Function at 0x408690
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SYSTEMCurrentControlSetServicesHWHandSet
push 0x80000002
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
cmp edi, ebx
je 0x4086ee
push edi
push str.INFO:_Open_Key_HWHandSet_error___d._n
call fcn.00404950
add esp, 8
cmp edi, 5
jne 0x408724
pop edi
pop esi
pop ebp
mov eax, 0x4e2d
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x10]
push str.QCDriverResident
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.QCDriverPowerManagementEnabled
push edx
call esi
mov eax, dword [esp + 0x10]
push str.QCDriverWaitWakeEnabled
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x40875d
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServiceshw_usbdev
push 0x80000002
call ebp
mov edi, eax
test edi, edi
je 0x40876a
push edi
push str.INFO:_Open_Key_hw_usbdev_error___d._n
call fcn.00404950
add esp, 8
cmp edi, 5
jne 0x4087ab
pop edi
pop esi
pop ebp
mov eax, 0x4e2d
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push str.QCDriverResident
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.QCDriverPowerManagementEnabled
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.QCDriverWaitWakeEnabled
push edx
call esi
mov eax, dword [esp + 0x10]
push str.EnableCD
push eax
call esi
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ebx, eax
call edi
jmp 0x4087b1
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x4086e1
mov eax, dword [0x43700c]
cmp eax, 2
je 0x408831
cmp eax, 3
je 0x408831
cmp eax, 4
je 0x408831
cmp eax, 5
je 0x408831
cmp eax, 7
je 0x4087e1
cmp eax, 6
jne 0x408899
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching
push 0x80000002
call ebp
mov esi, eax
test esi, esi
je 0x40880f
push esi
push str.Open_Key_Searching_Windows_Update_error___d._n
jmp 0x40885d
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.SearchOrderConfig
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
jmp 0x408897
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsDriverSearching
push 0x80000002
call ebp
mov esi, eax
test esi, esi
je 0x408877
push esi
push str.INFO:_Open_Key_Searching_Windows_Update_error___d._n
call fcn.00404950
add esp, 8
cmp esi, 5
jne 0x408899
pop edi
pop esi
pop ebp
mov eax, 0x4e2d
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.DontSearchWindowsUpdate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call edi
push 0
call fcn.00405060
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret