Function at 0x4612d0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468870
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x485f50]
xor eax, ebp
mov dword [ebp - 0xd8], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 2
lea ecx, [ebp - 0xbc]
call fcn.00407d10
mov dword [ebp - 4], 0
push str.enter_RemoveUDDriver__
lea eax, [ebp - 0xbc]
push eax
call fcn.004052a0
add esp, 8
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.004048a0
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x124], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x124]
call fcn.00408250
push eax
push str.RemoveUDDriver
push 0xc9
push 0x47637c
push 0xf0000000
call fcn.00404cf0
mov ecx, eax
call fcn.004155d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.00408840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.004055a0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
call fcn.00461020
lea eax, [ebp - 0x3c]
push eax
push 0xf003f
push 0
push 0x476390
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x46177c
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc0], 0
lea ecx, [ebp - 0xc4]
push ecx
push 0
lea edx, [ebp - 0xcc]
push edx
push 0
push 0x4763e0
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4614c7
mov ecx, dword [ebp - 0xc4]
add ecx, 0x20
push ecx
call fcn.0043d2ed
add esp, 4
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x4614b6
mov edx, dword [ebp - 0xc4]
add edx, 0x20
mov dword [ebp - 0xc8], edx
mov eax, dword [ebp - 0xc8]
push eax
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call fcn.0043cea0
add esp, 0xc
lea edx, [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0xc0]
push eax
lea ecx, [ebp - 0xcc]
push ecx
push 0
push 0x4763f0
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x38], eax
jmp 0x4614c7
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4617f7
cmp dword [ebp - 0x38], 0
jne 0x461707
cmp dword [ebp - 0xcc], 7
jne 0x461707
push 0x4732ce
lea ecx, [ebp - 0xf4]
call fcn.00408210
mov dword [ebp - 4], 2
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
mov ecx, dword [ebp - 0xc0]
add ecx, dword [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0xf4]
call fcn.00409150
lea ecx, [ebp - 0xf4]
call fcn.00408da0
mov edx, dword [ebp - 0xd4]
lea eax, [edx + eax + 1]
mov dword [ebp - 0xd4], eax
push 0x476400
lea ecx, [ebp - 0xf4]
call fcn.00409120
test eax, eax
jne 0x46155c
mov dword [ebp - 0xd0], 1
jmp 0x46156d
mov ecx, dword [ebp - 0xd4]
add ecx, 1
cmp ecx, dword [ebp - 0xc4]
jb 0x461509
cmp dword [ebp - 0xd0], 0
jne 0x46159e
mov edx, dword [ebp - 0xc0]
push edx
call fcn.0043c968
add esp, 4
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4616f3
mov ecx, dword [ebp - 0xc0]
add ecx, dword [ebp - 0xc4]
movzx edx, byte [ecx - 1]
test edx, edx
jne 0x4615d2
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0xc4]
movzx ecx, byte [eax - 2]
test ecx, ecx
jne 0x4615d2
mov dword [ebp - 0xf8], 0
jmp 0x4615fc
mov edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0xc4]
movzx eax, byte [edx - 1]
test eax, eax
jne 0x4615f2
mov dword [ebp - 0xf8], 1
jmp 0x4615fc
mov dword [ebp - 0xf8], 2
mov ecx, dword [ebp - 0xd4]
sub ecx, 8
mov dword [ebp - 0xfc], ecx
jmp 0x46161c
mov edx, dword [ebp - 0xfc]
add edx, 1
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0xc4]
sub eax, 8
cmp dword [ebp - 0xfc], eax
jae 0x46164c
mov ecx, dword [ebp - 0xc0]
add ecx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0xfc]
mov al, byte [edx + 8]
mov byte [ecx], al
jmp 0x46160d
mov ecx, dword [ebp - 0xc0]
add ecx, dword [ebp - 0xc4]
mov byte [ecx - 8], 0
mov edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0xc4]
mov byte [edx - 7], 0
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xc4]
lea edx, [ecx + eax - 8]
push edx
mov eax, dword [ebp - 0xc0]
push eax
push 7
push 0
push 0x476408
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0xc0], 0
je 0x4616bc
mov edx, dword [ebp - 0xc0]
push edx
call fcn.0043c968
add esp, 4
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x38], 0
je 0x4616f3
mov dword [ebp - 0x11c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.00408840
mov eax, dword [ebp - 0x11c]
jmp 0x4617f7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.00408840
jmp 0x46177a
cmp dword [ebp - 0x38], 2
je 0x46171c
cmp dword [ebp - 0x38], 0
jne 0x46174a
cmp dword [ebp - 0xcc], 7
je 0x46174a
cmp dword [ebp - 0xc0], 0
je 0x46173e
mov ecx, dword [ebp - 0xc0]
push ecx
call fcn.0043c968
add esp, 4
mov dword [ebp - 0xc0], 0
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46177a
cmp dword [ebp - 0xc0], 0
je 0x46176c
mov eax, dword [ebp - 0xc0]
push eax
call fcn.0043c968
add esp, 4
mov dword [ebp - 0xc0], 0
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4617f7
jmp 0x461780
xor eax, eax
jmp 0x4617f7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4617e0
push 0xf01ff
push 0x476418
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4617d6
lea eax, [ebp - 0x28]
push eax
push 1
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.SYSTEMCurrentControlSetServicesRmDrvMg
push reloc.WS2_32.dll_bind
call fcn.00461280
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xd8]
xor ecx, ebp
call fcn.0043c3a4
mov esp, ebp
pop ebp
ret