Function at 0x437f60
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x6ec84c]
lea edx, [ebp - 0x1a0]
xorps xmm0, xmm0
mov word [ebp - 0xe8], ax
mov al, byte [0x6ec84e]
lea ecx, [ebp - 0x108]
movlpd qword [ebp - 0x1a0], xmm0
movq xmm0, qword [0x746fd4]
movq qword [ebp - 0x1ac], xmm0
movups xmm0, xmmword [str.HKLMSYSTEMControlSet001Control_]
push ebx
push esi
mov esi, dword [0x746fdc]
movups xmmword [ebp - 0x108], xmm0
push edi
movups xmm0, xmmword [0x6ec83c]
push 0
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x194], esi
movups xmmword [ebp - 0xf8], xmm0
mov byte [ebp - 0xe6], al
call fcn.00416da0
add esp, 4
test eax, eax
js 0x438050
mov esi, dword [ebp - 0x1a0]
push str.hardwares
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
jne 0x438043
push 3
mov edx, str.delete_mtspe_data
mov ecx, str.mtspe
call fcn.0041cb10
add esp, 4
cmp dword [0x73cb5c], 1
je 0x438043
mov eax, dword [0x71702c]
xor ecx, ecx
test eax, eax
mov dword [0x73cb5c], 1
cmovg eax, ecx
mov dword [0x71702c], eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x194]
mov ebx, dword [ebp - 0x1ac]
test ebx, ebx
je 0x43822b
test esi, esi
je 0x43822b
xor eax, eax
mov dword [ebp - 0x190], eax
test ebx, ebx
jle 0x43822b
lea edi, [eax + esi]
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x438080
push 0x80
lea eax, [ebp - 0x188]
sub esi, ecx
push 0
push eax
call fcn.005f46f0
add esp, 0xc
lea eax, [ebp - 0x188]
push esi
push edi
push eax
call fcn.005f40c0
mov eax, dword [ebp - 0x190]
add esp, 0xc
inc eax
add eax, esi
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x188]
push eax
push str.mtspe_sub_key_name__s
call fcn.00437c40
push 0x100
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.005f46f0
lea edi, [ebp - 0x108]
add esp, 0x14
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4380f0
mov ecx, 8
mov esi, str.HKLMSYSTEMControlSet001Services
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x108]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x438110
mov ax, word [0x6e9fec]
lea edx, [ebp - 0x188]
mov word [edi], ax
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x438130
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x438140
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x1a0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [ebp - 0x108]
call fcn.00416da0
add esp, 4
test eax, eax
js 0x438216
mov edi, dword [ebp - 0x1a0]
lea eax, [ebp - 0x18c]
push eax
push 0
push 0
push 0
push 0x6ea11c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4381a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x438216
push 4
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x18c], 4
push eax
push 4
push 0
push 0x6ea11c
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
push edi
sbb esi, esi
and esi, 0xfffffff2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sar esi, 0x1f
mov edx, str.mtspe_driver_registration
and esi, 1
mov ecx, str.mtspe
add esi, 3
push esi
call fcn.0041cb10
add esp, 4
cmp dword [0x73cb5c], 1
je 0x438216
cmp esi, 4
je 0x438216
mov eax, dword [0x71702c]
xor ecx, ecx
test eax, eax
mov dword [0x73cb5c], 1
cmovg eax, ecx
mov dword [0x71702c], eax
mov eax, dword [ebp - 0x190]
mov esi, dword [ebp - 0x194]
sub ebx, 1
jne 0x438076
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret