Function at 0x407f60
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x43e6bc]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.SYSTEMCurrentControlSetServiceshwdatacard
mov ebx, 1
push 0x80000002
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x407fde
push esi
lea ecx, [esp + 0x24]
push str.INFO:_Open_Key_hwdatacard_error___d._n
push ecx
call fcn.00416ae4
lea edx, [esp + 0x2c]
push edx
call fcn.00403d60
add esp, 0x10
cmp esi, 5
jne 0x40807b
mov eax, 0x4e2d
jmp 0x4083b7
cmp byte [0x43fbf7], bl
jne 0x407ffd
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.QCDriverPowerNotify
push ecx
call edi
cmp byte [0x43fbf6], bl
jne 0x408033
mov eax, dword [0x434008]
cmp eax, ebx
je 0x408018
cmp eax, 2
je 0x408018
cmp eax, 3
jne 0x408033
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.QCDriverWinxpPMEnabled
mov dword [esp + 0x28], ebp
push eax
jmp 0x40804c
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.QCDriverWinxpPMEnabled
mov dword [esp + 0x28], ebx
push edx
call edi
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.QCDriverResident
push ecx
mov dword [esp + 0x2c], ebx
call edi
mov edx, dword [esp + 0x10]
push edx
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, 5
je 0x4080cd
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServiceshwusbdev
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
je 0x4080d7
push esi
lea ecx, [esp + 0x24]
push str.INFO:_Open_Key_hwusbdev_error___d._n
push ecx
call fcn.00416ae4
lea edx, [esp + 0x2c]
push edx
call fcn.00403d60
add esp, 0x10
cmp esi, 5
jne 0x408135
mov eax, 0x4e2d
jmp 0x4083b7
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.QCDriverResident
push ecx
call edi
mov eax, dword [0x43fc04]
test eax, eax
je 0x40811c
mov ecx, dword [esp + 0x10]
xor edx, edx
push 4
cmp eax, 1
lea eax, [esp + 0x1c]
push eax
push 4
setne dl
push 0
push str.EnableCD
push ecx
mov dword [esp + 0x30], edx
call edi
jmp 0x408128
mov edx, dword [esp + 0x10]
push str.EnableCD
push edx
call ebx
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, 5
je 0x407fd4
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesew_hwusbdev
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
je 0x408198
push esi
lea edx, [esp + 0x24]
push str.INFO:_Open_Key_ew_hwusbdev_error___d._n
push edx
call fcn.00416ae4
lea eax, [esp + 0x2c]
push eax
call fcn.00403d60
add esp, 0x10
cmp esi, 5
jne 0x408211
mov eax, 0x4e2d
jmp 0x4083b7
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push str.QCDriverResident
push edx
mov dword [esp + 0x30], 0
call edi
mov eax, dword [0x43fc04]
test eax, eax
je 0x4081f4
push 4
xor ecx, ecx
cmp eax, 1
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 4
setne cl
push 0
push str.EnableCD
push eax
mov dword [esp + 0x34], ecx
call edi
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov ebp, eax
call ebx
jmp 0x408217
mov ecx, dword [esp + 0x10]
push str.EnableCD
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov ebp, eax
call ebx
jmp 0x408217
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, 5
je 0x407fd4
mov eax, dword [0x434008]
cmp eax, 2
je 0x408293
cmp eax, 3
je 0x408293
cmp eax, 4
je 0x408293
cmp eax, 5
je 0x408293
cmp eax, 7
je 0x408247
cmp eax, 6
jne 0x408314
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
je 0x408279
push esi
push str.Open_Key_Searching_Windows_Update_error___d._n
jmp 0x4082c3
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
mov dword [esp + 0x24], 2
push str.SearchOrderConfig
jmp 0x408301
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsDriverSearching
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
je 0x4082e9
push esi
push str.INFO:_Open_Key_Searching_Windows_Update_error___d._n
lea ecx, [esp + 0x28]
push ecx
call fcn.00416ae4
lea edx, [esp + 0x2c]
push edx
call fcn.00403d60
add esp, 0x10
cmp esi, 5
jne 0x40830f
mov eax, 0x4e2d
jmp 0x4083b7
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
mov dword [esp + 0x24], 1
push str.DontSearchWindowsUpdate
mov ecx, dword [esp + 0x24]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [0x434008]
cmp eax, 7
je 0x4083ab
cmp eax, 6
je 0x4083ab
call fcn.004044f0
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesewusbnet
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
je 0x40837e
push esi
lea ecx, [esp + 0x24]
push str.INFO:_Open_Key_ewusbnet_error___d._n
push ecx
call fcn.00416ae4
lea edx, [esp + 0x2c]
push edx
call fcn.00403d60
add esp, 0x10
cmp esi, 5
jne 0x4083ab
mov eax, 0x4e2d
jmp 0x4083b7
mov edx, dword [esp + 0x10]
xor eax, eax
cmp byte [0x43fbf8], al
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
setne al
push 0
push str.QCDriverQOSEnabled
push edx
mov dword [esp + 0x2c], eax
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
push 1
call fcn.004045b0
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041613d
add esp, 0x118
ret