Function at 0x41bd30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x72c7c0
lea eax, [ebp - 0x110]
xorps xmm0, xmm0
push str.system32DRIVERS_s.sys
push eax
mov esi, ecx
movlpd qword [ebp - 0x120], xmm0
call fcn.00417690
add esp, 0xc
lea edx, [ebp - 0x120]
mov ecx, esi
push 1
call fcn.00416da0
mov edi, dword [ebp - 0x120]
mov esi, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
test esi, esi
js 0x41c082
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x114]
push 4
push eax
push 4
push 0
push str.DebugLevel
push edi
mov dword [ebp - 0x114], 1
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 0
push str.FltMgr
push str.DependOnService
push dword [ebp - 0x11c]
push edi
call fcn.0041bc60
mov esi, eax
add esp, 0x14
test esi, esi
js 0x41c07c
push 4
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 1
push eax
push 4
push 0
push 0x6ea10c
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 4
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 3
push eax
push 4
push 0
push 0x6ea11c
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 4
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 1
push eax
push 4
push 0
push str.Type
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 4
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 2
push eax
push 4
push 0
push 0x6ea12c
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 8
push str.PNP_TDI
push 1
push 0
push str.Group
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bed0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x110]
push eax
push 2
push 0
push 0x6ea140
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 0x21
push 0x6ea14c
push 1
push 0
push 0x6ea170
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 0x21
push 0x6ea14c
push 1
push 0
push str.Description
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c07c
push 0
lea eax, [ebp - 0x124]
push eax
mov eax, dword [0x71701c]
push 0
or eax, 0xf003f
push eax
push 0
push 0
push 0
push str.Instances
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41c077
mov edx, dword [ebp - 0x124]
mov ecx, 0x72c7c0
mov dword [ebp - 0x114], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bf87
sub ecx, esi
lea eax, [ecx + 1]
push eax
push 0x72c7c0
push 1
push 0
push str.DefaultInstance
push edx
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c05f
push 0
lea eax, [ebp - 0x128]
push eax
mov eax, dword [0x71701c]
push 0
or eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x72c7c0
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41c05a
mov eax, dword [ebp - 0x128]
push 7
push str.410000
push 1
push 0
push str.Altitude
push eax
mov dword [ebp - 0x118], eax
call ebx
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff2
jl 0x41c042
push 4
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0
push eax
push 4
push 0
push str.Flags
push dword [ebp - 0x118]
call ebx
neg eax
sbb esi, esi
mov eax, 0
and esi, 0xfffffff2
cmovge esi, eax
mov ecx, dword [ebp - 0x118]
mov eax, ecx
or eax, 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41c065
push ecx
call ebx
jmp 0x41c065
mov esi, 0xfffffff2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x114]
mov eax, ecx
or eax, 0
je 0x41c082
push ecx
call ebx
jmp 0x41c082
mov esi, 0xfffffff2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
or eax, dword [ebp - 0x11c]
je 0x41c08f
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret