Function at 0x407b20
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x43e6bc]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SYSTEMCurrentControlSetServiceshwdatacard
push 0x80000002
mov dword [esp + 0x38], ebx
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
cmp edi, ebx
je 0x407b97
push edi
lea ecx, [esp + 0x1c]
push str.INFO:_Open_Key_hwdatacard_error___d._n
push ecx
call fcn.00416ae4
lea edx, [esp + 0x24]
push edx
call fcn.00403d60
add esp, 0x10
cmp edi, 5
jne 0x407bcd
mov eax, 0x4e2d
jmp 0x407f38
mov eax, dword [esp + 0x10]
push str.QCDriverResident
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.QCDriverPowerManagementEnabled
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.QCDriverWaitWakeEnabled
push edx
call esi
mov ebx, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x407c15
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServiceshuawei_updateParameters
push 0x80000002
call ebp
mov edi, eax
test edi, edi
je 0x407c1f
push edi
lea edx, [esp + 0x1c]
push str.INFO:_Open_Key_hwusbdev_error___d._n
push edx
call fcn.00416ae4
lea eax, [esp + 0x24]
push eax
call fcn.00403d60
add esp, 0x10
cmp edi, 5
jne 0x407c44
mov eax, 0x4e2d
jmp 0x407f38
mov ecx, dword [esp + 0x10]
push str.DataInOutPacketsPerXfer
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.DebugLevel
push edx
call esi
mov ebx, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x407b8d
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServiceshwusbdev
push 0x80000002
call ebp
mov edi, eax
test edi, edi
je 0x407c9f
push edi
lea edx, [esp + 0x1c]
push str.INFO:_Open_Key_hwusbdev_error___d._n
push edx
call fcn.00416ae4
lea eax, [esp + 0x24]
push eax
call fcn.00403d60
add esp, 0x10
cmp edi, 5
jne 0x407cdc
mov eax, 0x4e2d
jmp 0x407f38
mov ecx, dword [esp + 0x10]
push str.QCDriverResident
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.QCDriverPowerManagementEnabled
push edx
call esi
mov eax, dword [esp + 0x10]
push str.QCDriverWaitWakeEnabled
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.EnableCD
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x407b8d
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesew_hwusbdev
push 0x80000002
call ebp
mov edi, eax
test edi, edi
je 0x407d37
push edi
lea ecx, [esp + 0x1c]
push str.INFO:_Open_Key_ew_hwusbdev_error___d._n
push ecx
call fcn.00416ae4
lea edx, [esp + 0x24]
push edx
call fcn.00403d60
add esp, 0x10
cmp edi, 5
jne 0x407d74
mov eax, 0x4e2d
jmp 0x407f38
mov eax, dword [esp + 0x10]
push str.QCDriverResident
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.QCDriverPowerManagementEnabled
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.QCDriverWaitWakeEnabled
push edx
call esi
mov eax, dword [esp + 0x10]
push str.EnableCD
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x407b8d
mov eax, dword [0x434008]
cmp eax, 7
je 0x407dff
cmp eax, 6
je 0x407dff
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesewusbnet
push 0x80000002
call ebp
mov edi, eax
test edi, edi
je 0x407dde
push edi
push str.INFO:_Open_Key_ewusbnet_error___d._n
lea eax, [esp + 0x20]
push eax
call fcn.00416ae4
lea ecx, [esp + 0x24]
push ecx
call fcn.00403d60
add esp, 0x10
cmp edi, 5
jne 0x407e46
mov eax, 0x4e2d
jmp 0x407f38
mov edx, dword [esp + 0x10]
push str.NetworkCardNotRemovalable
push edx
call esi
mov eax, dword [esp + 0x10]
push str.QCDriverQOSEnabled
push eax
call esi
mov ecx, dword [esp + 0x10]
mov ebx, eax
push ecx
jmp 0x407e40
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesewusbmbb
push 0x80000002
call ebp
mov edi, eax
test edi, edi
je 0x407e2d
push edi
push str.INFO:_Open_Key_ewusbwwan_error___d._n
jmp 0x407db8
mov edx, dword [esp + 0x10]
push str.QCDriverQOSEnabled
push edx
call esi
mov ebx, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x434008]
cmp eax, 2
je 0x407ead
cmp eax, 3
je 0x407ead
cmp eax, 4
je 0x407ead
cmp eax, 5
je 0x407ead
cmp eax, 7
je 0x407e6d
cmp eax, 6
jne 0x407f22
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching
push 0x80000002
call ebp
mov esi, eax
test esi, esi
je 0x407e9b
push esi
push str.Open_Key_Searching_Windows_Update_error___d._n
jmp 0x407ed9
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.SearchOrderConfig
jmp 0x407f0c
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsDriverSearching
push 0x80000002
call ebp
mov esi, eax
test esi, esi
je 0x407efc
push esi
push str.INFO:_Open_Key_Searching_Windows_Update_error___d._n
lea edx, [esp + 0x20]
push edx
call fcn.00416ae4
lea eax, [esp + 0x24]
push eax
call fcn.00403d60
add esp, 0x10
cmp esi, 5
jne 0x407f22
mov eax, 0x4e2d
jmp 0x407f38
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.DontSearchWindowsUpdate
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call fcn.004045b0
add esp, 4
cmp ebx, 5
mov eax, 0x4e2d
je 0x407f38
mov eax, ebx
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041613d
add esp, 0x110
ret