Function at 0x413b70
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4256e8
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, 7
xor edi, edi
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], ax
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.00413ea0
test eax, eax
je 0x413c8b
push 0x18
mov eax, str.Drivers_atheros_bth.inf
lea ecx, [ebp - 0x48]
call fcn.0040b420
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x413bdf
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x298]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x413c81
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
push 0xa
mov eax, str.AddRegKeys
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
call fcn.0040b550
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00412a50
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], 8
jb 0x413c40
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00416027
add esp, 4
xor edx, edx
push 0xd
mov eax, str.DeleteRegKeys
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
call fcn.0040b550
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00413340
add esp, 4
cmp dword [ebp - 0x18], 8
jb 0x413c8b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00416027
add esp, 4
jmp 0x413c8b
call fcn.00412e20
call fcn.004136e0
call fcn.004129c0
test al, al
jne 0x413e6e
mov ecx, dword [0x4357a4]
mov edx, dword [0x4357a0]
lea eax, [ebp - 0x2a0]
push eax
push ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.SYSTEMCurrentControlSetServicesBTHPORTParametersSupportedServices
push 0x80000002
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 0x2a4], 1
mov dword [0x4357a0], 0x80000002
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x413d00
mov edx, dword [ebp - 0x2a0]
push str.0000112d_0000_1000_8000_00805f9b34fb
push edx
call ebx
mov eax, dword [ebp - 0x2a0]
push eax
call esi
mov edx, dword [0x4357a4]
mov eax, dword [0x4357a0]
lea ecx, [ebp - 0x29c]
push ecx
push edx
push 0
push str.SYSTEMCurrentControlSetServicesBTHPORTParametersSupportedServices
push eax
call edi
test eax, eax
jne 0x413d38
mov ecx, dword [ebp - 0x29c]
push str.0000112e_0000_1000_8000_00805f9b34fb
push ecx
call ebx
mov edx, dword [ebp - 0x29c]
push edx
call esi
mov ecx, dword [0x4357a4]
mov edx, dword [0x4357a0]
lea eax, [ebp - 0x2a0]
push eax
push ecx
push 0
push str.SYSTEMCurrentControlSetServicesBTHPORTParametersSupportedServices
push edx
call edi
test eax, eax
jne 0x413d71
mov eax, dword [ebp - 0x2a0]
push str.0000112f_0000_1000_8000_00805f9b34fb
push eax
call ebx
mov ecx, dword [ebp - 0x2a0]
push ecx
call esi
mov eax, dword [0x4357a4]
mov ecx, dword [0x4357a0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea edx, [ebp - 0x29c]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesBTHPORTParametersUnsupportedServices
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x413dca
mov eax, dword [ebp - 0x29c]
push 4
lea edx, [ebp - 0x2a4]
push edx
push 4
push 0
push str.0000112d_0000_1000_8000_00805f9b34fb
push eax
call edi
mov ecx, dword [ebp - 0x29c]
push ecx
call esi
mov eax, dword [0x4357a4]
mov ecx, dword [0x4357a0]
push 0
lea edx, [ebp - 0x2a0]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesBTHPORTParametersUnsupportedServices
push ecx
call ebx
test eax, eax
jne 0x413e16
push 4
lea edx, [ebp - 0x2a4]
push edx
push 4
push eax
mov eax, dword [ebp - 0x2a0]
push str.0000112e_0000_1000_8000_00805f9b34fb
push eax
call edi
mov ecx, dword [ebp - 0x2a0]
push ecx
call esi
mov eax, dword [0x4357a4]
mov ecx, dword [0x4357a0]
push 0
lea edx, [ebp - 0x29c]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesBTHPORTParametersUnsupportedServices
push ecx
call ebx
test eax, eax
jne 0x413e62
push 4
lea edx, [ebp - 0x2a4]
push edx
push 4
push eax
mov eax, dword [ebp - 0x29c]
push str.0000112f_0000_1000_8000_00805f9b34fb
push eax
call edi
mov ecx, dword [ebp - 0x29c]
push ecx
call esi
mov edx, dword [ebp - 0x2a8]
mov dword [0x4357a0], edx
cmp dword [ebp - 0x34], 8
jb 0x413e80
mov eax, dword [ebp - 0x48]
push eax
call fcn.00416027
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret