Function at 0x403870
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
push str.Enter_function_void_OnDeviceArrival___n
call esi
call fcn.00402400
call fcn.00408c80
xor edi, edi
push 0x206
lea ecx, [ebp - 0x416]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x420], edi
mov word [ebp - 0x418], ax
call fcn.0041d650
add esp, 0xc
push str.SoftwareAtherosVistaAddOn
lea edx, [ebp - 0x418]
push 0x104
push edx
call fcn.00415b9a
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
mov ebx, 1
push ebx
push edi
lea ecx, [ebp - 0x418]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403959
mov ecx, dword [ebp - 0x420]
lea edx, [ebp - 0x42c]
push edx
lea eax, [ebp - 0x428]
push eax
push edi
push edi
push str.IsWin7DriverOnly
push ecx
mov dword [ebp - 0x42c], 4
mov dword [ebp - 0x428], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x420]
xor edx, edx
cmp dword [ebp - 0x428], ebx
push eax
sete dl
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x403959
push str.This_package_is_for_Win7_driver_only__no_need_to_add_and_delete_registry__n
call esi
jmp 0x40395e
call fcn.00413b70
mov ecx, dword [0x42ea7c]
mov edx, dword [0x42ea80]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x42ea84]
mov dword [eax + 4], edx
mov edx, dword [0x42ea88]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.00401eb0
add esp, 0x10
test eax, eax
je 0x4039d1
call fcn.004020a0
test eax, eax
je 0x4039d1
push str.Enter_Function_DisableRadioHandler__n_n
call esi
mov eax, dword [0x436850]
mov edi, dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0
push ebx
push 0x5e5d
push eax
call edi
push str.Enter_Function_DisableRadioHandler__n_n
call esi
mov ecx, dword [0x436850]
push 0
push 0
push 0x5e5d
push ecx
call edi
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.0041d650
add esp, 0xc
push 0
mov dword [ebp - 0x424], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x403a59
push 0x208
lea ecx, [ebp - 0x210]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
push str.The_cServPath_is__s__n
call fcn.0040ca40
lea eax, [ebp - 0x210]
push str.System32
push eax
call fcn.00415ac5
add esp, 0x10
test eax, eax
je 0x403a50
push str.This_adminservice_is_for_MSFT_WU_or_3002_Intel._n
mov dword [ebp - 0x424], 0
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403a60
push str.OnDeviceArrival________Error_GetModuleHandle_NULL__
call esi
cmp dword [0x436838], 0
jne 0x403a82
push str.Enter_condition_pSvc__RegeditCustomHandle__NULL_n
call esi
call fcn.00401d70
cmp dword [0x436838], 0
je 0x403b4b
push str.Enter_condition_pSvc__RegeditCustomHandle___NULL_n
call esi
mov eax, dword [0x436c70]
and eax, 0xfffffffe
xor edi, edi
mov byte [ebp - 0x419], bl
mov dword [0x436c70], eax
test al, 1
jne 0x403b4b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
cmp edi, 0xa
jge 0x403b4b
lea ecx, [ebp - 0x419]
push ecx
push 0xfc1e
mov ecx, 1
call fcn.00414e20
add esp, 8
cmp eax, 2
je 0x403b0c
mov dword [0x436c60], 0
call fcn.00408760
cmp eax, 0xa
jne 0x403af0
call fcn.004128c0
cmp dword [ebp - 0x424], 0
je 0x403b00
push 0x1f4
call ebx
inc edi
test byte [0x436c70], 1
je 0x403ab0
jmp 0x403b4b
push 0x3e8
call ebx
cmp dword [0x436c60], 3
jg 0x403b41
inc dword [0x436c60]
push str.::PostThreadMessage_pSvc__dwThreadID_CUSTOM_THREAD_EVENT_DEVICE_ARRIVAL__0__0___n
call esi
mov edx, dword [0x436850]
push 0
push 0
push 0x5e5f
push edx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
jmp 0x403b4b
mov dword [0x436c60], 0
call fcn.00408760
cmp eax, 0x1e
jne 0x403b68
push str.Set_Timethread_parameter_to_0__n
call esi
xor eax, eax
mov dword [0x436864], eax
mov dword [0x436860], eax
push str.Leave_function_void_OnDeviceArrival___n
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041558a
mov esp, ebp
pop ebp
ret