Function at 0x402910
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Persist via run registry key
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x153c
call fcn.00410f10
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 0x1538], eax
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
call fcn.00401870
cmp edi, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], bp
je 0x402a66
mov ebx, 1
cmp dword [esp + 0x18], ebx
jle 0x402a66
mov edx, dword [edi + 4]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x402983
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x30]
call fcn.00403320
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x4029ac
lea eax, [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push eax
call esi
push 0x41693c
call esi
mov eax, dword [edi + 4]
mov ecx, 0x416940
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4029ea
cmp dx, bp
je 0x4029e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4029ea
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x4029c4
xor eax, eax
jmp 0x4029ef
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x4029fe
push str._1:_Unload_driver_n
call esi
mov dword [esp + 0x14], ebx
mov eax, dword [edi + 4]
mov ecx, str._s_u
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402a2c
cmp dx, bp
je 0x402a28
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402a2c
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x402a06
xor eax, eax
jmp 0x402a31
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x402a40
push str._2:_Unload_driver_n
call esi
mov dword [esp + 0x1c], ebx
mov ebx, 2
lea eax, [esp + 0x28]
call fcn.00403160
cmp eax, 0xffffffff
je 0x402a62
push str._3:_Unload_driver_n
call esi
mov dword [esp + 0x14], 1
xor ebp, ebp
jmp 0x402a6c
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x3fe
lea edx, [esp + 0x14e]
push ebp
push edx
mov word [esp + 0x154], bp
call fcn.00408a00
add esp, 0xc
push 0x200
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
jne 0x402aad
push str.Failed_to_get_system_windows_directory__n
call esi
jmp 0x402ec7
push 0x3fe
lea edx, [esp + 0x54e]
push ebp
push edx
mov word [esp + 0x554], bp
call fcn.00408a00
push str.amwrtdrv
lea eax, [esp + 0x158]
push eax
push str._s_system32_s.sys
lea ecx, [esp + 0x560]
push 0x200
push ecx
call fcn.00404522
push 0x3fe
lea edx, [esp + 0x96e]
push ebp
push edx
mov word [esp + 0x974], bp
call fcn.00408a00
push str.ammntdrv
lea eax, [esp + 0x178]
push eax
push str._s_system32_s.sys
lea ecx, [esp + 0x980]
push 0x200
push ecx
call fcn.00404522
add esp, 0x40
push 0x3fe
lea edx, [esp + 0xd4e]
push ebp
push edx
mov word [esp + 0xd54], bp
call fcn.00408a00
push 0x415ee8
lea eax, [esp + 0x158]
push eax
push str._s_system32_s.sys
lea ecx, [esp + 0xd60]
push 0x200
push ecx
call fcn.00404522
add esp, 0x20
push ebp
lea edx, [esp + 0x14]
push edx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebp
push str.amoverinst
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
cmp dword [esp + 0x14], ebp
jne 0x402dd4
push ebp
push str.vsscom.exe__regserver
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.amoverinst
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.amreboot
push edx
call esi
call fcn.00401980
test eax, eax
je 0x402ca3
push 0x20
mov eax, str.amwrtdrv
call fcn.00401210
call fcn.004023b0
push 0x10
mov eax, str.amwrtdrv
call fcn.00401210
add esp, 8
call fcn.00403ff0
call fcn.00403ba0
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.004040d0
mov esi, eax
test esi, esi
je 0x402c83
push 0x3ff
lea eax, [esp + 0x114d]
push 0
push eax
mov byte [esp + 0x1154], 0
call fcn.00408a00
push esi
lea ecx, [esp + 0x1158]
push str.Unmount_fail__Ret_u
push ecx
call fcn.0040459e
add esp, 0x18
mov eax, str.ammntdrv
call fcn.00402100
call fcn.00402660
push 0x10
mov eax, str.ammntdrv
call fcn.00401210
add esp, 4
xor ebp, ebp
push 2
lea edx, [esp + 0x54c]
mov ecx, str.amwrtdrv
call fcn.00401f90
add esp, 4
test eax, eax
je 0x402cd7
push 2
lea edx, [esp + 0x94c]
mov ecx, str.ammntdrv
call fcn.00401f90
add esp, 4
test eax, eax
jne 0x402d53
call fcn.00401980
test eax, eax
jne 0x402d1f
mov eax, str.amwrtdrv
call fcn.00402100
mov eax, str.ammntdrv
call fcn.00402100
push str.Failed_to_Install_drive._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x402edb
mov eax, dword [esp + 0x2c]
push eax
jmp 0x402ed3
push 0x416b54
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 2
lea edx, [esp + 0x54c]
mov ecx, str.amwrtdrv
call fcn.00401f90
push 2
lea edx, [esp + 0x950]
mov ecx, str.ammntdrv
call fcn.00401f90
add esp, 8
push ebp
lea edx, [esp + 0xd4c]
mov ecx, 0x415ee8
call fcn.00401f90
add esp, 4
test eax, eax
je 0x402d98
call fcn.00401c50
test eax, eax
jne 0x402d80
push str.Failed_to_add_filter_param_to_register_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00401980
test eax, eax
je 0x402dca
call fcn.00401560
call fcn.004018f0
jmp 0x402eac
call fcn.00401980
test eax, eax
jne 0x402dba
mov eax, 0x415ee8
call fcn.00402100
call fcn.00401e20
call fcn.004018f0
jmp 0x402eac
push str.12_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00401e20
call fcn.004018f0
jmp 0x402eac
push str.Comn.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, ebp
je 0x402e19
push str.CreateObjectBootQuickCfg
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x402e12
call eax
mov edi, eax
cmp edi, ebp
je 0x402e12
mov edx, dword [edi]
mov eax, dword [edx + 4]
push ebp
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
push ebp
push ebp
mov ecx, edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00401a90
cmp esi, ebp
jne 0x402eac
mov eax, str.amwrtdrv
call fcn.00402100
mov esi, eax
neg esi
sbb esi, esi
mov eax, str.ammntdrv
neg esi
call fcn.00402100
neg eax
sbb eax, eax
neg eax
and esi, eax
call fcn.00401e20
test eax, eax
je 0x402e67
call fcn.00401330
test eax, eax
jne 0x402e67
push str.Unable_to_remove_ambakdrv._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esp + 0x1c], ebp
jne 0x402eac
mov edx, dword [esp + 0x10]
push ebp
lea ecx, [esp + 0x48]
push ecx
push 1
push ebp
push str.amreboot
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebp
je 0x402e95
push str.Failed_to_Uninstall_drive._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebp
push str.vsscom.exe__unregserver
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.OK_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004013a0
cmp dword [esp + 0x40], 8
jb 0x402edb
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004043c9
add esp, 4
mov ecx, dword [esp + 0x1548]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004043ce
add esp, 0x153c
ret 0x10