Function at 0x402900
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Persist via run registry key
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x153c
call fcn.00410f00
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 0x1538], eax
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
call fcn.00401870
cmp edi, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], bp
je 0x402a56
mov ebx, 1
cmp dword [esp + 0x18], ebx
jle 0x402a56
mov edx, dword [edi + 4]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x402973
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x30]
call fcn.00403310
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x40299c
lea eax, [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push eax
call esi
push 0x41693c
call esi
mov eax, dword [edi + 4]
mov ecx, 0x416940
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4029da
cmp dx, bp
je 0x4029d6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4029da
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x4029b4
xor eax, eax
jmp 0x4029df
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x4029ee
push str._1:_Unload_driver_n
call esi
mov dword [esp + 0x14], ebx
mov eax, dword [edi + 4]
mov ecx, str._s_u
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402a1c
cmp dx, bp
je 0x402a18
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402a1c
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x4029f6
xor eax, eax
jmp 0x402a21
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x402a30
push str._2:_Unload_driver_n
call esi
mov dword [esp + 0x1c], ebx
mov ebx, 2
lea eax, [esp + 0x28]
call fcn.00403150
cmp eax, 0xffffffff
je 0x402a52
push str._3:_Unload_driver_n
call esi
mov dword [esp + 0x14], 1
xor ebp, ebp
jmp 0x402a5c
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x3fe
lea edx, [esp + 0x14e]
push ebp
push edx
mov word [esp + 0x154], bp
call fcn.004089f0
add esp, 0xc
push 0x200
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
jne 0x402a9d
push str.Failed_to_get_system_windows_directory__n
call esi
jmp 0x402eb7
push 0x3fe
lea edx, [esp + 0x54e]
push ebp
push edx
mov word [esp + 0x554], bp
call fcn.004089f0
push str.amwrtdrv
lea eax, [esp + 0x158]
push eax
push str._s_system32_s.sys
lea ecx, [esp + 0x560]
push 0x200
push ecx
call fcn.00404512
push 0x3fe
lea edx, [esp + 0x96e]
push ebp
push edx
mov word [esp + 0x974], bp
call fcn.004089f0
push str.ammntdrv
lea eax, [esp + 0x178]
push eax
push str._s_system32_s.sys
lea ecx, [esp + 0x980]
push 0x200
push ecx
call fcn.00404512
add esp, 0x40
push 0x3fe
lea edx, [esp + 0xd4e]
push ebp
push edx
mov word [esp + 0xd54], bp
call fcn.004089f0
push 0x415ee8
lea eax, [esp + 0x158]
push eax
push str._s_system32_s.sys
lea ecx, [esp + 0xd60]
push 0x200
push ecx
call fcn.00404512
add esp, 0x20
push ebp
lea edx, [esp + 0x14]
push edx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebp
push str.amoverinst
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
cmp dword [esp + 0x14], ebp
jne 0x402dc4
push ebp
push str.vsscom.exe__regserver
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.amoverinst
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.amreboot
push edx
call esi
call fcn.00401980
test eax, eax
je 0x402c93
push 0x20
mov eax, str.amwrtdrv
call fcn.00401210
call fcn.004023a0
push 0x10
mov eax, str.amwrtdrv
call fcn.00401210
add esp, 8
call fcn.00403fe0
call fcn.00403b90
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.004040c0
mov esi, eax
test esi, esi
je 0x402c73
push 0x3ff
lea eax, [esp + 0x114d]
push 0
push eax
mov byte [esp + 0x1154], 0
call fcn.004089f0
push esi
lea ecx, [esp + 0x1158]
push str.Unmount_fail__Ret_u
push ecx
call fcn.0040458e
add esp, 0x18
mov eax, str.ammntdrv
call fcn.004020f0
call fcn.00402650
push 0x10
mov eax, str.ammntdrv
call fcn.00401210
add esp, 4
xor ebp, ebp
push 2
lea edx, [esp + 0x54c]
mov ecx, str.amwrtdrv
call fcn.00401f80
add esp, 4
test eax, eax
je 0x402cc7
push 2
lea edx, [esp + 0x94c]
mov ecx, str.ammntdrv
call fcn.00401f80
add esp, 4
test eax, eax
jne 0x402d43
call fcn.00401980
test eax, eax
jne 0x402d0f
mov eax, str.amwrtdrv
call fcn.004020f0
mov eax, str.ammntdrv
call fcn.004020f0
push str.Failed_to_Install_drive._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x402ecb
mov eax, dword [esp + 0x2c]
push eax
jmp 0x402ec3
push 0x416b54
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 2
lea edx, [esp + 0x54c]
mov ecx, str.amwrtdrv
call fcn.00401f80
push 2
lea edx, [esp + 0x950]
mov ecx, str.ammntdrv
call fcn.00401f80
add esp, 8
push ebp
lea edx, [esp + 0xd4c]
mov ecx, 0x415ee8
call fcn.00401f80
add esp, 4
test eax, eax
je 0x402d88
call fcn.00401c50
test eax, eax
jne 0x402d70
push str.Failed_to_add_filter_param_to_register_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00401980
test eax, eax
je 0x402dba
call fcn.00401560
call fcn.004018f0
jmp 0x402e9c
call fcn.00401980
test eax, eax
jne 0x402daa
mov eax, 0x415ee8
call fcn.004020f0
call fcn.00401e20
call fcn.004018f0
jmp 0x402e9c
push str.12_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00401e20
call fcn.004018f0
jmp 0x402e9c
push str.Comn.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, ebp
je 0x402e09
push str.CreateObjectBootQuickCfg
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x402e02
call eax
mov edi, eax
cmp edi, ebp
je 0x402e02
mov edx, dword [edi]
mov eax, dword [edx + 4]
push ebp
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
push ebp
push ebp
mov ecx, edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00401a90
cmp esi, ebp
jne 0x402e9c
mov eax, str.amwrtdrv
call fcn.004020f0
mov esi, eax
neg esi
sbb esi, esi
mov eax, str.ammntdrv
neg esi
call fcn.004020f0
neg eax
sbb eax, eax
neg eax
and esi, eax
call fcn.00401e20
test eax, eax
je 0x402e57
call fcn.00401330
test eax, eax
jne 0x402e57
push str.Unable_to_remove_ambakdrv._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esp + 0x1c], ebp
jne 0x402e9c
mov edx, dword [esp + 0x10]
push ebp
lea ecx, [esp + 0x48]
push ecx
push 1
push ebp
push str.amreboot
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebp
je 0x402e85
push str.Failed_to_Uninstall_drive._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebp
push str.vsscom.exe__unregserver
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.OK_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004013a0
cmp dword [esp + 0x40], 8
jb 0x402ecb
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004043b9
add esp, 4
mov ecx, dword [esp + 0x1548]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004043be
add esp, 0x153c
ret 0x10