Function at 0x407100
Capabilities:
Delete registry key
Get file version info
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x628
mov rax, qword [0x00454a00]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
mov qword [r11 + 0x18], rbx
mov ebx, dword [rdx + 0x20]
mov qword [r11 + 0x20], rbp
mov ebp, dword [rdx + 0x28]
mov qword [r11 - 8], rsi
mov esi, dword [rdx + 0x24]
mov qword [r11 - 0x18], r12
mov r12, rcx
lea rcx, [r11 - 0x368]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x80], esi
mov qword [r11 - 0x20], r13
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x7c], ebp
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x54], 0x104
call fcn.00420630
lea rdx, [rsp + 0x90]
lea rax, [rsp + 0x58]
xor r13d, r13d
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rdx, str.SOFTWAREHuawei_technologiesCurrentDriver
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4071e6
movzx eax, byte [0x00456476]
lea rcx, str.INFO:_DriverInfo_Open_Key_error._n
mov byte [0x00456477], al
movzx eax, byte [0x0044a009]
mov byte [0x00456478], al
call fcn.004042c0
xor eax, eax
jmp 0x4079b9
cmp dword [rsp + 0x90], 2
mov qword [rsp + 0x618], rdi
mov qword [rsp + 0x600], r14
mov r14d, 1
jne 0x40739e
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2c0]
lea r8, [rsp + 0x1b0]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov edi, r13d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40739e
lea rdx, str.MajorVersion
lea rcx, [rsp + 0x1b0]
add edi, r14d
call fcn.0041ff80
test rax, rax
je 0x407283
mov r8d, dword [rsp + 0x54]
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x78]
call fcn.00420a60
lea rdx, str.MinorVersion
lea rcx, [rsp + 0x1b0]
call fcn.0041ff80
test rax, rax
je 0x4072b6
mov r8d, dword [rsp + 0x54]
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x80]
call fcn.00420a60
lea rdx, str.Customization
lea rcx, [rsp + 0x1b0]
call fcn.0041ff80
test rax, rax
je 0x4072e6
mov r8d, dword [rsp + 0x54]
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x7c]
call fcn.00420a60
lea rdx, [0x00439d14]
lea rcx, [rsp + 0x1b0]
call fcn.0041ff80
movzx ecx, byte [0x00456477]
lea rdx, str.DualDriver
test rax, rax
cmovne ecx, r14d
mov byte [0x00456477], cl
lea rcx, [rsp + 0x1b0]
call fcn.0041ff80
movzx ecx, byte [0x00456478]
mov r8d, 0x104
test rax, rax
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x54], 0x104
cmovne ecx, r14d
xor edx, edx
mov byte [0x00456478], cl
lea rcx, [rsp + 0x2c0]
call fcn.00420630
mov rcx, qword [rsp + 0x58]
lea r11, [rsp + 0x54]
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x2c0]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x1b0]
mov edx, edi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x407250
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x00456475], r13b
jne 0x407429
movzx ecx, byte [0x0044a009]
movzx edi, byte [0x00456477]
movzx edx, byte [0x00456476]
cmp cl, r14b
movzx eax, byte [0x00456478]
jne 0x4073d7
test al, al
je 0x4073ea
cmp dl, r14b
jne 0x407404
test dil, dil
jne 0x407404
cmp cl, r14b
jne 0x4073fb
test al, al
jne 0x4073fb
cmp dl, r14b
mov byte [0x00456478], r14b
jne 0x407443
test dil, dil
jne 0x407443
mov byte [0x00456477], r14b
jmp 0x407443
cmp dword [rsp + 0x7c], ebp
jne 0x407443
mov eax, dword [rsp + 0x78]
cmp ebx, eax
jb 0x40741f
cmp ebx, eax
jne 0x407443
cmp esi, dword [rsp + 0x80]
jae 0x407443
mov eax, 0x4e2a
jmp 0x4079a9
movzx eax, byte [0x0044a009]
mov byte [0x00456478], al
movzx eax, byte [0x00456476]
mov byte [0x00456477], al
lea rdx, str.SOFTWAREHuawei_technologiesCurrentDriver
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rdx, str.SOFTWAREHuawei_technologiesCurrentDriver
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4074a7
lea rcx, str.INFO:_DriverInfo_Open_Key_error_for_update._n
call fcn.004042c0
jmp 0x4079a7
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.MajorVersion
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.MinorVersion
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.Customization
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [0x00456478], r14b
jne 0x407575
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.DualDriver
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [0x00456477], r14b
jne 0x4075b0
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x00439d14]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rsp + 0x4e0]
mov rdx, r12
call fcn.004209a0
lea rdx, [0x00439cc8]
lea rcx, [rsp + 0xa0]
call fcn.004209a0
xor eax, eax
lea rdi, [rsp + 0x4e0]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xa0]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, r14
test al, al
jne 0x4075f1
lea rcx, [rsp + 0x4e0]
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ecx, eax
mov ebx, eax
call fcn.004135f4
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.00420630
lea rcx, [rsp + 0x4e0]
mov r9, rbp
mov r8d, ebx
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40764e
mov rcx, rbp
call fcn.004135ec
jmp 0x40799c
lea r9, [rsp + 0x94]
lea r8, [rsp + 0x98]
lea rdx, [0x00439c94]
mov rcx, rbp
mov qword [rsp + 0x98], r13
mov dword [rsp + 0x94], r13d
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x407641
mov rax, qword [rsp + 0x98]
mov ecx, dword [rax + 8]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x98]
mov ecx, dword [rax + 0xc]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x8c], eax
shr eax, 0x10
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rsp + 0x8c]
movzx esi, ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rsp + 0x8a]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rsp + 0x88]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, str._d_d_d_d
lea rcx, [rsp + 0x3d0]
mov r9d, edi
movzx r8d, ax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
call fcn.004209a0
mov rcx, rbp
call fcn.004135ec
xor eax, eax
lea rdi, [rsp + 0x3d0]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x3d0]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea r8, [rcx - 3]
lea rcx, [rsp + 0xa0]
call fcn.00420a60
lea rcx, [rsp + 0xa0]
mov byte [rsp + rdi + 0x9e], r13b
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rdx, [rsp + 0x3d0]
lea rdi, [rsp + 0x3d0]
mov ebx, eax
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
movzx ecx, word [rcx + rdx - 3]
mov byte [rsp + 0xa2], al
mov word [rsp + 0xa0], cx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x40], r13
mov edi, eax
lea rax, [rsp + 0x70]
lea rdx, str.SysInfo
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4078a2
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rdx, [0x00439cb0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x407897
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea rdx, str.MajorVersion
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea rdx, str.MinorVersion
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rdx, str.InfInfo
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40799c
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rdx, [0x00439c98]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x407991
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea rdx, str.MajorVersion
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea rdx, str.MinorVersion
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rdi, qword [rsp + 0x618]
mov r14, qword [rsp + 0x600]
mov r13, qword [rsp + 0x608]
mov r12, qword [rsp + 0x610]
mov rsi, qword [rsp + 0x620]
mov rbp, qword [rsp + 0x648]
mov rbx, qword [rsp + 0x640]
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.00420600
add rsp, 0x628
ret