Function at 0x44adcb
Capabilities:
Accept command line arguments
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov dword [0x4b3a50], eax
call fcn.0046137c
mov dword [esp], str.iDriver.exe___WinMain___Begin
call fcn.00461675
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
mov dword [ebp + 0x10], eax
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, 0x498ef8
lea edi, [ebp - 4]
lea eax, [ebp - 4]
movsw word es:[edi], word [esi]
push eax
push dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
call fcn.0044ab33
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x44ae54
mov esi, eax
mov al, byte [esi]
cmp al, 0x6d
je 0x44ae41
cmp al, 0x4d
je 0x44ae41
push 6
push 0x498ef0
push esi
call fcn.004693a4
add esp, 0xc
test eax, eax
jne 0x44ae54
push esi
call fcn.0044ab74
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x44b5d6
push dword [ebp + 8]
mov esi, 0x4b3a58
mov dword [0x4b3ac8], 0x498b98
mov dword [0x4b3d00], esi
push 0x498a28
push esi
mov dword [0x4b3a58], 0x84
mov dword [0x4b3abc], 0x300
call fcn.0044bb1c
mov edi, 0x47f570
mov eax, edi
test eax, eax
je 0x44aea6
push 0x10
push edi
push 0x49f928
call fcn.004684f0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 8], ebx
mov dword [0x4b3adc], eax
mov dword [ebp - 0x10], ebx
je 0x44af5d
push str.UnregServer
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x44afa8
push str.RegServer
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x44b068
mov eax, dword [ebp - 8]
mov cl, byte [eax]
cmp cl, 0x73
je 0x44aef8
cmp cl, 0x53
jne 0x44af11
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_CharNextA]
push eax
push 0x4b3af0
call fcn.0044ab0b
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov cl, byte [eax]
cmp cl, 0x64
je 0x44af1d
cmp cl, 0x44
jne 0x44af24
mov byte [0x4b3bf4], 1
mov al, byte [eax]
cmp al, 0x75
je 0x44af2e
cmp al, 0x55
jne 0x44af44
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_CharNextA]
push eax
push 0x4b3bf8
call fcn.0044ab0b
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.0044ab33
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x44aebd
mov ecx, esi
call fcn.0044aac0
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x64
push eax
push dword [ebp + 0x10]
call fcn.0044ab33
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x44b3aa
push 8
push str.ForceROT
push eax
call fcn.004693a4
add esp, 0xc
test eax, eax
jne 0x44b3aa
mov dword [ebp + 0x10], 1
jmp 0x44b3af
push esi
call fcn.0044bc70
push dword [ebp + 8]
mov dword [0x4b3ac8], 0x498b98
mov dword [0x4b3d00], esi
mov dword [0x4b3a58], 0x84
push 0x498a98
push esi
mov dword [0x4b3abc], 0x300
call fcn.0044bb1c
mov eax, edi
test eax, eax
je 0x44aff6
push 0x10
push edi
push 0x49f928
call fcn.004684f0
add esp, 0xc
push ebx
push 1
push esi
call fcn.0044be99
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push 0xf003f
push ebx
push str.AppID
push SysReAllocStringLen
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b034
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push str.DEF67AFC_20D3_4ED3_8DE2_7A14E1C72E28
lea ecx, [ebp + 0x10]
call fcn.0042936f
push str.IDriver.EXE
lea ecx, [ebp + 0x10]
call fcn.0042936f
push str.D896C3EE_492B_4BB2_A1CD_350F7CDEAFA1
lea ecx, [ebp + 0x10]
call fcn.0042936f
lea ecx, [ebp + 0x10]
call fcn.00403666
jmp 0x44b5b3
push esi
call fcn.0044bc70
push dword [ebp + 8]
mov dword [0x4b3ac8], 0x498b98
mov dword [0x4b3d00], esi
mov dword [0x4b3a58], 0x84
push 0x498a98
push esi
mov dword [0x4b3abc], 0x300
call fcn.0044bb1c
mov eax, edi
test eax, eax
je 0x44b0b6
push 0x10
push edi
push 0x49f928
call fcn.004684f0
add esp, 0xc
push ebx
push 1
push esi
call fcn.0044bd20
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push 0xf003f
push ebx
push str.CLSIDD5641912_E47A_429C_879E_CFE13EAC7A13
push SysReAllocStringLen
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b0f4
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, str.DEF67AFC_20D3_4ED3_8DE2_7A14E1C72E28
push edi
call esi
inc eax
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push str.AppID
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b129
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppIdDEF67AFC_20D3_4ED3_8DE2_7A14E1C72E28
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b15f
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push str.InstallShield_InstallDriver
call esi
inc eax
push eax
push str.InstallShield_InstallDriver
push 1
push ebx
push ebx
push dword [ebp + 0x10]
call edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x44b197
cmp al, 4
jne 0x44b197
push str.RunAs
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x44b1b2
push str.Interactive_User
call esi
inc eax
push eax
push str.Interactive_User
push 1
push ebx
push str.RunAs
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b1c3
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.CLSID79BB1585_E75D_439D_A217_5E1C30656C57_
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b1f9
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push str.D896C3EE_492B_4BB2_A1CD_350F7CDEAFA1
call esi
inc eax
push eax
push str.D896C3EE_492B_4BB2_A1CD_350F7CDEAFA1
