Function at 0x408470
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x441dac]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
push edi
xor ebp, ebp
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.SYSTEMCurrentControlSetServicesHWHandSet
push 0x80000002
mov dword [esp + 0x38], 1
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x4084ef
push esi
lea ecx, [esp + 0x20]
push str.INFO:_Open_Key_HWHandSet_error___d._n
push ecx
call fcn.00419ba9
lea edx, [esp + 0x28]
push edx
call fcn.00404820
add esp, 0x10
cmp esi, 5
jne 0x408597
mov eax, 0x4e2d
jmp 0x408748
cmp byte [0x4432d8], 1
jne 0x40850f
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.QCDriverPowerNotify
push ecx
call edi
cmp byte [0x4432d7], 1
jne 0x408547
mov eax, dword [0x43900c]
cmp eax, 1
je 0x40852c
cmp eax, 2
je 0x40852c
cmp eax, 3
jne 0x408547
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.QCDriverWinxpPMEnabled
mov dword [esp + 0x28], ebp
push eax
jmp 0x408564
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.QCDriverWinxpPMEnabled
mov dword [esp + 0x28], 1
push edx
call edi
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.QCDriverResident
push ecx
mov dword [esp + 0x2c], 1
call edi
mov edx, dword [esp + 0x10]
push edx
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, 5
je 0x4085df
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServiceshn_usbdev
push 0x80000002
call ebx
mov esi, eax
test esi, esi
je 0x4085e9
push esi
lea ecx, [esp + 0x20]
push str.INFO:_Open_Key_hn_usbdev_error___d._n
push ecx
call fcn.00419ba9
lea edx, [esp + 0x28]
push edx
call fcn.00404820
add esp, 0x10
cmp esi, 5
jne 0x40864b
mov eax, 0x4e2d
jmp 0x408748
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.QCDriverResident
push ecx
call edi
mov eax, dword [0x4432e8]
test eax, eax
je 0x40862e
mov ecx, dword [esp + 0x10]
xor edx, edx
push 4
cmp eax, 1
lea eax, [esp + 0x1c]
push eax
push 4
setne dl
push 0
push str.EnableCD
push ecx
mov dword [esp + 0x30], edx
call edi
jmp 0x40863e
mov edx, dword [esp + 0x10]
push str.EnableCD
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, 5
je 0x4084e5
mov eax, dword [0x43900c]
cmp eax, 2
je 0x4086c3
cmp eax, 3
je 0x4086c3
cmp eax, 4
je 0x4086c3
cmp eax, 5
je 0x4086c3
cmp eax, 7
je 0x40867b
cmp eax, 6
jne 0x40873c
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching
push 0x80000002
call ebx
mov esi, eax
test esi, esi
je 0x4086a9
push esi
push str.Open_Key_Searching_Windows_Update_error___d._n
jmp 0x4086ef
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
mov dword [esp + 0x24], 2
push str.SearchOrderConfig
jmp 0x40872a
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsDriverSearching
push 0x80000002
call ebx
mov esi, eax
test esi, esi
je 0x408712
push esi
push str.INFO:_Open_Key_Searching_Windows_Update_error___d._n
lea edx, [esp + 0x24]
push edx
call fcn.00419ba9
lea eax, [esp + 0x28]
push eax
call fcn.00404820
add esp, 0x10
cmp esi, 5
jne 0x40873c
mov eax, 0x4e2d
jmp 0x408748
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
mov dword [esp + 0x24], 1
push str.DontSearchWindowsUpdate
mov edx, dword [esp + 0x24]
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.00405160
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041811d
add esp, 0x114
ret