Function at 0x434b10
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45ad9b
push eax
mov dword fs:[0], esp
sub esp, 0x734
lea eax, [esp + 0x228]
push 0
push str.ResetLeftoverACFStuff_entry_n
push eax
call fcn.0043a4a0
add esp, 0xc
mov ecx, 0x475b68
call fcn.0042f5e0
lea ecx, [esp + 0x228]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
call fcn.00434940
test eax, eax
jne 0x435099
push ebx
push ebp
push esi
push edi
mov edi, str.SystemCurrentControlSetServicesClassPorts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x338]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x338]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x434d8f
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push 0x104
push eax
push 0
push ecx
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x434d84
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or ecx, 0xffffffff
lea edi, [esp + 0x338]
xor eax, eax
lea edx, [esp + 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x134]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46a404
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x134]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xf003f
lea ecx, [esp + 0x13c]
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x434d63
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
lea eax, [esp + 0x30]
push edx
push eax
push 0
push 0
push str.PortDriver
push ecx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x434d58
lea edx, [esp + 0x30]
push str.MOHSER.VXD
push edx
call fcn.0043a6f0
add esp, 8
test eax, eax
jne 0x434d58
lea eax, [esp + 0x134]
lea ecx, [esp + 0x238]
push eax
push str.Changing_PortDriver_at__s_n
push ecx
call fcn.0043a4a0
add esp, 0xc
lea edx, [esp + 0x238]
mov ecx, 0x475b68
push edx
call fcn.0042f820
mov edi, str.SERIAL.VXD
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
push ecx
lea ecx, [esp + 0x34]
push ecx
push 1
push eax
push str.PortDriver
push edx
call ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x30]
mov eax, ebp
push 0x104
push ecx
push eax
push edx
inc ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x434be7
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x471df4]
mov dword [esp + 0x18], ecx
mov edi, str.SystemCurrentControlSetServicesClassModem
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x338]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x74c], 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x338]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43504e
mov ecx, dword [esp + 0x14]
mov ebp, 0x104
lea eax, [esp + 0x30]
push ebp
push eax
push 0
push ecx
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x435043
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
or ecx, 0xffffffff
lea edi, [esp + 0x338]
xor eax, eax
lea edx, [esp + 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x134]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x46a404
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x134]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x134]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.INIT
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xf003f
lea ecx, [esp + 0x13c]
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43501e
lea edx, [esp + 0x1c]
lea eax, [esp + 0x43c]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push 0
lea eax, [esp + 0x550]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov esi, 1
call ebx
test eax, eax
jne 0x435013
lea edx, [esp + 0x43c]
lea ecx, [esp + 0x18]
push edx
call fcn.0044a511
lea ecx, [esp + 0x18]
call fcn.0044a88a
push str.IBC1_0_1_____1
lea ecx, [esp + 0x1c]
call fcn.00449464
cmp eax, 0xffffffff
jne 0x434f94
push str.PCW0
lea ecx, [esp + 0x1c]
call fcn.00449464
cmp eax, 0xffffffff
jne 0x434f94
push str.PMH0
lea ecx, [esp + 0x1c]
call fcn.00449464
cmp eax, 0xffffffff
je 0x434fd7
lea eax, [esp + 0x134]
lea ecx, [esp + 0x238]
push eax
push str.Deleting_InitString_at__s_n
push ecx
call fcn.0043a4a0
add esp, 0xc
lea edx, [esp + 0x238]
mov ecx, 0x475b68
push edx
call fcn.0042f820
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x540]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
dec esi
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x43c]
push edx
lea edx, [esp + 0x30]
push ecx
push edx
lea ecx, [esp + 0x2c]
push 0
lea edx, [esp + 0x550]
mov eax, esi
push ecx
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
inc esi
call ebx
test eax, eax
je 0x434f41
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x30]
mov eax, ecx
push ebp
push edx
push eax
mov eax, dword [esp + 0x20]
inc ecx
push eax
mov dword [esp + 0x38], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x434e22
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [esp + 0x648]
push str.ResetLeftoverACFStuff_exit_n
push edx
call fcn.0043a4a0
add esp, 0xc
lea eax, [esp + 0x644]
mov ecx, 0x475b68
push eax
call fcn.0042f820
mov ecx, 0x475b68
call fcn.0042f5f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x74c], 0xffffffff
call fcn.0044a3d4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x734]
mov dword fs:[0], ecx
add esp, 0x740
ret