push 1
push ebx
push str.AppID
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b225
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppIDIDriver2.EXE
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b25b
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push str.D896C3EE_492B_4BB2_A1CD_350F7CDEAFA1
call esi
inc eax
push eax
push str.D896C3EE_492B_4BB2_A1CD_350F7CDEAFA1
push 1
push ebx
push str.AppID
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b287
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppIdD896C3EE_492B_4BB2_A1CD_350F7CDEAFA1
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b2bd
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push str.InstallShield_InstallDriver
call esi
inc eax
push eax
push str.InstallShield_InstallDriver
push 1
push ebx
push ebx
push dword [ebp + 0x10]
call edi
push str.RunAs
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0x10], ebx
je 0x44b2f3
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppIdDEF67AFC_20D3_4ED3_8DE2_7A14E1C72E28
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b329
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push str.InstallShield_InstallDriver
call esi
inc eax
push eax
push str.InstallShield_InstallDriver
push 1
push ebx
push ebx
push dword [ebp + 0x10]
call edi
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppIDIDriver.EXE
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b376
lea ecx, [ebp + 0x10]
call fcn.00403666
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push str.DEF67AFC_20D3_4ED3_8DE2_7A14E1C72E28
call esi
inc eax
push eax
push str.DEF67AFC_20D3_4ED3_8DE2_7A14E1C72E28
push 1
push ebx
push str.AppID
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b3a2
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea ecx, [ebp + 0x10]
jmp 0x44b05e
mov dword [ebp + 0x10], ebx
jmp 0x44b3fd
push esi
call fcn.0044bc70
push dword [ebp + 8]
mov dword [0x4b3ac8], 0x498b98
mov dword [0x4b3d00], esi
mov dword [0x4b3a58], 0x84
push 0x498b28
push esi
mov dword [0x4b3abc], 0x300
call fcn.0044bb1c
mov eax, edi
test eax, eax
je 0x44b3fd
push 0x10
push edi
push 0x49f928
call fcn.004684f0
add esp, 0xc
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
je 0x44b421
push ebx
push 4
push esi
call fcn.0044bb9f
push 0x12c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
jl 0x44b3fd
cmp dword [ebp + 0x10], ebx
je 0x44b5dd
lea eax, [ebp - 0x14]
push eax
call fcn.0044dfd2
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 4]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
je 0x44b44d
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [ebp - 0xc], 0x64
mov edi, 0x80004005
mov dword [ebp + 8], ebx
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
je 0x44b54d
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
push 0xffffffffffffffff
mov dword [ebp + 0x10], ebx
lea esi, [eax + 8]
push esi
call fcn.0040dee8
pop ecx
mov dword [ebp - 0x1c], eax
pop ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push 0x495d0c
call dword [sym.imp.ole32.dll_CreateItemMoniker]
push dword [ebp - 0x1c]
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp edi, ebx
jge 0x44b4bb
push edi
push esi
push str.Failed_to_CreateItemMoniker__s__error_is:_0x_lx
call fcn.0044ad47
add esp, 0xc
jmp 0x44b4e9
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x44b4cb
mov dword [ebp + 8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.ole32.dll_GetRunningObjectTable]
mov edi, eax
cmp edi, ebx
jge 0x44b4ff
push edi
push str.Failed_to_get_ROT__error_is:_0x_lx
call fcn.0044ad47
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x44b45c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x44b45c
mov esi, dword [0x480b1c]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov ecx, dword [eax]
push edx
mov edx, dword [ebp - 0x14]
push dword [ebp + 0x10]
add esi, edx
push esi
push ebx
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, ebx
jge 0x44b52a
push edi
push str.Failed_register_RO__error_is:_0x_lx
jmp 0x44b4e2
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x44b53b
mov ecx, dword [eax]
push eax
xor esi, esi
call dword [ecx + 8]
jmp 0x44b53e
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x44b550
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x44b550
mov esi, dword [ebp - 0x18]
cmp edi, ebx
jl 0x44b586
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call edi
test eax, eax
je 0x44b57a
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
jmp 0x44b561
mov eax, dword [ebp + 8]
push dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x44b593
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
je 0x44b59d
mov eax, dword [esi]
push esi
call dword [eax + 8]
push 0x4b3a58
call fcn.0044bc34
push dword [0x4b3aec]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4b3a58
call fcn.0044bc70
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.iDriver.exe___WinMain___End
call fcn.00461675
pop ecx
call fcn.0046164e
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call esi
test eax, eax
je 0x44b59d
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
jmp 0x44b5ea