Function at 0x401560
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ebx, ebx
lea eax, [esp + 0x14]
push eax
push str.SYSTEMCurrentControlSet_services_ambakdrv
push 0x80000002
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
xor ebp, ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x401833
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
lea edx, [esp + 0x14]
push edx
push str.SYSTEMCurrentControlSetServices_volsnap
push 0x80000002
mov dword [esp + 0x20], ebx
call edi
test eax, eax
jne 0x4015e4
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x2c], 1
call esi
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebx
push str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x401833
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x18]
push edx
push ebx
lea eax, [esp + 0x28]
push eax
push ebx
push str.UpperFilters
push ecx
call edi
mov ecx, eax
sub ecx, 2
je 0x40163e
xor edx, edx
cmp eax, ebx
sete dl
mov esi, edx
cmp esi, ebx
jmp 0x401689
mov ecx, dword [esp + 0x14]
push 2
lea eax, [esp + 0x14]
push eax
push 7
push ebx
push str.UpperFilters
push ecx
mov word [esp + 0x28], bx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x401833
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push ebx
lea eax, [esp + 0x28]
push eax
push ebx
push str.UpperFilters
push ecx
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x401833
mov eax, dword [esp + 0x18]
xor edx, edx
cmp edx, eax
sbb esi, esi
neg esi
je 0x401833
add eax, 2
push eax
mov dword [esp + 0x1c], eax
call fcn.00404589
mov esi, eax
mov eax, dword [esp + 0x1c]
push eax
push ebx
push esi
mov dword [esp + 0x2c], esi
call fcn.004089f0
mov eax, dword [esp + 0x24]
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
push esi
lea edx, [esp + 0x28]
push edx
push ebx
push str.UpperFilters
push eax
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x401833
mov eax, dword [esp + 0x18]
xor edi, edi
test eax, 0xfffffffe
jbe 0x401751
mov ebx, dword [esp + 0x1c]
lea esp, [esp]
push 0x415ee8
push ebx
call fcn.004042a5
add esp, 8
test eax, eax
jne 0x40171d
add edi, 8
add ebx, 0x10
lea ebp, [eax + 1]
jmp 0x40173d
push str.volsnap
push ebx
call fcn.004042a5
add esp, 8
test eax, eax
jne 0x40173d
add edi, 7
add ebx, 0xe
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x18]
mov ecx, eax
add edi, 1
shr ecx, 1
add ebx, 2
cmp edi, ecx
jb 0x401700
xor ebx, ebx
cmp ebp, ebx
mov edi, eax
jne 0x40175a
lea edi, [eax + 0x12]
mov eax, dword [esp + 0x24]
cmp eax, ebx
jne 0x40176b
cmp dword [esp + 0x28], ebx
je 0x40176b
add edi, 0x10
cmp ebp, ebx
je 0x401777
cmp eax, ebx
jne 0x401833
push edi
call fcn.00404589
push edi
mov ebx, eax
push 0
push ebx
mov dword [esp + 0x3c], ebx
call fcn.004089f0
add esp, 0x10
test ebp, ebp
mov ecx, ebx
jne 0x4017b2
mov eax, 0x415ee8
mov edx, ebx
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4017a0
lea ecx, [ebx + 0x12]
cmp dword [esp + 0x24], 0
jne 0x4017e2
cmp dword [esp + 0x28], 0
je 0x4017e2
mov eax, str.volsnap
mov esi, ecx
sub esi, eax
lea esp, [esp]
movzx edx, word [eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x4017d0
add ecx, 0x10
xor edx, edx
test dword [esp + 0x18], 0xfffffffe
jbe 0x401817
mov edi, edi
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + edx*2]
cmp ax, 0xd
je 0x40180a
cmp ax, 0xa
je 0x40180a
mov word [ecx], ax
add ecx, 2
mov eax, dword [esp + 0x18]
add edx, 1
shr eax, 1
cmp edx, eax
jb 0x4017f0
sub ecx, ebx
push ecx
mov ecx, dword [esp + 0x18]
push ebx
push 7
push 0
push str.UpperFilters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
xor ebx, ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x401842
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x401853
push eax
call fcn.00404717
add esp, 4
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x401864
push eax
call fcn.00404717
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret