + 0xc], 0x6e61486d
mov dword [eax + 0x10], 0x6e696c64
mov byte [eax + 0x14], 0x67
mov dword [esp + 0x3c], 0x15
mov byte [eax + 0x15], 0
mov dword [esp + 0x10], str.Remove_success__re_enumerate_the_device
mov dword [esp + 0xc], 0x2b8
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x415c7b
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], 0x12c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
sub esp, 0xc
test eax, eax
jne 0x41584a
mov eax, dword [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Reenumerate_DevNode]
sub esp, 8
mov dword [esp], 0x3e8
call edi
mov eax, 0xffffffff
sub esp, 4
jmp 0x4158df